text: The Audit Committee receives regular reports from management on our company's cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Board of Directors The Audit Committee of the Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Audit Committee reviews quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, any newly-identified risks, existing projects, and key performance insights and engages in discussions with management based on such reports and other recent developments.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO

secItem: Item 1C


text: Our management team, including the General Counsel and Chief Administrative Officer and Vice President, IT, is responsible for assessing and managing our material risks from cybersecurity threats. Our Vice President, IT has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our Vice President, IT, possesses over twenty-five years of experience in the IT industry. Over the past ten years, he has held the position of Senior Director of Information Technology for multiple public biotechnology companies. During his tenure at HilleVax, he has managed both internal and external teams to ensure the seamless support of the Company's IT infrastructure, cybersecurity measures, and day-to-day operations.

companyName: HilleVax, Inc.


text: Our Board exercises its oversight role through the Board's audit committee, which in the event of a cybersecurity incident or material new risk arising from a cybersecurity threat would provide the Board with reports and findings discussed with our Chief Technology Officer ("CTO") and/or our Chief Information Security Officer ("CISO").

companyName: AdTheorent Holding Company, Inc.


text: The Board has oversight of the Company's risk management process, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, legal, strategic, and other risks that may affect the Company. These risks include, among other things, risks related to cybersecurity and information security. Risk oversight plays a role in major Board decisions, and the evaluation of key risks is a core part of the decision-making process – from guidance on strategy to review of major capital expenditures.

companyName: Matson, Inc.

ticker: MATX


text: Our first line of defense is our employees. Employees receive training, at least annually, on information security. In addition, our Information Security Officer provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials.

companyName: Village Bank & Trust Financial Corp.


text: We have a written incident response plan that uses a severity classification process to identify incidents to escalate to executive management and determine whether the impact of the incident is material. We also conduct periodic trainings and tabletop exercises to enhance incident response preparedness. We are a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo initial cyber security awareness training when hired and maintenance cyber security awareness training annually.

companyName: GUESS INC

ticker: GES


text: Material Impact of Cybersecurity Threats While to date we are not aware of any material information security breaches and have not incurred significant operating expenses related to information security breaches, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the risks related to our business section for more information. Our incident response practices require incident assessments to be conducted in concert with our CEO, CFO and MSP. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: We strive to embed security into our products and services through the Cisco Secure Development Lifecycle (CSDL). The CSDL introduces security and privacy considerations throughout the lifecycle of our products and services. In addition, S&TO advises business units and functional areas on addressing cybersecurity risks and monitors initiatives to mitigate and manage such risks over time. Our business units or functional areas are responsible for managing risks and ensuring that security policies and standards are implemented within the respective business unit or function. S&TO also conducts mandatory cybersecurity training for our employees and provides employees with tools to report suspected incidents.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: Governance; Board Oversight Under the ultimate direction of our Chief Executive Officer, with oversight from our Board and Audit Committee (as described below), we maintain a security governance structure to evaluate and address cybersecurity risks. Our Chief Executive Officer regularly consults with our Chief Financial Officer and third-party IT consultants and computer security firms, leveraging and relying upon these consultants' cybersecurity expertise, to develop strategies that assess and address threats while aligning cybersecurity efforts with business objectives and operational requirements.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: We have also established a structured incident response process driven by the severity and type of issue. This process, which engages our Security Operations Center (SOC) for incident identification, our internal security team for incident analysis and assignment, our Technology Solutions teams for isolation/remediation and our third-party business partner for continuity awareness and escalations. These teams operate at the direction of our Legal Department when we identify potentially impactful information security incidents, which, among other things, directs external and internal reporting, including escalation to other functional areas within the Company and the Board of Directors. We have adopted an in-depth defense approach that includes intrusion detection systems and intrusion prevention systems, endpoint protection, endpoint detection and response and a log management platform. Additionally, to defray the costs of any future data breach, we have a cyber liability insurance policy.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: In certain limited situations we allow third party suppliers to access certain areas of our systems. In such cases third party access is strictly minimized and supervised to optimize security and control.

companyName: Airspan Networks Holdings Inc.


text: The Head of Internal Audit reports to the Chair of the Audit Committee and has thirteen years of experience with internal audit oversight and risk management. The Head of Internal Audit and the Chief Operating Officer have overall responsibility for the Company-wide risk management program.

companyName: ThredUp Inc.

ticker: TDUP


text: Our cybersecurity risk management and strategy processes discussed above, are led by our Chief Information Security Officer and Chief Technology Officer, both of whom are Certified Information Systems Security Professionals ("CISSP"). Specifically, our Chief Information Security Officer has approximately nine years of experience developing cybersecurity strategy, incident response, and implementing cybersecurity programs for public media companies and our Chief Technology Officer has approximately 15 years of experience developing cybersecurity strategy, incident response, and implementing cybersecurity programs.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from the CIO and the VP of Information Security at least twice yearly. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program, which is supported by third parties, is designed to allow us to identify, assess, and manage cybersecurity risks. Our external partners include professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and security testing firms. We have also begun an assessment process, using an external partner, to assess cybersecurity risks across our business that is informed by the Center for Internet Security Controls and have recently invested in a full-time role dedicated to assessing, developing, and maintaining our IT/Cybersecurity infrastructure. Our Senior Director IT has years of experience leading cybersecurity teams. We also provide cybersecurity trainings to our employees during onboarding and are formalizing an ongoing information security training program for active employees and relevant consultants to address matters such as phishing, email security, and training on data privacy.

companyName: Akero Therapeutics, Inc.


text: We should have a formal risk management program that addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.

companyName: Bannix Acquisition Corp.


text: We identify risks from cybersecurity threats by first developing and maintaining an understanding of those assets essential to our operation and reputation, as well as assets that could provide value to threat actors. Any cyber act is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or its value.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors ("Board of Directors") and management. Our Board of Directors delegated oversight of Cybersecurity to the Audit Committee. Members of our Board of Directors receive reports and presentations on data privacy and security, which address relevant cybersecurity issues, and which can span a wide range of topics, including but not limited to, recent developments, evolving standards, vulnerability assessments, review of risks from third parties such as service providers and suppliers, and the current threat environment. These updates are presented by IT third-party experts, finance, and legal departments. Members of our Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and updates to our cybersecurity risk management and strategy programs. Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; Reviewing our risks and cybersecurity programs and policies; Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs;

