text: We are establishing incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident.

companyName: Kandi Technologies Group, Inc.


text: Our Chief Security Officer, who reports directly to the Chief Technology Officer and has over 25 years of experience managing information technology and cybersecurity matters, including more than six years at Pinterest, together with our Privacy and Data Protection Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks related to Data, Security and Privacy."

companyName: PINTEREST, INC.

ticker: PINS

secItem: Item 1C


text: Responsible for designing, implementing and managing the Company's framework for assessing, prioritizing and mitigating cybersecurity risk. Manages the Company's privacy program. Responds to incidents and issues in a timely manner, and elevates emergent risks or incidents to the Disclosure Committee. Provides periodic updates to the Board, the Audit Committee and the Disclosure Committee, as applicable.

companyName: US Foods Holding Corp.

ticker: USFD


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery / business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for threats and unauthorized access. We also provide various training programs and tools to employees so they can avoid risky practices and help us promptly identify potential or actual issues and have incident response procedures, service tools to log incidents and issues for investigation, and to follow up on matters already reported.

companyName: Australian Oilseeds Holdings Ltd

ticker: COOT


text: Management is responsible for implementing our cybersecurity program on an ongoing basis to identify, assess and manage cybersecurity risks. Our cybersecurity program is led by our Vice President of Information Systems with support from our Senior Manager of IT Security & Compliance and various other team members. Our Vice President of Information Systems has over 25 years of industry experience, including more than 10 years as the leader of the Company's technology function. On a bi-annual basis, or more frequently as needed, management informs the audit committee of material aspects of our cybersecurity program, including updates on key strategic and operational goals, assessments of cybersecurity risks, updates to any incidents, and the status of our ongoing investments in cybersecurity governance.

companyName: Citi Trends Inc

ticker: CTRN


text: As part of the above processes, we engage with a third-party to review our information security program and related cybersecurity safeguards to help identify areas for continued focus, improvement, and/or compliance. Along with these third parties we ensure that the appropriate personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their impact and potential mitigations. We have implemented the following activities (among others) to mitigate risk: • Periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • Running simulated cybersecurity drills, which are performed both in-house and by the third-party service provider, including vulnerability scanning, penetration testing and disaster recovery exercises; • background checks prior to hire; • encryption of data at rest and in transit; • logging and event monitoring; • threat detection to monitor for malicious activity and anomalous behavior; • malware protection and restricting connections to malicious websites; • data loss protection mechanisms; • third party penetration testing; • cybersecurity risk assessments of our third-party vendors; • reviews by internal and external audit of the effectiveness of information security-related internal controls; • closely monitor emerging data protection laws and implement changes to our processes designed to comply as needed; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Talkspace, Inc.

ticker: TALK


text: Our management team, including our Chief Executive Officer, General Counsel, and Head of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel. Our management team's experience includes a Head of IT with over 30 years' experience leading the IT and cybersecurity functions for companies similar to ours.

companyName: Oncternal Therapeutics, Inc.


text: Consistent with business requirements, components of the Company's information technology and controls are assessed by independent third parties against various frameworks and standards. With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and assesses those systems pursuant to the Company's cybersecurity policies, control standards, and control procedures. Mitigation of identified threats and vulnerabilities may be delayed.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: As of November 30, 2024, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: AFB Ltd


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Audit Committee is primarily responsible for oversight of risks from cybersecurity threats. As set forth in the Amended & Restated Audit Committee Charter, the Audit Committee oversees the steps management takes to monitor and control our data privacy and cybersecurity risk exposure. The Board delegated this responsibility to the Audit Committee in part because it includes members with significant experience and/or expertise in cybersecurity and other technology matters.

companyName: MKS INC

ticker: MKSI


text: The GRCC prioritizes top enterprise and emerging risks for reporting to, and dialogue with, our executive staff at least quarterly, and from this discussion, risks are presented to the Nominating and Governance Committee to consider for further assessment and report-out either to a committee or the full Board as appropriate.

