text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process— Our business and operations, or those of our CROs or other third parties, may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity, which could materially affect our business, results of operations and financial condition.".

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Dakota Gold Corp.

ticker: DC

secItem: Item 1C


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee. Our CFO, who oversees the information technology department as led by our Director of Information Technology, provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.

companyName: GrowGeneration Corp.

ticker: GRWG


text: The Compliance Committee is responsible for identifying, monitoring and mitigating compliance risks, including cybersecurity, and is comprised of the Chief Compliance Officer & General Counsel, CEO, CFO, Chief Technology Officer, Chief Business Officer, Chief People Officer, Vice President of Information Technology ("VP IT"), Corporate Controller and Senior Director, Internal Audit. The Compliance Committee meets regularly during the year and receives periodic updates on cybersecurity risks from the VP IT. The Compliance Committee is responsible for assessing the materiality of cybersecurity incidents based on quantitative and qualitative materiality factors, and for providing recommendations on public disclosures of cybersecurity incidents to the Audit Committee if an incident is identified to be possibly material. The Compliance Committee also provides input and consideration into internal controls surrounding cybersecurity along with reviewing cybersecurity risks, mitigation strategies, ensuring the cybersecurity strategy is in alignment with business objectives and is incorporated into the overall risk management processes.

companyName: Astra Space, Inc.


text: Cybersecurity is an integral part of our risk management program and is an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates, as warranted, including quarterly updates from our Chief Information Security Officer ("CISO") regarding matters of cybersecurity, such as key risks facing the healthcare industry and our company, core topics, review of incidents, as well as progress against key information security initiatives. Senior executive leadership also engage in ad-hoc discussions with management on cybersecurity topics. In addition, our Board of Directors are provided with an annual report regarding cybersecurity information and related topics.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: Like other global companies, we face various cybersecurity threats that could have a material adverse effect on our business strategy, results of operations or financial condition. Cybersecurity, therefore, is an important element of our business and our overall enterprise risk management program, and while we have experienced a small number of cyber incidents over the last few years, none to date have been material or had a material adverse effect on our business or financial condition. To mitigate the risk, we have established a multilayered approach to assessing, identifying and managing material risks from cybersecurity threats, which includes the following:

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: The Enterprise Security team utilizes third-party consultants to regularly conduct a review of the Registrants' cybersecurity program that includes assessing their (i) ability to detect and respond to malicious behavior, (ii) configuration of security tools and (iii) security roadmap, training and staffing plans. The Enterprise Security team also utilizes multiple sources of threat intelligence information from real time feeds that come from government, industry and private sources to help stay abreast of emerging threats that could impact the Registrants.

companyName: OGE ENERGY CORP.

ticker: OGE


text: As noted above, management of Ashland's cybersecurity risks is part of the Company's overall ERM program, which is overseen by the Board. The Board's Audit Committee has primary responsibility for the oversight of the Company's information and cybersecurity risks and programs established to manage such risks. The Audit Committee fulfills this oversight responsibility through receiving regular (and as needed) reports and updates from the Company's Vice President of Cyber Security and Ashland's Board also receives periodic reports updates from the Vice President of Cyber Security and the Audit Committee regarding information and cybersecurity matters.

companyName: ASHLAND INC.

ticker: ASH


text: Procedures for Information Security Risk Management and Information Security Risk Management Methodology based on the ISO 27005 Information security, cybersecurity and privacy protection standard and Control Objectives for Information and Related Technology ("COBIT"), which establishes criteria to identify, analyze, evaluate, treat and accept risks to the Company's technology infrastructure, including cybersecurity risks.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: The Company's cybersecurity policies and procedures are fully integrated into its broader risk management framework, reflecting a holistic approach to cybersecurity risk management. Regular cybersecurity risk assessments are conducted to identify potential threats and vulnerabilities, with detailed mitigation strategies developed and implemented accordingly.

companyName: T Stamp Inc

ticker: IDAI


text: Our cybersecurity risk management processes include a cybersecurity incident response plan, and we have invested in technical and organizational safeguards intended to manage and mitigate material risks from cybersecurity threats to our IT Systems, including network security controls, employee training, internal vetting of third-party vendors and service providers with whom we may share data, and regular system reviews and security exercises. Our cybersecurity risk management program is a component of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: SKYWEST INC

ticker: SKYW


text: In fiscal 2024 the Audit Committee received reports on our cybersecurity risk management initiatives. In addition, our management team updates the Board with respect to the Company's overall cybersecurity risk posture and initiatives in order to improve our cybersecurity risk controls. As necessary, the Audit Committee will oversee management's responses to any significant cybersecurity incidents including any disclosures required by law. The full Board also receives a briefing from management on our cyber risk management program at least annually.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: We have adopted a cybersecurity incident reporting process ("IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management, the Board and other key stakeholders informed and involved as appropriate.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: The Fund relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Fund. The Fund relies on the Adviser's risk management program and processes, which include cyber risk assessments.

companyName: Stone Point Credit Income Fund


text: Our cybersecurity team has also established company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, the Company utilizes a well-defined incident response plan that is designed to coordinate the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact of the incident, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Our information security program is principally managed by our information security team, which is led by our Information Security Officer. Our Information Security Officer reports to our Vice President of Information Services, who has extensive experience with information technology governance, data management, and systems management, including managing information security and data privacy law compliance at large multinational companies. Our information security team includes professionals with deep professional experience and cybersecurity expertise, including our Information Security Officer. Such expertise includes applicable security and technology degrees and certifications held by information security team members, including degrees in computer science, cybersecurity, and systems engineering and management and security certifications such as COMP TIA Security+, COMP TIA Data+, and GIAC Security Essentials. We also augment our internal cybersecurity expertise by engaging security service organizations which provide 24x7 security operations centers.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Our cybersecurity program and controls are designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risks are incorporated into the Company's broader Enterprise Risk Management process to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. As part of the cybersecurity program, our information systems are monitored by automated tools and the Information Security team. The Company's Security Incident Management Process outlines the procedures the Company believes are necessary to prepare for, identify, contain, eradicate, and recover from a security incident, and is overseen by the Information Security team. We have also adopted a Cybersecurity Incident Response Plan to provide organizational and operational structure, processes, and procedures to Company personnel, so that team members can properly respond to incidents that may affect the function and security of our IT assets, information resources, and business operations. We conduct regular information security awareness training for employees and provide related educational materials.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our technology department continuously identifies, evaluates and manages material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and tenant data in alignment with our business objectives and operational needs.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: Management regularly reviews material technology services used, the population of technology service providers, and material and/or sensitive financial and operational data, and then assesses the material risks from cybersecurity threats associated with these items. Management has developed processes, procedures, and internal controls to address materials risks focusing on application security (levels of access, passwords, etc.), system change controls, and operations processing. The design and operating effectiveness of internal controls are subject to testing annually by the Partnership's internal audit function.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: We monitor the threat environment for potential risks, employing various methods, including automated detection tools, environment scans, and investigations of potential threats and reports. We also use threat intelligence feeds and vulnerability databases to monitor our systems, and have incident response processes designed to ensure swift action.