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: At the Board level, Danaher's Board of Directors has delegated to the Audit Committee of the Board responsibility for oversight of risks relating to cybersecurity, as set forth in the Committee's charter. Multiple members of Danaher's Audit Committee have prior work experience overseeing or assessing a cybersecurity function. Danaher's CISO and CIO update the Audit Committee multiple times per year regarding Danaher's cybersecurity program, including key program metrics, initiatives and developments. The Audit Committee regularly briefs the full Board on these matters. In addition, in the event of a significant cybersecurity incident, Danaher policy and process requires timely engagement of and consultation with the Audit Committee.

companyName: DANAHER CORP /DE/

ticker: DHR


text: On or about June 28, 2023, we identified a cybersecurity incident that temporarily disrupted the Company's IT network and resulted in some limited downtime for certain systems. Through investigation, we confirmed that this event was related to an apparent ransomware attack involving the unauthorized encryption of some of our files and the deployment of malware. This incident required us to temporarily implement manual processes to conduct our operations with as little disruption to production as possible. There were no payments made in this cybersecurity incident and no material impact on the operations of our business operating segments.

companyName: CHARLES & COLVARD LTD


text: The Board, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. Management provides cybersecurity updates to the Audit Committee, at least quarterly, and material cybersecurity incidents are reported to the Board.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: We maintain an incident response policy and program focused upon detecting, managing, documenting, and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we establish an Incident Response Team ("IRT") that works in conjunction with our internal crisis management team, subject matter experts, and business stakeholders to identify, contain, eradicate and, if necessary, recover from the incident. We have built into our incident response program, a review process that gives our disclosure committee real-time access to information to rapidly assess materiality. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: We have not identified cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see the Risk Factor titled "If our information technology systems suffer interruptions or failures, including as a result of cyber-attacks, our business operations could be disrupted or other material adverse impacts on our business could result."

companyName: UNIFIRST CORP

ticker: UNF


text: The Southern Company system emphasizes both security and resiliency through business assurance and incident response plans designed to identify, evaluate, and remediate incidents when they occur. A 24/7 security operations center is also utilized, which facilitates real-time situational awareness across the cyber-threat environment, and a robust insider threat protection program that leverages cross-function information sharing to assess insider threat activity is employed. The Southern Company system regularly reviews and updates its plans, policies, and technologies and conducts regular training exercises and crisis management preparedness activities to test their effectiveness. In addition, a security awareness program for the Southern Company system's employees has also been implemented, which is designed to educate and train employees at least annually, or more often as needed, about risks inherent to human interaction with information and operational technology.

companyName: SOUTHERN CO GAS


text: Depending on the environment, our risk mitigation strategies include a variety of technical, physical and operational measures designed to manage and mitigate material risks from cybersecurity threats to our systems and data. We require employees annually to complete a general security awareness training, and additional engineering and security specific training may also be required for certain positions. Further, we maintain a vendor security review program, which is designed to provide an assessment of the security practices of those third-party vendors that process Adobe non-public data or connect to our networks. We maintain an information security incident response plan designed to monitor, analyze, address, escalate and report cybersecurity incidents, and escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Security Officer ("CSO"), Chief Cybersecurity Legal and Privacy Officer ("CCPO"), Chief Financial Officer, Chief People Officer, President of Digital Media, President of Digital Experience, General Counsel and Chief Executive Officer.

companyName: ADOBE INC.

ticker: ADBE


text: Our cybersecurity program includes safeguards that are designed to protect the Company's information systems from cybersecurity threats. Such safeguards include firewalls, automated intrusion detection systems, anti-malware functionality and access controls, which are evaluated and improved through periodic vulnerability assessments and ongoing cybersecurity threat intelligence. We have established and maintain an incident response plan that addresses the Company's response to and recovery from a cybersecurity incident. The incident response plan is tested and evaluated on an annual basis.

companyName: Phreesia, Inc.

ticker: PHR


text: Our policies and procedures include the establishment of an Incident Response Team ("IRT") that consists primarily of representatives from the CWG, legal, corporate communications, finance, and other relevant stakeholders. The IRT follows the guidance as outlined in the IRP to respond to cybersecurity incidents and escalate as necessary to the CWG based on a defined severity matrix. The senior executive leadership stakeholders are responsible for assessing the materiality of risks in consultation with the IRT, CWG, and external advisors.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Additionally, effective December 9, 2022, the FTC's amendments to the GLBA's Safeguards Rule went into effect. That rule requires financial institutions to: (i) appoint a qualified individual to oversee and implement their information security programs; (ii) implement additional criteria for information security risk assessments; (iii) implement safeguards identified by assessments, including access controls, data inventory, data disposal, change management, and monitoring, among other things; (iv) implement information system monitoring in the form of either "continuous monitoring" or "periodic penetration testing;" (v) implement additional controls including training for security personnel, periodic assessment of service providers, written incident response plans, and periodic reports from the qualified individual to the board of directors. Additionally, multiple states and Congress are considering laws or regulations which could create new individual privacy rights and impose increased obligations on companies handling personal data. Risk management and strategy.

companyName: CapStar Financial Holdings, Inc.


text: Material Findings from Cybersecurity Risks The Company faces many of the same risks and has experienced similar cybersecurity incidents as other transportation providers. None of these risks or incidents to date have materially affected our business strategy, operations, or financial condition.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: While we have experienced cybersecurity incidents in the past, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, financial condition, cash flows or reputation. However, cybersecurity threats and/or incidents could have a material effect on the Company. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the cybersecurity risks we face, see "Item 1A. Risk Factors— Risks Related to Technology, Security and Intellectual Property" of this Annual Report on Form 10-K.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: Our management team, including our Chief Technology Officer and our SVP Cybersecurity and Runtime Operations, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Additional management is in place for dedicated governance, risk and compliance (GRC) team and cloud and application security team all with a daily focus on the technology risk management within 2U. These management teams have decades of experience in technology risk management.

companyName: 2U, LLC


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect us. Cyber criminals do, however, target us, Ellington and Ellington's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or Ellington's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors—We are highly dependent on Ellington's information systems and those of third-party service providers, including mortgage servicers, and system failures could significantly disrupt our business, which could materially adversely affect our business, financial condition and results of operations, and our ability to pay dividends to our shareholders." and "—Because we are highly dependent on information systems when sharing information with third party service providers, systems failures, breaches or cyber-attacks could significantly disrupt our business, which could have a material adverse effect on our results of operations and cash flows."

