text: Cyber Risk Management and Strategy Under the oversight of our board of directors and the Audit Committee of the board, we have adopted cybersecurity risk management processes that take a risk based approach to assessing, identifying, and managing risks from cybersecurity threats. Management of cybersecurity risks is part of our overall risk management strategy.

companyName: TELA Bio, Inc.

ticker: TELA


text: Cybersecurity risks are integrated into our overall risk management process through the collaboration of the cybersecurity professionals and our risk management functions to assess threat levels at the subsidiary and parent company level and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through regular reports received from the CIO, which include updates on our performance with preparing, preventing, detecting, responding to, mitigating and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to the Company, our processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or incident.

companyName: Waste Connections, Inc.

ticker: WCN

secItem: Item 1C


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. Please see Part I, Item 1A Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect Cryoport, including our business strategy, results of operations, or financial condition. Refer to "Part I, Item 1A—Risk Factors—Risks Related to Our Technology and Intellectual Property—Cyberattacks, data incidents and breaches in the security of our information systems and networks and of the electronic and confidential information in our possession could materially adversely impact our business, financial condition and results of operations, in addition to our reputation and relationships with our employees, customers, suppliers and business partners" in this Form 10-K for additional discussion about cybersecurity-related risks.

companyName: Cryoport, Inc.

ticker: CYRX


text: Our information technology, software and application systems ("digital technology') has been an important part of our operations and our ability to compete successfully. We continue to invest in technology solutions to improve more inefficient systems, to streamline and automate workflows and to provide digital and mobile applications for our field service personnel. We are committed to maintaining robust cybersecurity measures, continuously evaluating and updating our cybersecurity practices, and being prepared to respond to and recover from cybersecurity incidents. We face ongoing risk from cybersecurity threats. There can be no assurance that our efforts will prevent or mitigate all cybersecurity events, which, if realized, could have a material impact on our operations and financial results. See Part I, Item 1A "Risk Factors" of this Report.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: Risks from cybersecurity threats have not materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1A. Risk Factors of this report for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: During the fiscal year ended June 30, 2024, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: Our Executive Vice President of Talent, Advocacy & Communications and Vice President of IT, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Additionally, they are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Our board, as part of the board's enterprise risk management oversight, actively oversee our cybersecurity risk management framework, ensuring that material risks are identified, assessed, and mitigated.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: The Board of Directors is ultimately responsible for the oversight of cybersecurity risk management, with the Board Risk Committee assisting the Board with oversight of the Company's cybersecurity risk program and reporting. The Board of Directors appoints the CISO, and the CISO is given the full authority of the Board for administering and executing the Company's written information security program.. The CRO/CISO delivers an annual report to the full Board of Directors on the status and effectiveness of the Company's written information security program, and reports to the Board Risk Committee any emerging threats or cyber risks on a periodic basis throughout the year. The Board Risk Committee has also approved an Information Security and Cybersecurity Risk Appetite Statement.

companyName: Capital Bancorp Inc

ticker: CBNK


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our board of directors and senior management. Assessment Processes: We conduct regular risk assessments to proactively identify potential cybersecurity threats and vulnerabilities. These assessments involve thorough evaluations of our IT infrastructure, data systems, and processes to pinpoint areas of weakness;

companyName: Jet.AI Inc.

ticker: JTAI


text: Monitor Cybersecurity Incidents Our CITO and Director of IT Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan managed by a dedicated Cybersecurity Event Response Team and Corporate Crisis Management Team. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: The audit committee of our board of directors is responsible for the general oversight around cybersecurity-related matters, while our management is responsible for the day-to-day operations around the assessment and management of any cybersecurity risks we might face. Our board of directors and the audit committee, in consultation with management, established and maintain robust procedures and internal controls around cybersecurity. These mechanisms are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Terns Pharmaceuticals, Inc.

ticker: TERN


text: The SLA services provide by Hawaiian Electric are mainly for applications and systems on Hawaiian Electric's infrastructure, networks and servers. The SLA does not cover support for certain software applications that were procured outside of Hawaiian Electric's procurement and IT policies and procedures. These include the HEI's general ledger application itself, excluding the infrastructure that the general ledger application is installed on, and certain cloud-based software. Although these applications are not supported by Hawaiian Electric, security measures and internal control procedures related to user access and periodic security reviews have been implemented on these applications and are performed on an on-going basis in accordance with Hawaiian Electric's IT policies and procedures. These controls are required to protect HEI's financial and other sensitive information, as well as to prevent cybersecurity breaches on Hawaiian Electric's infrastructure, networks and servers. In the event of a cybersecurity breach on these unsupported applications, HEI employs third party cybersecurity consultants to assess and resolve issues resulting from a breach, depending on its severity. Hawaiian Electric may also provide guidance and support to assist HEI in assessing and resolving cybersecurity breaches. HEI has also formulated disaster recovery plans, which are updated on an annual basis, involving all of its applications, including those applications not supported by Hawaiian Electric.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: We adhere to industry-leading frameworks to safeguard our systems and data. The primary framework we follow is the HITRUST CSF (Common Security Framework). The HITRUST CSF provides a comprehensive, scalable, and technology-neutral approach to regulatory compliance and risk management. It encompasses information security risk management controls, including risk assessment, mitigation, and evaluation. Our processes for assessing, identifying, and managing material cybersecurity risks align with the HITRUST CSF guidelines.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: A key part of the Company's strategy, informed by CIS's guidance, for managing risks from cybersecurity threats is the regular evaluation, ongoing assessment and testing of the Company's processes and practices through assessments, tabletop exercises, threat modeling, penetration testing, employee training and testing (including on phishing scams), and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company engages third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: Revance Therapeutics, Inc.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A. Risk Factors — The occurrence of cyber incidents, or a deficiency in our cyber security, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.

companyName: W. P. Carey Inc.

ticker: WPC


text: Our Board and senior management oversee our processes for management of cybersecurity risks consistent with the foregoing standards. Such oversight includes regular reporting by management to the Board on the adequacy of such processes and potential material issues identified. Before escalation to the Board, issues are generally identified and assessed through our risk governance structure established under our Enterprise Risk Management Program. The risk governance structure includes three distinct components: management oversight, third-party professional assessment, and separate oversight and review by our Internal Audit Department. Management oversight is maintained through several committees that serve as forums for further assessment, remediation, and escalation. These management oversight committees include the Information Security Committee, co-chaired by the CISO and CRO, the Operational and Compliance Risk Committee, chaired by the CFO, vice chaired by the CISO and Chief Compliance Officer, the IT Steering Committee, chaired by the Chief Information Officer, the Enterprise Risk Management Committee, chaired by the CRO and the executive management committee known as the Strategic Deployment Committee, chaired by the CEO.