companyName: EQUINIX INC

ticker: EQIX


text: We identify and address cybersecurity threats and risks related to our business using an interdisciplinary approach that includes assessments primarily by our management, IT team and legal department. To defend against, detect and respond to cybersecurity incidents, we employ a multi-layered approach that has been integrated into our overall risk management systems and processes which includes, among other things: conducting proactive privacy and cybersecurity reviews of systems and applications, auditing applicable data policies, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and continuously improving controls and implementing appropriate changes. The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework. Our management performs an annual review of third-party service providers' SOC reports to verify appropriate controls are in place.

companyName: STAR OPERATING COMPANIES, INC.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "A cyberattack that bypasses our information technology ("IT") security systems or the IT security systems of our third-party providers, causing an IT security breach or cybersecurity incident, may lead to a disruption of our IT systems and the loss of business information which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs." in Part I, Item 1A, "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: FTAI Infrastructure Inc.

ticker: FIP


text: External Assessments Our cybersecurity policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, we engage with a third-party auditing firm to conduct cyber audits to assess our controls against the NIST Cybersecurity Framework and CIS controls on an annual basis. The results of these assessments are reported to management and Audit Committee. Cybersecurity processes and controls are adjusted based on the information provided from these assessments.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Risk Management and Strategy RPC approaches cybersecurity as an enterprise-wide risk and has created an accountability framework that includes oversight of cybersecurity risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, RPC has adopted the Center for Internet Security (CIS) framework, which provides prioritized guidance to help defend systems and networks against the most prevalent cyber-attacks as well as support for a Zero Trust. RPC has created a cross-departmental team to screen Company vendors (also known as partners and managed service providers) for vulnerabilities on their own systems and compliance with RPC's policies and procedures, to mitigate risks potentially caused by third party breaches.

companyName: RPC INC

ticker: RES


text: Education and Awareness We provide regular mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools and education to address cybersecurity threats and to communicate our evolving information security policies, standards, processes, and practices.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Risks from Cybersecurity Incidents To our knowledge, Koil Energy has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations or financial condition.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: Our Sr. Director, Information Security and Privacy Compliance, prepares an incident summary and collaborates with the CIO to conduct an initial assessment of information and cybersecurity incidents. They perform an impact assessment with respect to information or cybersecurity incidents meeting certain criteria and elevate the review of any such information or cybersecurity incidents for review by our executive officers.

companyName: CoreCivic, Inc.

ticker: CXW


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity-related risks, see "Our internal computer systems have suffered, and our collaborators or other contractors or consultants may suffer from security breaches, which could result in a material disruption of our product development programs," in Item 1A "Risk Factors."

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: Our cybersecurity risk management and strategy processes are led by our CISO and our CCTO. These individuals have collectively over 50 years of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt, or misuse our critical systems or gain unauthorized access to sensitive information. The structure of our information security program is designed to address applicable laws, regulatory guidance, and industry best practices, including Section 501 (b) of the Gramm-Leach-Bliley Act and its implementing regulations, the Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, and the Center for Internet Security Critical Security Controls. In addition, we leverage certain industry and government associations, vendors, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer, Chief Digital & Innovation Officer, and our Chief Risk Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends, issues, and emerging risks and identify best practices.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: The Company has an IT Security Policy that establishes IT security and rules for the Company. This policy covers both good practice quality guidelines and regulations ("GxP") and non-GxP IT systems. With the assistance of a senior IT consultant, management has evaluated the potential cyber risk associated with each of our information systems, both internal and external, taken appropriate steps to mitigate risks, and assigned specific tasks to our Cyber Incident Response Team members in case of a cyber incident. Our Cyber Incident Response Team currently consists of all remaining members of management.

companyName: Fresh Tracks Therapeutics, Inc.


text: Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer). Currently, the Director of Information Technology role is held by an individual who has approximately 20 years of information technology experience and 11 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Director of Information Technology and up to the Chief Product Officer and other members of executive management, where appropriate.