companyName: Ellington Credit Co

ticker: EARN


text: As chair of the Cybersecurity Steering Committee, the CISO holds regular meetings to provide strategic updates on the Company's cybersecurity infrastructure and preparedness. These meetings, supplemented by regular updates to the Board of Directors, are instrumental in aligning with the Company's strategic goals. Our Board of Directors is also provided with ongoing education including updates on relevant legislation and regularly receives reports on cybersecurity risks, threats, incidents and other trends. Several members of our Board's Audit Committee have expertise and experience in cybersecurity, and one director is the President of a major cybersecurity services provider.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: We have adopted an incident response plan to guide us in responding to cybersecurity incidents and maintain processes to inform and update executive management and the audit committee about security incidents that may pose a significant risk for our business, as applicable.

companyName: 908 Devices Inc.

ticker: MASS


text: The Board and executive team provide regular oversight of the Company's cybersecurity risk management program. The Vice President of Information Technology and Security presents to the Board and the executive team regularly with updates via business review dashboards. The Board and executive team provide guidance, including with respect to any changes to business priorities, risk tolerance, or security initiatives.

companyName: Vireo Growth Inc.

ticker: VREOF


text: Roper performs cybersecurity risk assessments to assess compliance with mandated cybersecurity controls and to assess the likelihood and impact of specific cyberattacks. Cybersecurity risk assessments are periodically performed to assess internal compliance with cybersecurity strategy and the implementation of cybersecurity controls, which would include the validation of cybersecurity control implementation through testing. Areas identified for enhancement and improvement are monitored and tracked to remediation by the Roper cybersecurity team, including the Vice President of Cybersecurity. Cybersecurity risk is also addressed in, and monitored by, the Company's enterprise risk management program.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: During the last fiscal year, 2024, the Company did not encounter any material cybersecurity incidents, nor did it incur any notable expenses as a result.

companyName: SPAR Group, Inc.

ticker: SGRP


text: To manage material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, the Trust undertakes the below-listed activities: Monitoring emerging data risks, laws, and regulations pertaining to cybersecurity; vulnerability scans of the Trust's digital infrastructure; training for employees, including regular phishing email simulations; third-party service providers to assess each vendor's cybersecurity processes prior to engaging and on an ongoing basis; access controls that restrict third-party service provider access to systems necessary to provide services;

companyName: Frontier Funds


text: Our cybersecurity risk management program utilizes a variety of frameworks, including the NIST Cybersecurity Framework and CIS Critical Security Controls, as guides to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: Enovis CORP

ticker: ENOV


text: The Company's Chief Information Officer ("CIO") and CISO work closely with other management positions, including the Chief Financial Officer, Chief Legal Officer, and the Head of Internal Audit, to evaluate cybersecurity risks in alignment with our business objectives and operational needs. The CIO oversees the Company's security team and the CISO and has participated in the NIST review and validation of security procedures and processes.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Third-party risk management efforts. In addition to the assessment, identification and management of our own cybersecurity related risks, we also consider and evaluate cybersecurity risks associated with certain third-party service providers upon which we rely for a wide variety of technical and business functions. Our efforts in this regard consist of (among other efforts): (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party service provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.

companyName: Angi Inc.

ticker: ANGI


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our internal information technology policies which are inclusive of cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Cybersecurity Committee, which is comprised of representatives from our business operations and support functions, assesses risks based on current risks we are aware of, probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Cybersecurity Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: The controls and processes employed to assess, identify, and manage material risks from cybersecurity threats are implemented and overseen by our Chief Information Officer ("CIO"). Our CIO has more than 20 years of information technology experience, including seven years specializing in cybersecurity. Our CIO is responsible for assessing the impact of cybersecurity threats and incidents, assessing whether and to what extent they can be contained and mitigated, containing and mitigating them, remediating incidents, and performing post-incident analysis and program enhancements. In the event of a significant cybersecurity incident, our CIO would engage senior management to inform them of the incident and related threats and response. We would also likely engage a third-party incident response vendor to assist us in the event of a significant cybersecurity incident. Our Chief Executive Officer directly oversees our CIO and receives information on cybersecurity risks from our CIO. Our CIO, in turn, is informed about risks from cybersecurity threats through dashboards, email alerts, reporting from the MSSP, and regular review of our systems and information technology environment.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: The strength and resilience of the Company's information systems, assets, data, and network infrastructure is critical to its business operations. The Company takes cybersecurity risk seriously and has implemented a cybersecurity risk management program that is integrated in the Company's enterprise risk management system and processes. The enterprise risk management program, which is led by our executive leadership team, includes a process that identifies, assesses, mitigates and manages the risks from both internal and external factors that could significantly impact the Company and influence our business strategy and performance.

companyName: SSR MINING INC.

ticker: SSRM


text: AutoZone's Chief Information Security Officer (CISO) reports directly to our Chief Information Officer and Senior Vice President of Information Technology. Our CISO has over 25 years' experience in IT, with almost 20 years in dedicated Information Security leadership roles. He has experience across a broad range of industries and holds credentials including the Certified Information Systems Security Professional and the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.

companyName: AUTOZONE INC

ticker: AZO


text: As one of the elements of our overall risk management program, we focus on the following key areas: • Technical Safeguards: We deploy technical safeguards, including by not limited to firewalls, anti-malware functionality and access controls. • Outside Consultants: We utilize outside consultants, including contractors and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our incident prevention, response, and documentation procedures.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: Through the date of filing this Annual Report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affect our Company, including our business strategy, results of operations, or financial condition. We have not encountered any significant incidents in the past fiscal year. However, we are aware of the ongoing threats that could, if materialized, have a significant impact on our business operations, strategies, or financial condition. Despite our rigorous cybersecurity efforts, we recognize that no system is infallible, and thus we cannot guarantee complete efficacy in preempting or mitigating all potential cyber threats. We continuously evaluate and disclose how identified cybersecurity risks, including those from past incidents, could materially influence our operational, strategic, or financial landscapes.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents discussed at committee meetings and the actions taken to the Information Technology Steering Committee on a quarterly basis (or more frequently as may be required by the Incident Response Plan). The Information Technology Steering and Audit Committees are responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Technology Officer provide quarterly reports to the Information Technology Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee and Audit Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full board of directors at least quarterly.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: As discussed above, these members of management report to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Our Vice President, Information Technology, who reports directly to our Senior Vice President, Operations, has over 25 years of experience managing information technology and cybersecurity matters and is certified as Certified Information Systems Security Professional. Together with our Senior Vice President, Operations and the other members of our senior leadership team, our Vice President, Information Technology is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third-party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Spyre Therapeutics, Inc.