companyName: 1ST SOURCE CORP

ticker: SRCE


text: We rely heavily on our vendors and suppliers to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. The costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.

companyName: Unicycive Therapeutics, Inc.

ticker: UNCY


text: Our cybersecurity risk management framework is implemented by our global security team, which is led by our EVP, Information Technology and Global Security, our SVP, Information Systems and Global Security, and our GVP, Governance, Risk, and Compliance. As the leaders of our global security efforts, these roles and their teams support the establishment and maintenance of our corporate-wide information security program to protect our information assets and to oversee our cybersecurity and insider risk and compliance teams. Our SVP, Information Systems and Global Security, and our GVP, Governance, Risk, and Compliance report to our EVP, Information Technology and Global Security, and our EVP, Information Technology and Global Security reports to our Chief Executive Officer.

companyName: Concentrix Corp

ticker: CNXC


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. The Company works with such providers to recommend securities measures to be improved where possible, and generally requires those third parties that could introduce significant cybersecurity risk to us to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: N-able, Inc.

ticker: NABL


text: Our management team, including the Vice President of Technology Support and Director of IT Service Management, is primarily responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our internal information technology management team has over 15 years of tenure with the Company and over 45 years of experience in the information technology space. We also leverage a third party cybersecurity team from FIT Solutions to assist with cybersecurity governance and operations. Our third party team has over 65 years of experience across cybersecurity leadership, information technology engineering, and operations. Further, both our internal and retained consultants have obtained industry certifications, including Certified Information Systems Security Professional (CISSP), Rapid7 Certified Security Analyst, GIAC Security Operation Center Analyst (GSOC), GIAC Certified Incident Handler (GCIH), GIAC Penetration Tester (GPEN), Microsoft Security Certifications, and AWS Practitioner, among others.

companyName: PACS Group, Inc.

ticker: PACS


text: Our cybersecurity and data privacy risk management processes are integrated in our overall risk management program, and we have developed processes for assessing, identifying, and managing material risks from cybersecurity threats. We have adopted physical, technological, and administrative controls on data security and have a defined procedure for incident detection, containment, response, and remediation. Our information security team is primarily responsible for managing our cybersecurity and data privacy risk management processes. We conduct regular test exercises to ensure all relevant teams are aware of their responsibilities during a cybersecurity event or incident, and we use these exercises to promote a culture of continuous improvement. We also have implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: UPWORK, INC

ticker: UPWK


text: We recognize the critical role that cybersecurity plays in protecting our operations, customers, and digital assets. As part of our broader technology and information security risk management framework, our cybersecurity strategy is designed to safeguard the confidentiality, integrity and availability of our systems and data. We continuously assess, strengthen and refine our cybersecurity practices to adapt to an evolving threat landscape.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: The operation of our businesses is dependent on the secure functioning of our computer infrastructure and digital information systems. Furthermore, all our businesses require us to collect and maintain sensitive customer data, as well as confidential employee and shareholder information, which is subject to electronic theft or loss. We also use third-party service providers to electronically process certain of our business transactions and perform certain cyber-related functions, such as system monitoring and critical infrastructure protection and maintenance. The confidentiality, integrity, and availability of information systems, both ours and those of our third-party service providers, are vulnerable to security breaches by computer hackers and cyber terrorists and the negligent or intentional breach of established controls and procedures or mismanagement of confidential information by employees. We may also be impacted by attacks and data security breaches of financial institutions, merchants or other business partners. As part of our utility operations, we own electric generation, transmission and distribution facilities that are part of an interconnected regional grid, the operation of which is dependent on information technology systems. Parties who wish to disrupt the U.S. bulk power system or our utility operations could view our computer systems, software or networks as attractive targets for cyber-attack. Although we have not historically experienced material cyber incidents, we and other utilities are subject to cyber-attacks of increasing frequency and sophistication, and any significant interruption or failure of our information systems or any significant breach of security due to cyber-attacks, hacking or internal security breaches, could adversely affect our business and our financial condition, operating results and liquidity.

companyName: Otter Tail Corp

ticker: OTTR


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement and compliance.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: Blend maintains an incident response plan that is designed to contain and address any suspected security incident identified by the Company. This plan is tested at least annually. Our security operations team triages issues and invokes the incident response plan when deemed necessary. This plan includes provisions for notifications of internal and external parties, including Blend leadership and the Audit Committee as required.

companyName: Blend Labs, Inc.

ticker: BLND


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Report, including "Risks Related to Information Technology Systems, Data Security and Data Privacy."

companyName: GERON CORP

ticker: GERN


text: Implemented a revised and updated phishing email training program; and Retained a consultant to act as the Company's Virtual Chief Information Security Officer (VCISO), who has more than 20 years of experience in various cybersecurity roles (e.g., managing information security, developing cybersecurity strategies, implementing cybersecurity and incident response programs, etc.) to oversee the implementation and performance of the Company's cybersecurity program.

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: Access to records containing client's personal information shall be limited to those persons who are reasonably required to know such information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: We manage risks from cybersecurity threats through our overall companywide risk management process, which is overseen by our Board of Directors and specific Board Committees. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Our policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Further, associates outside of our technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, our associates are provided with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulations, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all employees. In addition to company policies that we make available to all employees, our awareness training provides clear reporting and escalation processes in the event of suspicious activity.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks Since the completion of the Business Combination on February 14, 2024, management has been working to create a defined cybersecurity risk management program, through the addition of enhanced applications to identify and mitigate risks. During 2024 the Company engaged and managed an experienced third party vendor, specializing in cybersecurity, to conduct a Company wide cybersecurity risk assessment. The assessment included a multi-phase approach consisting of open-source intelligence gathering, network system penetration testing of the Company's internal, external, and wireless networks, and targeted social engineering through strategic phishing, vishing, and smishing campaigns. Action items and preventative recommendations were identified by management and are being incorporated into the Company's information security incident response plan, which is designed to follow the National Institute of Standards and Technology Cybersecurity Framework 2.0 standards and practices for identifying and mitigating cybersecurity incidents. Management will complete implementation of the action items during 2025, which we intend to test periodically for effectiveness.

companyName: Sable Offshore Corp.

ticker: SOC


text: Material Impact of Cybersecurity Risks In the last three fiscal years, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors — Risks related to our Business and Structure — We are subject to cybersecurity risks and incidents that may adversely affect our operations, the operations of RCM or the companies in which we invest. A failure in our, or RCM's, cybersecurity systems could impair our ability to conduct business and damage our business relationships, compromise or corrupt our confidential information and ultimately negatively impact business, financial condition and operating results."