companyName: 908 Devices Inc.

ticker: MASS


text: Regulatory Compliance We remain committed to complying with all relevant cybersecurity regulations and standards applicable to our industry. Our governance structure is designed to adapt to evolving regulatory requirements and industry best practices.

companyName: DNOW Inc.

ticker: DNOW


text: Roper's Cybersecurity Program Roper maintains a global Cybersecurity Program that outlines required cybersecurity controls for all Roper businesses. Given the decentralized nature of Roper's operating model, day-to-day management and implementation of the Cybersecurity Program and deployment of the program's cybersecurity controls are managed locally by each of Roper's 27 business units. In addition, because Roper's businesses generally operate independently and maintain separate infrastructure and systems, the risk of an enterprise-wide cybersecurity incident is somewhat reduced. While cybersecurity technologies and implementation may differ based on the needs and risk profile of each individual business, Roper has also implemented cyber tools and managed services to centrally monitor certain aspects of the Cybersecurity Program.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: At eHealth, information security is everyone's responsibility, and we value the trust our customers and business partners place in us to protect their sensitive information. We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.

companyName: eHealth, Inc.

ticker: EHTH


text: We have processes in place designed to allow us to oversee and identify risks from cybersecurity threats associated with our use of third party service providers and suppliers through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data and security rating platforms. We also include cybersecurity and information security language in our contracts where applicable. We require our suppliers and partners to report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties. We have established processes to contain the impact of potential security incidents on Perrigo's third party service providers.

companyName: PERRIGO Co plc

ticker: PRGO


text: The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by our Board and delegated to the Audit Committee. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: Trilogy Metals Inc.

ticker: TMQ


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection and onboarding process, review of System and Organization Control (SOC) reports on an annual basis and a regular review of vendor contracts.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: Our Chief Financial Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.

companyName: NN INC

ticker: NNBR


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • a documented set of cybersecurity policies and procedures that specifies the manner in which security controls are implemented; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile,, suppliers, and vendors who have access to our critical systems and information.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: Our strategy toward managing cybersecurity risk in our business is informed by and aligned with the core principles and methods outlined within the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, while including elements of the International Organization for Standardization's ISO/IEC 27001 publication and industry best practices. This does not mean that we seek to meet any particular technical standards, specifications, or requirements, only that we intend to use the NIST CSF or ISO 27001, and other resources as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Inclusive in these frameworks and our program are components for continuous improvement through feedback, self-review and external testing.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: Our board of directors provides oversight of our cybersecurity program and helps guide our strategy for managing cybersecurity risks in the context of our overall risk management system. Our cybersecurity program is managed by our Executive Vice President of Finance and Regional Manager, our internal IT team and our external Chief Information Security Officer ("CISO") whose is responsible for leading enterprise-wide cybersecurity strategy, protocols, framework, standards and processes. The Executive Vice President of Finance and Regional Manager reports to our board of directors, as well as our Chief Executive Officer and Chief Financial Officer and other members of senior management as appropriate.

companyName: InspireMD, Inc.

ticker: NSPR


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: NETFLIX INC

ticker: NFLX


text: To effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by our Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, education, and risk management processes. This responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remediation measures, and maintaining our cybersecurity program.

companyName: Fisker Inc./DE


text: Cybersecurity is an important part of our overall risk management processes and an area of focus for our Board of Directors and management.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: The IT Security team reports the detection, mitigation and remediation of cybersecurity incidents to executive management and the Audit Committee of the Board of Directors. If we were to experience a cybersecurity incident, our Director of IT Security will inform the rest of the IT Security Team, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and in accordance with our incident response plan, notify executive management and the necessary finance, operations and legal team functions. The CIO additionally reports all cybersecurity incidents to the Audit Committee of the Board. Once a cybersecurity incident is reported to the Audit Committee of the Board, and potentially the overall Board of Directors, the Audit Committee, with the input of the IT Security Team and executive management, will discuss impact, determine how to address it and whether or not the incident would require external reporting, if applicable.