ticker: SYRE


text: 1.External Expertise: We recognize the value of external expertise in assessing and enhancing our cybersecurity posture. To complement the internal capabilities of our Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO") and their team of professionals, we engage assessors, consultants, auditors, and other third-party experts with specialized knowledge in cybersecurity. These external stakeholders conduct independent assessments, penetration testing, vulnerability scans, and audits to evaluate the effectiveness of our cybersecurity controls and identify areas for improvement.

companyName: NewtekOne, Inc.

ticker: NEWT


text: The Company's risk management framework includes its risk appetite statement, which is approved annually by the Board's Risk Management Committee and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company's risk appetite using a quantitative risk scorecard, which consists of risk appetite metrics and associated limits reported to the Board's Risk Management Committee on a quarterly basis. The Company's risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committee (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board's Risk Management Committee oversees the Company's risk profile relative to its risk appetite and compliance with risk limits.

companyName: US BANCORP \DE\

ticker: USB


text: Audit Committee of the Board of Directors (the "Audit Committee") oversees our management of enterprise risks, including cybersecurity risks. Members of the management team, including our IT director and General Counsel, brief the Audit Committee on the effectiveness of risk management efforts on at least a semi-annual basis. In addition, these risks are reviewed by the Board of Directors at least annually.

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: Our CSO and the Risk Steering Committee ("RSC") oversees our enterprise risk management process. Under the direction and supervision of our CSO, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. The Board of Directors receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks, and an analysis of cybersecurity threats and incidents across the industry. The CSO and RSC review the results of the enterprise risk assessment in detail with management on a regular basis and reports its findings, as needed, to the Board of Directors.

companyName: HARTE HANKS INC

ticker: HHS


text: We use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. We maintain processes designed to reduce the impact of a cybersecurity attack or other compromise at a third-party vendor.

companyName: GameStop Corp.

ticker: GME


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including product and SaaS security. These measures vary depending on the environment and threat. For example, we monitor our information systems, networks, and devices for potential threats, utilizing multiple mechanisms. We maintain Network Security Operations (NSO) and Site Reliability Engineering (SRE) teams to respond to potential threats or anomalies. We update vendor-provided tools (e.g. data management systems, financial reporting systems and infrastructure systems) in an effort to address identified vulnerabilities or threat vectors arising through vendor-provided products and services. We have adopted policies and standards aimed at implementing product security, including: conducting third-party penetration testing of our SaaS solutions; developing code based on a Security Software Development Lifecycle (SSDLC) process; and using automated tools for static code analysis and open-source scanning.

companyName: Life360, Inc.

ticker: LIF


text: We seek to provide a secure working environment by establishing and maintaining effective security measures to protect the Company's employees, properties, technology and our customers' assets from potential threats, including cybersecurity threats. Accordingly, we have implemented numerous controls, technologies and processes and have integrated operational measures into our overall risk management system to assess, identify and manage material risks from internal and external cybersecurity threats.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: We have an established policy on information security, as well as overall corporate information, workforce and workplace standards policies. These are collectively designed to establish auditable procedures for information security oversight by management, including: 1) identification of different types and forms of information, 2) guidelines for acceptable use and dissemination of information, 3) handling use and destruction of information, 4) personnel and physical site security, 5) incident reporting and response, 6) recovery plans, and 7) standards for web-based applications, communications and mobile devices. Three levels of security procedures have been identified as relating to the sensitivity of the information we manage in connection with different operations. Our policies call for the individuals assigned to these procedures to review and certify them annually and to recommend changes where appropriate. All breaches are required to be reported to senior management and the Board, together with a report on response and recovery, as well as recommendations to address further challenges.

companyName: Rekor Systems, Inc.

ticker: REKR


text: We have certain processes in place to assess, identify and manage material cybersecurity risks. We also periodically monitor and test our information systems for potential vulnerabilities. We use various tools designed to help identify, investigate and resolve cybersecurity incidents, and to help recover from them in a timely manner. These processes, policies and tools comprise our cybersecurity risk program and are integrated into our overall risk management program.

companyName: Contineum Therapeutics, Inc.

ticker: CTNM


text: Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal information security program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: a.we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO);

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats are conducted in-house, with the help of analytics and notifications that are built-in to our third-party tools. These processes include: Providing employees with tools and training to minimize and report cybersecurity risks; databases and tools for unusual activity or suspicious login attempts; managing, and safely disposing of physical hardware; and to any identified threats and reporting these situations to management.

companyName: PCS Edventures!, Inc.

ticker: PCSV


text: Given the size of our company and the nature of our operations, we do not believe that we face significant cybersecurity risk. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We utilize standard commercial software for business operations, which includes basic security features such as password protection and data encryption. Our management is generally responsible for assessing and managing any cybersecurity threats.

companyName: African Agriculture Holdings Inc.


text: Cybersecurity is an important part of our risk management processes and is an area of focus for our board of directors and management. Our board of directors, as a whole, has oversight responsibility for our strategic and operational risks, and ensures that appropriate risk mitigation strategies are implemented by management. Our audit committee assists the board of directors with this responsibility by periodically reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of our management team, which is responsible for the assessment and management of cybersecurity risks.

companyName: STAR OPERATING COMPANIES, INC.


text: The Audit and Risk Committee of the board of directors is responsible for oversight of the Company's processes and policies for enterprise risk identification, management, and assessment, including key risks around data privacy, technology, and information security. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology Officer (CTO), Leigh Gower, who has more than 20 years of experience in the information technology field, including work in cybersecurity risk management. Prior to serving the Company, our CTO gained cybersecurity experience serving as Vice President, Technology at Blue Nile, as Senior Director, Product & Technology at T-Mobile, and as Management Consultant at Slalom Consulting.

companyName: Dutch Bros Inc.

ticker: BROS


text: We are increasingly dependent upon information technology systems, infrastructure and data to operate our business. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. In the ordinary course of business, we collect, store and transmit confidential information (including but not limited to intellectual property, proprietary business information and personal information). It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Prelude Therapeutics Inc

ticker: PRLD


text: As part of our incident detection and response process, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within Equifax (including the CISO and the CEO) and to the Board of Directors based on incident severity. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our CISO, our Chief Financial Officer and our Chief Legal Officer.

