text: The corporate security team has a combined professional experience of several decades in cybersecurity and related fields, including software and hardware engineering, information technology systems, devops, and security program management. They hold a range of certifications in security and technology, such as in LCSPC, ISO/IEC 27001:2013, OSCP, SANS SEC, CSSLP and AWS. Several team members participate in groups that focus on information security such as OWASP, Open Security Summit and other professional organizations and projects.

companyName: Life360, Inc.

ticker: LIF


text: Christopher M. Killian, age 55, is Senior Vice President, Chief Technology Officer, and Sustainability Officer. Dr. Killian has responsibility for Eastman's global technology and innovation organization, and leadership of Eastman's sustainability strategy. Dr. Killian joined Eastman in 1996 as a research chemist. During his career at Eastman, he has held various leadership positions in technology and the business including Director, Tritan Growth Platform early in his career. Prior June 2021 Dr. Killian served as Vice President of Technology for the AFP, CI, and AM segments and was appointed Senior Vice President and Chief Technology Officer effective June 2021. Dr. Killian was appointed to his current position effective January 2025.

companyName: EASTMAN CHEMICAL CO

ticker: EMN

secItem: Item 1C


text: Management of Cybersecurity Risks Textron Information Services is led by our CIO who has held positions of increasing responsibility within our corporate, Bell and Textron Systems IT organizations since 2008, including leading the IT organizations at both segments in maintaining compliance with the DoD information security requirements, as well as with our enterprise information security policies and standards. He previously led strategic IT projects and teams responsible for delivering global IT solutions for several large U.S. based companies.

companyName: TEXTRON INC

ticker: TXT


text: The Audit Committee receives regular presentations and reports from management on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Risk Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the ERM process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: The IT Steering Committee consists of the Company's senior management, the entire IT team, and various operations personnel. The primary function of the IT Steering Committee is to perform Strategic Planning, discuss hardware and software replacement, new projects, current cybersecurity threats, and ongoing cybersecurity issues and threats. The IT manager provides an IT status report to the Risk Management committee on a quarterly basis.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of our Advisor and other third-party service providers. Our Advisor manages our day-to-day operations and has implemented a cybersecurity program that applies to us and its operations.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: BioCardia, Inc.

ticker: BCDA


text: The Company's planned investments in cybersecurity include implementing advanced data loss prevention measures, encryption protocols, and continuous monitoring to safeguard sensitive information and mitigate the risk of unauthorized access or disclosure. As part of the Company's risk management strategy, it has secured comprehensive cyber insurance coverage. The Company regularly reviews and updates its cyber insurance coverage to align with the evolving nature of cyber threats and industry standards.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: We utilize an internal risk management process to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. We conduct initial risk assessments of key third-party suppliers and service providers based on various factors to classify each into a risk category. Our process is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of key third-party suppliers and service providers that have access to our networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their cybersecurity controls. We also require that our key suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, for example, periodic cybersecurity testing and cybersecurity awareness training for employees.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: Our cybersecurity program's effectiveness is periodically evaluated against established quantifiable goals and other external benchmarks, including the National Institute of Standards and Technology security framework. This evaluation is carried out through internal and external risk assessments and compliance audits. We regularly engage third parties to help conduct these evaluations, assessments and audits, advise us on the effectiveness of our cybersecurity processes and assist the Company in remediating any identified vulnerabilities.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Our Operational and Information Technology Systems" in Item 1A. Risk Factors.

companyName: HOME BANCORP, INC.

ticker: HBCP


text: The Company employs a comprehensive, cross-departmental approach to continuously assess, identify, and manage potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the information technology ("IT") security team, which is led by our Chief Information Security Officer ("CISO"), the Information Security Steering Committee ("ISSC"), which is chaired by our CISO and comprised of executive and senior representatives from key corporate functions as overseen by the Board of Directors, primarily through the Audit Committee. The Company's cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management program and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: Our technology team, and particularly our information security team, is actively involved in the development and implementation of policies and tools to assess risk and identify emergent risks, with cross-functional support from enterprise risk management, legal, compliance and finance, among other teams. We have established governance structures to increase the maturity of our cybersecurity program with a governance, risk and compliance approach. This includes the identification of internal weaknesses and the mitigation of information technology risks through training programs or new policies and internal controls.

companyName: Frontdoor, Inc.

ticker: FTDR


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under NIST.

companyName: EchoStar CORP

ticker: SATS


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, see "Risk Factors-Risks Related to Employee Matters, Managing Growth and Other Operational Matters -Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions or compromise, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, or trigger contractual and legal obligations, potentially exposing us to liability, reputational harm or otherwise adversely affecting our business and financial results."

companyName: PepGen Inc.

ticker: PEPG


text: To date, the company is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition.

companyName: CME GROUP INC.

ticker: CME


text: Our cybersecurity risk assessment and management processes are implemented and maintained by a third-party service provider reporting to the Company's management. Management is also responsible for integrating cybersecurity considerations into our overall risk management strategy, communicating key priorities to employees, approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and making required disclosures. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.

companyName: OPAL Fuels Inc.

ticker: OPAL


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Ares, the parent company of our Advisor. Ares' cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Ares' enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Ares' cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Ares has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: Detection, Response and Recovery We employ threat monitoring and detection capabilities intended to identify active attackers and threats to our technology systems. We have established a defined incident response plan to assess, respond and recover from cybersecurity incidents, including cyberattacks and other non-cybersecurity related business technology outages. The plan includes the coordination of activities that include an evaluation of materiality and facilitation of any required notifications, regulatory obligations and disclosures.

companyName: TYSON FOODS, INC.

ticker: TSN


text: Following these risk assessments, we re-examine our systems and processes to ensure that reasonable safeguards are in place to minimize identified risks and address any issues that arise. The head of our IT department, who reports to our Chief Financial Officer, works with management to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Sigyn Therapeutics, Inc.