companyName: RAND CAPITAL CORP

ticker: RAND


text: The ISP, which is part of our Enterprise Risk Management Program, is organized in an operating framework that is supported by policies, standards, procedures, and guidelines that establish the information security control environment. Information Security collaborates with additional areas of our Enterprise Risk Management Program to ensure comprehensive risk oversight and reporting. The ISP is designed and implemented to comply with or exceed regulatory control requirements. Multiple internal and independent third-party assessments and audits are conducted annually to ensure our compliance with its policies, controls, and regulatory requirements.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: We use of semi-quantitative risk assessment as a tool for evaluating the probability (likelihood) and severity (impact) of potential risks.

companyName: Health In Tech, Inc.

ticker: HIT


text: In addition, we have an IT Security Committee comprised of our top executives from across the Company, including our Chief Executive Officer, Chief Financial Officer, General Counsel, our Director of Information Security and Privacy. The IT Security Committee meets quarterly to discuss and address management of the risks facing our business. Technological risk is a regular component analyzed by our IT Security Committee to identify and assess potential cybersecurity risks across our business operations.

companyName: INSEEGO CORP.

ticker: INSG


text: To operate its business, the Company engages certain third-party vendors to perform a variety of functions. The Company seeks to engage reliable, reputable service providers. Depending upon the nature of the services and the sensitivity of the data that a third-party service provider processes, the Company's vendor management procedures including reviewing the cybersecurity procedures, imposing contractual requirements, and conducting periodic reassessments as needed. The Company seeks to further enhance this review to expand the scope and depth of this analysis.

companyName: Veris Residential, L.P.


text: Lumen periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also share and receive threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.

companyName: QWEST CORP

ticker: CTBB


text: The Audit Committee oversees our cybersecurity posture to assess key strategic, operational, and compliance risks. Our CIO and CISO update the Audit Committee on a quarterly basis regarding cyber risks, the threat landscape, reports on our security roadmap, risk mitigation and governance, and any cybersecurity incidents.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: Cybersecurity risk oversight is also a key area of focus for management. As discussed above, the CTO is primarily responsible for the cybersecurity program, strategy, policy, standards and processes. On a quarterly basis, or more frequently if a need arises, the CTO presents a briefing to the Audit Committee regarding the Company's cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Potentially material cybersecurity matters are escalated to the Audit Committee and/or the full Board of Directors, as appropriate, for risk oversight.

companyName: GoHealth, Inc.

ticker: GOCO


text: See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks. International Seaways, Inc.

companyName: International Seaways, Inc.

ticker: INSW


text: complying with North American Reliability Corporation Critical Infrastructure Protection Reliability Standards and standards for the protection of Bulk Electric System Cyber Systems; and continually assessing and, as necessary, enhancing the Company's cybersecurity through a managed process integrated with the Company's risk management principles.

companyName: UNITIL CORP

ticker: UTL


text: The Company's cybersecurity risk management processes incorporate multiple layers of security to help identify and protect against cybersecurity threats including a dedicated cybersecurity team, technical security controls, policy enforcement, monitoring systems, employee training, contractual arrangements and management oversight. Given the dynamic nature of the cyber-threat environment, the Company engages third-party assessors, consultants and others from time to time to assist in various cyber-related matters, including assessing, enhancing, implementing and monitoring the Company's cybersecurity risk management process.

companyName: OPENLANE, Inc.

ticker: OPLN


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We operate in an increasingly interconnected digital landscape and we recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. In the normal course of business, we may collect and store certain sensitive information, including proprietary and confidential business information, intellectual property, sensitive third-party information, employee information and personal information. We rely on information systems for the management of this information in addition to our management of business processes including inventory, payment of obligations, collection of cash, human capital management, financial tools and other processes and procedures. Our ability to manage our business effectively depends on the reliability and capacity of these systems. We seek to address these risks by safeguarding assets, data, and operations through the cybersecurity risk management processes described below: Risk Assessment:

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: In addition, manufacturing operations at our Mexico-based facility may also suffer disruptions from cybersecurity attacks, which could negatively impact our ability to produce Tablo consoles and cartridges, restrict or delay our ability to deliver products to our customers and meet our customers' demand on a timely basis, and result in customer dissatisfaction, all of which would adversely impact our results of operations. Moreover, we use Amazon Web Services to support Tablo's cloud connectivity and any disruption of service as a result of cybersecurity attacks could interrupt or delay our ability to receive and deliver certain treatment and reporting information from and to providers and patients. The continuing and uninterrupted performance of Tablo is critical to our success and any repeated or prolonged system failures may damage our reputation, reduce the attractiveness of Tablo to providers and patients, and result in decreased demand for Tablo, thereby adversely affecting our business, financial condition and results of operations. For more information on the risks we face from cybersecurity threats and the potential impacts on our company, see the section above entitled "Risk Factors" under Part I, Item 1A, including the risk factor entitled "We may face additional costs, loss of revenue, significant liabilities, harm to our brand, decreased use of our platform and business disruption if there are any security or data privacy breaches or other unauthorized or improper access."

companyName: Outset Medical, Inc.

ticker: OM


text: The Company maintains an Enterprise Risk Management (ERM) program that is designed to identify, analyze and manage risks, including risks from cybersecurity threats. This program scores, ranks, and reports risks to Company managemen t based on the likelihood and impact the risk has relative to the strategic objectives and financial standing of the Company.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: Southwest's processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to customer and employee data or our systems. Third-party risks are included within our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through our diligence review. Our due diligence process involves the use of questionnaires that are completed by third-party service providers and reviewed by business unit representatives and cybersecurity specialists to identify risks associated with third-party service providers. We use the responses provided in the questionnaires to assist in finding ways to mitigate risks presented by a particular third-party service provider consistent with the services provided. Additionally, contracts with third parties that could introduce significant cybersecurity risk to Southwest include terms to assist in the mitigation of cybersecurity risks, including but not limited to, requiring counterparties to report data privacy or cybersecurity incidents to us and to agree to be subject to periodic cybersecurity audits as appropriate.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: As part of our Enterprise Risk Management ("ERM") program, we maintain processes to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats. Central to these processes is a committee comprised of our Vice President of Internal Audit, our Chief Information Officer ("CIO"), members of our executive team, and other senior members of management that evaluates cybersecurity risks and designs and ensures implementation of appropriate controls, protections and training. This committee periodically reviews overall risks to the Company as part of the ERM program and ensures the alignment of cybersecurity efforts with the overall risk management framework. The committee has identified cybersecurity threats as one of the primary categories of risk to the Company.