companyName: EQUIFAX INC

ticker: EFX


text: assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader and third-party security tools to monitor our systems, identify cybersecurity risks, and test our IT environment. use of third-party cybersecurity experts, where appropriate, to assess, test or otherwise assist with aspects of our security processes. cybersecurity incident response plan and business continuity plan. training for employees and key business partners with access to our systems. third-party cybersecurity risk management process for service providers and vendors who access our systems.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Cybersecurity Risk Management and Strategy GitLab's cybersecurity program was designed in alignment with industry standards and recognized best practices to identify, assess, and manage material risks from cybersecurity threats. Our cybersecurity program is led by our Chief Information Security Officer, who has over 25 years of experience working at SaaS and technology companies, and consists of over 120 security practitioners located around the world. Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, and financial impact. Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management including integration into our enterprise risk management program, led by Internal Audit. We also make judgments based on current data, assumptions about the risk, the company's risk tolerance, impact to confidentiality, integrity, and availability, and reasonable analysis of costs associated with mitigating or reducing the severity of the risk. Our global incident response team iteratively evaluates security events for impact, using both qualitative and quantitative factors. Security incidents that are assessed as potentially material are escalated to designated members of our management and board of directors, as applicable. Our global incident response team performs at-least annual tabletop exercises of our incident processes, including material breach, disaster recovery, and business continuity scenarios.

companyName: Gitlab Inc.

ticker: GTLB


text: We have previously engaged, and may engage in the future, with third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, vulnerability assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: We maintain a robust information security program that is designed to protect our information and the information of our customers. Our information security program is based on a recognized cybersecurity framework established by the National Institute of Standards and Technology ("NIST") and establishes controls to mitigate critical areas of cybersecurity risk. Our information security program has adopted all elements of the NIST cybersecurity framework, including the six functions of identify, protect, detect, respond, recover and govern, as well as each of the categories and control groups thereunder. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST framework as a guide to ensure our information security program is designed to manage cybersecurity risks relevant to our business. Among other things, the cybersecurity controls in our information security program address information access rights, incident monitoring and response processes, information technology system configuration, network security, security architecture planning, mobile device security and compliance with information security policy requirements and protocols. These cybersecurity controls are designed to oversee, identify and mitigate risks from all cybersecurity threats, including those arising from our use of third-party service providers. Our cybersecurity controls are evaluated regularly by our internal information security team and we engage a third party examiner to assess the maturity of our information security program against the NIST cybersecurity framework no less frequently than bi-annually. Additionally, our information security program is assessed periodically by a federal regulator in the United States as part of its routine audit of the Company. In addition to our internal assessments, we also assess our third-party service providers on a regular basis using a risk-based approach that assigns a risk calculation to each such service provider. Results of our assessments are tracked and evaluated to ensure these third parties comply with our cybersecurity standards.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: Oversight and Governance Our Chief Information Security Officer ("CISO"), assisted by our Information Security team, has primary responsibility for assessing and managing the Program and reporting on cybersecurity matters to the Company's Board of Directors and members of executive management. Our CISO has extensive experience managing information technology systems and information security systems, previously served as the Company's Chief Information Officer, and holds the Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM") certifications. Our CISO regularly updates members of executive management on developments surrounding cybersecurity. The CISO reports to the Risk Committee of the Board of Directors and provides regular reports to the Board of Directors and Risk Committee on emerging cybersecurity issues and the Company's cybersecurity infrastructure.

companyName: BROOKLINE BANCORP INC


text: The VP of Integration and IT Operations regularly updates the Audit Committee on cybersecurity-related risks. Our incident response plan involves informing the Management Team and then the Board of Directors about any substantial threats or incidents that occur.

companyName: Lowell Farms Inc.

ticker: LOWLF


text: Cyber advisors are a key part of Synovus' cybersecurity infrastructure, and we partner with leading cybersecurity companies and organizations to leverage third-party technology and expertise as appropriate. We engage and retain independent third-parties to review and assess our information security program on a regular basis and to perform annual penetration tests against our network. We maintain computer forensics, legal, and security firms on retainer in case of a cyber security incident. In addition, we are members of financial sector organizations, including the Financial Services Information Sharing and Analysis Center (FS-ISAC), which facilitates the sharing of cyber and physical threat, vulnerability, and incident information for the good of the membership and for improvement in industry best practices. We also perform comprehensive cybersecurity due diligence and ongoing oversight of third-party relationships, including vendors, and require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: Key's Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity & Access Management Operations, Information Security Governance and Data Protection, and Security Architecture, Engineering and Platform Operations. The Deputy CISO has over 17 years of cybersecurity and technology risk management experience across financial services and retail, previously served as the Head of Information Security Governance within KeyCorp's Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp's Risk Management group. He holds a bachelor's degree in Finance and Management Information Systems and an MBA.

companyName: KEYCORP /NEW/

ticker: KEY


text: The Company does not currently have formal processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our approach to cybersecurity is currently informal and primarily reactive, involving basic security measures such as: Basic Security Software: We use standard antivirus and anti-malware software for protection against common threats. Password Policies: Simple password policies are in place to protect access to our systems.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: The Company also has a Risk Committee composed of the following members of the Company's management: • Executive Vice President of Business Services & General Counsel • President, Nucor Business Technology • Vice President and Corporate Controller • Vice President and General Manager, Corporate Legal Affairs • General Manager of Internal Audit • Cybersecurity Director • Director of Legal Compliance and Assistant Corporate Secretary • Manager of External Reporting The Risk Committee is responsible for overseeing the Company's response to cybersecurity incidents. The Risk Committee and the Chair, President, and Chief Executive Officer inform the Audit Committee and the Board of Directors on cybersecurity risks.

companyName: NUCOR CORP

ticker: NUE


text: Securing company systems, business information, and personal information of our guests, team members, vendors, and other third parties is important to us. We have systems in place to: • safely receive, protect, and store that information; • collect, use, and share that information appropriately; and • detect, contain, and respond to information security, cybersecurity, and data privacy incidents.

companyName: TARGET CORP

ticker: TGT


text: For a discussion of our risks related to cybersecurity, see the section titled, "Item 1A. Risk Factors – Risks Related to our Operations – Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation. "

companyName: Quanterix Corp

ticker: QTRX


text: We have a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats. The Company's cybersecurity program includes administrative, technical and physical safeguards that address our information systems, including our IT and operational technology environments. The program is designed to ensure the confidentiality, security, integrity and availability of those systems and the information residing therein.