ticker: SIGY


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Previous cybersecurity incidents have not materially affected us, including our business strategy, financial condition, results of operations or cash flows. However, risks from cybersecurity threats, including but not limited to security breaches, computer malware, ransom attacks, other cyber-attacks, or other similar threats may materially affect us, including our business, financial condition, results of operations or cash flows.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented policies designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. While we have taken measures designed to protect the security of the confidential and personal information under our control, we cannot provide absolute assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

companyName: Innovative Eyewear Inc

ticker: LUCY


text: The Interim Chief Technology Officer of the Manager, in coordination with relevant senior management, including but not limited to the Director of IT Operations, Information Security Manager, and General Counsel of the Manager and the Director of Information Technology of the Adviser, work to define, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's incident response plan. To ensure the effectiveness of the relevant controls, our technology team monitors, updates, and evolves systems' security postures to align to controls defined in the NIST Cybersecurity Framework. The Interim Chief Technology Officer of the Manager will promptly notify the Director of Information Technology of our Adviser, who will then notify the General Counsel of the Adviser and our President and Chief Executive Officer, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.

companyName: VINEBROOK HOMES TRUST, INC.


text: Signet has a cybersecurity operations program that monitors its global cybersecurity environment and coordinates the investigation and remediation of cybersecurity alerts. In the event of a cybersecurity incident, the Chief Information Security Officer ("CISO") is equipped with an incident response plan that includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents. We frequently stage incident response drills to prepare support teams to respond to a significant incident. The Company's information security program includes the following specific controls that are used to some extent: endpoint threat detection and response; identity and access management; privileged access management; logging and monitoring involving the use of security information and event management; multi-factor authentication; firewalls and intrusion detection and prevention; and vulnerability and patch management, as well as policy and technical controls governing the use of AI.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: Our management team, including our Cybersecurity management team, has primary responsibility for our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity management team has been led, since 2017, by our Vice President, Chief Information Officer, who also functions as our Chief Information Security Officer and reports to our CEO. Mr. Downing has an extensive career of 29 years in information technology services in the energy sector, including at WorleyParsons, British Petroleum and Schlumberger. He holds a degree in Information Systems as well as a Masters of Business Administration.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Cybersecurity risks fall within the purview of the Audit Committee and, ultimately, the Board of Directors. Regular oversight and reviews occur at established intervals. The Audit Committee engages in discussions with the COO and Company management at least once a year, covering various aspects of cybersecurity risk management, including recent developments, evolving standards, vulnerability assessments, and the threat environment.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity have a unified and centrally-coordinated team, led by our Michael Farkas that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across the Company.

companyName: Balance Labs, Inc.

ticker: BLNC


text: Our Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Incident Response Plans including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO, Information Security, and Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the Board when appropriate.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing. We maintain cyber insurance coverage to supplement our cybersecurity program given the complex and evolving nature of global cyber threats; however, the insurance may not be sufficient to cover all losses from any breaches of our systems and does not extend to reputational damage or costs incurred to improve or strengthen systems against future threats or activity. Given the increasing sophisticated threats, a disruption from a cybersecurity incident is possible to occur and we are actively taking actions to minimize the likelihood and impact of such incidents. In the event of such an incident, our information security team is continuously engaged to investigate and respond, including isolating systems, performing forensics, containing and eradicating malicious activity, and recovering systems in-line with business expectations and operations.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: The Board of Directors does not have a designated cybersecurity committee, but the Audit Committee receives periodic updates on cybersecurity matters. The Company has no t experienced any material cybersecurity incidents to date.

companyName: Golden Star Resource Corp.

ticker: GLNS


text: Like many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. We do not maintain stand-alone servers for our emails. However, we do maintain a standalone server for our main enterprise resource planning (ERP) program (Great Plains), and we maintain two servers dedicated to processing orders for Artisan Specialty Foods and Food Innovations, Inc. We also maintain a file server that currently houses approximately one terabyte of data. Each of our servers is protected by firewall and two-factor-authentication. Additionally, we take multiple snapshots of our servers several times throughout the day and store encrypted backups of our data both locally and in a cloud server to mitigate loss in the event of any malicious attacks on these resources. In the normal course of our relationships with the providers of our services not controlled in-house, we regularly monitor their message boards and other formal and informal communications channels for signs of breaches of their systems. We also survey available public information for indications that they have suffered a breach of their systems.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: The Information Technology department, under the direction of the CIO, is principally responsible for managing first line functions to protect and secure the Company's technology infrastructure, systems, and data. Second line functions, including Information Security under the direction of the CISO, provide guidance, oversight, monitoring and challenge of the first line's activities. Second line functions are separated from first line functions through organizational structure and ultimately report directly to the Chief Risk Officer. Information Security consists of information security professionals with varying degrees of education and experience. Associates within the department with information systems and cyber security related responsibilities and job duties typically hold professional certifications and regularly participate in continuing education in their field. The CISO has substantial relevant experience in information and data security, cybersecurity risk management, and information technology infrastructure and operations. The CISO has served in various roles in Information Security and Information Technology with the Company for over 30 years and maintains several professional affiliations, including serving as a member of the cybersecurity advisory board of a state university and as a member of the governing body of a cybersecurity peer exchange.

companyName: LAKELAND BANCORP INC


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register; (2) the security team works with certain members of our senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and provides periodic reports to the technology and audit committees of our board of directors, which evaluate our overall enterprise risk.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Role of Management Management has implemented risk management structures, policies and procedures, and is responsible for day-to-day cybersecurity risk management. Our Information Technology department that is led by our Chief Technology Officer ("CTO") is responsible for the day-to-day assessment and management of cybersecurity risks. Our CTO has led IT departments, including cybersecurity teams, for the past 15 years in worldwide leading logistics companies. We have implemented several processes which allow the management team to be informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include, among other things, system alerts of potential malicious cyber activity, access to real-time dashboards that monitor and assess our systems, status reports provided on a daily, weekly and monthly basis, and regular ongoing communications with service providers regarding potential new attack vectors and vulnerabilities. Our CTO and his team share such information with our management team and reports information about such risks to our Audit and Executive Oversight Committee ("AEOC").