companyName: Nextpower Inc.

ticker: NXT


text: As part of its overall risk management approach, the Company prioritizes the identification and management of cybersecurity risk at several levels, including Board oversight, day-to-day executive risk management and employee training. The Audit Committee, comprised of independent directors from the Board, oversees the Board's responsibilities relating to the operational (including information technology risks, business continuity and data security) risk affairs of the Company. The Audit Committee is informed of such risks through quarterly reports from the Senior Vice President, Chief Information Officer (CIO), who oversees the implementation and compliance of information security standards and mitigation of cybersecurity related risks, assesses and manages the cyber risk management program, informs senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents with the support of the cybersecurity incident management team and supervises such efforts. The Company's cybersecurity incident management team has decades of experience selecting, deploying and operating cybersecurity technologies, initiatives and processes as well as managing enterprise risk. The Incident Response Leadership Committee, which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents. The CIO communicates to the Audit Committee regarding the activities of the Incident Response Leadership Committee.

companyName: MARTIN MARIETTA MATERIALS INC

ticker: MLM


text: Our CISO leads our Information Security Department, is responsible for the information security program, which includes cybersecurity, and reports to the Chief Risk Officer. Our CISO joined the Company in 2012. He has 18 years of experience, involving both information technology and information security. He has a Master of Business Administration in Cybersecurity, graduate studies certificate in cybersecurity and has achieved four certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Data Privacy Solutions Engineer and Cisco Certified Network Associate. The CISO provides an annual report of the information security program and monthly reports to the Audit Committee, including any security incident or notable security event for the period. The CISO also reports to the Company's Risk Committee on risk assessments annually and key risk indicators at least quarterly.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have engaged a third-party information technology ("IT") and cybersecurity firm who serves as our dedicated IT and cybersecurity team to help us oversee, implement and manage these processes and controls. This IT and cybersecurity firm is independently audited on an annual basis and has a System and Organization Controls Audit certification.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: physical, and organizational safeguards recovery and business continuity planning encryption and network security controls restrictions and physical security measures asset management systems monitoring security training assessment to date shows that cybersecurity incidents and vulnerabilities have not materially impacted our business operations, financial performance, or strategic direction.

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: Our CISO, working with his team and the Information Security Core Committee, has primary responsibility for assessing and managing our cybersecurity threat management program. He has more than 25 years of experience in building and leading information security teams and has worked at a technology start-up and a large, publicly-traded financial institution before joining the Company. His experience as a technology engineer has prepared him to lead a variety of teams, both large and small, design, implement and execute executive cyber and information security controls. He studied Computer Science at the University of Virginia and holds a Certified Information Systems Security Professional ("CISSP") certification. In addition to frequent electronic communication, the committee meets monthly and more frequently, as circumstances warrant, to discuss and monitor prevention, detection, mitigation and remediation of risks from cybersecurity threats. When appropriate, meetings will also include our Chief Risk Officer, Chief Financial Officer, General Counsel and members of our disclosure committee. On a regular basis, the CISO also updates the executive management team on developments within the cybersecurity sphere.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: KULR's Chief Technology Officer ("CTO"), in conjunction with our third-party providers, is responsible for assessing and managing KULR's cyber risk management program, informs senior Management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervises such efforts.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: Our Board is responsible for the oversight of cybersecurity risk management. The Board may assign this oversight a committee of the Board.

companyName: New ERA Energy & Digital, Inc.

ticker: NUAI


text: We engaged a well-known external firm to audit our compliance with the European Union's NIS 2.0 Directive (the Directive on Security of Network and Information Systems). This audit is being conducted to confirm that our cybersecurity practices align with the latest regulatory requirements and best practices for managing the security of critical infrastructure and services. The Technology Committee receives periodic reports from management on our cybersecurity program and risks. In addition, management updates the Technology Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Technology Committee reports to our Board regarding its risk management functions, including those related to cybersecurity.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Our cybersecurity risk management program is informed by legal and regulatory requirements and considerations. Cybersecurity risks are included as an integral part of our broader Enterprise Risk Management ("ERM") program and reviewed regularly by internal stakeholders comprised of a cross-functional team to assess the risk level and strength of our mitigation strategies. Our cybersecurity risk assessment is performed regularly throughout the year, and may include: • Regular cybersecurity program, risk and incidents reporting to the Board of Directors; • Regular cybersecurity risk reporting to the Enterprise Risk Committee, which includes the Company's Chief Executive Officer, Chief Financial Officer, Senior Vice President, Legal, General Counsel & Secretary, Internal Audit, Chief Information Officer and Chief Information Security Officer ("CISO"); and • Routine Security Steering Committee meetings with members from the Company's cybersecurity, ERM, Information Technology ("IT"), internal audit and legal teams.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: We maintain a Third Party Security and Privacy Standard and conduct security reviews of vendors, including for potential fourth-party risks, prior to and during their contracts with Robinhood and require all third-party service providers with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry standards. Any identified security or privacy risks of doing business with a vendor, including potential fourth-party risks, are highlighted to business owners to help make informed risk-based decisions.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Our cybersecurity program is based on the International Organization for Standardization ("ISO") 27001 security controls. We maintain an ISO 27001:2022 certification and we undergo routine audits by an independent, certified accreditation body to maintain this certification. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.