companyName: Valaris Ltd

ticker: VAL


text: MDB Holdings and its subsidiaries including Public Ventures, our regulated broker-dealer, we have implemented a comprehensive cybersecurity program aimed at identifying, monitoring, and mitigating cybersecurity risks to the best of our ability. Our security program encompasses information security responsibilities, incident response, and is diligently managed by our information technology department. Cybersecurity is integrated into our overall risk management framework, with consultation from subject matter experts to assess and address potential cyber risks and their impacts.

companyName: MDB Capital Holdings, LLC

ticker: MDBH


text: Monitor Cybersecurity Incidents The Senior Director of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Under his direction, the IT department implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the IT department is equipped with a well-defined written procedure. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: Third-Party Service Providers We work with third parties that help us identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Oversight for cybersecurity risk lies with the Audit Committee. Periodically the Audit Committee will work with our IT management to provide a full update to the board on continuous improvements made to our monitoring and preventative activities, as well as information on those monitoring activities itself such as attempts of unauthorized access to systems.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Our chief information officer meets with the Audit Committee each quarter to review our information technology systems and discuss key cybersecurity risks. In addition, at least annually, the chief financial officer reviews with the board of directors our global enterprise risk management program, which includes cybersecurity risks.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: We have an employee security awareness training program, offered upon employee onboarding and on an annual basis, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.

companyName: Disc Medicine, Inc.

ticker: IRON


text: Each employee and contractor is responsible for the security and confidentiality of company and client information. This expectation is communicated at onboarding and through required annual data security and privacy trainings; frequent internal publications; and annual employee attestations to the Company's Standards of Conduct. BOK Financial regularly conducts risk assessments to evaluate internal controls implemented to prevent and detect data breaches. These controls are aligned with ISO 27001:2013 and the NIST Cybersecurity Framework Version 2.0 and are frequently monitored to ensure their effectiveness. The controls are routinely tested via tabletop exercises and reviewed by internal auditors.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: The Company's Director of IT is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying cybersecurity threats and incidents and managing the material risks associated with the cybersecurity threats. The Company's Director of IT engages third-party vendors and cybersecurity consortiums periodically for cybersecurity-related guidance and certifications. In the event of a cybersecurity incident, the Company's process calls for the Director of IT and Chief Financial Officer, to work to assess and respond to the incident and provide briefings to the Chief Executive Officer and the Audit Committee of the Board of Directors.

companyName: US ENERGY CORP

ticker: USEG


text: Once a cybersecurity incident is contained the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, and increased network monitoring or logging to identify recurring attacks.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Incidence Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans intended to fully and timely address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Our Director of Enterprise Applications leads a dedicated management committee responsible for overseeing cybersecurity matters. The Information Security committee contributes decades of experience in technology, cybersecurity, architecture, and incident response in both military and private sector with certifications including Certified Information Systems Security Professional ("CISSP"), Certified Ethical Hacker ("CEH"), CompTIA Secure Infrastructure Specialist ("CSIS"), and degrees in cybersecurity, data science, and computer science. Collectively, this team has served in various large, publicly traded companies, implementing and managing robust IT and cybersecurity programs, developing tools, and safeguarding internal networks, business applications, customer-facing applications, and payment systems. This committee consists of members with diverse expertise, including information technology, legal, risk management and finance, who collaborate to provide strategic guidance, evaluate potential risks and ensure the adequacy of our cybersecurity measures. The committee regularly provides updates to senior leadership and the Audit Committee, as well as the full Board, which includes information regarding our cybersecurity program initiatives, program performance, and the reporting provided by third-party service providers.

companyName: AZZ INC

ticker: AZZ


text: Our IRP describes the circumstances that require internal and external notifications of cybersecurity incidents that (i) relate to any of our computer systems or networks and compromise the confidentiality, integrity, or availability of the systems or networks, (ii) compromise the confidentiality, integrity, or availability of any sensitive data that belongs to us or a third party and is in our care or custody, or (iii) involve one or more third parties with whom we share sensitive data. It describes the (i) involvement of the SVP of Enterprise Strategy and Execution, (ii) escalation process of such incidents to senior management, including the General Counsel, CIO, Chief Financial Officer, CRO, and Chief Executive Officer, (iii) reporting process to the Risk Committee and Board, and (iv) the notification and disclosure process to customers, distribution partners, regulators, and the SEC. The IRP also provides guidance on how to evaluate potential cyber events and suspicious cyber occurrences. We engage outside legal counsel and technical experts to regularly review the IRP and use internal teams and outside advisors with specialized skills to support the response and recovery efforts of proprietary and confidential information.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: Cybersecurity is a critical component of our risk management program; thus we have implemented a Cyber and Information Security Program to protect the confidentiality, integrity and availability of our information and information technology environment. Our program aligns with applicable federal and state regulations, industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC") and best practices from the National Institute of Standards and Technology ("NIST"). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity and availability of sensitive information. NIST is part of the U.S. Department of Commerce, which develops cybersecurity standards, guidelines and other resources.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: We have taken a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, senior management and the IT Steering Committee (a task force comprised of senior representatives from all functional areas of the bank) devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology (IT) security team reviews enterprise risk management-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the IT Steering Committee's framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management. We have designed our enterprise-wide information security programs consistent with industry standards using the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Meridian Corp

ticker: MRBK


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. Our enterprise-wide information security program is designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity threats and develop related security controls and safeguards. We conduct regular periodic reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing internally and with external independent third-parties, threat modeling, simulations, and other exercises in an effort to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: Bandwidth Inc.

ticker: BAND


text: Our Board of Directors oversees the management of our cybersecurity risk exposures and the steps management has taken to monitor and control such exposures. At each quarterly meeting, the Board of Directors receives an update from our CFO and other members of management on relevant topics, including cybersecurity program maturity progress, new capabilities implemented, penetration testing results, key cyber risk metrics (e.g., simulated phishing testing and vulnerability management) and notable incidents or events should they occur. On an annual basis, our Board of Directors meets with our CFO and our third-party cybersecurity consultant to review our cybersecurity strategy and the results of our NIST CSF assessment. In accordance with our cybersecurity incident response plan, our Board of Directors is promptly informed of potentially material cybersecurity incidents, including with respect to our third-party service providers.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Certain members of our management team, including the Head of Risk Management and our General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. These individuals have primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Safehold Inc.