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Our CSRO has more than 23 years of experience working in information technology and cybersecurity roles including software development, identity and access management projects, privilege account management and multi-factor authentication implementations. While in those roles, our CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The CSRO currently reports to the CIO.

companyName: HORTON D R INC /DE/

ticker: DHI


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We provide regular updates across the Company to highlight recent examples of risks as they are identified. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: The Company also considers cybersecurity risks associated with third-party vendors and service providers, including its online sales platforms and other external service providers.

companyName: REST EZ Inc.

ticker: RTEZ


text: Our Chief Business Officer ("CBO") is responsible for day-to-day management of our cybersecurity strategy. Our CBO manages the Company's response to risks from cybersecurity threats, and works with our managed services provider to implement cybersecurity controls.

companyName: BRAINSTORM CELL THERAPEUTICS INC.

ticker: BCLI


text: Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.

companyName: NEPHROS INC

ticker: NEPH


text: Our CIO is a member of the Company's Management Board and is responsible for the administration of the cybersecurity risk management program. Prior to joining the company in 2020, our CIO spent 24 years in the aerospace and defense industry and held multiple senior leadership roles within digital technology, leading large global organizations in all aspects of digital technology, including cybersecurity risk management.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, future incidents could have a material impact on its business. Additional information about cybersecurity risks the Company faces is described in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity Risks," which should be read in conjunction with the information above.

companyName: Varagon Capital Corp


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information. ", for additional discussion about cybersecurity-related risks.

companyName: TPG Twin Brook Capital Income Fund


text: Our Director of Information Technology has more than 20 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information technology department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from the University of California, Santa Barbara with focus on Business Administration coursework, Certified Information Systems Security Professional from ISC2 Organization.

companyName: BayCom Corp

ticker: BCML


text: The Company performs an annual cybersecurity risk and control assessment as part of the Enterprise Risk Management team's risk assessment processes. The CISO and the Company's Chief Technology and Operations Officer review and approve the cybersecurity assessment. In addition, as part of their regular responsibilities, the Company's Governance, Risk and Compliance officers within its Technology and Cybersecurity groups assess technology and cybersecurity risks by leveraging the Company's risk framework related to technology and cybersecurity, which aligns with the Company's enterprise risk management strategy.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: CPKC's cybersecurity risk management program is an integrated and essential component of the Company's overall risk management strategy. Through its Security Management Plan, CPKC maintains a comprehensive, risk-based plan that is modelled on and was developed in conjunction with the security plan prepared by the Association of American Railroads post-September 11, 2001. This plan also covers regulatory requirements such as TSA Cyber Security Directives and auditing requirements. Under this plan, the Company routinely examines and prioritizes cyber vulnerabilities and threats while also testing and revising protective measures for its assets and operations, both physical or cyber. Likewise, the Company's cybersecurity risk management program entails real-time review and monitoring of CPKC's cyber-risk exposures and implements strategic processes to manage those risks.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: While the Company has experienced cybersecurity threats to its data and systems, such threats have not materially affected the Company, including our business strategy, results of operations or financial condition, with the exception of an incident in the fourth quarter of 2023, as disclosed in a Current Report filed by the Company on Form 8-K on December 22, as amended on December 29, 2023 and January 12, 2024. Prior to the Company's systems being taken offline in connection with this incident, we produced an internal forecast estimating our adjusted earnings per share to be $1.00. Our actual adjusted earnings per share was 69 cents, including a 5 cent tax benefit, implying a 36 cent shortfall relative to our internal estimate. Although the Company believes that most of this difference is related to the incident, the exact impact the incident had on our fourth quarter results is unknowable. Included in this 36 cent shortfall was $11 million of direct expenses related to the incident in our corporate segment including our $5 million insurance retention. We do not believe the incident will have a material impact on the Company's overall financial condition or its ongoing results of operations. For additional information on cybersecurity risks we face, see Item 1A. Risk Factors of this Annual Report, which should be read in conjunction with the foregoing information.

companyName: First American Financial Corp

ticker: FAF


text: We consider the following factors, among others, to identify and manage material risks: (i) the likelihood of a risk occurring; (ii) the impact of a risk on us and others, including the likelihood of enforcement actions alleging potential regulatory violations, sanctions, litigation and other legal risks; and (iii) the controls we have applied to mitigate a risk's likelihood and impact. When selecting controls, we consider the likelihood and impact of identified risks, regulatory and other legal requirements, the feasibility of implementing a control and the potential impact of a control on our operations.

companyName: NuStar Energy L.P.


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Broadcom Inc.

ticker: AVGO


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Technology Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the President and, as discussed below, periodically to our board of directors.

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: For the year ended December 31, 2024, there have been no risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."

companyName: GENTEX CORP

ticker: GNTX


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board of Directors has overall responsibility for risk oversight, the Board of Directors has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee reports to the Board of Directors at least annually, and notifies the Board of Directors as necessary regarding significant new cybersecurity threats or incidents. The Audit Committee of our Board of Directors meets not less than annually to discuss our approach to overseeing cybersecurity threats with management, including with members of our internal cybersecurity team. Any material cybersecurity incidents are promptly reported by management to our Audit Committee.

companyName: Humacyte, Inc.