companyName: H&E Equipment Services, Inc.


text: We also maintain a third-party risk management program that includes policies and procedures designed to oversee and manage the cybersecurity risks associated with our third-party service providers. The Company conducts risk assessments at the initial onboarding of vendors or service providers who have access to Company systems or data and, subsequently, at regular intervals in an effort to help determine the severity and scope of risks to Company systems, data and operations. In addition to implementing safeguards that attempt to minimize risks associated with a cybersecurity incident, the Company maintains disaster recovery and business continuity plans that include data backup capabilities. We also have incident response procedures designed to address cybersecurity events that may occur despite the safeguards we have put in place. Further, our incident response procedures and business continuity plans are also designed to assist in responding to breaches of any of our third-party service providers.

companyName: Wingstop Inc.

ticker: WING


text: Our Information Security Program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise Information Technology ("IT") environment; • Regular testing of our systems to identify and address potential vulnerabilities; • Integrated planning and preparedness activities supporting business continuity and operational resiliency; • Security teams principally responsible for managing (1) our annual cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; •24/7 monitoring and measurement of cybersecurity threats through our PayPal Cyber Defense Center ("CDC");

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: Quality Control of Security To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization Standardization 27001 Information Security Management System Requirements ("ISO 27001") and the American Institute of Certified Public Accountants' Service Organization Control Type 2 ("AICPA SOC 2"). Various parts of our business maintain independently assessed security certifications, and we also run certification programs to expand the scope of our existing security certifications.

companyName: Criteo S.A.

ticker: CRTO


text: Our Board of Directors and Audit Committee oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. On at least an annual basis, the Board of Directors and Audit Committee receive presentations and reports on cybersecurity risks from our Vice President of Information Technology, which may address topics including our overall assessment of cybersecurity risks, compliance with cybersecurity policies and procedures, third-party test results, the current threat environment, and technological trends and information security considerations arising with respect to our peers in the biotechnology space. The Board and Audit Committee also receive ad hoc reporting as appropriate. Our Vice President of Information Technology, who reports to our Chief Legal Officer, is primarily responsible for assessing such risks. This individual has over 20 years of information technology and cybersecurity experience in the biotechnology industry.

companyName: Foghorn Therapeutics Inc.

ticker: FHTX


text: As of the date of this report, the Company is not aware of any cybersecurity risks that have, or are reasonably likely to, materially affect us, our business strategy, results of operation, or financial condition. Although we have invested in information security and monitor our systems on an ongoing basis, there can be no guarantee that such efforts will in the future prevent compromises to our information technology systems that could have a material adverse effect on our business. For additional information concerning cybersecurity risks we face, refer to Part I, Item 1A, Risk Factors.

companyName: Churchill Downs Inc

ticker: CHDN


text: The Company will contract with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: The cybersecurity team reports to the Chief Information Officer and in January 2024, we hired a Chief Information Security Officer ("CISO") with significant experience in leading cybersecurity teams to assume the leadership of management's responsibilities and governance discussed below.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Our systems face cybersecurity risks, and we have in the past experienced threats to our data and systems. However, to date, these incidents have not had a material impact on our business strategy, results of operations, or financial condition. We can provide no assurance that we will not experience any material cybersecurity threats or incidents in the future. See "Part I—Item 1A. Risk Factors—Failure to maintain the security of our information and technology systems could have a material adverse effect on us".

companyName: Brookfield Asset Management Ltd.

ticker: BAM


text: Cybersecurity is a crucial component of our risk management program and of Cohen & Steers' enterprise risk management program. Cohen & Steers has implemented and maintains various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software and critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to Advisor clients and investments.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested cybersecurity incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for handling and managing potential cybersecurity incidents. We have relationships with a number of third-party service providers to assist with cybersecurity incident containment and remediation efforts.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data. We have integrated cybersecurity risk management into our broader risk management framework. Our risk management team works with our digital & technology organization to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our CIO and CISO meet with the Audit Committee on a quarterly basis and provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of ERM also meets with our executive management team and the Audit Committee on a quarterly basis and with the Board of Directors on an annual basis and reports on applicable cyber risk management processes and activities pertinent to the ERM function. The Audit Committee has also periodically participated in certain of our cyber tabletop exercises.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: We consider our information security management program and the cybersecurity governance structure described below to be part of our overall enterprise risk management program.