companyName: Installed Building Products, Inc.

ticker: IBP


text: We regularly engage assessors, consultants, auditors and other third parties to support our enterprise information security program. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

companyName: MKS INC

ticker: MKSI


text: We engaged a third party to perform a cybersecurity audit in the fourth quarter of 2021 and intend to undertake another cybersecurity audit in the third quarter of 2024. To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation, or financial condition. To date, we have not experienced a material cybersecurity attack, such as a cybersecurity threat, a ransomware attack, computer viruses or other malicious codes, security breaches, unauthorized access, phishing attacks, or system failures. The Company carries cybersecurity insurance and considers our coverage to be adequate.

companyName: MAXCYTE, INC.

ticker: MXCT


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to designated employees and other members of management depending on the circumstances, including in some cases to our executive team. The board of directors receives regular reports from management concerning our cybersecurity risk management program. The board also receives various summaries and/or presentations related to cybersecurity threats, risks and mitigation.

companyName: Corvex, Inc.

ticker: MOVE


text: We have processes to inform the Directors' Risk Committee, Audit Committee and the Board about risks from cybersecurity threats. Our management team reports its findings using the FFIEC Cybersecurity Assessment Tool and our information security team's determination as to whether our security controls, at a minimum, are in place and effective.

companyName: First Foundation Inc.

ticker: FFWM


text: The Company has established a risk committee (the " Risk Committee ") consisting of executive officers, including the Company's Chief Information Security Officer ("CISO"), that is directly responsible for the Company's risk management process. The Company's cybersecurity policies, standards, and practices are integrated into the Company's risk management process. The Board oversees information technology, data security, and cybersecurity risk management through regular reports and presentations from the CISO and other management members. The Risk Committee meets at least annually to define and improve the risk-mapping process and considers any updates at least quarterly. In addition, the Risk Committee presents comprehensive reports directly to the Board at least annually through the enterprise risk management matrix, which, as described below, is reviewed by the Audit Committee.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: Managing Material Risks & Overall Risk Management We have a cross-departmental approach to addressing cybersecurity risk, including input from our employees, senior management, and Audit Committee of our Board of Directors (the "Board"). The Company devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats promptly and effectively.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: The Board coordinates with the Audit Committee and Finance Committee to ensure active Board- and Committee-level oversight of the Company's technology and cyber risk profile, enterprise technology and cyber strategies, and information security initiatives. In addition, the Board has delegated primary responsibility for oversight of the Company's key risks, including cybersecurity, to the Audit Committee. The Audit Committee reviews technology and cybersecurity risks, as well as the Company's risk mitigation processes and internal control procedures to protect sensitive business information. The Audit Committee also receives regular updates from the Chief Digital Solutions Officer and the CISO on the Company's technology and cybersecurity programs. In addition, the Finance Committee oversees management's strategy with regard to technology and associated risks, including cybersecurity risks, when considering major capital expenditures and acquisitions. The Board also receives regular updates from the Audit Committee and Finance Committee on their in-depth Committee-level reviews.

companyName: S&P Global Inc.

ticker: SPGI


text: Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation, government action, increased regulation, penalties, fines or judgments, any or all which may ultimately have a materially adverse effect on our results of operations, financial condition, reputation, and business (including our strategy of operating a resilient freight railroad).

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Management's Role Managing Risk At the management level, our cybersecurity program is managed by our Head of Information Security, who reports to our Vice President of Information Technology. Our Head of Information Security has over twenty-five years of information technology experience, with five years of experience in the information security space. Our Head of Information Security holds a Bachelor of Science in Computer Science and a Master of Business Administration.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: The Audit Committee receives regular updates from the Chief Information Security Officer and other members of management on our cybersecurity program, including on information security and technology risks, program assessments, and risk management practices. Our Chief Information Security Officer and other senior information technology executives also provides similar topical updates to the full board of directors at least annually.

companyName: AbbVie Inc.

ticker: ABBV


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks and sets associated risk parameters and tolerance levels. The audit committee assists the board of directors with this responsibility by reviewing and discussing the defined risks, its assessment and proposed mitigation strategies, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors. is responsible for day-to-day assessment and management of cybersecurity risks and reports regularly to the audit committee.

companyName: Zedge, Inc.

ticker: ZDGE


text: Our board of directors delegates to the Audit Committee the oversight of our programs, policies, and procedures related to cybersecurity, information asset security, and data privacy and protection. Broad oversight is maintained by our full Board, which receives a report from the Audit Committee at least annually.

companyName: Research Solutions, Inc.

ticker: RSSS


text: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, our Chief Technology Officer, and other members of management.

companyName: Champion Homes, Inc.

ticker: SKY


text: The IRT also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident, which may include, but are not limited to, rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, or employee re-training.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: We plan to establish an appropriate confidentiality framework and adhere to relevant document management regulations. The Company and its employees are also required to sign confidentiality agreements for purposes including ensuring cybersecurity. As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: ABVC BIOPHARMA, INC.

ticker: ABVC


text: Training and Awareness We require all employees with access to our systems to complete an annual information and cyber security training and conduct simulated phishing campaigns to measure the effectiveness of the training program.

companyName: Enviva, LLC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."

companyName: Playtika Holding Corp.

ticker: PLTK


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Village Bank & Trust Financial Corp.


text: Weatherford also provides guidance to support employees on acceptable use, remote access, encryption, cloud security, and anti-virus best practices. Weatherford has long included a safety moment at the beginning of major internal meetings, and cyber safety is an occasional topic.

companyName: Weatherford International plc

ticker: WFRD


text: The Information Technology and Legal departments are responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. The Director of Information Technology and Assistant General Counsel are also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: CHIMERIX INC


text: Our Board of Directors oversees the Company's aggregate risk profile and risk management process. The Board of Directors administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.

companyName: ZeroStack Corp.