ticker: HUMA


text: Incident Response Plan The Integrated Incident Response Program is reviewed at least annually to ensure alignment with any changes in notification laws, company structure and operations, service providers and the risk landscape. Most recently, we updated the Cyber Incident Response Plan to include materiality assessments in accordance with the new U.S. Securities and Exchange Commission ("SEC") cybersecurity rules. Tabletop exercises are conducted to assess readiness for plan execution.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: The IT Risk Governance Subcommittee, a management level subcommittee of our Operations Committee, also addresses information security and is responsible for overseeing the protection of the integrity, security, safety and resiliency of corporate information systems and assets. The IT Risk Governance Committee meets quarterly to review the development of the program and provide recommendations. The subcommittee provides regular reports to the Operations Committee and, ultimately, the Board Risk Committee through the CISO. Together, our CISO and Director of Enterprise IT Risk co-lead the company's IT Risk Governance Committee.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: Our cybersecurity risk management program is considered by and integrated into our Company-wide Enterprise Risk Management program, and shares common methodologies, reporting channels and governance processes that apply across the Enterprise Risk Management program to that of other enterprise level risks (such as product development, safety and surveillance, financial and intellectual property risks). Regular evaluations are conducted of the greatest risks to our business and their underlying risk drivers as well as the associated mitigation activities, maturity and controls. This program is overseen by our Executive Vice President and Chief Financial Officer and guided by the Enterprise Risk Council, a cross-functional group of the Company's business leaders representing key business functions that is chaired by our Chief Audit Executive. The results of the enterprise risk evaluations and the status and operation of the Enterprise Risk Management program are presented to our Board of Directors, which oversees the Company's enterprise-level risks.

companyName: AMGEN INC

ticker: AMGN


text: The information/cybersecurity risk management program relies upon a layered security model to protect against both internal and external threats; and is a component of the Bank's formalized enterprise risk management program ("ERM Program"), which is reviewed and approved by the Board of Directors or Committee thereof at least annually. The ERM Program sets forth enterprise-wide operational practices to ensure consistency in the organizations approach to risk identification, documentation, measurement, management, and mitigation with all aspects of risk management documented within a centrally maintained risk management platform ("RMP"). A key aspect of the ERM Program is the risk and control self-assessment ("RCSA") process, which is used to evaluate the mitigation effectiveness of implemented controls through an independent effective challenge program. Gaps or control weaknesses identified as part of the RCSA process require creation of issues and remediation strategies, both of which are formally documented within the RMP, where remediation efforts are managed and monitored from initial creation through ultimate completion of the respective work effort. Independent effective challenge has been embedded throughout this process and ensures that remediation efforts will, and have satisfactorily addressed the identified issue.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: A security information and event management process ("SIEM") has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan within our SIEM that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct annual reviews of our cyber incident response plan.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: The Risk Committee is responsible for overseeing our Framework, including cybersecurity and technology risk. The Risk Committee regularly receives reports from management on our cybersecurity and technology risk profile, and key enterprise cybersecurity initiatives, and on any identified significant threats or incidents, or new risk developments. The Risk Committee coordinates with the full Board of Directors regarding the strategic implications of cybersecurity and technology risks.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Other non-technical protocols include securing of documents and work areas that could contain personal, nonpublic information and independent verification of information changes by outside vendors.

companyName: PermRock Royalty Trust

ticker: PRT


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response Plan ("IRP") and business continuity and disaster recovery plans in the event of a significant cybersecurity incident.

companyName: NEXTNAV INC.

ticker: NN


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program, including tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition to our bug bounty program, we also engage third parties to provide independent penetration testing, to support internal security audits and to provide external security audits. We also regularly report on the results of our assessments and security testing to our audit committee.

companyName: Braze, Inc.

ticker: BRZE


text: Integration with Enterprise Risk Management Our cybersecurity risk management program is integrated into our enterprise risk management framework. It shares methodologies, reporting channels, and governance processes applied across other risk domains, including legal, compliance, strategic, operational, and financial risks.

companyName: AIRGAIN INC

ticker: AIRG


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates from senior management, including leaders from our Information Security, Compliance, and Legal teams regarding matters of cybersecurity. This includes various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Our VP of Information Technology has over 25 years of industry experience involving information technology, including security, auditing, compliance, systems, and programming. Team members who support our cybersecurity program have relevant educational and industry experience.

companyName: NV5 Global, Inc.


text: Our CISO has 15 years of experience in Information Technology. During the last decade, he has focused on leading information security programs, with the aim of creating alignment and synergy between security programs and other business units. Prior to joining Instructure in 2022, he led the inauguration of an information security program and implemented strong and adaptable information security processes and controls at a retail technology company. Before that, he was Director of Information Security for a leading modern media company. He has both a Master's Degree and Bachelor's Degree in Information Security from Marymount University.

companyName: INSTRUCTURE HOLDINGS, INC.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process. The Audit Committee oversees our cybersecurity program, as well as the steps management has taken to monitor and control cybersecurity threats and related risks. This oversight includes receiving reports on the regular assessments of the Company's disclosure controls and procedures to ensure that current practices account for material cybersecurity risks facing the Company. The Audit Committee receives presentations on the cybersecurity program and related risks on at least a quarterly basis. These presentations address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee, and the full Board as necessary, also receive prompt and timely information regarding any cybersecurity incident that meets recognized established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Audit Committee routinely meets with our Chief Legal and Regulatory Officer ("CLRO") and CISO as well as outside experts as appropriate to assess cybersecurity risks and to evaluate the status of the Company's cybersecurity efforts, which include a broad range of tools and training initiatives that work together to protect the data and systems used in our businesses.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: The Company employs a variety of security-focused training/awareness practices to equip the Company's personnel with effective tools to address cybersecurity threats. Information Technology ("IT") and cybersecurity-based training is performed during employee on-boarding to communicate the Company's evolving information security policies, standards, processes and practices. Additional personnel training occurs on an ongoing basis. The Company also regularly conducts tabletop exercises for security scenarios, including both leadership-focused exercises and IT-driven exercises. Phishing simulations are performed on a monthly basis and Company-wide notifications and/or cyber awareness messages are sent on an as-needed basis. The Audit Committee also surveys data and factors that impact costs and incident response efforts.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: We have an Incident Response Policy and related processes that outline steps to be taken in the event of a cybersecurity incident that impacts Helios, our partners and third-party hosted systems. When a cybersecurity incident occurs, the IT team promptly notifies the VP, Information Technology and assesses its potential impact on operations and business continuity. Incidents that pose a potential threat to operations or business continuity are escalated to a cross-functional team comprising the VP, Information Technology, the Chief Financial Officer (CFO), and the General Counsel. This team evaluates the incident's materiality, considering factors such as the nature, scope, and timing of the event, as well as its potential financial and operational. Based on the evaluation, incidents determined to be material are reported to the ESG Committee. This escalation ensures that the Board of Directors is informed of significant cybersecurity events that could impact the company's financial health or operations.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: IT leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. This includes the coordination and creation of an Incident Response Policy, Incident Response Team, and Incident Response Plan in the event of a cybersecurity event. The AOB incident response policy covers our internal program and guidelines. The incident response team is composed of various stakeholders from all necessary aspects of the business, and the plan includes the steps to follow and communications necessary if/when a cybersecurity event occurs. The individual incident response team members represent expertise in IT, cybersecurity, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience. The head of IT has served in various roles in information technology and information security for over 28 years, including serving in technical management and leadership positions in multiple verticals for 19 years. The head of IT holds undergraduate and graduate degrees in computer science and has attained the several recognized network and security certifications throughout their career. The individual incident response team members are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: We have hired an independent third-party cybersecurity firm to perform penetration testing annually. The third-party checks for vulnerabilities on our external and internal network perimeters. If vulnerabilities are found, corrective actions are implemented to remediate any issues.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Impact of Cybersecurity Threats on our Business Although risks from cybersecurity threats did not, to our knowledge, materially affect our business strategy, results of operations, or financial condition for the fiscal year ended December 31, 2023, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1, Business, in this Annual Report for a discussion of notification obligations and potential liability around data security incidents, including cyberattacks.

