text: Our Operational Risk Committee ("ORC") provides oversight and governance for our information security risk management activities, including those related to cybersecurity. This includes efforts to identify, measure, manage, monitor, and report information security risks associated with our information and information systems. The ORC escalates risks to the Risk Management Committee or our Board based on the escalation criteria provided in our information security framework. Members of management with cybersecurity oversight responsibilities are informed about cybersecurity risks and incidents through a number of channels, including periodic and annual reports, with the annual report also provided to our Risk Management Committee and the ORC. Our CISO leads the strategy, engineering, and operations of cybersecurity across the Company and is responsible for providing annual updates to our Board and the ORC on our WISP, as well as ad hoc updates on information security and cybersecurity matters. Our CISO reports directly to the Risk Management Committee. The CISO has been with the Company since 2023 and has over 28 years of information technology and cybersecurity experience.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Board of Directors and its Audit/Finance Committee Our Board and its Audit/Finance Committee exercises oversight over our enterprise risk management including our cybersecurity program. The Audit/Finance Committee receives updates from our CIO or CISO at each of its regularly scheduled meetings regarding matters related to information technology and cybersecurity including the state of the Company's cybersecurity programs, emerging cybersecurity developments and threats, and the Company's strategy to mitigate cybersecurity risks. Additionally, our full Board receives reports on our cybersecurity program at least annually which includes a review of our cybersecurity incident response plans which are described above.

companyName: CONAGRA BRANDS INC.

ticker: CAG

secItem: Item 1C


text: Oversee Third-Party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the system and organization controls (SOC) reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Rocky Mountains Group Ltd


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the company or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. For more information on how cybersecurity risk could materially affect the company's business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors."

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: We have established procedures for timely reporting of significant cybersecurity incidents; our commitment involves promptly notifying regulatory authorities, customers, and other stakeholders in the event of any material cyber incidents that may impact our operations or the security of sensitive information. In particular, we have enhanced disclosure controls and procedures to meet the requirement to report material cybersecurity incidents on Form 8-K within four business days after we determine that an incident is material.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyberattacks. There is no guarantee that our cybersecurity program will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. Also, there is no guarantee that our cyberattack insurance coverage limits will fully cover any future claims or that such insurance proceeds will be paid to us in a timely manner. We have experienced cybersecurity incidents in the past that were not material, but future incidents could have a material impact on our business strategy, results of operations, financial condition and reputation. See "We are subject to information technology risks related to breaches of security pertaining to sensitive company, customer, employee and vendor information as well as breaches in the technology used to manage operations and other business processes" in Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Sylvamo Corp

ticker: SLVM


text: Our board of directors has yet to establish any formal committees related to cybersecurity risks. Management updates our board of directors regarding cybersecurity risks as necessary.

companyName: Nano Nuclear Energy Inc.

ticker: NNE


text: Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including risks from cybersecurity threats.

companyName: Cabaletta Bio, Inc.

ticker: CABA


text: We operate a closed server in a locked room and regularly examine cybersecurity threats that could compromise our information system's security or data and otherwise maintain our cybersecurity policies and procedures in accordance with industry standard control frameworks and applicable regulations, laws, and standards.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For further discussion of our risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality and Integrity of Our Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."

companyName: METROPOLITAN LIFE INSURANCE CO


text: The Partnership has endeavored to adopt a zero-trust architecture approach that authenticates and authorizes interactions between its network and users. Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.

companyName: CSI Compressco LP


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program and is a crucial component of our risk assessment process. For instance, we report on, review, and consider the results and findings from external and internal security and privacy assessments as part of our risk program. Additionally, we analyze how cybersecurity risks interact with operational, financial, compliance, and reputational risks.

companyName: Compass, Inc.

ticker: COMP


text: We maintain an ongoing end-user cybersecurity awareness program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions, including quarterly training and simulated phishing campaigns.

companyName: Prime Medicine, Inc.

ticker: PRME


text: As part of our broader risk management and control framework, we have implemented cybersecurity controls over the information technology and process control systems of the Company and of our third-party service providers, to support the oversight and identification of risks from cybersecurity threats. We engage third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer, and vendor data as well as data affecting our process controls and data used to operate our manufacturing facilities. As part of our cybersecurity risk management program, we conduct information security and data protection training for employees, including training on matters such as phishing, social engineering, cybersecurity awareness, and email security best practices. In addition, we work with third-party providers to undertake penetration testing and maturity assessments of the Company's information security program based on the National Institute of Standards and Technology cybersecurity framework. With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations. In addition, recently, we have been including provisions in our supplier contracts that require the suppliers to maintain an effective information security management program and to notify us in the event of a known or suspected cyber incident. We have added these requirements in new or amended contracts going forward. We also consult with external advisors and specialists, as necessary, regarding opportunities and enhancements to strengthen our cybersecurity practices and policies and implement enhancements to our cybersecurity capabilities based on evolving threats.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: The Chief Information Security Officer ("CISO") leads our information security organization responsible for overseeing our information security program. Our CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").

companyName: EchoStar CORP

ticker: SATS


text: Our information security program also includes an information security awareness program, which includes annual training regarding our acceptable use and information classification and handling policies, regular phishing campaigns complemented by additional employee training as appropriate, and communications and companion trainings to keep users informed on current events.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats.

companyName: Longduoduo Co Ltd

ticker: LDDD


text: As part of our security framework and evaluation of our supply chain risks, we review our service providers' security practices and require appropriate certifications from them. We also perform an analysis of controls to manage our third-party security risks.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Awareness and training for employees, involving phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats; Security tools and technologies, along with control policies and active review procedures which strengthen authentication and access protection;

companyName: Seneca Foods Corp

ticker: SENEA


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners, payors, clinical trial participants, and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We generally follow the HITRUST Common Security Framework in our cybersecurity policies, standards, processes, and practices.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: See "Item 1A—Risk Factors—Our computer systems and those of our third-party service providers have in the past failed or been compromised and may in the future fail or be compromised, including through cybersecurity breaches; we may experience issues from new and complex information technology methodologies such as artificial intelligence; and unanticipated problems could materially adversely impact our disaster recovery systems and business continuity plans, any of which could expose confidential information such as personal information of our customers or employees, damage our reputation, impair our ability to conduct business effectively, result in enforcement action or litigation, and materially adversely affect our business, financial condition and results of operations."