companyName: Twist Bioscience Corp

ticker: TWST


text: Our Chief Financial Officer ("CFO") has significant work experience related to information security issues and oversight and is the executive officer that oversees our cybersecurity program, which includes the implementation of controls to identify threats, detect attacks and protect our information assets. Our dedicated ERM Committee, which includes our CFO and certain members of our executive leadership team, provides principal oversight and guidance of our cybersecurity risk management programs and processes. While our Board has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. Our Audit Committee is responsible for reviewing and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures and the guidelines, programs and steps implemented by management to assess, manage and mitigate any such exposures. The ERM Committee reports to the Audit Committee at least annually on the Company's enterprise risk management and will report security instances to the Audit Committee as they occur, if material.

companyName: Park Hotels & Resorts Inc.

ticker: PK


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "Cyber-attacks, system security risks and data protection issues could disrupt our internal operations and cause a reduction in revenue, increase in expenses, negatively impact our results of operation or result in other adverse consequences."

companyName: AXT INC

ticker: AXTI


text: The VP of Information Technology, in coordination with our senior management team, including the CFO, work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Canopy Growth Corp

ticker: CGC


text: We occasionally engage third parties and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: Toughbuilt Industries, Inc


text: During the year ended June 30, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: The Audit Committee receives regular reports (at least quarterly) from our CISO on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate.

companyName: FLEX LTD.

ticker: FLEX


text: Our board of directors oversees our enterprise risk management activities in general, and receives regular updates on the company's risk management process and the risk trends related to cybersecurity. The audit committee specifically assists the board of directors in its oversight of risks related to cybersecurity. To help ensure effective oversight, the audit committee receives regular reports on information security and cybersecurity from the CISO.

companyName: RingCentral, Inc.

ticker: RNG


text: Governance - board oversight The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, directly and through its committees. The Regulatory Compliance & Sustainability Committee (RCSC) of the board is primarily responsible for oversight of risk from cybersecurity threats and oversees compliance with applicable laws, regulations and Company policies related to, among others, privacy and cybersecurity.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: On an annual basis, the board of directors discuss our approach to cybersecurity risk management with management which includes our Chief Information Officer ("CIO"). Our CIO has overall operational responsibility for our cybersecurity risk management. To facilitate the success of our cybersecurity risk management program, we have an Infrastructure, Operations & Security Team ("IOS Team") that is tasked with the responsibility to design, implement, and manage systems, processes, and policies to defend against cybersecurity threats and to respond to cybersecurity incidents. Working collaboratively across our Company, the IOS Team implements and maintains a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Our cybersecurity program leverages the National Institute of Standards and Technology ("NIST") framework, which consists of five core functions: identify, protect, detect, respond and recover. We have engaged the assistance of third-party experts to conduct comprehensive cybersecurity assessments centered on appraising our alignment with the NIST. Additionally, as further described in Item 1. Business-Regulation-Safety and Security Regulations, TSA has issued a series of security directives that all pipeline owners and operators must include in their cybersecurity planning, testing and in their reporting of any incidents. We have continued to expand investments in cybersecurity, including additional end-user training, using layered defenses, identifying and protecting critical assets, and strengthening monitoring and alerting. We regularly test our cybersecurity defenses by performing simulations and drills at both a technical level (including through penetration testing) and by reviewing our operational policies and procedures with third-party experts. We report the test results to the TSA as required. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our stakeholders, including investors, customers, employees, and vendors. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers based on the potential impact of a disruption of the services to our operations and the sensitivity of data shared with the service providers. The internal business owners of our hosted applications are required to document user access reviews at least annually and receive and review a System and Organization Controls (SOC 1 or SOC 2) report from the vendor. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and evaluate the associated risks. If a provided SOC report identifies significant deficiencies or control weaknesses, we conduct a detailed risk assessment, request remediation plans, implement additional monitoring measures, or, if necessary, reevaluate the vendor relationship. Our assessment of third-party provider risks is an integral part of our overall cybersecurity program, ensuring that appropriate safeguards are in place to protect our data and operations.

companyName: GENESIS ENERGY LP

ticker: GEL


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.

companyName: Cheniere Corpus Christi Holdings, LLC


text: Matthews has experienced cyber-attacks in the past and, while none of these cyber-attacks resulted in a material disruption to the Company's business, Matthews may experience additional cyber-attacks in the future. As of the filing of this Form 10-K, the Company is not aware of any such attacks that have occurred since the beginning of fiscal 2024 that have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While the Company has implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, refer to Item 1A - "Risk Factors - The Company relies on information technology to operate the Company's business. Security breach incidents and breakdowns of information technologies, or failure to comply with laws governing data privacy and data protection, could disrupt the Company's operations, subject the Company to legal claims, and impact the Company's financial results."

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: At Precigen, cybersecurity risk management is an integral part of our overall enterprise risk management processes. Our cybersecurity risk management program is managed by our security steering team. Designed to align with industry best practices, our program provides a framework for identifying, monitoring, assessing and responding to cybersecurity threats and incidents and facilitates coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.

companyName: PRECIGEN, INC.

ticker: PGEN


text: The Board of Directors (the "Board") has established oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats.

companyName: Allegion plc

ticker: ALLE


text: During the incident review process, senior management, in collaboration with relevant personnel from information technology, data security, and external cybersecurity firms specializing in forensic investigations, when necessary, assesses the materiality of the breach alongside the severity scale. This evaluation aims to accurately identify risks and potential operational and business impacts. Materiality determination involves an objective analysis of both quantitative and qualitative factors, including an evaluation of impact and reasonably likely impacts.

companyName: NBT BANCORP INC

ticker: NBTB


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's cybersecurity and privacy risk exposures and policies. On a quarterly basis, the SVP of IT reports to the Audit Committee on information technology and cybersecurity matters, including key information technology risks. The SVP of IT also apprises the Audit Committee and full Board of Cyber Security Incidents consistent with our incident response program, promptly.