companyName: AGILE THERAPEUTICS INC


text: Deutsche Bank Group employs a variety of mechanisms to self-identify areas for improvements and control enhancements. These include security testing, security problem management and lessons learned. The effectiveness of Deutsche Bank Group s overall information security program is evaluated on a regular basis by third-party organizations that compare Deutsche Bank Group's approach with industry benchmarks. Deutsche Bank Group s independent internal audit function is mandated to regularly assess security controls as part of its audit plan.

companyName: RREEF Property Trust, Inc.


text: Risks from Cybersecurity Threats For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the discussion under the headings "Our internal computer systems, or those of our CROs, CMOs, supply chain partners, collaboration partners or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug development programs" and "Significant disruptions of information technology systems or breaches of data security could adversely affect our business".

companyName: CYTOKINETICS INC

ticker: CYTK


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: Risks from Cybersecurity Threats As of the date of this filing, the Company has not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. The Company's strategy is to mitigate risks preventatively; however, no assurances can be provided that there will not be incidents in the future or that they will not materially affect the Company.

companyName: ELECTRAMECCANICA VEHICLES CORP.


text: While we have not experienced a material breach, our systems are frequently the target of cyber security attacks intending to steal, misuse, or destroy data, to impact our ability to do business, or otherwise negatively impact us. If we did experience a significant disruption in service, theft of data, or other significant attack, it could result in legal claims or proceedings, liability under federal and state laws that protect the privacy of personal information, regulatory penalties, remediation costs, increased cybersecurity costs, loss of revenue or customers, damage to our reputation or competitive position, or other harm to our business. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: We have an information security program designed to identify, protect, detect and respond to, and manage reasonably foreseeable cybersecurity risks and threats.

companyName: Global Interactive Technologies, Inc.

ticker: GITS


text: During the fiscal year ended December 31, 2024, we did not experience any cybersecurity incidents that materially impacted, or are reasonably likely to materially impact, our business strategy, results of operations or financial condition. Please refer to the risk factors described in this report under Item 1A, "Risk Factors," for a discussion of the potential impacts of future cybersecurity events.

companyName: WEYCO GROUP INC

ticker: WEYS


text: Acknowledging the dynamic and complex landscape of cybersecurity threats, we engage with various external specialists to evaluate and strengthen our information security practices and procedures. Such engagements differ across our subsidiaries, as they are tailored to the specific risk profile of each subsidiary, ensuring that each entity works with experts most suited to their specific cybersecurity needs. These engagements, which may encompass regular audits, risk assessments, gap assessments, social engineering and penetration testing, and consultations on security enhancements, enable us to align with industry best practices. Significant results and recommendations of these assessments are reported to the audit committee and, as necessary, the board of directors, leading to adjustments in our cybersecurity approach to ensure our defenses remain robust and effective.

companyName: ARGAN INC

ticker: AGX


text: In the last fiscal year, we have not identified any risks from known cybersecurity threats that have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: Gaucho Group Holdings, Inc.


text: Our cybersecurity leadership team ("CSLT"), which includes leaders accountable for security operations, incident response, risk and compliance, data security, application security, digital solutions security, vulnerability management and operational technology security, is responsible for assessing and managing our risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Information security personnel maintain a variety of technical and managerial security certifications and have broad security experience in manufacturing, finance, software and information technology environments.

companyName: Avery Dennison Corp

ticker: AVY


text: Regular risk management: We regularly evaluate and adapt our security measures to respond to emerging threats, including new ransomware strains and the evolving cyber threat landscape. incorporate threat intelligence into our security operations to proactively identify and mitigate potential cyber risks.

companyName: Health In Tech, Inc.

ticker: HIT


text: The Audit Committee is responsible for providing governance and oversight over the Company's operational cybersecurity program, risk management and incident response on behalf of the Board. The CFO reports the results of risk assessments, including the evaluation of cybersecurity risks, the actions that the Company has taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry to the Audit Committee. This includes assessing the measures and controls in place to mitigate cybersecurity risks and providing oversight of the response of any significant cybersecurity threats and incidents.

companyName: Concrete Pumping Holdings, Inc.

ticker: BBCP


text: Our cybersecurity program is primarily overseen by our Head-Server and Network Administrator, who works closely with our information technology team and our senior management to develop and advance our cybersecurity strategy, as well as to respond to cybersecurity incidents. Our Head-Server and Network Administrator reports to our Chief Operating Officer on cybersecurity matters and collaborates with stakeholders to assess risks and implement strategies.

companyName: SS Innovations International, Inc.