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: To keep information security risks related to suppliers and other third parties within an acceptable range, Envestnet has a third-party oversight program. This program categorizes our third parties, assesses the potential impact of a compromise of Envestnet data and other resources in relation to the third-party's engagement and manages the risk associated with third parties. This risk management includes understanding whether the third-party has required controls in place, whether it has vulnerabilities that need to be managed before beginning work with us and what residual risks will remain and require acceptance or further decision making.

companyName: ENVESTNET, INC.


text: A cybersecurity group within GATX's IT department, led by the Global Head of IT Security, works collaboratively across the Company to administer a program designed to protect the Company's information systems and information from cybersecurity threats and to execute processes in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams and the cybersecurity group, the Global Head of IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and reports such threats and incidents to the Audit Committee when appropriate. The Global Head of IT Security has served in various roles in information technology and information security for over 15 years, and holds undergraduate and graduate degrees in information security, as well as multiple certifications in cybersecurity and information technology.

companyName: GATX CORP

ticker: GATX


text: Related to Cybersecurity Risks The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: management and strategy engage and implement risk management strategies to identify, assess, and manage material risks arising from cybersecurity threats and alerts. Our method involves a systematic evaluation of all potential threats, vulnerabilities, and their possible impacts on the Company's operations, data, and system integrity. Our cybersecurity risk management strategy includes: Identify cybersecurity risks to our environment; teams and third-party providers to investigate, contain, and resolve identified threats; cybersecurity awareness training to our staff; and and periodic testing of a cybersecurity incident response plan.

companyName: PORTSMOUTH SQUARE INC

ticker: PRSI


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Usio, Inc.

ticker: USIO


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Our systems are continually subject to sophisticated and evolving cyber threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that materially impacted our operations or financial condition. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to invest in our security controls, incident response capabilities, and third-party vendor management protocols. For additional information on the cybersecurity risks that we face, also see Item 1A. "Risk Factors".

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Risk and Compliance Committee of the Board. The Risk and Compliance Committee oversees the quality and effectiveness of our information security framework, including capabilities, policies and controls, and methods for identifying, assessing and mitigating information and cybersecurity risks. The Risk and Compliance Committee also assesses the effectiveness of the Company's management of information security-related risks, including consulting with internal and external advisors as appropriate.

companyName: TransUnion

ticker: TRU


text: Our cybersecurity program is built on a collection of fundamental security controls, focused on the overall protection of company and stakeholder data. Company leadership has defined the following objectives for information security: • Governance: Establish proper governance for the cybersecurity program. • Security Operations & Data Protection: Create a secure digital operating environment (apps, networks, systems, etc.) designed to protect critical data and to prevent business disruption. • Response and Recovery: Develop and practice incident response, business continuity and disaster recovery processes to minimize the impact of a major incident. • Compliance & Effectiveness: Meet all compliance requirements and develop program metrics to ensure effectiveness.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: With respect to third-party service providers, our Information Security Program includes conducting due diligence of relevant service providers' information security programs prior to onboarding. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. Our service providers are contractually required to notify us promptly of actual or reasonably suspected information security incidents occurring on their systems that may affect our systems or data, including personal information.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to designated employees depending on the circumstances, including in some cases to our executive team. The board of directors receives periodic reports from management concerning our cybersecurity risk management program.

companyName: Corvex, Inc.

ticker: MOVE


text: Our information and security team, led by our Chief Information Security Officer ("CISO"), have implemented and continue to maintain various technical, physical, and administrative processes, policies, and standards as the foundation of our Security Program, which are designed to help us manage and mitigate risks from cybersecurity threats, including, but not limited to, incident detection and response plans, vulnerability management processes, risk assessments, disaster recovery and business continuity plans, access controls, asset management, logging and monitoring, security awareness training, and third-party risk management programs.

companyName: SPS COMMERCE INC

ticker: SPSC


text: Implementation of endpoint detection and response (EDR) technology, as well as partial operational technology (OT) security measures on some of our factories, to protect our on-premises systems.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Our risk management activities include periodic assessments, vulnerability testing, and tabletop exercises, as well as regular engagement with third-party experts to perform independent security assessments. We have expanded employee training and phishing simulations, and we conduct ongoing monitoring of access to our systems, including oversight of third-party vendors and service providers. The results of assessments and reviews are reported to senior management and the Audit Committee, and our policies and controls are updated as necessary.

companyName: Pluri Inc.

ticker: PLUR


text: Our Internal Audit team reviews, monitors and audits various aspects of the Company's enterprise risk management program to evaluate whether risks, including cybersecurity risks, are appropriately identified and managed. Internal Audit periodically reports to the Audit Committee on the Company's cybersecurity risk mitigation efforts. The Audit Committee Chair, in turn, reports to the full Board of Directors.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2024.

companyName: Rezolute, Inc.

ticker: RZLT


text: Our global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure. Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification, Certified Incident Handler certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once a year and have access to more frequent cybersecurity trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. Program performance is reported to and monitored by senior leadership and the Audit Committee on a quarterly basis.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: Our Board is ultimately responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. On an annual basis, the Board reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our director Dr. Yuanyuan Huang regularly briefs senior management and the Board of Directors on cybersecurity issues as part of our overall enterprise risk management program, which may include information regarding our exposure to privacy and cybersecurity risks deemed to have a moderate or higher business impact, even if immaterial to us. Dr.

companyName: STRATEGIC ACQUISITIONS INC /NV/

ticker: STQN


text: Independent Audits and Assessments External firms conduct regular penetration testing, Service Organization Controls (SOC) 2 audits, and other assessments to validate the effectiveness of our cybersecurity controls and identify areas for improvement.

companyName: Astrana Health, Inc.