companyName: EyePoint, Inc.

ticker: EYPT


text: Team and Internal Operations Our cybersecurity team is comprised of a diverse group of security veterans with experience managing all facets of information risk including, but not limited to, Application Security, Data Governance, Security Engineering, Security Processes and Services, Secure Software Development, Governance Risk and Compliance, Risk Management, Cyber Threat Intelligence, Breach Readiness, Cyber Defense Center for monitoring, Offensive Security, and Security Awareness.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: We have a Privacy and Security Executive Taskforce ("Taskforce") consisting of executive-level leaders that meets periodically to, among other things, review global trends in privacy, security, and compliance, identify key projects and resource needs, and review operational privacy and security statistics and metrics. Additionally, our Chief Technology Officer ("CTO") is a member of the Taskforce and manages and oversees a team (the "IT Security Team") that is responsible for leading company-wide cybersecurity efforts. The IT Security Team works with various business units and departments, including legal, product development, and operations, to help set standards, policies, and processes. Our CTO along with key members of his IT Security Team have worked in the information security field for many years and are actively involved in our cybersecurity efforts. Our internal audit function also provides independent testing on aspects of the operations of our cybersecurity program and the supporting control framework and reports the results of these audits in reports to our Audit Committee.

companyName: TechTarget Holdings Inc.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: (1) having an information security incident response plan for incident detection and response; (2) maintaining a disaster recovery plan, business continuity program, vulnerability management process and vendor risk management process; (3) conducting periodic risk assessments and employee training on cybersecurity; (4) maintaining security controls intended to address the National Institute of Standards and Technology and Cybersecurity Framework; (5) encrypting and segregating data, having network security controls, access controls and physical security, monitoring systems, managing assets (tracking and disposal) and conducting penetration testing; and (6) maintaining cybersecurity insurance.

companyName: NETGEAR, INC.

ticker: NTGR


text: Board of Directors The audit committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, and Vice President of Information Technology. Any updates on cybersecurity matters, including material risks and threats, are provided to the Company's audit committee, and the audit committee provides updates to the Company's Board of Directors at regular Board meetings.

companyName: iANTHUS CAPITAL HOLDINGS, INC.

ticker: ITHUF


text: Amgen has a multi-layered and iterative approach towards assessing, identifying, managing and mitigating risks from cybersecurity threats. The Company's Digital, Technology & Innovation (DTI) function is designed to support our productivity, innovation and outreach globally through the quality delivery of information systems, solutions and services for our business and operations. The DTI function has a Cybersecurity & Digital Trust (CDT) team that assesses and reduces cybersecurity exposure, including by providing employees with training and resources to identify potential cybersecurity threats and implementing information technology security practices. The CDT team also monitors for cybersecurity threat activity and seeks to mitigate the impact from cybersecurity incidents by deploying information security engineers, system architects, analysts and cybersecurity specialists to provide monitoring, reporting and management of cybersecurity incidents.

companyName: AMGEN INC

ticker: AMGN


text: Risk Assessment and Technical Safeguards On an ongoing basis, we assess cybersecurity risk, including the review of our policies, standards, processes and practices. These assessments include a variety of activities including third party security penetration testing and independent reviews of our information security control environment and operating effectiveness. The results of these assessment activities are presented to our Board, Audit Committee, and members of management. We regularly assess and deploy technical safeguards based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and complete our security questionnaires at the time of onboarding. On a recurring basis, our third-party service providers are required to update their responses to our security questionnaires and, where available, additional information such as System and Organization Controls ("SOC") SOC 1 or SOC 2 reports are provided.

companyName: SPX Technologies, Inc.

ticker: SPXC


text: Approvals/exceptions The Company's Governance, Risk, and Compliance (GRC) team maintains the IT risk register and reports updates to the IT Risk Council, which meets regularly. The IT Risk Council is made up of members representing the Company's cybersecurity, network, server, client, database, and software teams.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Our board of directors has a cybersecurity committee of the board to assist it in fulfilling its oversight responsibility with respect to the management of cybersecurity risks related to our products and services as well as our information technology and network systems. The responsibilities of the cybersecurity committee include overseeing our implementation and maintenance of cybersecurity measures, data governance, and compliance with applicable information security laws. The cybersecurity committee receives reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them and has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation. In addition, our audit committee has oversight responsibility over our internal financial controls and our enterprise risk management program, including disclosure controls related to cybersecurity. Finally, management periodically provides cybersecurity briefings to the entire board of directors.

companyName: Snowflake Inc.

ticker: SNOW


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register. Also, the security team works with management to identify, discuss, and prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, we use third-party service providers to assist us from time to time in reviewing our policies, standards and procedures, identifying and assessing material risks from cybersecurity threats, and making recommendations to improve our security program including for example professional services firms, external legal counsel, penetration testing firms, cybersecurity consultants, and cybersecurity software providers.

companyName: Sprout Social, Inc.

ticker: SPT


text: Our Board addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the Board (the "Audit Committee") is responsible for overseeing the Company's risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: EMERSON RADIO CORP