ticker: SSII


text: Within our organization, we have a management team responsible for assessing and managing cybersecurity risks. The team is led by our CIO and consists of the Cyber Security Incident Response Team (CSIRT) and internal audit personnel. The CSIRT is comprised of IT management and experienced cybersecurity personnel. The role of the CSIRT is to promptly handle an incident so that containment, investigation, and recovery can occur quickly. Where third-party services are leveraged, they ensure they are engaged as necessary. The CSIRT Leader oversees and prioritizes actions during an incident's detection, analysis, and containment. They are also responsible for conveying the special requirements of high severity incidents to the rest of the organization as well as communicating potential impacts to the CIO. Additionally, they are responsible for understanding the SLAs in place with third parties, and the role third parties may play in specific response scenarios. Our CIO has more than 30 years of experience in IT, enterprise security, and cyber risk management and has previously held global IT infrastructure and business solutions roles, including nearly 20 years in such positions in the manufacturing industry. In addition, our CSIRT Leader has 30 years of technology and cybersecurity experience and has previously held data security and global IT infrastructure positions at risk management and asset protection services companies. Effective February 2, 2024, our CIO has retired from employment and continues to serve as our CIO as a contractor through April 2024. During this time, he will continue his existing duties including oversight and management of cybersecurity risks. An active search is underway for a new CIO.

companyName: TENNANT CO

ticker: TNC


text: The Company evaluates risk associated with the engagement of any third-party through a lifecycle-based approach, conducting risk-based due diligence before an engagement, using contractual provisions to address risk, and, for certain third-parties, engaging in architectural review and validation prior to an engagement.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: Our information security program is designed to align our defenses and resources to identify, assess, and address more likely and more damaging cyber events, to provide support for our organizational mission and operational objectives, and to position us to deter, detect, mitigate, and respond to a wide variety of potential attacks in a timely fashion. Our information security program employs quantitative and qualitative approaches to evaluate the effectiveness of controls and assess the resiliency of critical computing resources. This data is combined with knowledge of common attack techniques to assess the likelihood of components being compromised and assess potential financial implications under different scenarios. The results are used to help identify potentially material risks and provide insights which are taken into account when prioritizing our security initiatives.

companyName: UNION PACIFIC CORP

ticker: UNP


text: The Audit Committee is primarily responsible for assisting our board of directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.

companyName: Rocky Mountains Group Ltd


text: We periodically undertake cybersecurity audits, the results of which are reported to our Audit Committee. We have also implemented security monitoring programs designed to alert us of any suspicious activity, and have developed an incident response program in the event of a security breach.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Board of Directors receives regular reports from the SMIS and Cybersecurity Committee on, among other things, the Company's cyber risks and threats, the status of projects to strengths of the Company's information security systems, assessments of the Company's security program, insurance, and the emerging threat landscape. In accordance with our cyber incident response plan, the Cybersecurity committee s promptly informed by SMIS's team of cybersecurity incidents that could adversely affect the Company or its information systems and is also regularly updated about incidents with less impact potential. The Board of Directors and Audit committee are informed of any incidents that could adversely affect the Company by the Cybersecurity committee and SMIS's team.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: a team comprised of IT security, infrastructure, and compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents, supported by legal, human resources, corporate security and other internal resources;

companyName: SIMON PROPERTY GROUP L P


text: Cyber Risk Management and Strategy Disc Medicine, under the oversight of the audit committee of the board of directors, has implemented and maintains processes to review and manage enterprise risks, including annual assessments of cybersecurity risks, across the Company.

companyName: Disc Medicine, Inc.

ticker: IRON


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: Recognizing the complexity and evolving nature of cybersecurity threats, Gorman-Rupp engages with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and testing our risk management systems. These external experts leverage their specialized knowledge and insights on cybersecurity to assess and enhance our internal policies and processes through regular audits, threat assessments, and consultation on security enhancements and strategies.

companyName: GORMAN RUPP CO

ticker: GRC


text: Flywire recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Flywire Corp

ticker: FLYW


text: We have implemented standard operating procedures to define the channels by which cybersecurity threats are communicated to the Company's Board of Directors (the "Board"). This ensures that The Board has oversight and effective governance in managing risks associated with cybersecurity threats.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Risk Management and Cybersecurity We are committed to robust cybersecurity measures to protect our data and systems. Our policies include regular risk assessments, employee training, and incident response plans. The board oversees our cybersecurity strategy, ensuring appropriate risk mitigation. Technical controls like firewalls and encryption safeguard our information, while continuous monitoring allows prompt incident response. In case of a cybersecurity incident, we have established procedures for reporting, investigating, and mitigating impacts, with timely disclosure to stakeholders.

companyName: LEGEND SPICES, INC.


text: Material Impact on Partnership During 2023, the Partnership did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Partnership, including its business strategy, results of operations, or financial condition.

companyName: CVR PARTNERS, LP

ticker: UAN


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various industry standard security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Given the prevalence of social engineering attacks, we have implemented a two-pronged approach of training and security mitigations: educating users about how to detect a potential attack (phishing, malware, etc.) and security tools, which can decrease the likelihood of occurrence through multi-factor authentication, endpoint detection and response and other tools focused on locking down cyber threats. A team of industry experts comprised of representatives from our Information Technology department and support functions, along with outside experts assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Executive Leadership Team and Audit Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors. These mitigations target implementing automated tools for detection and prevention wherever possible, supplemented by training and process controls as needed. Recurring maintenance, reporting and awareness tasks are conducted and documented within our Service Management Software and Security tools for record keeping and trending.

companyName: Neuronetics, Inc.

ticker: STIM


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Pulmatrix, Inc.

ticker: PULM


text: As cyberattacks have become more frequent and sophisticated, including against third-party technology providers, Registrant expects to continue to increase its investment in information and operational technology to monitor and address cyber threats and attempted cyberattacks, and to improve its posture in addressing security vulnerabilities. Registrant has implemented robust cybersecurity systems and controls to prevent any unauthorized access to information. Its platform was designed to be consistent with industry best practices such as the U.S. National Institute of Standards and Technology ("NIST")