ticker: ASTH


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. That said, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: We operate under written cybersecurity policies and procedures, and we use a risk-based approach to information security and periodically assess our cybersecurity risks. Our risk management strategy is based on the following principles:

companyName: NVE CORP /NEW/

ticker: NVEC


text: We also incorporate intelligence sharing about emerging threats through collaboration with other companies in our industry, consultants and public-private partnerships with government intelligence agencies, such as the Arizona Cyber Threat Response Alliance ("ACTRA") and The Internet and Television Association ("NCTA").

companyName: Cable One, Inc.

ticker: CABO


text: Our information security organization is led by our CISO, who has over eighteen years of relevant experience, serving in leadership roles across the retail and technology sectors. The CISO is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our CISO reports to our Chief Information and Digital Officer (CIDO), who has more than thirty years' experience in which he has led global digital responsibilities, including leading global cyber teams. Our CIDO reports to the Chief Executive Officer.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: Cybersecurity risk management is a critical part of our overall risk management efforts. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our key systems and information. This program leverages the security-control principles outlined by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0 and other industry-recognized standards, as applicable. Our program prioritizes detection, analysis, and response to known, anticipated or unexpected threats. Some of the processes in place to manage risks from cybersecurity threats include identity and access management, logging and monitoring, penetration testing, vulnerability scanning, security monitoring, employee awareness training, and professional services from third-party providers. As cybersecurity threats evolve, we assess our program and make enhancements as needed to address emerging risks, adopt best practices, and strengthen our overall security posture.

companyName: Karat Packaging Inc.

ticker: KRT


text: We take seriously the security of the data entrusted to us by our customers and the confidentiality, integrity, and availability of our platforms. We have integrated cybersecurity risk management into our broader enterprise risk management framework in an effort to protect our applications, networks, and systems from risks from cybersecurity threats. This strategic integration allows cybersecurity risk management to inform early decision-making processes across the organization.

companyName: MeridianLink, Inc.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our enterprise risk management (ERM) program. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the Company on an annual basis. Risks are discussed with appropriate members of management, who manage risk coverage, monitoring and reporting in the relevant risk function, including our cybersecurity program, and incorporate those activities as part of developing our strategic plan. The ERM program's annual risk assessment is presented annually to our Board of Directors and the Risk Committee of the Board.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: Related to Cybersecurity Risks Our Senior Director of Information Technology ("IT") reports directly to our Chief Financial Officer and is responsible for the strategic leadership and direction of our cybersecurity program, with support from our Associate Director of Information Security and Senior Manager of IT. With over 20 years of experience in IT and cybersecurity risk management, our Senior Director of IT works alongside individuals across other Company management functions to establish and implement our cybersecurity risk management strategy.

companyName: Adicet Bio, Inc.

ticker: ACET


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. Specifically, our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives regular updates from senior management including our Senior Vice President of Information Technology on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our cybersecurity protocol requires that the Chair of the Audit Committee and senior management be immediately notified upon any cybersecurity incident.

companyName: Emerald Holding, Inc.

ticker: EEX


text: Cyber Risk Management Personnel The Company's director of cybersecurity reports to the CIO. The CIO, who reports to the chief executive officer, holds a degree in Business Administration and oversees the information technology and cybersecurity portfolios for the Company with over 25 years of information technology experience and 19 years working directly in the energy and utilities business. The director of cybersecurity has a bachelor's degree in computer information systems, 25 years of information security experience, and holds certified information systems security professional and certified risk and information systems control certifications. The members of the designated cybersecurity team that report to the director of cybersecurity have a combined 57 years of experience. The other members of information technology director level leadership also responsible for managing cybersecurity risks have a combined 95 years of experience and have degrees including Bachelor of Computer Information Systems, information systems management, electronics, electrical engineering, business administration, and accounting, along with certified information systems auditor certification and a cybersecurity fundamentals certificate.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: To evaluate the adequacy of our cybersecurity program, we apply various assessment techniques, such as continuous asset audit, vulnerability management, external attack surface management, source code review, a bug bounty program, threat hunting, red-team exercises, and direct engagement with functional leaders. We routinely examine our cybersecurity defenses through automated and manual vulnerability scanning to identify and correct critical vulnerabilities. In addition, we conduct regular testing to evaluate our security posture and the adequacy of our policy as a whole. We compare our cybersecurity program against industry standards and established frameworks, such as the NIST and Center for Internet Security. Further, we engage in cyber incident simulation exercises executed by senior management and IT/Information Security personnel, involving hypothetical cybersecurity incidents to test our cyber incident response processes. In addition to the foregoing internal review of our cybersecurity program, we periodically engage independent third parties to assess the risks associated with our information technology resources and information assets. Among other things, these independent parties analyze the effectiveness of controls over information technology resources and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes for qualifications under recognized industry standards and for annual certification under Payment Card Industry Data Security Standard (PCI DSS), HITRUST, SOC 2 Type II, and ISO 27001. We memorialize our findings and review the results of these assessments with management and, where appropriate, our board of directors. Relevant modifications are incorporated into our cybersecurity framework to ensure that our systems functionally align with our cybersecurity strategies.

companyName: TaskUs, Inc.

ticker: TASK


text: Engagement of Third Parties Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged a third-party consultant to assist with evaluating and testing our risk management approach. This enables us to leverage specialized knowledge and insights in connection with our cybersecurity strategies and processes.

companyName: INNODATA INC

ticker: INOD


text: We recognize the critical importance of maintaining the safety and security of our technology systems and data and have a holistic process for overseeing and managing cybersecurity and information technology related risks. This process is supported by both management and our Board. The Audit Committee (the "Audit Committee") of our Board has oversight of the Company's risk management program, and cybersecurity is a component of our overall approach to risk management.

companyName: INSEEGO CORP.

ticker: INSG


text: The Divisional Vice President of IT manages both an Information Security team and an IT Risk team within the Department of Information Technology. The IT Risk team is responsible for governance and compliance related to regulations and frameworks for data classification, data privacy, handling of private data and CUI, and internal policies and procedures. The Cyber Security team is responsible for identifying and implementing technologies to mitigate IT risk, enhance data security, and identify and defend against attacks. Both teams work closely together to establish the cybersecurity policies for the Company, evaluate the current risk profile, and to prevent, investigate, mitigate, and remediate any cyber-attacks on the Company.

companyName: Mistras Group, Inc.