ticker: MSN


text: Risk Management and Strategy BOK Financial is committed to safeguarding company and client information through protections integrated into all lines of business, support functions, and third-party relationships. To effectively manage cybersecurity risks mentioned in Item 1A, our cybersecurity risk management program evaluates the likelihood and potential damage of internal and external threats. We also evaluate the adequacy of our policies, procedures, and capabilities in place to mitigate cyber risk at least annually.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Our CISO has over 25 years of information technology experience, including leading data analytics, customer relationship management, architecture and application development teams. He has been leading our global information security program for almost five years. He is a Certified Information Systems Professional, a member of Google Cloud CISO Customer Advisory Board and New Jersey Infragard and completed the FBI CISO Academy. He joined the Company over 25 years ago and has extensive knowledge regarding our business processes and the associated information technology platforms utilized worldwide, enabling him to guide his organization to protect the Company's systems and information.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: As we have previously described in Item 1A, Risk Factors, there have been significant and increasing instances of data and security breaches, malicious interference with technology systems and industrial espionage involving companies in numerous industries, including cloud providers, and cybersecurity threats are becoming more complex. In addition, at times a large percentage of our workforce may be working remotely in response to outbreaks of infectious disease, which may heighten these risks. While we have taken steps to maintain and enhance our cybersecurity by implementing additional security technologies, internal controls, network and data center resiliency, redundancy and disaster recovery processes and backup systems, upgrading our remote work environment and by obtaining insurance coverage, these measures may be inadequate and our technology systems could be vulnerable to disability, failures, or unauthorized access. As a result, any inability by us to successfully manage our information systems, or respond effectively to any attack on or interference with our systems, including matters related to system and data security, privacy, reliability, compliance, performance and access, problems related to our systems caused by natural disasters, security breaches or malicious attacks, and any inability of these systems to fulfill their intended business purpose, could impede our ability to record or process orders, manufacture and ship in a timely manner, account for and collect receivables, protect sensitive data of the Company, our customers, our employees, our suppliers and other business partners, comply with our third party obligations of confidentiality and care, or otherwise carry on business in the normal course. Any such events could require costly remediation beyond levels covered by insurance and could cause us to lose customers and/or revenue, including as a result of legal or regulatory claims or proceedings, or damage our reputation, any of which could have a material adverse effect on our business and operating results. We are also subject to an increasing number of evolving data privacy and security laws and regulations that impose requirements on us. We collect, store, access and otherwise process various types of confidential or sensitive data, including proprietary business information, personal data and other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Failure to comply with such laws and regulations could result in the imposition of fines, penalties and other costs.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS


text: The governance of cybersecurity risks is a critical function of our Board which has a key role in the oversight of cybersecurity and related technology risks. The Board is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: We have experienced no material cybersecurity breaches. As such, we have not spent any material amount of capital on addressing impacts during this time, nor have we incurred any material breach expenses from penalties and settlements. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.

companyName: ONE Gas, Inc.

ticker: OGS


text: Once cyber incidents are identified, a risk assessment is performed by the CDC, in accordance with the CSIRP. The risk assessment includes quantitative and qualitative considerations determined by a committee of individuals, including, among others, the Controller, CISO and Chief Ethics and Compliance Officer, that report to the Chief Financial Officer, CIO, and Senior Vice President General Counsel and Chief Sustainability Officer. Any cyber incidents that exceed thresholds set in the CSIRP are then escalated to the aforementioned committee for a materiality assessment and disclosure considerations.

companyName: PUGET ENERGY INC /WA


text: Our Internal Audit department facilitates an annual ERM assessment that is designed to gather information regarding key enterprise risks, emerging risks, critical risk events, and key third-party dependencies that could impact our objectives and strategies. The Internal Audit department partners with our Information Security, Information Technology and Privacy teams to gather information about risks related to cybersecurity threats. The ERM assessment is presented to the Board and provides the foundation for the annual Internal Audit plan, management's monitoring and risk mitigation efforts, and ongoing Board-level oversight. On a quarterly basis, Gap Inc.'s Chief Audit Executive updates the Audit and Finance Committee on the Internal Audit plan and any updates to the Company's enterprise risk profile, including identified cybersecurity risks.

companyName: GAP INC

ticker: GAP


text: CDRM manages our cybersecurity program, including by fostering collaboration with partners across business units and functional areas to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate and manage such risks. Business units and functional areas are responsible for managing risks and implementing our policies and standards within the respective business unit or function. Compliance with our policies and standards is assessed by CDRM in conjunction with our internal audit function, through periodic cybersecurity audits.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Board's Roles and Responsibilities Oversight for risk management and the overall enterprise risk management strategy of the Company, including cybersecurity, is the responsibility of the Board of Directors. Risks identified are monitored by the Board as a whole or the Board may delegate oversight to a specific subcommittee. Our Technology Committee, comprised of four board members possessing relevant background and experience, assists the Board of Directors in its oversight role with respect to strategy and risk management for our information systems, information technology, or IT, and IT security, including cybersecurity.

companyName: MAXIMUS, INC.

ticker: MMS


text: The Company internally assesses its cybersecurity regularly and engages a third-party external auditor to conduct annual cybersecurity risk assessments, both of which allow us to identify key cybersecurity and data protection risks and develop plans, policies, and procedures to mitigate such risks.

companyName: BRINKS CO

ticker: BCO


text: The Risk Committee works with the CISO and the Company's senior executives in reviewing the cybersecurity risks and strategy, provides guidance on the Company's cybersecurity goals and objectives, and monitors the information it receives from management regarding the assessment and management of cybersecurity risk. The Risk Committee also conducts an annual review that includes a survey of enhancements to the Company's defenses and a cyber trend report, as well as management's progress in implementing the Company's cybersecurity strategic roadmap and compliance initiatives.

companyName: CONDUENT Inc

ticker: CNDT


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CIO, Chief Legal & Compliance Officer, and others, who help the Company mitigate and remediate cybersecurity incidents of which they are notified and who may further notify the Board in accordance with such policies.

companyName: EVERBRIDGE, INC.


text: Board of Directors' oversight function includes cybersecurity risk management. The Board of Directors has tasked the Audit Committee with overseeing the Company's cybersecurity risk management processes and with determining which threats are likely to impact the Company's strategy, business operations, and financial condition.

companyName: OptimizeRx Corp

ticker: OPRX


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of FS Investments' third-party risk management, legal, information technology, and compliance personnel of the Adviser and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: FS KKR Capital Corp

ticker: FSK


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Officer. Our current Chief Information Officer has over 20 years of technology experience, including 15 years in Banking.

companyName: HBT Financial, Inc.

ticker: HBT


text: Management reviews budgets for cybersecurity initiatives and ensures that adequate resources are allocated to address cybersecurity risks and that investments in cybersecurity align with the Company's risk tolerance and strategic objectives.