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Physical Safeguards: We deploy physical safeguards such as facility access control via keycard access and security cameras. In addition, workstation and device security is controlled with proper logging and identity access controls to protect our physical assets. Administrative Safeguards: We have implemented policies, security standards and procedures to ensure proper user and protection of our assets.

companyName: VERACYTE, INC.

ticker: VCYT


text: Our chief information officer assesses our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.

companyName: AAON, INC.

ticker: AAON


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data. We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.

companyName: AVAI BIO, INC.

ticker: AVAI


text: Our cybersecurity program is led by our Information Technology (IT) team. The IT team is principally responsible for developing, managing, and implementing our cybersecurity risk assessment processes, maintaining and implementing our incident response plans, selecting and implementing security controls, providing cybersecurity training, performing ongoing threat analysis, and responding to cybersecurity threats and incidents. The cybersecurity program also draws upon a combination of industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, that are designed to help companies measure their security posture, reduce cybersecurity risks, and provide guidance for implementing effective security controls.

companyName: ROSS STORES, INC.

ticker: ROST


text: As of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: Green Plains Inc.

ticker: GPRE


text: Our board of directors, as a whole and through its committees, is responsible for our overall enterprise risk management program, which incorporates as an element our cybersecurity risk management program. Our audit committee, a subcommittee of our board of directors, has been delegated responsibility for oversight of cybersecurity risk management, which includes reviewing our cybersecurity and other information, technology risks, controls and procedures, including our plans to mitigate and respond to cybersecurity risks. The Head of IT, alongside the Chief Legal and Compliance Officer, and Chief Financial Officer, provide quarterly reports to the audit committee covering cybersecurity and other information technology risks affecting us. These reports may include reviewing our current infrastructure and the status of key cybersecurity initiatives, including the status of ongoing mitigation efforts, providing insights into the latest cybersecurity threats, and discussing any recent security incidents impacting our peer companies. Periodically, or in the event of a critical cybersecurity incident, the Chief Legal and Compliance Officer, and Chief Financial Officer will provide our full board of directors with findings and recommendations from these reports.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: Our cybersecurity risk management and strategy program consist of cybersecurity-related policies and procedures, industry standard technology solutions including antivirus, firewalls and monitoring tools, awareness training for all employees, periodic testing, insurance coverage and a cybersecurity incident response plan. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (Information Systems and Data).

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: Risks Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IGM Biosciences, Inc.


text: Our SVP of Group Operations, in collaboration with our Cybersecurity Steering Committee, oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our SVP of Group Operations is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through oversight of the external consultant and the IT department, which includes oversight of a combination of automated technologies and manual responses to detect, respond and recover from any cybersecurity incident, as well as oversight of the 24x7 network and security operations center. Our SVP of Group Operations is responsible for informing our executive leadership and our Audit Committee about confirmed cybersecurity incidents, and for providing regular updates to senior executive management, including our CFO, concerning our IT and cybersecurity posture.


text: Most information is stored directly to Amazon Web Services platforms, which provide market-leading data security for their centralized servers. Our company follows best practices for security, indemnity and compliance. All connections in and out of our remote services are made over secure connections, including https and Secure Shell (SSH) protocols. On occasion, limited amounts of information such as names and emails are exported from our systems solely for the purposes of accounting and filings and is not shared outside of our company and its contracted accounting consultants, which are under confidentiality agreements.

companyName: Mobiquity Technologies, Inc.

ticker: MOBQ


text: 1. Governance: As described under “Governance” below, our board of directors oversees cybersecurity risk management in coordination with the audit committee of our board of directors, which regularly interacts with our management team, including our Chief Executive Officer, our General Counsel, our Senior Vice President, Finance, and our Senior Director, Head of IT (“Head of IT”).

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: Our Board of Directors, directly and through its committees, routinely discusses significant enterprise risks with management and reviews the procedures we have in place designed to manage those risks. At Board and committee meetings, directors engage in analyses and dialogue regarding specific areas of cybersecurity risk, including those identified through our ERM process. In addition to the overall risk oversight function administered directly by our Board, the Audit and Compliance Committee of our Board also exercises oversight over managing the Company's cybersecurity risks. Management briefs the Audit and Compliance Committee at least once a year on cybersecurity controls, protocols, risk assessments and mitigation measures.

companyName: Ventas, Inc.

ticker: VTR


text: We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery. Our main external service provider is US-based and utilizes a 24 x 7 x 365 Service Operation Center (SOC). Program Assessment.

companyName: Vuzix Corp

ticker: VUZI


text: Our processes to identify, assess, and manage risks presented by cybersecurity threats are informed by industry cybersecurity standards, including components of the National Institute of Standards and Technology Cybersecurity Framework, ISO 27001 standard, and Health Insurance Portability and Accountability Act ("HIPAA") security regulations. Our cybersecurity management processes have included an assessment to identify key risk areas and to inform our overall strategy, as well as cybersecurity assessments in connection with our review of key financial systems. Our processes also include technical controls, such as network monitoring tools and multi-factor authentication, where appropriate, and we engage reputable vendors to host sensitive company information. Before contracting with such vendors or purchasing third party technology or other solutions that involve exposure to sensitive company information, we conduct due diligence on the vendor, which includes a security review, and we receive and review security updates and alerts from these vendors. We have also implemented annual training for employees as well as phishing and other attack simulations as part of our cybersecurity readiness processes.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: Under the oversight of the audit committee of the Company's board of directors, and as directed by the Company's Chief Executive Officer, the Company's Director of Information Technology (DIT) is primarily responsible for the assessment and management of material cybersecurity risks. The DIT has over 20 years of experience in information security, risk management, and compliance, and has served essential security and audit roles at other organizations. The DIT is supported by members of senior management who provide cross-functional support for cybersecurity risk management and facilitate the response to any cybersecurity incidents.

companyName: Inuvo, Inc.