ticker: MG


text: Material Impacts from Cybersecurity Threats and Incidents Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyber-attack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Cybersecurity Risk Strategy We drive an aggressive cybersecurity roadmap aligned to internationally recognized cybersecurity frameworks and focused on evolving global threats, new cybersecurity insurance requirements and continuous improvement of incident response. Our cybersecurity program is aligned with the NIST Cybersecurity Framework and we also maintain ISO 27001 certification. Pursuant to the framework, we utilize industry leading cyber solutions and techniques to prevent, detect, and respond to incidents using a layered security model. We conduct an annual gap assessment against the NIST Cybersecurity Framework, the results of which are used to establish goals and measure progress against our cybersecurity roadmap. Based on the gap assessment, for example, we have taken a number of actions intended to reduce our cybersecurity risk, including enhancing our email and end-point security programs, implementing a single dashboard for security monitoring and improving our web application filtering programs. We are focused on the continuous improvement of key processes such as data security, asset management, access control, vulnerability management, incident response, and third-party risk management. We also maintain business continuity management certification to ensure the ongoing review of our business continuity, disaster recovery and incident management processes, including as a result of a cybersecurity breach.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: We are not aware of any risks from cybersecurity threats, including because of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: OS Therapies Inc

ticker: OSTX


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST as well as by engaging experts to attempt to penetrate our information systems. To provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: Quantum-Si Inc

ticker: QSI


text: Our business strategy, results of operations and financial condition have not been materially affected by cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see the section entitled "Risk Factors" in this report.

companyName: Getaround, Inc


text: We rely heavily on our supply chain to deliver our products to our customers and consumers, and a cybersecurity incident at a supplier or partner could materially adversely impact us. As such, we have processes in place to oversee and identify risks from cybersecurity threats associated with suppliers and our use of third-party service providers, including through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data and proprietary algorithms. We also include security and privacy addendums to our contracts where applicable. We require that our suppliers and partners report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties.

companyName: Kenvue Inc.

ticker: KVUE


text: Risk Management and Strategy the oversight of the Board of Directors and Audit Committee, we have implemented and maintained a risk management program that includes processes for systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories.

companyName: Laser Photonics Corp

ticker: LASE


text: The EISP is our core policy for assessing, identifying and managing cybersecurity risks, and it applies to all employees, contractors, temporary employees, and other parties doing business on behalf of or in support of the Bank who, by the nature of their work, have access to our information assets and systems. Broadly, it establishes the administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with the applicable law. To do this, the EISP, among other provisions: • allocates key responsibilities, including the responsibilities of our chief information security officer ("CISO") and our Chief Risk and Compliance Officer ("CRCO") related to cybersecurity risk management; • establishes a security education, training and awareness program, which is intended to influence development of skills and habits to safeguard our information assets; • establishes a risk-based vulnerability management program; • mandates and establishes standards for periodic penetration testing; • provides controls and minimum standards regarding physical security (e.g., systems are located behind locked doors) and operational security (e.g., monitoring existing and emerging threats); • mandates the development, acquisition and maintenance of systems with appropriate security controls (e.g., maintaining appropriate configuration management and control processes and maintaining appropriate patch management processes); and • mandates the adoption of industry standards to address business requirements within a cybersecurity program that leverages both the National Institute of Standards and Technology program and the Center for Information Security Controls in measuring the maturity of our information security program and its adoption of best practices.

companyName: Federal Home Loan Bank of Indianapolis


text: To further strengthen its cybersecurity posture, Tredegar employs third-party consultants who work with the internal audit and information technology ("IT") departments to assess Tredegar's information security program and practices, including incident management, service continuity, and information security compliance programs, and identify areas for improvement.

companyName: TREDEGAR CORP

ticker: TG


text: We devote resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt to the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. Our cybersecurity risk management program is designed to help coordinate the Company's identification of response to and recovery from cybersecurity incidents across all consolidated entities. This includes rapid identification, assessment, investigation and remediation of incidents, as well as complying with applicable legal obligations, communicated promptly and effectively. internal audit team assesses regularly the effectiveness of our internal controls relating to cybersecurity and updates as necessary.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: Risks from cybersecurity threats could materially affect our business strategy, results of operations or financial condition as described under Item 1A in this Form 10-K. There are no known risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect the registrant as of the date of this filing.

companyName: CEDAR FAIR L P


text: The audit committee assists the board of directors by overseeing the steps management has taken to monitor and mitigate cybersecurity threats and risks. The audit committee receives reports annually from management on our cybersecurity strategy and program. Significant changes are reported to the audit committee quarterly. Cybersecurity incidents which are determined by management to be material will be reported immediately to the audit committee.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: Our cybersecurity program includes the following key elements: • Identification. Avanos maintains an inventory of IT assets, comprising hardware and software, as well as the associated risk profiles of those systems and applications. We utilize a risk management strategy and annual risk assessment process to identify key risk areas based on the holistic threat landscape facing Avanos and our industry. To define that threat landscape, we utilize threat intelligence feeds, such as those provided by Health Information Sharing and Analysis Center (H-ISAC) and a third-party vendor, to determine security threats to the Company and other healthcare and life science organizations. • Protection. We utilize multiple intrusion protection systems and processes to protect our technology assets. These protections include Identity and Access Management (IAM), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), Vulnerability Management, Endpoint Detection and Response (EDR), Advanced Anti-Phishing and Awareness trainings, Network and Cloud Security and other protective technologies. Annual audits are conducted to assess these controls.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: There are no management positions directly responsible for overseeing our cybersecurity risk. The Chief Operating Officer ("COO") who functions as our head of IT and certain members of management assist with our cybersecurity efforts and risk assessments. The COO has over 10 years of prior experience in information technology and security.

companyName: Volato Group, Inc.