ticker: ZSTK


text: As of March 31, 2024, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents that have materially affected Microchip, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "We continue to be the target of attacks on our IT systems. Interruptions in and unauthorized access to our IT systems, and security breaches or incidents impacting our systems or data that we or our service providers maintain or otherwise process, could adversely affect our business", in this Annual Report on Form 10-K.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. See "Risks Related to Our Business and Industry—A security breach or other threat relating to our information systems could adversely affect us." within Item 1A, "Risk Factors" in this Annual Report.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: The Company's Corporate Information Security team members are also responsible for completing additional mandatory annual training to understand the processes, procedures, and technical requirements for securing information assets across the enterprise. The Company also offers ongoing practice and specialized education for Corporate Information Security team members to stay up to date with emerging trends in cybersecurity threat protection, detection, and response.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: The Board of Directors exercises risk management oversight, including cybersecurity risk, through the Audit Committee. The Audit Committee receives regular reports on our risk management program. These include regular reports from the CISO on the state of our cybersecurity risk management program and updates on cybersecurity matters.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: We strive to create a culture of cybersecurity resilience and awareness and believe that cybersecurity is the responsibility of every employee and contractor. At the same time, primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our CISO, Michael Daly, who has more than 35 years of experience in security and information systems and spent 25 years with Raytheon Technologies, most recently as Chief Technology Officer of Cybersecurity, Special Missions, Training & Services. Our CISO supported the U.S. President's National Security Telecommunications Advisory Committee for more than 20 years, is a member of the Massachusetts Cybersecurity Strategy Council, and previously served as Chair of the Kogod Cybersecurity Governance Center at American University. He also served on the Rhode Island Homeland Security Advisory Board and was a member of various commercial cyber product councils.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: As a foundation of this approach, our privacy and security policies govern our business lines and subsidiaries. We monitor the privacy and security regulations applicable to us in the regions where we do business as well as proposed privacy and security regulations and emerging risks.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: Managing cybersecurity risks is an important component of our approach to enterprise risk management. As part of our overall risk management system, we have established certain procedures to assess, identify, mitigate and respond to risks from cybersecurity threats. We have regular programs to evaluate cybersecurity threats and to assess our systems, procedures and processes in order to identify areas of potential vulnerability and to improve our protection against evolving cybersecurity threats. We use the Center for Internet Security's Critical Security Controls framework in our regular assessment of cybersecurity risks with respect to our information systems, including vulnerability management, access controls, infrastructure hardening, employee training and evaluation of external threats, including in connection with potential data breaches, ransomware and other forms of unauthorized access.

companyName: RH

ticker: RH


text: Our information security procedures are overseen by our Vice President of Risk Management, supported by our Chief Technology Officer and our IT Manager, who are responsible to provide regular reports to our Interim President and Chief Executive Officer and Chief Financial Officer as well as the Technology and Social Responsibility Committee and the Governance Committee of our Board. These procedures are responsible for identifying, assessing, and managing cybersecurity threats and risks and work to monitor and evaluate our threat environment and risk profile using various methods. These methods include evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third parties to conduct external audits and threat assessments for certain systems.

companyName: Rekor Systems, Inc.

ticker: REKR


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program designed to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer, General Counsel, and Director of Information Technology.

companyName: Inhibrx Biosciences, Inc.

ticker: INBX


text: Our Information Security team, including our Information Security leadership, has primary responsibility for identifying, assessing and managing material risks to the Company from cybersecurity threats, including our overall cybersecurity risk management program and supervision of our internal cybersecurity personnel and our external cybersecurity consultants. Our Chief Information Security Officer ("CISO") has over 20 years of information security/cybersecurity experience, working in a variety of roles within PricewaterhouseCoopers LLP, as the Director of Cyber Operations for Nationwide Building Society, the CISO at The Crown Estate and the CISO at Insight Investment.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the COO and Chief Financial Officer ("CFO"). The COO and CFO work with the other members of the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company will report to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: To assist with management oversight, the CDIO chairs a security council which supports risk management by providing input into cyber security strategy and helps prioritize monitoring, mitigation and remediation across operational groups. This security council is comprised of senior leaders from a cross-functional group of departments including Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure. In addition, we have established processes and response teams that are responsible for monitoring and making determinations regarding the materiality of cybersecurity incidents. The members of these teams have extensive expertise in evaluating the potential impact and materiality of events in the context of Frontier's business and financial position, reputational and industry risk, and legal and regulatory environment, and there are procedures in place to escalate potentially material incidents for consideration by the Audit Committee. For example, the Audit Committee was actively involved in the review, disclosure and mitigation of the reported April 2024 cyber-attack. See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.

companyName: Frontier Communications Parent, Inc.


text: We conduct a comprehensive annual tabletop exercise facilitated by an external cybersecurity specialist. This exercise involves simulating various attack vectors, utilizing our incident response plans and procedures to respond effectively, prevent, block, and remediate potential threats. This exercise also includes preparing for other related potential impacts to the Company, such as business interruptions, business continuity plans, backup strategies, data protection policies and compliance, incident response, third-party forensic and legal assistance, as well as consideration of regulations such as GDPR, CCPA, PCI and other cybersecurity regulations. This tabletop exercise is attended by members from all subsidiaries, including IT management teams as well as finance, legal, insurance, and operations management teams. We believe our holistic approach ensures we are well-prepared and coordinated to handle a range of cybersecurity scenarios.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Depending on the environment, we implement and maintain various technical, physical and administrative processes, measures, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, among other things, incident detection and response plan and procedures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, cryptography, network security controls, secured remote access, access controls, change management, physical security, asset management, secured software development lifecycle, logging and monitoring, third-party risk management programs, security awareness trainings, third-party and company penetration testing, cybersecurity insurance and dedicated cybersecurity staff. We use our own software to help further mitigate the risk of a material cybersecurity incident. In addition, our Varonis Data Security Platform is deployed internally as part of our insider threat, data security posture, security operations and compliance management programs.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: Our management team, including Endeavor's Chief Compliance Officer, Chief Information Officer, SVP, Privacy & Cybersecurity, and SVP, Cybersecurity, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer is responsible for implementation and enforcement of written information security policies. The Chief Information Officer has designated leaders, including the SVP, Cybersecurity, to be responsible for overall management of the information security management program, including developing and operating within the defined global information security controls to protect our IT systems, selecting and supervising retained cybersecurity consultants, and working with Legal, Compliance, and Human Resources personnel to develop and launch appropriate information security training of our workforce. Our management team has decades of experience leading and managing cybersecurity teams as well as professional credentials in cybersecurity and data privacy. Our SVP, Privacy & Cybersecurity, leads a team of five dedicated privacy professionals in the Legal department.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Thoughtworks has a multilayer approach to governance of its cybersecurity program. Our Board of Directors encourages management to promote a culture that incorporates risk management into our corporate strategy and day-to-day business operations. Management discusses strategic, operational, financial and legal risks at regular management meetings and raises strategic issues and points of concern with the Board of Directors, or its standing subcommittees, through regularly scheduled or, if necessary, special meetings, as needed. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational risk affairs of the Company, including information technology risks, business continuity and data security. Our Audit Committee is informed of such risks through an annual board meeting.

companyName: Thoughtworks Holding, Inc.