ticker: INUV


text: We conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems, implementation of two factor authentication for logins, and improved rules for password maintenance.

companyName: enVVeno Medical Corp

ticker: NVNO


text: Management assesses our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to Management, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our senior management team, including our cybersecurity team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk management processes. Our cybersecurity team includes Vice President of Information Technology and Information Security Officer with a team of eight full-time information technology professionals and several outside security vendors to manage our information security program. When a cybersecurity incident is identified, our computer incident response team will notify the Information Security Officer immediately, and upon assessment of the nature and severity of the incident, internal and external parties may be further notified to determine the appropriate response strategy, and written preliminary and final reports will be submitted to management. Our Vice President of Information Technology and Information Security Officer have served in various roles in information technology and information security, and together they have over 55 years of experience in this field. Our Information Security Officer is a certified information systems security professional (CISSP). The cybersecurity team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with senior management team, including our Chief Executive Officer and Chief Financial Officer, as well as our Board of Directors.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: Acknowledging the crucial role of third-party service providers, the Board-approved Vendor Management Policy, coupled with the ISP, guides the identification and management of risks posed by critical vendors. A third-party risk assessment, based on due diligence criteria and identified controls, is conducted regularly to assess inherent and residual risks. Contractual requirements ensure that providers maintain information security controls, providing reasonable assurance of data confidentiality, integrity, and availability. Third-party access is inventoried and monitored, with management reporting to the Board annually on the status and overall effectiveness of the Vendor Management Program.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: The full Board also receives briefings from our CISO on cybersecurity matters annually. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.

companyName: FLEX LTD.

ticker: FLEX


text: Our cybersecurity program is led by our Chief Information Officer (CIO) and the Chief Information Security Officer (CISO). They are supported by Information Security Officers who work closely with our operational teams. Our CIO and CISO have more than 35 years of collective experience in the cybersecurity field. The CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks, systems, and data. The CISO has served in similar roles at three major public companies and is a recognized cybersecurity leader. He regularly engages with peer CISOs, cybersecurity experts and organizations, including the Cloud Security Alliance (CSA) and the NIST, to stay informed on the latest industry developments. The CISO regularly informs our internal Disclosure Committee, Chief Financial Officer, and our President and Chief Executive Officer of cybersecurity risks and incidents as per our internal cyber risk framework. This also helps ensure that the highest levels of management are kept abreast of our cybersecurity posture and potential risks.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: Management is responsible for day-to-day assessment and oversight of cybersecurity risks. At the senior management level, the CITO is responsible for overseeing the Company's information technology systems, technology capabilities, and cybersecurity practices. The CITO has more than 15 years of experience working in information technology-related roles and is a member of the Company's executive leadership team and reports to the Chief Executive Officer. Prior to joining the Company, the CITO held various leadership positions with global companies.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: The SISO reports directly to the Chief Risk Officer ("CRO"), who has over 35 years of experience in enterprise risk, audit, and compliance. The CRO maintains oversight of entity-wide risk management, inclusive of but not limited to cybersecurity risk.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: To date, management has not identified risks from cybersecurity incidents, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we work to maintain our cybersecurity processes, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third-party providers.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Our cybersecurity governance program is led by our Vice President of Information Technology ("VP of IT"). The VP of IT is informed about and monitors the prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the security team. Our VP of IT has been assessing and managing cybersecurity risk for the company since 2015. In total, our VP of IT has over 20 years of IT industry experience in various roles.

companyName: Titan Machinery Inc.

ticker: TITN


text: Accountability and auditing IT Management ensures that the Company's risks are properly monitored, managed and mitigated to the extent possible; and oversees the implementation and maintenance of formal strategies that govern information resources.

companyName: ATEL 14, LLC


text: We believe we maintain an information technology and security program appropriate for a company of our size, taking into account our operations and risks. We recognize the critical importance of maintaining the trust and confidence of our investors, employees, customers and vendors. We have implemented cybersecurity processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes include mechanisms, controls, and certain technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with an outside information technology consultant on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: CHAMPIONS ONCOLOGY, INC.

ticker: CSBR


text: We believe that cybersecurity is a critical part of our overall risk management profile, which is supported by both our management and our Board of Directors. We believe that we face the same external threats common to other participants in the infrastructure sectors, which include ransomware and malware attacks in addition to the risks brought on through the vendor supply chain. Through the leadership of our Vice President of Information Technology, who reports to our Chief Financial Officer, we continuously assess these threats and evaluate our landscape for new vulnerabilities, considering both for their probability of occurrence as well as their perceived potential impact. We supplement our risk assessment processes with robust third-party identification tools which we review routinely through the use of intrusion prevention and detection systems. We supplement our internal procedures with third parties, who routinely assess our network infrastructure for vulnerabilities both internal and external to our firewall. We also conduct periodic training and awareness programs for all of our employees with systems access in order to drive adoption and awareness of their critical roles in cybersecurity processes and controls.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: Our business does not require us to collect personal customer information. We minimize other cybersecurity risks by using specialist service providers for sensitive operations such as payroll processing, credit card transactions, email, and remote data backup. We verify our information service providers ' cybersecurity policies.

companyName: NVE CORP /NEW/

ticker: NVEC


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we have a process to review risks to our company in connection with certain third-party providers and vendors, as appropriate.

companyName: Aura Biosciences, Inc.

ticker: AURA


text: Data Backup: Deployment of our new data backup system was completed in June 2024 and offers robust protection against catastrophic failures, early detection of data loss prevention events, and near real-time mitigation of ransomware attacks.

companyName: SES AI Corp

ticker: SES


text: No cybersecurity incidents were identified this year. One threat was identified: insecurely stored credentials. This was responded to by implementing an encrypted password manager Company-wide. We will continue to monitor for threats to avoid risks to Company or individuals' data, interruptions to business operations, or financial losses. Information about risks or any identified cybersecurity threats are reported by our Director of Technology to our President.

companyName: PCS Edventures!, Inc.

ticker: PCSV