ticker: SOAR


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers, and our dealers have been the target of cybersecurity incidents and such threats are continuing and evolving, which may cause cybersecurity incidents to be more difficult to detect for periods of time. Our networks and in-vehicle systems, sharing similar architectures, could also be impacted by, or a cybersecurity incident may result from, the negligence or misconduct of insiders or third parties who have access to our networks and systems. A cybersecurity incident could harm our reputation, cause customers to lose trust in our security measures, and/or subject us to regulatory actions or litigation, which may result in fines, penalties, judgments, or injunctions, and a cybersecurity incident involving us or one of our suppliers could impact our business strategy, results of operations, financial condition, or our reputation. For additional information, see "Operational information systems, security systems, vehicles, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford and Ford Credit as well as their suppliers and dealers" on page 20.

companyName: FORD MOTOR CO

ticker: F


text: The Company regards information and data as valuable assets. As a result, we have implemented safeguards to protect corporate informational and data assets. Associated and established technology resources maintain the integrity, availability, and privacy of confidential information of the respective assets. Additionally, we maintain a similar risk-based approach to our third-party vendors including identifying and overseeing cybersecurity risks they present.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: The Board of Directors oversees the Company's information security and risk management program. To support effective governance in managing risks related to cybersecurity, the Board has established an information technology and security committee.

companyName: CORPAY, INC.

ticker: CPAY


text: The Company's board of directors, through its Technology & Cybersecurity Committee, oversees 8x8's cybersecurity risk management strategy. This committee meets quarterly and receives briefings from senior leadership on cybersecurity risk trends, controls testing and efficacy, compliance posture, and incident management preparedness. The full board of directors is informed at least annually on cybersecurity matters, with additional updates as needed.

companyName: 8X8 INC /DE/

ticker: EGHT


text: As noted above, the CIDO provides cybersecurity updates to the Board or its Committees, regularly attends and provides updates with the CISO to the IOC, and has met with the IOC, without other members of management present, during the IOC executive sessions.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT environment for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: Our Board of Directors provides direct oversight of and evaluates our CSRM at least annually. The Board's oversight is led by James Dubois, former CISO and Chief Information Officer (CIO) with the Microsoft Corporation, who communicates with cybersecurity leadership throughout the year. The Board is provided updates via our Enterprise Risk Management program quarterly, while meeting with the CISO at least annually.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Third parties with which we, the Adviser, J.P. Morgan and its affiliates do business or that facilitate our, the Adviser's, J.P. Morgan's, and its affiliates' business activities (e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries) are also sources of cybersecurity risk to us. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises, could affect a third party's ability to deliver a product or service to us or the Adviser, or result in losing or compromising our or our stockholders', clients' and customers' information. Stockholders, clients and customers are also sources of cybersecurity risk to us and our information assets, particularly when their activities and systems are beyond our, the Adviser's, J.P. Morgan's, and its affiliates' security and control systems. However, where cybersecurity incidents occur because of stockholder, client or customer failures to maintain the security of their own systems and processes, they are responsible for losses incurred. J.P. Morgan engages in periodic discussions with external parties concerning cybersecurity risks including opportunities to improve cybersecurity.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: The VP of Information Security oversees the Information Security Steering Committee ("Steering Committee"), which provides education on the Company's cybersecurity programs and controls to key members of the Company. The Steering Committee meets quarterly and is comprised of members from the Executive Leadership Team, including the Chief Financial Officer and Executive Vice President of Business Affairs, as well as the SVP of Information Technology, VP of Information Security, VP of Corporate Communications, SVP of Digital Innovation, and Head of Global Human Resources.

companyName: SKECHERS USA INC


text: The Board receives a report on the results of the Company's annual ERM Program risk assessment, as well periodic updates on the ERM Program, including ongoing monitoring of the Company's risks, as appropriate. The ERM Program has identified cybersecurity as one of the Company's primary risks.

companyName: Xylem Inc.

ticker: XYL


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage a third-party vendor to conduct an annual payment card industry data security certification of our security controls protecting payment information, as well as third-party penetration testing of our cardholder environment and related systems. The results of these assessments are reported to the Audit Committee.

companyName: WideOpenWest, Inc.

ticker: WOW


text: Cybersecurity incidents have not materially affected the Company's results of operations or financial condition, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: NOBILITY HOMES INC

ticker: NOBH


text: We manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessment, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.

companyName: SOCIETY PASS INCORPORATED.

ticker: SOPA


text: The Technology and Operations Committee receives regular and prompt information from the Information Security Department as reported by the CISO, who in turn provides periodic, regular and prompt reporting to the Management Committee on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted the Bank.

companyName: Federal Home Loan Bank of New York


text: Management is responsible for assessing and managing risk at the Company, including communicating key risks to the Board of Directors and its committees. The Board of Directors has primary responsibility for risk oversight, with a focus on the most significant risks facing the Company. With respect to cybersecurity risks, the Audit Committee of the Board of Directors ("Audit Committee") provides oversight for matters specifically relating to cybersecurity and other risks related to information technology systems and procedures, including but not limited to data security and privacy.

companyName: OPENLANE, Inc.

ticker: OPLN


text: The data from the threat intelligence program mentioned above also feeds into a third-party risk evaluation to ensure that any impactful event (cyber or otherwise) experienced by a third-party doing business with Wyndham is considered in the risk profile of that organization.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Program and Strategy We understand the importance of maintaining a robust cybersecurity program to assess, identify, and manage the material risks associated with cybersecurity threats.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Western Digital has in the past experienced cybersecurity incidents of varying degrees involving our technology infrastructure and information systems, including incidents in which unauthorized parties have obtained access to our information systems and networks. While these incidents have at times resulted in some disruptions to our business operations, as of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "The compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents, data security breaches, other security problems, design defects, information system failures or other events could have a material negative impact on our business" in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our choice of tools is shaped by these providers' reputations and the outcomes of our internal evaluation process. We have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing services parties and regularly review the performance of these vendors and monitor for any adverse developments which may impact our own security posture. Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from any such compromise or failure.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: We use a variety of processes to assess, identify, manage, and mitigate material risks from cybersecurity threats. Our cybersecurity risk management process has been integrated into the Company's overall Enterprise Risk Management framework as well as our Internal Audit plan. Our cybersecurity program regularly monitors external and internal threats to assess cybersecurity risk and engages in risk-based remediation. Our program is aligned to the Federal Financial Institutions Examination Council and other applicable industry standards. We conduct regular security awareness training, phishing exercises, and other security awareness programs to keep employees engaged and informed on ways to mitigate cybersecurity risk.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: We have not identified incidents from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, could be reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Part I, Item 1A "Risk Factors" for risks related to cybersecurity.