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition as of December 31, 2023, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Additional information on cybersecurity risks the Trust faces is discussed in Part I, Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Invesco CurrencyShares Japanese Yen Trust

ticker: FXY


text: Board Oversight of Cybersecurity Risks The audit committee of the board of directors of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company's Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: FS KKR Capital Corp

ticker: FSK


text: 4. Cybersecurity Strategy and Resilience The Company has established robust cybersecurity resilience measures to ensure that cyber incidents do not materially impact operations. These include: • Backup and Redundancy: Critical business systems are backed up and replicated to prevent data loss and operational disruptions. • Incident Containment and Recovery: Automated security responses, real-time malware detection, and forensic analysis capabilities enable the Company to respond swiftly to threats. • Proactive Threat Intelligence: Continuous monitoring of emerging cyber threats and industry trends, allowing for adjustments to the security strategy.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Management's responsibility The Company's senior executive team, which includes our Director of Information Systems, is responsible for providing input and oversight of our ERM program, including assessing and managing our material risks from cybersecurity threats. The senior executive team is informed about and oversees the prevention, detection, mitigation, and remediation of cybersecurity incidents through their management of, and participation in, our cybersecurity risk management and strategy processes. The senior executive team provides an in-depth annual report and quarterly updates on our enterprise risks, including cybersecurity risks, to present to the full Board.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT


text: All employees receive mandatory cybersecurity awareness training at onboarding, covering phishing prevention, secure data handling, and reporting suspicious activities.

companyName: Quality Industrial Corp.

ticker: QIND


text: Our management team, including our Chief Technology Officer and VP Risk & Compliance, is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our management's experience includes years of working in the cybersecurity field in various industries, including the financial services industry.

companyName: Fold Holdings, Inc.

ticker: FLD


text: Our Vice President of Information Technology has developed expertise in cybersecurity and compliance, enterprise architecture and rod mapping, data and analytics, digital transformation, and customer service through her extensive experience in information technology. She earned her Bachelor of Science in Accounting and emphasis in Information Systems Management from North Dakota State University. Our CISO has worked for 30 years in product development and information technology, including the areas of infrastructure and application architecture. In the last 15 years, he has worked in security for healthcare, pharmaceutical and technology companies, the last six years as CISO. He earned his Bachelor of Science in Electronic Engineering from Universidade Federal do Rio de Janeiro in Brazil.

companyName: NEVRO CORP


text: Management's Role in Cybersecurity Risk Management Our management team, including our Chief Legal Officer, President, and Director of Information Technology is responsible for assessing and managing material risks from cybersecurity threats. Members of our management team possess relevant expertise in various disciplines that are key to effectively managing such risks, such as technology systems, technology leadership, technological development, cybersecurity, regulatory compliance and corporate governance. Our Director of Information Technology has over 10 years of experience in technology systems and cybersecurity and has the requisite training, skills, and experience to manage our cybersecurity risks. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.

companyName: Nxu, Inc.

ticker: NXUR


text: We also maintain what we believe are appropriate levels of cybersecurity insurance that covers settlements, judgments and defense costs arising out of a failure of network security, a privacy breach, media liability, business income loss resulting from a cyber event and for cyber extortion coverage. This cybersecurity insurance coverage also provides for certain breach response services in connection with incidents involving the theft, loss or unauthorized disclosure of third-party information, and computer system security breaches.

companyName: NPK International Inc.

ticker: NPKI


text: As an important cybersecurity risk mitigant, E2open provides mandatory training to its new hires and quarterly training of its employees, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.

companyName: E2open Parent Holdings, Inc.


text: The Company is a holding company and its business units are decentralized. Together with its business units, the Company maintains a risk-based information security program establishing administrative, technical, and physical safeguards that are designed for the size, scope and type of the Company's businesses.

companyName: Graham Holdings Co

ticker: GHC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our enterprise risk assessment function, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cyber threats. Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our information technology systems and confidential information; • products and services built with security tools; • cybersecurity awareness training, including internal phishing tests of our employees, contractors, consultants, or any third-parties who will have access to our information technology systems and environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for key service providers, suppliers, and vendors based on their criticality and risk profile; and • a level of cybersecurity insurance that we believe is appropriate, taking into consideration the material risks from cybersecurity threats.

companyName: BM Technologies, Inc.


text: The Company's risk management program for cybersecurity is integrated into our risk management and general compliance programs and processes. Our cybersecurity program utilizes a layered, defense-in-depth strategy to identify and mitigate cybersecurity threats. Our Information Security Officer ("ISO") is responsible for the day-to-day management of the Company's global information security program, which includes defining policies and procedures to safeguard our information systems and data, conducting vulnerability, threat and third-party information security assessments, information security event management (i.e., responding to ransomware and other cyber-attacks, business continuity and recovery), evaluating external cyber intelligence, supporting industry cybersecurity efforts and working with governmental agencies. The information security team also develops training for employees to support adherence to the Company's policies and procedures, along with increasing awareness of cyber-related risk. The personnel training includes, but is not limited to, mandatory onboarding training, phishing simulations with automated remediation training, table-top incident response exercises, and educational intranet posting and email campaigns.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Company and the Advisers. This cyber risk management program is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Company and other affiliates of TIAA.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: Our Audit Committee takes the lead on behalf of our Board of Directors in monitoring risk management, which includes overseeing the Company's management of its cybersecurity and data privacy. The Audit Committee meets on a quarterly basis with our General Counsel and Chief Financial Officer, who provide quarterly reports concerning the Company's information security and cybersecurity risks.

companyName: AMC Networks Inc.

ticker: AMCX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee. Our current Vice President, Global Head of Information Technology and Chief Information Security Officer has over a decade of IT management experience, over eight years of cybersecurity management experience and is currently an ISACA Certified Information Security Manager (CISM). He reports directly to our Chief Financial Officer.

companyName: CS Disco, Inc.

ticker: LAW


text: Cybersecurity is fundamental to FIS' complex, global business. As part of our business, FIS and its vendors, technology partners, and clients electronically receive, process, store and transmit a wide range of confidential information, including sensitive customer information and consumer personal data. Our operations extend to managing payment systems, cash access and prepaid card systems. Cyberattacks on information technology systems and the vendors and technological supply chain they rely on continue to grow in frequency, complexity and sophistication. This is a trend we expect to continue. Cyberattacks have garnered significant attention from individuals, businesses, governmental entities and the media drawing the focus of a large ecosystem of criminal threat actors. The objectives of these cyberattacks include, among other things, gaining unauthorized access to systems to disrupt operations, steal information, seek ransom payments from victims, perpetrate financial fraud, or sell stolen information. Perpetrators of cyberattacks attempt to exploit technical, human, social, and organizational vulnerabilities to gain unauthorized access. There is a growing trend of identifying and exploiting vulnerabilities in widely used technologies or vendor systems, allowing a single compromise or failure to extend unauthorized access to numerous systems.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with periodic cybersecurity training. This training program covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all cybersecurity incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: KALA BIO, Inc.