ticker: SAFE


text: Cybersecurity for U.S. Government Authorized Systems Our information technology systems used in connection with programs for the U.S. government align with the NIST standard and meet the requirements of 32 CFR Part 117 (National Industrial Security Program Operating Manual or "NISPOM") and other applicable U.S. government guidance. The program includes authorizations and assessments of new and existing IT systems by our customers. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition, as of the fiscal year ended December 31, 2024. Our Risk Factors include further detail about our material cybersecurity risks.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities; • Third-Party Risk Management – regular evaluation and monitoring of our network of external partners, vendors, suppliers and service providers, which includes monitoring of third parties, securing vendor remote access, and implementation of protections against cyber threats that may arise through business-to-business system integrations; • Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls; • Incident Response Plan - a cybersecurity incident response plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; • Assessments – annual cybersecurity assessments, administered by a third-party specialist, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks; • Training - security awareness training for all salaried personnel that highlights critical organizational risks through monthly phishing simulation campaigns, "lunch and learns," and annual cybersecurity learning modules; • Insurance - cybersecurity insurance policies and periodic reviews of our policies and coverage levels; and • Monitoring Legal/Regulatory Developments - review of emerging data protection, data privacy, and other relevant cybersecurity laws and regulations to determine appropriate changes to cybersecurity controls and processes.

companyName: CULP INC

ticker: CULP


text: Cybersecurity incidents are communicated to the Company's senior management, including the CEO and CFO, who direct the Company's response with the assistance of third-party specialists. Management notifies the Audit Committee of any cybersecurity incidents, including the nature of the incident, the Company's remediation actions and any required improvements and changes to systems and processes.

companyName: CAMBER ENERGY, INC.

ticker: CEIN


text: Our Board is actively engaged in the oversight of the Company's cybersecurity, information security, data protection, and technology programs ("cybersecurity"). The Audit Committee of the Board, acting through its written charter, serves as the principal agent of the Board in fulfilling its oversight and review of the Company's policies and procedures with respect to cybersecurity risk assessment and risk management. The Company's Chief Information Officer (CIO) leads the Company's cybersecurity risk assessment and risk management program. Our CIO, with over 25 years of experience leading cybersecurity oversight, brings a wealth of expertise and in-depth knowledge that is instrumental in developing and executing our cybersecurity program.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: We have also implemented the following protective and preventative measures: • identity management and access control safeguards; • encryption of data in transit and at rest; • system and network security and monitoring; • information protection and governance; and, • ongoing systems and equipment maintenance.

companyName: Texas Pacific Land Corp

ticker: TPL


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating training programs for our entire workforce. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. • Proactive Reporting and Investigation: As part of our training initiatives, we educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.

companyName: Village Farms International, Inc.

ticker: VFF


text: Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, impacting our competitive position in the market.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: Our Cybersecurity Risk Committee is led by our CISO and our Director of Cyber Security and Compliance. These two individuals have decades of experience in designing, implementing, and managing cyber security risk programs. They are experts in the assessment, identification, and management of cybersecurity risk. Our Cybersecurity Risk Committee members receive updates about our security from our information technology and security teams, stay abreast of industry trends and regulations, and regularly inform management of various cybersecurity risks, trends, threats, and countermeasure techniques.

companyName: Urgent.ly Inc.

ticker: ULY


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: QMIS TBS Capital Group Corp.


text: Our current VP, IT Data Security, has led our Data Security Department for nine years and holds more than seventeen years of experience in cybersecurity, including security operations, cloud security, and risk management. He has extensive experience with enterprise information security controls and frameworks, such as ISO 27001, PCI DSS, SOC 2 Type II, and HITRUST. Additionally, he holds multiple certifications, including CIISSP (Certified Information Systems Security Professional), CISA (Certified Information Security Auditor), and CISM (Certified Information Security Manager).

companyName: IBEX Ltd

ticker: IBEX


text: Vroom's Chief Technology Officer reports to the Committee on a quarterly basis on our cybersecurity risks. In addition, the Chief Technology Officer updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee periodically reports to the full Board regarding its activities, including those related to cybersecurity. Committee members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.

companyName: Vroom, Inc.

ticker: VRM


text: Overall Process and Governance We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program. This provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. We engage third party experts as well as our internal information technology ("IT") audit group to audit our information security programs, and the results are reported to our executive management and the Audit Committee.

companyName: TEAM INC

ticker: TISI


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances and designated risk level, including the Chief Financial Officer, Chief Executive Officer and/or full Executive Leadership Team, who participates in our disclosure controls and procedures. The Head of IT and Chief Operating Officer work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Equillium, Inc.

ticker: EQ


text: We periodically review, test and assess our cybersecurity systems, using both internal resources and third-party service providers with cybersecurity expertise. We periodically (at least once per year) review and test our incident response plan through simulations and assessments.

companyName: California BanCorp


text: We recognize the significance of these threats, sometimes referred to as hacking, cybersecurity fraud, and cyberattacks, and maintains processes and procedures to protect its critical systems and sensitive information from unauthorized access. Despite our on-going efforts to improve our cybersecurity infrastructure and processed, there can be no assurance that a sophisticated cyber-attack would timely be detected or thwarted. To date, we are not aware of any material information security breaches and has not incurred significant operating expenses related to information security breaches. For more information on risks related to cybersecurity, please see the section titled "Risk Factors" included under Item 1A of this Annual Report on Form 10-K.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: The third line of defense is independent Internal Audit, led by our Head of Internal Audit, who is responsible for ensuring that the first and second line of defenses are both designed and operationally effective in mitigating cybersecurity risk through internal audits of including but not limited to: cybersecurity, electronic banking, GLBA/Privacy, information security, information technology, and vendor risk management. The Head of Internal Audit is independent of management and reports to the Board Audit Committee Chair.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Our cybersecurity risk management program includes common methodologies, reporting channels and governance processes that apply across the enterprise to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Arteris, Inc.

ticker: AIP


text: In response to an identified cybersecurity incident, a group comprised of appropriate management personnel, our third-party IT service provider and, depending on the scope and severity of the incident, additional third-party subject matters experts, will be assembled to develop and implement a response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. This group will also report any such cybersecurity incident to the Audit Committee of the Board.