companyName: TransUnion

ticker: TRU


text: Risk Assessments We assess our systems, networks and data infrastructure to identify potential cybersecurity threats and vulnerabilities via continuous automated processes that are complemented by manual processes that are executed on both a routine and ad hoc basis. These processes are designed to prevent, detect and investigate activities and events that could pose a cybersecurity risk or threat to us, and include, but are not limited to, monitoring and evaluating cybersecurity intelligence information published or provided by certain United States federal government agencies as well as private cybersecurity groups. Our risk assessment processes are conducted, monitored and reviewed by our security and compliance team as well as third-party consultants. In addition, we perform cybersecurity tabletop exercises with our information technology ("IT") department throughout the year. We also engage a third-party consultant to conduct an annual penetration test of our systems, networks and data infrastructure to complement our risk assessment processes and activities. These risk assessments help evaluate the likelihood and potential impact of cybersecurity incidents.

companyName: Antero Midstream Corp

ticker: AM


text: Our audit committee is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. Our Head of IT, or a delegate, informs the CEO of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The CEO is also primarily responsible for advising our Chief Financial Officer regarding cybersecurity disclosures in public filings. The CEO also notifies the audit committee chair of any material cybersecurity incidents.

companyName: RYVYL Inc.

ticker: RVYL


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant program delays and reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—We are susceptible to a security breach, through cyber-attack, cyber-intrusion, insider threats or otherwise, and to other significant disruptions of our IT networks and related systems, or those of our customers, suppliers, vendors, subcontractors, partners, or other third parties" in this Annual Report.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: The Company is currently unaware of any risks from cybersecurity threats, including those from publicly disclosed incidents with respect to other companies, that have materially affected, or are reasonably likely to materially affect the Company, including strategies, results of operations, or financial condition.

companyName: DILLARD'S, INC.

ticker: DDS


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with Information Technology and management. Personnel at all levels and departments are made aware of our cybersecurity policies through engage consultants, or other third parties in connection with our risk assessment processes if required. These service providers assist us in designing and implementing our cybersecurity policies and procedures. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: We have engaged an independent, third-party services provider to assist in monitoring our information technology systems, as well as identifying, assessing, and mitigating the associated cyber risk. With that provider, we conduct periodic assessments of our information security program to evaluate the effectiveness of applicable security controls, which include penetration testing, vulnerability scanning, and red teaming. Our Chief Financial and Administrative Officer ("CF&AO") reviews the results of those assessments with our third-party provider to reasonably address any identified potential gaps. We also utilize a range of tools and services to help ensure material threats are prevented or the risks of such threats are mitigated, which include, network and endpoint monitoring, system patching, user and server backups, annual awareness training, and periodic vulnerability evaluation. Management reviews monthly monitoring reports and meets with our third-party provider on a regular basis to review activities and debrief on any key IT-related issues.

companyName: Savara Inc

ticker: SVRA


text: During 2024, the Corporation did not experience a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Corporation, including its business strategy, results of consolidated operations or financial condition. Refer to the risk factor captioned "Cyber Security Risks and Technology Dependence" in Part I, Item 1A. "Risk Factors" for additional information.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: The Company's cybersecurity program is aligned and integrated into the overall company risk management process through its Enterprise Risk Management Program ("ERM"). At Emergent, ERM is a centralized process that prioritizes, and groups the top risks to our organization into 12 categories, one of which is Cybersecurity. We conduct an Enterprise Risk Assessment ("ERA") annually to proactively identify, assess, respond, monitor, and report risks to our enterprise. Identified risks are assessed and we accordingly will either accept the risk or take action to reduce or avoid the risk. Mitigations against risks are developed, as necessary, and all risks are monitored, reviewed quarterly, and reported to executive leadership and the Board of Directors.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: Role of Management RPC's cybersecurity program is overseen by the Chief Information Officer (CIO) as well as several key members of RPC's Enterprise Technology team. These key leaders collectively have over 50 years of experience in network security, cybersecurity and enterprise risk management. The Chief Executive Officer and CIO receive regular updates on cybersecurity matters, results of mitigation efforts related to existing risks and cybersecurity incident response and remediation. These leaders communicate closely with members of RPC's Information Security Committee (ISC) which oversees the adopted CIS Control Framework, governs the Company's information security programs and monitors the effectiveness of the Company's cybersecurity and technology risk management practices. In addition, ISC provides oversight to align security strategies with business objectives. The Company also maintains business continuity and disaster recovery plans.

companyName: RPC INC

ticker: RES


text: The CISO regularly briefs the cyber risk committee to review and evaluate potential threats and cyber risks to the Company. A cyber risk update is provided on a quarterly basis to the Audit Committee, which has delegated authority from the Board for cybersecurity risk oversight, and reports are made to the full Board on an annual basis.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: In 2023, the Board held an education session with outside experts on cybersecurity. The Company has also implemented a cybersecurity training and compliance program to ensure regular education for all employees. In addition, external parties are engaged to assess Company information security programs and practices, including incident management, service continuity, and information security compliance programs.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: The Company assesses cybersecurity risks on an ongoing basis, including assessing and deploying technical safeguards designed to protect its information systems from cybersecurity threats. The Company has established comprehensive incident response and recovery plans, regularly tests and evaluates the effectiveness of those plans, and maintains cybersecurity risk insurance.

companyName: Sleep Number Corp

ticker: SNBR


text: Nominating and Corporate Governance Committee Our Nominating and Corporate Governance Committee oversees risks associated with data privacy and information security, which encompasses cybersecurity. Our CISO and Chief Compliance Officer, among other executives, provide periodic reports to our Nominating and Corporate Governance Committee and also meet with our Nominating and Corporate Governance Committee to discuss any material events when they arise. The periodic reports are designed to keep our Nominating and Corporate Governance Committee abreast of the Company's cybersecurity practices, as well as risks and trends in cybersecurity threats. Our Nominating and Corporate Governance Committee also has discussions with management focused on evaluating our exposure to cybersecurity risks and cybersecurity practices in place to mitigate such risks. These discussions enable our Nominating and Corporate Governance Committee to be informed of the steps management is taking to detect, monitor and manage cybersecurity risks. These reports to our Nominating and Corporate Governance Committee typically include information on any incidents that have occurred, how they were managed, and any changes to the risk profile of the Company. Our Nominating and Corporate Governance Committee seeks these updates to facilitate proactive governance and to address emerging cybersecurity issues with management.