ticker: KALA


text: Our chief financial officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. Leaders of our information technology and device engineering, together with members of our finance team, comprise our Cybersecurity Committee, which meets to assess cybersecurity risks and identify new risks and assess our risk management framework on a quarterly basis. Among the members of this committee are employees who are knowledgeable about our products and systems, have prior experience managing cybersecurity risks, and maintain an active Certified Information Systems Security Professional certification.

companyName: CVRx, Inc.

ticker: CVRX


text: Incident reports and issues identified from any cybersecurity events; and requirements and industry standards. In addition to our regularly scheduled Board meetings, the ISO regularly communicates with senior staff regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: CMC recognizes the critical importance of a well-developed cybersecurity risk management program and has designed ongoing cybersecurity management protocols that are embedded in our global business processes and activities. These protocols include, but are not limited to, penetration testing, vulnerability scanning, attack simulations and appropriate internal controls, along with independent third-party audits conducted to evaluate compliance with security standards and best practices. The protocols are designed by our Chief Information Security Officer ("CISO") and implemented by an experienced team comprising our information security and various technology departments. We engage expert consultants and third-party service providers to review our cybersecurity controls and readiness, alert us to potential improvements and provide incremental industry knowledge and expertise. Additionally, employees are required to complete cybersecurity training at the start of their employment and annually thereafter, and are regularly exposed to phishing awareness campaigns that simulate real-world threats.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: Our IT consultant regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. To the extent necessary, our Chief Executive Officer reports such risks to our Board, which has overall responsibility for risk oversight.

companyName: Decoy Therapeutics Inc.

ticker: DCOY


text: For a discussion of the Company's cybersecurity-related risks, see Item 1A of this Form 10-K under the heading "Risk Factors—If we or one of our significant vendors sustain a cyber-attack or suffer data privacy or security breaches that disrupt our information systems or operations, or result in the dissemination of sensitive personal or confidential information, we could suffer increased costs, exposure to significant liability, reputational harm, loss of business, and other serious negative consequences."

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: Use of Third Parties We collaborate with, and intend to continue to collaborate with, nationally recognized third-party experts for specialized security functions in rapidly evolving areas. This partnership approach enables us to leverage advanced expertise in threat identification, penetration testing, tabletop exercises, maturity assessments, training, awareness and incident response.

companyName: BELLRING BRANDS, INC.

ticker: BRBR


text: Our information systems generally fall into two categories: our platform and our corporate systems. Each category has dedicated teams and processes in place to address cybersecurity risk. Our product security team, which reports into our EVP, Engineering, works alongside our product and engineering teams to address how security is designed into our platform. Our corporate security team, which reports to our Chief Information Security Officer within our Chief Financial Officer's organization, is responsible for the secure design of our corporate systems. In addition, our Chief Information Security Officer manages a global security team that performs certain cybersecurity functions for both our platform and corporate systems, including certification management, incident response, threat detection, analytics, and offensive security (such as simulations and penetration tests).

companyName: Snowflake Inc.

ticker: SNOW


text: Related to Cybersecurity Risks Our Board considers cybersecurity risk as part of its overall risk oversight, and has delegated to the Audit, Finance and Risk Committee ("AFRC") responsibility for oversight of major risk exposures, including in relation to security, cybersecurity and privacy. At the management level, we have also established an Executive Risk and Compliance Committee ("ERCC"), which oversees the development and implementation of our risk oversight and management processes, including in relation to cybersecurity. The ERCC is comprised of members of our executive leadership from across the organization. Our CISO reports to the ERCC on identified material cyber risks (if any) and on the implementation of cybersecurity priorities. The members of the ERCC, in turn, are responsible for updating the AFRC, and, where required, our Board on key milestones and progress regarding identified material cyber threats.

companyName: AlTi Global, Inc.

ticker: ALTI


text: Oversight of Cybersecurity Risk Cybersecurity risk oversight at the Antares Parties is embedded within a governance structure that includes board-level engagement, cross-functional collaboration, and continuous monitoring of key cyber risk indicators.

companyName: Antares Strategic Credit Fund


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: We outsource substantially all of our IT functions, including cybersecurity, through BankOnIT, LLC ("BankOnIT"), a third-party banking technology service provider. BankOnIT provides significant resources to identify, assess and manage risks from cybersecurity threats, including: Continuous 24/7/365 monitoring of our information systems; Scanning of our information systems; Continuous updating and testing processes; Performing vulnerability assessments; and Maintaining up-to-date firewall and anti-virus protections.

companyName: Bank7 Corp.

ticker: BSVN


text: The Company has cybersecurity insurance (subject to specified retentions or deductibles) related to a cybersecurity incident that addresses costs, losses, and expenses related to cybersecurity investigations, crisis management, notification processes and credit monitoring services, public relations, and legal advice. However, damages, fines and claims arising from such incidents may not be covered or may exceed the amount of any insurance available or may not be insurable.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: We use people, process, and technology controls to manage and mitigate cybersecurity risk. The Risk and Compliance Committee, in consultation with and regular reporting to our full Board of Directors (the "Board"), has been delegated oversight for enterprise technology and its associated risks including cybersecurity. As a financial services and technology company, we face a range of cybersecurity risks that are inherent in our industry. Cybersecurity risk has been integrated into the Company's overall Enterprise Risk Management framework as well as our Internal Audit plan.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: Cybersecurity risk management and oversight are of utmost importance to Air Products and are necessary to maintain the trust and confidence of our customers, employees, and other stakeholders. The Company has implemented a thorough cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats as a fully integrated component of the Company's overall Enterprise Risk Management ("ERM").