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and patients, employee, vendor and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise IT environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

companyName: SUNLINK HEALTH SYSTEMS INC


text: Like many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. We do not maintain stand-alone servers for our emails. However, we do maintain a standalone server for our main enterprise resource planning (ERP) program (Great Plains), and we maintain two servers dedicated to processing orders for Artisan Specialty Foods and Food Innovations, Inc. We also maintain a file server that currently houses approximately one terabyte of data. Each of our servers is protected by firewall and two-factor-authentication. Additionally, we take multiple snapshots of our servers several times throughout the day and store encrypted backups of our data both locally and in a cloud server to mitigate loss in the event of any malicious attacks on these resources. In the normal course of our relationships with the providers of our services not controlled in-house, we regularly monitor their message boards and other formal and informal communications channels for signs of breaches of their systems. We also survey available public information for indications that they have suffered a breach of their systems.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: Our cybersecurity program is designed to assess, identify and manage material risks from cybersecurity threats, and is a component of our overall enterprise risk program. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework, version 2.0. We conduct regular scans, penetration tests, and vulnerability assessments to identify potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage material risks from cybersecurity threats include potential threats associated with third party service providers, including cloud-based platforms.

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: All of the Company's officers and employees are employees of the Manager and subject to its policies and procedures. Our Manager utilizes a third-party managed & cybersecurity services provider (the "MSSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our Manager and the MSSP engage in periodic assessment and training regarding the policies, standards and practices designed to address cybersecurity threats and incidents. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management To date, we have not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company and we are not aware of any cybersecurity threats that are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Risk Factors—General Risk Factors—We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: Additionally, we follow a cybersecurity incident response process that provides a framework for responding to cybersecurity incidents. The process identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, the Board and the audit committee. It also addresses requirements for our external reporting obligations. The cybersecurity incident response process is reviewed and updated, as necessary, under the leadership of the Chief Information Officer.

companyName: Newsmax Inc.

ticker: NMAX


text: Kroger's CDO reports to the CEO and leads technology and digital capabilities for the Kroger Co., including the overall cybersecurity strategy. Kroger's CDO has over 20 years of both leading and transforming technology, digital growth, and e-commerce in the retail and food industry. He graduated with a master's degree in business administration and management from Ecole Sup rieure de Commerce de Chamb ry, Rh ne-Alpes, France. Kroger's interim CISO brings nearly 20 years of experience developing and leading security and risk programs. His experience includes governance, information security, and threat management. He graduated from Miami University with a bachelor's degree in management information systems and marketing.

companyName: KROGER CO

ticker: KR


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.

companyName: Amplitude, Inc.

ticker: AMPL


text: Additionally, we also provide mandatory training to our employees to help identify, avoid and mitigate cybersecurity threats. These trainings cover a wide range of cybersecurity topics such as insider threats, phishing, spoofing, and the like.

companyName: Spire Global, Inc.

ticker: SPIR


text: The Board's risk oversight is enabled by an enterprise risk management program designed to identify, prioritize and assess a broad range of risks, including risks related to cybersecurity, that may affect the Company's ability to execute its corporate strategy and fulfill its business objectives, and to formulate plans to mitigate their effects.

companyName: NEW YORK TIMES CO

ticker: NYT


text: In May 2024, the SEC adopted amendments to Regulation S-P, which, beginning in December 2025, requiring investment companies and SEC-registered investment advisers to adopt written policies and procedures for incident response programs to address unauthorized access to, or use of, customer information, including providing notice to certain individuals affected by any such incident. GECM will need to comply with this amended rule beginning December 2025. With the SEC particularly focused on cybersecurity, we expect increased scrutiny of our policies and systems designed to manage cybersecurity risks and related disclosures.

companyName: Great Elm Group, Inc.

ticker: GEG


text: Board of Directors The Board of Directors oversees our risk management processes, including with respect to cybersecurity risk, and the Board considers cybersecurity risk management an enterprise priority. The Board has delegated primary responsibility for reviewing and discussing with management our strategies, initiatives and policies relating to cybersecurity to the Audit Committee, which regularly reports to the full Board regarding such review and discussions. In addition, in connection with its oversight of cybersecurity risks in relation to financial reporting and internal controls, the Audit Committee plays a crucial role in the Board's understanding and management of the financial and operational impacts of cybersecurity risks.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents.

companyName: Amesite Inc.

ticker: AMST


text: Our Manager of Information Technology ("MIT") is responsible for our IT cybersecurity policies, procedures, and controls and reports to our Chief Financial Officer ("CFO"). Our MIT has a Bachelor of Business Administration degree in management information systems and has over 20 years of relevant experience in the IT field. Team members also include third-party service providers who have relevant education and experience in cybersecurity.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: Integration into Overall Risk Management System The Company employs comprehensive methodologies for risk assessment and diligently identifies and evaluates potential cybersecurity threats and vulnerabilities across our systems, networks and data assets. This process involves regular examinations of emerging threats, conducting penetration tests, vulnerability scanning and thorough analysis of industry-specific risks.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Our cybersecurity risk management and strategy processes are managed by the head of our Information Technology department, and our Information Technology team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.

companyName: Varex Imaging Corp

ticker: VREX


text: The security of the Company's products, data, services and network is a critical priority. To effectively assess, identify and manage material risks associated with cybersecurity threats, the Company has adopted a comprehensive approach with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, third-party management, security (with respect to physical assets, products, networks and systems), security monitoring and vulnerability identification. The Company has, and continues to, invest in internal and external tools to better detect, patch, monitor, and restore systems. Further, the Company maintains cybersecurity insurance coverage intended to protect against loss of business and other related consequences resulting from cyber incidents.

companyName: WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORP

ticker: WAB


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. See also the cybersecurity-related risks in Item 1A "Risk Factors."

companyName: T1 Energy Inc.

ticker: TE


text: Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its VP of IT Operations and Strategy, who reports to the CFO. The qualifications of the VP of IT Operations and Strategy include 25 years of IT management, cybersecurity and information governance experience. The VP of IT Operations and Strategy is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. Management's role includes:

companyName: DallasNews Corp


text: The Board, primarily through the Audit Committee, provides oversight of our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular, quarterly presentations and reports from our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") on cybersecurity risks and management's mitigation activities, which address a wide range of topics including our cybersecurity risk profile, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment and significant newly identified risks, technological trends, and information security considerations arising with respect to our industry peers and third parties. In addition, the CTO and CISO provide the Audit Committee with timely information regarding significant cybersecurity incidents, as applicable. During 2023, the Audit Committee also held an informational meeting with an external advisor regarding the cybersecurity landscape.