companyName: AvePoint, Inc.

ticker: AVPT


text: We have implemented an information security program, which is overseen by our CIO and our CISO, that consists of controls designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats. Both our CIO and our CISO each have extensive experience assessing and managing cybersecurity programs and cybersecurity risk across a mix of public and large, private enterprises in the retail space. Our CISO has over 25-years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Leaders and team members who support our information security program have relevant education and industry experience, including various cybersecurity industry certifications.

companyName: Murphy USA Inc.

ticker: MUSA


text: As of the date of this Annual Report on Form 10-K, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the period covered by this report. However, institutions like KKR, as well as KKR's employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of increasingly sophisticated cyber actors. For a discussion of how risks from cybersecurity threats may affect us, see "Item 1A. Risk Factor - Cybersecurity Risks."

companyName: KKR Enhanced US Direct Lending Fund-L Inc.


text: To promote strong governance and oversight in managing cybersecurity risk, we have established a Cyber Risk Council, which is composed of our CTO, DISO, Chief Privacy Officer, Chief Financial Officer, Chief Legal & Administrative Officer, and representatives of our technology and cybersecurity teams. The Cyber Risk Council is responsible for overseeing cybersecurity risk, monitoring performance of the cybersecurity risk management program, providing strategic guidance, and direction of the cybersecurity risk management program, among other oversight and monitoring functions.

companyName: Waystar Holding Corp.

ticker: WAY


text: We engage assessors, consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Arcellx, Inc.

ticker: ACLX


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Franklin Templeton cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from and reporting cybersecurity events. The Company has a policy that supplements the Franklin Templeton cybersecurity incident response plan and addresses reporting and disclosure considerations related to a cybersecurity incident.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: At least annually, we conduct a cybersecurity risk assessment to identify the inherent cyber security risks and threats to which we are exposed to, evaluate maturity and effectiveness of our systems and processes in addressing such identified risks and threats, and to identify any areas for further enhancements. Our cybersecurity risk assessment considers information from internal stakeholders, known and potential information security vulnerabilities, and data from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on prioritization of initiatives to enhance our security controls, make recommendations to senior management, and if necessary, but at least annually, inform the Audit Committee and Board of Directors.

companyName: Karat Packaging Inc.

ticker: KRT


text: The Company relies on TIAA to engage external experts, including third-party IT service providers such as cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, including those applicable to the Company and other products, subsidiaries, and affiliates of TIAA. The Company also relies on TIAA's risk management program and processes, which include cyber risk assessments.

companyName: Nuveen Global Cities REIT, Inc.


text: 1.Identification: We evaluate the activities of our lines of business on a regular basis to identify potential cybersecurity and technology risk, including cybersecurity threats and vulnerabilities. This process takes into account the changing business environment, the technology and cyber threat landscape, and the objectives of the line of business being assessed.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Cybersecurity is also included in our product development life cycle and part of our vendor and business partner evaluation process. Our product development approach considers cybersecurity best practices and builds security controls into our product design. Haemonetics is a member of MedISAO, an industry organization dedicated to improving the security of medical devices, where security issues can be reported securely. We monitor our products for vulnerabilities and follow bulletins, patches and alerts posted to our download center or communicated directly to customers. Additionally, we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with services they provide. This risk assessment is heightened with respect to vendors or business partners that have access to personal information that we collect, maintain or use.

companyName: HAEMONETICS CORP

ticker: HAE


text: We recognize the importance of maintaining the trust and confidence of the customers we serve, our business partners, employees and our stockholders and are committed to protecting the confidentiality, integrity and reliance of our business operations and systems. Effective data protection and cyber security practices, including responsible stewardship of our intellectual property and the secure processing, storage, maintenance and transmission of critical information by us and other third parties with whom we do business is vital to our operations. We have adopted policies and procedures with an intended design to identify, assess and manage risks associated with cybersecurity threats.

companyName: Priority Technology Holdings, Inc.

ticker: PRTH


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy currently include: • Cross-Functional Collaboration and Coordination. Our Enterprise Cybersecurity Services ("ECS") team, led by our Chief Information Security Officer ("CISO"), has first line responsibility for our cybersecurity risk management processes. T he ECS team works in partnership with other internal teams to coordinate efforts, priorities and oversight. These include: our Cybersecurity Executive Council (the "Council"), which is composed of key leaders from stakeholder groups throughout the Company, including the CISO and certain members of senior management;

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: –PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: • PSEG Board —The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG's risk management program and reviewing the most significant risks facing PSEG, including cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risk is mapped primarily to the Board's Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice, as administered by the CISO. • IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, of overseeing PSEG's cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed about cybersecurity risks by the CIDO and/or the CISO, during the IOC's four regularly scheduled meetings a year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risk, a cybersecurity update from the CISO and/or CIDO, and review of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO are regular attendees at IOC meetings. In addition, the IOC meets with the CISO in executive session at each meeting with no other members of management present, and has also met with the CIDO, to whom the CISO directly reports, in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. • Audit Committee—The Audit Committee has the charter responsibility of overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives a cybersecurity update twice a year from the CIDO, either with the full Board or the IOC in attendance. Audit Committee members have a courtesy invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair noted above. • Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Identify We assess our critical operational assets and those that may attract threat actors, identifying any cyber activities that could diminish asset value, hinder operational capabilities, or covertly grant access to threat actors.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: We believe each of the members of the AEOC has relevant work experience related to information security or cybersecurity to allow for the effective oversight of cybersecurity risks. In particular, Richard Palmieri has held numerous roles where he provided oversight of technology functions, Kristin Toth has significant experience managing e-commerce platforms and businesses, and Michael Gould has held senior roles in the technology consulting businesses at Oracle and Hewlett-Packard Company.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Employees are prohibited from keeping open files containing personal information on their computer screen when they are not at their desks. Employees are responsible for locking computer screen when away from workspace. must not share login information with co-workers.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with Information Technology controls; user and employee awareness of cyber policies and practices; information systems configuration management; infrastructure security systems; and cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third - party service providers. We also engage a range of third - party experts in connection with various security implementation, and maintenance activities related to our cybersecurity program.