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: We employ a suite of tools and services that support the continuous surveillance and reduction of cyber risks. Our internal teams undertake regular audits and penetration testing throughout the year. External third -party experts are enlisted annually to assess our cybersecurity maturity and conduct risk evaluations, besides offering specialized knowledge on various cybersecurity matters. Our security operations center operates 24/7 to identify, lessen, and react to cyber threats promptly. Defined protocols are in place to manage and mitigate any detected cybersecurity incidents swiftly, with regular reviews of our policies and procedures to ensure compliance with evolving regulatory standards and the dynamic threat landscape.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: Our information security team deployed a structured and measured vulnerability management program that proactively identifies vulnerabilities across our platforms and processes. The program is composed of the following: Internal persistent scans and external monthly scans;

companyName: BROWN & BROWN, INC.

ticker: BRO


text: We have a security policy which outlines mandatory security requirements for all of our employees, contractors or other agents. This policy is supported by internal standards, directives and procedures. The security program includes implementation of software security throughout the development life cycle, vulnerability and configuration management software across certain data infrastructure, products and services. Our risk management process includes employee education and annual analysis of risks from across the company, which are then prioritized for remediation. Our approach to cybersecurity is integrated into our overall company-wide approach to risk management, including that our management team, including our Chief Security Officer and Data Privacy Officer, evaluates material risks from cybersecurity threats against our overall business objectives and regularly reports to both the Audit Committee of our board of directors and to our internal audit function which evaluates our overall enterprise risk.

companyName: Unity Software Inc.

ticker: U


text: The Company's cybersecurity risk management and strategy processes are managed by the Chief Information Security Officer ("CISO") and the Vice President of Technology Solutions, who have 24 and eight years of work experience, respectively, in various roles involving systems security, operations and compliance. These individuals are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of internal information technology personnel and retained third-party personnel involved in the cybersecurity risk management and strategy processes described above, including the operation of the IRP. If a cybersecurity incident occurs, it is reviewed by the information technology team to determine whether further escalation to the CISO or Vice President of Technology Solutions is required. Any cybersecurity incident assessment that results in the possibility of a material impact to the Company is reported to the appropriate designated members of management and, when appropriate, outside counsel, to make final materiality determinations, as well as disclosure and other compliance decisions. Additionally, the Company's cyber security governance includes a Cybersecurity Steering Committee which is comprised of a subset of the Company's Executive Committee and other key officers, leaders and subject matter experts from various disciplines across the Company. The Cybersecurity Steering Committee meets quarterly to receive updates from the CISO and/or Vice President of Technology Solutions on Company-related cyber risks, monitor compliance with the Company's Cyber Program and to review cybersecurity policies.

companyName: PIONEER NATURAL RESOURCES CO


text: Cybersecurity is critical to our ongoing business as a provider of online marketplaces where consumers shop for financial services. Securing our business information, intellectual property, consumer, customer and employee data and technology systems is essential for the continuity of our business, meeting applicable regulatory requirements and maintaining the trust of our stakeholders.

companyName: LendingTree, Inc.

ticker: TREE


text: Our technologies, systems and networks may be subject to cybersecurity threats. Our business, like others within the energy technologies industry, is faced with growing cybersecurity threats as we increasingly rely on digital technologies across our business, some of which are managed by third -party service providers on whom we rely to help us collect, host or process information.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: Our Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. Beginning in 2024, the Audit Committee receives annual updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if applicable.

companyName: Sage Therapeutics, Inc.


text: Our CFO works closely with our IT support to assess, monitor, and manage our cybersecurity risks. Our IT support regularly informs our Chief Executive Officer ("CEO") and CFO of all aspects related to cybersecurity risks and incidents. This helps ensure that the highest levels of management are kept abreast of the cybersecurity potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions, if any, are escalated to our Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: LogicMark, Inc.

ticker: LGMK


text: Management's Role Managing Risk The Company's cybersecurity risk management is part of the Company's Information Security Office, led by the Chief Information Officer. In order to manage the risks associated with cybersecurity threats, the Company has implemented an Information Security Incident Response Plan.

companyName: WEIS MARKETS INC

ticker: WMK


text: Our cybersecurity risk management process is aligned with our enterprise risk management framework and policy, which supports our efforts to identify, assess, and manage risks arising from cybersecurity threats. As part of our integrated approach to risk management, and to help safeguard the confidentiality, integrity and availability of our data and systems, we maintain a comprehensive cybersecurity program that is comprised of administrative and technical controls, cybersecurity, technology and privacy policies and procedures, management oversight, accountability structures, and technology design processes (collectively, our "Cybersecurity Program").

companyName: Oportun Financial Corp

ticker: OPRT


text: Our Board and management recognize the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees.

companyName: Cuentas Inc.

ticker: CUEN


text: The incident response team also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions or validation of files or data that may have been affected. We have also retained an outside cybersecurity firm which would assist with containment, eradication, and recovery efforts, as needed.

companyName: American Homes 4 Rent

ticker: AMH


text: We conduct regular security and awareness training for all new hires and for current employees. Employees are required to apply risk assessment processes and to professionally assess risks in the course of performing their job duties.

companyName: Sonendo, Inc.

ticker: SONX


text: The members of the Company's management that are primarily responsible for assessing and managing risks from cybersecurity threats, including monitoring risk appetite metrics and limits related to cybersecurity, include the Company's CISO, Chief Risk Officer, and Chief Information and Technology Officer.

companyName: US BANCORP \DE\

ticker: USB


text: We recognize the critical importance of maintaining the trust and confidence of our patients, employees, and business partners toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our audit committee and board of directors are involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. We have taken into account recognized frameworks established by the National Institute of Standards and Technology, or NIST, when developing cybersecurity policies, standards, processes and practices among other considerations. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Profound Medical Corp.

ticker: PROF


text: The Board of Directors (the "Board") retains ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. The Board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness, and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee receives a cybersecurity report from management. This report may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties. The scope and focus of each report are determined based on current priorities and emerging issues in cybersecurity. The Audit Committee and management also report to the Board at least annually on data protection and cybersecurity matters.

companyName: WELLTOWER INC.

ticker: WELL


text: Our CISO has served in various roles in information security, information technology and engineering operations for over 25 years. Our CISO holds an undergraduate degree in electronics and communications engineering, and he has attained a professional certification in leadership from a leading graduate school. He also maintains a Certificate Information Systems Security Professional (CISSP) certification from the International Information System Security Certification Consortium (ISC2). Our CTO holds an undergraduate degree in management and information systems, and he has served in various technology roles for over 30 years. Our CTO's prior experience includes serving as the Chief Information Officer and Chief Information Security Officer of a public company and as Chief Technology Officer of a separate public company.

companyName: Repay Holdings Corp

ticker: RPAY


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives, at a minimum, quarterly reports and presentations from our risk management function, our Vice President Information Technology (our "VP of IT") and other members of management. The Board and Audit Committee also receive prompt and timely information regarding material cybersecurity incidents as described below.

companyName: Velo3D, Inc.

ticker: VELO