companyName: Travel & Leisure Co.

ticker: TNL


text: Emerson's Board directly, or through its appropriate committees, provides oversight of management's efforts to mitigate cybersecurity risk and response to cyber incidents. The Board and/or its appropriate committees receive regular updates on cybersecurity from management and engage in discussions throughout the year, including with subject-matter experts as appropriate, on the function of the Company's overall cybersecurity program, cybersecurity risks, strategies for addressing these risks and the implementation thereof. The Audit Committee has oversight responsibility for the Company's enterprise cybersecurity risks. The Board also receives reports on cyber events, as appropriate, including response efforts, legal obligations and outreach and notification to regulators and/or customers when needed, as well as provide guidance to management as appropriate.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: The Audit Committee oversees, on behalf of the Board, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. Some members of the Audit Committee have completed certifications in cybersecurity, including one from the National Association of Corporate Directors (NACD) in Cyber-Risk Oversight. On a quarterly basis, the CISO or its delegee report to the Board or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Juniata leverages internal and external auditors and independent external partners to periodically review its processes, systems and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted, by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Tripadvisor also has executive oversight committees responsible for assessing and managing cybersecurity risk as part of their enterprise risk management and compliance programs. Tripadvisor has designated the Compliance Committee and Chief Compliance Officer ("CCO") with day-to-day management and oversight of corporate compliance initiatives, including cybersecurity. The Tripadvisor Compliance Committee consists of, among others, the Chief Financial Officer, Chief Legal Officer and CCO. The CCO has further established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of the Chief Information Security Officer ("CISO") and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with Tripadvisor's information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Internal Cybersecurity Team The Information Security organization reports into the SVP, IT and includes a dedicated team of centralized information security experts with extensive cybersecurity knowledge and experience to manage the cyber risk under the leadership of the Director of Information Security.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our process of assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management system. Our process of managing risks from cybersecurity threats includes monitoring information channels from trusted security information sources. We review third-party service providers that manage sensitive Company information prior to engaging any such provider. Our reviews align with relevant government compliance requirements and review of System and Organization Controls reports. We establish governance, processes, and tools for managing various third-party related risks, including information security. As a condition of working with the Company, third-party service providers who access sensitive business or customer information are expected to meet certain information security requirements. Our processes for assessing, classifying, and managing cybersecurity risks were created in collaboration with consultants and auditors. We maintain consulting relationships that provide guidance for responding to evolving cybersecurity risks. We require employees to undertake data protection, cybersecurity training, and compliance programs annually. Internal and external auditors also review our adherence to established IT and cybersecurity controls.

companyName: ALAMO GROUP INC

ticker: ALG


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: We have never experienced a cybersecurity incident that was determined to be material, although, like many technology-dependent companies operating in the current environment, we have experienced cybersecurity incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, please see the section titled " Risk Factors."

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors that have access to our critical systems and information.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: Cyber Risk Management and Strategy the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process.

companyName: Premier Air Charter Holdings Inc.

ticker: PREM


text: Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process described above, including the operation of our incident response plan. Annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials, including current and emerging material cybersecurity threat risks and describing the company's ability to mitigate those risks, and discusses such matters with our IT Manager.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged a security auditor and advisor in systems administration and penetration testing, a systems auditor and advisor for cybersecurity and compliance, an IT Systems auditor and assurance vendor and an email security and cybersecurity training partner. We also purchase insurance to protect us against the risk of cybersecurity breaches.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident detection and response plan and policy; encryption of data; network security controls; access controls; physical security and employee training.

companyName: NGM BIOPHARMACEUTICALS INC


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and processes and controls supporting requirements with the General Data Protection Regulation (GDPR). We have an annual assessment performed by a third-party specialist of the our cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a Risk Mitigation Plan to mitigate such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Banzai International, Inc.

ticker: BNZI


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor security and information events on a real-time basis to respond to threats as they occur; Monitor emerging data protection laws and implement changes to our processes to comply; Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; Update key employees regularly on phishing email and other cybersecurity risks; Employ artificial intelligence assisted cybersecurity monitoring capabilities; and Complete regular updates to key software and infrastructure.

companyName: McEwen Inc.

ticker: MUX


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.

companyName: HERSHEY CO

ticker: HSY


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our VP of Information Technology, who reports to our General Counsel & Head of Operations, to manage the risk assessment and mitigation process.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Our management team, including the CISO, Data Privacy Officer (DPO), CCO (Chief Customer Officer) and Chief Product Officer (CPO), is responsible for the assessment and mitigation of cybersecurity threats and overseeing both our internal security personnel and external cybersecurity consultants. Our management team's cumulative experience includes decades working in cybersecurity and information security, including in the government and public and private companies, and overseeing risk management generally. Among other things, our CISO is a graduate of the Technion's Information Security Program as a Technion Certified CISO and brings vast experience as former Security Specialist in the U.S. Department of State, Senior Lead Information Security Architect at one of the Israeli leading banks, and Head of Cyber Architecture, Engineering & Research Group at one of the leading Israeli Aerospace & Defense companies. The team reporting to our CISO further includes experienced specialists in the area of Cyber Forensics and Counterterrorism and Network Security Engineers holding B.S. Computer Science Degrees and other relevant certifications.

companyName: KALTURA INC

ticker: KLTR


text: The Company assesses the cybersecurity preparedness of third-party vendors by obtaining SOC 1 or SOC 2 reports. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: regular simulation modules for all employees to enhance awareness and responsiveness to possible cybersecurity management and incident training for employees involved in our systems and cyber liability insurance that is intended to provide protection against the potential losses arising from a cybersecurity incident. are currently working with outside counsel to further develop a formal cybersecurity incident response plan.

companyName: CorMedix Inc.