companyName: CervoMed Inc.

ticker: CRVO


text: Our board of directors provides oversight and oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Two of our management have received training on cyber risk governance for public companies, regularly brief our board of directors on our cybersecurity and information security posture as well as cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the board's involvement in cybersecurity governance ensures that we are adequately focused on resources and protecting the Company's assets and reputation. Governance and Strategy: Management and the board ensure that our cybersecurity strategy is aligned with our business strategy.


text: In addition, our CISO oversees teams across the company supporting our security and privacy functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO reports directly to our Chief Executive Officer and is a member of the company's senior management team, and is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Additionally, our CISO and Chief Compliance Officer regularly update our senior leadership team, our Nominating and Corporate Governance Committee, and the full Board, on the company's privacy and cybersecurity program, including privacy and cybersecurity risks, incidents, and mitigation strategies.

companyName: AvePoint, Inc.

ticker: AVPT


text: In response to ever-changing cybersecurity threats, TEP maintains a comprehensive cybersecurity risk management program for its operations, information systems, data, and critical infrastructure. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected TEP, including its business strategy, results of operations, or financial condition. See Part I, Item 1A Risk Factors of this Form 10-K for a discussion of cybersecurity threats that could have a material impact on TEP, which should be read in conjunction with this Item 1C for a detailed description of the risks related to cybersecurity.

companyName: TUCSON ELECTRIC POWER CO


text: Threat Disclosure date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, " Risk Factors."

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: The CISO partners with the Company's Risk Department to promote alignment of cybersecurity risk management strategy with the broader risk management strategy for the organization. The integration of information security into the overall enterprise risk management framework enables collaboration on the identification, assessment, mitigation and monitoring of cybersecurity risks that have the potential to materially impact the operation of the Company.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: Additionally, we utilize third party vendors and service providers for legal, accounting, executive management services, web hosting and maintenance and other activities. We believe that our third-party vendors and service providers have their own respective cybersecurity protocols which our management believes to be adequate for protecting any of the Company's data that might be in their possession from time to time.

companyName: Polomar Health Services, Inc.

ticker: PMHS


text: To implement our cybersecurity risk management strategy, we maintain comprehensive processes and safeguards to secure the data we hold and to assess, identify and manage material risks from cybersecurity threats, including: • encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system; • regularly assessing product features for security vulnerabilities; • periodically conducting internal penetration tests; and • providing our customers with multi-factor authentication options to help them effectively protect their information.

companyName: APPFOLIO INC

ticker: APPF


text: Risk Management and Strategy and Governance We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Cybersecurity and risks related to our IT are an important focus of our board of directors' risk oversight. Our board of directors, with assistance from its audit committee, oversees our cybersecurity risk assessment and response program. The audit committee receives reports at least quarterly from executive management, including our Vice President of IT, on the identification and status of cybersecurity incidents, resolution, recovery and post incident management.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: a cybersecurity incident response plan and Security Operations Center ("SOC") to respond to cybersecurity incidents; and a third-party risk management process for service providers.

companyName: SIMON PROPERTY GROUP L P


text: Horizon's senior management briefs the Cyber Security Committee at each Cyber Security Committee meeting (see below for detailed discussion). In 2024, Horizon's information technology/cyber security program was audited by RSM and internal audit. The Cyber Security Committee Charter is posted on Horizon's website at www.horizonbank.com in the section headed "About Us – Investor Relations – Corporate Information" under the caption "Corporate Governance."

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: Engage Third parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Via Renewables, Inc. engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.

companyName: Via Renewables, Inc.

ticker: VIASP


text: We have not identified any material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.

companyName: NOVANTA INC

ticker: NOVT


text: Our chief technical officer, Timothy Scahill, is responsible for our cybersecurity protection. Mr. Scahill is an ISC2 Certified Information System Security Professional.

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC


text: As part of the CSIRP, PSE maintains a standalone team of IT security and risk management professionals in the Cyber Defense Center (CDC). The CDC is responsible for implementing the CSIRP, including the identification and ongoing monitoring and response to all cyber events and risks, including risks associated with the Company's use of third-party service providers, which impact the Company. To identify, defend, detect and respond to cyber events, PSE performs various on-going activities, such as, proactive privacy and cybersecurity reviews of systems and applications, monitoring threat intelligence information feeds, penetration testing to test security controls, conducting employee trainings, and monitoring emerging laws and regulations related to data protection and information security. Additionally, the Company conducts tabletop exercises to simulate our response to cybersecurity incidents. Depending on the nature of the incident, PSE may engage consultants, assessors, or other third-parties to assist in the assessment, testing, remediation, and/or management of cyber incidents.

companyName: PUGET ENERGY INC /WA


text: We employ an array of data security technologies, processes, and methods across our infrastructure to protect systems and sensitive information from unauthorized access. OneMedNet maintains comprehensive identity and access management practices ( e.g., roles and access privileges for each user; multi-factor authentication, privileged user accounts, single sign-on, user lifecycle management) and employs a variety of security information and event management tools. We developed, maintained and utilized a global integrated information security framework to guide our practices, based on relevant industry frameworks and laws, including, but not limited to NIST, GxP, HITRUST, the ISO 27000 family, COBIT, GDPR, and HIPAA.

companyName: OneMedNet Corp

ticker: ONMD


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2023, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: Our cybersecurity program includes monitoring for potential security threats that may lead to vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage incident response teams based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and/or the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident response process is also designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis.

companyName: RTX Corp

ticker: RTX


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements.

companyName: GPB Automotive Portfolio, LP


text: We utilize certain third-party service providers to perform a variety of functions, such as outsourcing certain business critical functions, augmenting staff for after-hours support, help tracking chain of custody for physical PCI devices for our shops, providing applications, hosting our systems, distributing our products, property management, providing cloud-based infrastructure, data center facilities, encryption and authentication technology, supporting corporate productivity services, and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, for certain service providers, our vendor management process includes reviewing the cybersecurity practices of certain providers, contractually imposing obligations on certain providers related to the services they provide and/or the information they process, conducting security vulnerability assessments, requiring providers to complete written questionnaires regarding their services and data handling practices, conducting periodic re-assessments during their engagement, using a third party vendor management security company to provide certain ongoing monitoring, or annually collecting certain information security-related compliance documentation and reports.

companyName: Dutch Bros Inc.

ticker: BROS