companyName: CYPHERPUNK TECHNOLOGIES INC.

ticker: CYPH


text: We have also established a cross-functional project team of subject matter experts from across the organization to quickly analyze, mitigate, and remediate potential cybersecurity incidents or vulnerabilities and comply with cybersecurity related reporting requirements. The details of any such cybersecurity incidents or threats are included in the quarterly reports to the Audit Committee.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: Cybersecurity risk management is overseen by the Company's Vice President of Information Technology and Security who is supported by full-time information security staff. The Vice President of Information Technology and Security advises the executive team on the development and implementation of the information security program.

companyName: Vireo Growth Inc.

ticker: VREOF


text: Management ' s Role Holley's information technology team, which is responsible for developing and implementing our cybersecurity program, currently operates under the oversight of our Chief Information Officer ("CIO"). The CIO is generally responsible for managing risks from cybersecurity threats, as well as overseeing the safeguarding and fortification of our networks and systems. The CIO reports directly to the Chief Financial Officer ("CFO"). Combined the two have a proven track record in developing and leading data science teams. The CFO's expertise in business, finance and technology enables him to guide the team in making strategic information technology investments that strike a balance between growth opportunities, risk mitigation and return on investment. The information technology team is comprised of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, penetration testing processes and methodologies, and risk communication and reporting. Our Chief Information Officer ("CIO") is overseeing our cybersecurity program and is responsible for the management and oversight of Holley's cybersecurity program.

companyName: Holley Inc.

ticker: HLLY


text: We conduct risk assessments to identify cybersecurity threats annually as well as in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: LENSAR, Inc.

ticker: LNSR


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: We are developing processes to continuously monitor, analyze emerging threats, and to develop and implement risk mitigation strategies and our management team plays a pivotal role in assessing and managing material risks from cybersecurity threats. As our first key investment, we have hired our Director of Information Security with over 20 plus years of information security experience to oversee our cybersecurity program. Our Director of Information Security reports up to our Chief Information Officer. Together our Director of Information Security and Chief Information Officer have over 40 years of combined experience.

companyName: Archer Aviation Inc.

ticker: ACHR


text: The Trust also relies on its other service providers, including the Trustee and the Custodians, to implement cybersecurity programs and engage external experts, including cybersecurity assessors, risk management and information technology professionals, attorneys, consultants and auditors to evaluate their cybersecurity measures and risk management processes.

companyName: SPDR GOLD TRUST

ticker: GLD


text: Our cybersecurity risk program, managed by our Chief Information Security Officer ("CISO") and the information security team, is conducted under our enterprise risk management framework and operates on a risk-based approach in assessing risks from cybersecurity threats, as follows: • Cybersecurity Threat Scenarios. Our cybersecurity risk assessment process consists of identifying and compiling a catalogue of top cybersecurity threat scenarios relevant to PMI, which facilitates risk assessments with our IT and business stakeholders. • Cybersecurity Maturity Assessment. Our risk exposure from relevant cybersecurity threat scenarios is mitigated by evaluating existing cybersecurity capabilities and corresponding maturity to identify and address areas for improvement. • Cybersecurity Threat Assessment. To establish PMI's current and target cybersecurity risk exposure, residual risk exposure from the most relevant cybersecurity threat scenarios across IT platforms and regions is evaluated and measured based upon the cybersecurity maturity assessments. • Cybersecurity Risk Program. PMI has a cybersecurity risk program to enhance its ability to identify, prevent, mitigate, respond and recover from disruptive cybersecurity threats and incidents and to reduce cybersecurity risk exposure. Improvements in our cybersecurity defense capabilities are prioritized based upon the results of cybersecurity threat assessments and cybersecurity maturity assessments. Identified issues from these assessments form the improvement initiatives under our cybersecurity risk program. As discussed in more detail below under "Governance," the program's key improvement initiatives, their implementation status, and the overall progression in our cybersecurity capability maturity are regularly presented to the applicable governing body within PMI. In addition, our cybersecurity risk program operates in coordination with the following:

companyName: Philip Morris International Inc.

ticker: PM


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks and reasonably address any identified gaps in existing safeguards. We also monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel to manage the risk assessment and mitigation processes.

companyName: Collective Audience, Inc.


text: Annually, our audit committee and board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our members generally receives information that includes a cybersecurity summary and other information discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Profound Medical Corp.

ticker: PROF


text: At the executive management and management levels, the chief information security officer leads the process of assessing and managing material risks from cybersecurity threats. Our chief information security officer has over 25 years of experience as a technology professional with in-depth knowledge of IT management processes and holds multiple degrees and professional designations, including as a certified information systems security professional (CISSP). The chief information security officer also works in collaboration with our chief information officer and chief risk officer and is supported by a cross-functional group of qualified and experienced professionals across various committees and functions. On a quarterly basis, the chief information officer provides a cybersecurity update to the disclosure committee and, on a monthly basis, the information security office team delivers a cybersecurity report to members of the senior executive team. Also refer to Item 10, Directors, Executive Officers and Corporate Governance, for additional qualification, experience and responsibility details.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: Vendor risk management program – We have implemented processes to oversee, identify and manage risks from cybersecurity threats associated with our use of third-party service providers. Our vendor risk management program establishes governance, processes and tools for managing various risks related to third-party service providers, including information security and supplier-related risks. As a condition of working with KORE, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have a documented security incident response plan that provides a consistent approach to identifying and classifying the incident as well as a defined escalation process to management to assess the materiality.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Board's Technology Committee. The Technology Committee reports to the Board as necessary with respect to its activities, including making such reports and recommendations to the Board and its other committees as necessary and appropriate and consistent with its purpose, described below.

companyName: DEXCOM INC

ticker: DXCM