ticker: CRMD


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For additional information regarding the ransomware attack we announced on May 31, 2022, see the section captioned "Overview - Ransomware Attack" under Part II, Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations" below. Other than this ransomware attack, as of the date of this report and for the years presented, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operational Risks - Any inadequacy, interruption, integration failure or security breach with respect to our information technology could harm our ability to effectively operate our business and have a material adverse effect on our business, results of operations, financial condition and cash flows" under Part I, Item 1A "Risk Factors" above.

companyName: Hanesbrands Inc.


text: The CIO provides periodic reports to the Board of Directors, the executive management team, and our Legal Counsel. These reports include updates on our cybersecurity risks and threats, assessments of our information security program, and any changes in the threat landscape. Our information technology systems are regularly evaluated by internal and external consultants, with the results of the review reported to the executive management team and the Board of Directors.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: The Company has established a comprehensive Data Security Event Plan ("DSEP") which formalizes how the Company and management identify, investigate, respond to and report incidents involving unauthorized access to sensitive data. The DSEP is co-managed by the CISO, the Chief Privacy Officer and the Vice President of Technology Risk. The DSEP assists with establishing a repeatable process for management to identify the relative significance of incidents and defines internal and external reporting obligations. Response strategies are tailored to the circumstances of each incident, considering technical, business, legal and regulatory factors. Thorough documentation and data preservation are paramount throughout the investigation process. Once incidents are properly identified and assessed under the DSEP, communications are coordinated internally and escalated accordingly to the Audit Committee and the Board, as well as externally, to allow for timely dissemination of accurate information while adhering to legal and regulatory requirements.

companyName: Walgreens Boots Alliance, Inc.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the board of directors.

companyName: Balance Labs, Inc.

ticker: BLNC


text: We have an established security program and framework based on ISO/IEC 27001 ("Security Program") and maintain ISO/IEC 27001:2013, SOC 1 Type 2, and SOC 2 Type 2 certifications. The Security Program has been established to allow management oversight of cybersecurity risks, institute directives and principles for information security, ensure alignment to regulatory and contractual cybersecurity obligations, and enable timely incident response and remediation.

companyName: SPS COMMERCE INC

ticker: SPSC


text: We have a core incident response team (Core Team) consisting of dedicated, skilled leadership representatives from our Information Security, Privacy and Law teams, responsible for analyzing and assessing cyber incidents and leading response efforts. Our Chief Information Security Officer (CISO), responsible for overseeing and managing information security incidents, has over 25 years of experience in information technology (IT), including over 20 years dedicated to practicing or leading cybersecurity functions. Our CISO is also a Certified Information Systems Security Professional (CISSP). Our Privacy leader, responsible for managing privacy incidents, has over 20 years of experience in IT risk management, including over 10 years in IT risk and control functions and the remaining time focused on privacy and cybersecurity related functions and holds several information privacy and risk certifications. Our Legal leader, responsible for providing guidance on legal and other regulatory obligations in the areas of privacy, cybersecurity, technology, data use and third-party risk management, holds a Juris Doctor degree, is licensed to practice law, and has over 20 years of legal experience, including 10 years focused on privacy and cybersecurity and holds several information security and privacy certifications, including the CISSP. The Core Team leaders are members of various organizations that support cybersecurity or privacy intelligence, education, information sharing and networking, including among others the Financial Services Information Sharing and Analysis Center (FS-ISAC), Domestic Security Alliance Council (DSAC), InfraGard, and International Association of Privacy Professionals (IAPP).

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: The audit committee reports to the full board of directors regarding its risk management activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cyber risk management program from time to time. Members of the board of directors receive presentations on cybersecurity topics from our Chief Technology Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: GCM Grosvenor Inc.

ticker: GCMG


text: Risk Management and Strategy Liberty Broadband's corporate level IT and cybersecurity functions are provided by Liberty as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in Liberty's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate headquarters, as detailed below. GCI operates its own cybersecurity function with oversight from Liberty Broadband.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: We face cybersecurity risks that could materially affect our business, financial condition, and results of operations. Cybersecurity threats include unauthorized access, data breaches, theft, misuse, disruption, or destruction of systems, digital assets, or confidential information. These risks are heightened given our reliance on digital asset custodians, cryptocurrency wallet providers, online hosting services, and other unaffiliated third-party service providers.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: We have a cybersecurity third party risk management program, which is an evolving, cross-functional program to help assess and mitigate risks from third party vendors and other service providers. Our cybersecurity team also uses several layers of defense and protection technologies, cybersecurity experts, and automated alerting and response mechanisms to reduce risk to Enbridge.

companyName: ENBRIDGE INC

ticker: ENB


text: The Company's Board of Directors, working in conjunction with its Audit and Corporate Governance Committees, oversees the Company's overall enterprise risk management program, including the evaluation of cybersecurity related risks. Our Board receives periodic updates from the Company's management team regarding technology matters including its cybersecurity framework, and the notification of any material cybersecurity events and/or risks.

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: Our board of directors provides oversight of our cybersecurity program and helps guide our strategy for managing cybersecurity risks in the context of our overall risk management system. Our cybersecurity program is managed by our Senior Vice President of Finance, our internal IT team and our external Chief Information Security Officer ("CISO") whose is responsible for leading enterprise-wide cybersecurity strategy, protocols, framework, standards and processes. The Senior Vice President of Finance reports to our board of directors, as well as our Chief Executive Officer and Chief Financial Officer and other members of senior management as appropriate.

companyName: InspireMD, Inc.

ticker: NSPR


text: A third party Managed Security Service Provider manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer. and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: We regularly engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices and trends.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN


text: The business continuity management program is designed to oversee and implement resilience, continuity, and response capabilities to safeguard employees, products and services, minimize financial losses, and minimize the impact to service to members during a disruption event, which includes the unavailability of information technology assets due to cybersecurity threats or incidents and other unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity management program provides planning for the restoration of facilities, communications, information technology systems, personnel, and other components necessary for the continuity of critical Bank processes. The business continuity management policy is overseen by the board.

companyName: Federal Home Loan Bank of Atlanta