companyName: Asana, Inc.

ticker: ASAN


text: We also have a vendor management program addressing cybersecurity risk associated with third-party application providers, hosting services and information technology support services we may retain. This program includes security questionnaires, review of vendor security programs, review of security assessments and assurance reports, vulnerability scans, and direct inquiries and collaboration with our vendors' security personnel. Our vendor management process involves different levels of assessment depending on the services provided by the vendor, the sensitivity of the related information systems and data, and the identity of the provider. It is designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: LEAR CORP

ticker: LEA


text: One of the functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: Both the Bank's management level Risk Committee and the Risk Committee of the Board review all risk assessments and remediations annually.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: Our incident response plan outlines the procedures for reporting, investigating, and remediating cybersecurity incidents, including a framework to facilitate the escalation to our management team and board of cybersecurity incidents, so that our management team is alerted in a timely manner to material information that would be required to be disclosed or reported.

companyName: Celcuity Inc.

ticker: CELC


text: Consistent with the Company's ERM practices, our cybersecurity policies, processes and layers of defense focus on the following areas: • Vigilance. The Company maintains 24/7 cybersecurity threat surveillance in conjunction with a managed security service that monitors system logs and network traffic for indicators of compromise and other suspicious activity, and conducts monthly external vulnerability assessments and annual penetration testing. • System Safeguards. The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including early detection and response antivirus tools, data leak prevention tools and systems, vulnerability scans of data centers, firewalls, and anti-malware functionality and access controls. • Third-Party Collaboration. The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management. The Company has processes in place for identifying and overseeing cybersecurity risks presented by third-party users of the Company's systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those systems. • Training. The Company requires personnel to complete training regarding cybersecurity threats and incident reporting procedures, which reinforces the Company's information security policies and processes. We also require new hires to complete training regarding cybersecurity threats and acceptable use of our information systems. • Incident Response Planning. The Company has established and maintains a cybersecurity incident response plan that outlines an organized and timely approach for responding to and handling security incidents affecting the Company's systems or data, as well as taking appropriate action when the source of the intrusion or incident involved data from a third party.

companyName: PHINIA INC.

ticker: PHIN


text: The Company has an Information Security Committee (the "Committee") to identify, assess, and manage cybersecurity risks and to implement necessary policies and procedures to mitigate those risks. The Committee also coordinates employee education efforts throughout the year. The Technology Risk & Information Security Officer serves as the Committee chair and the day-to-day manager of the Company's information security management systems. The Committee is comprised of members having expertise in information technology infrastructure, data security, risk management, compliance, legal, and business continuity and recovery efforts. The Committee identifies and assesses risks by understanding and evaluating the Company's systems, processes, data, and controls. This information is then augmented through participation by certain Committee members in industry threat intelligence groups designed to share best practices and emerging threats related to cybersecurity. The Committee also completes a full cybersecurity risk assessment annually, which drives the implementation of policies and procedures as well as the scope of third-party testing. The Committee has implemented an information security program that includes a comprehensive set of cybersecurity policies and procedures that follows standards established by the International Organization for Standardization ("ISO 27001"). The policies and procedures within the program, among other things, are to oversee, identify, and mitigate the Company's cybersecurity risks as well as cybersecurity risks to the Company associated with its significant service providers and vendors. The Company's cybersecurity policies and procedures have been independently certified by a third party as compliant with the ISO 27001 standard. The Committee engages third-party experts to perform penetration tests on a periodic basis and to assess whether these policies and procedures are designed appropriately and operating effectively.

companyName: DIAMOND HILL INVESTMENT GROUP INC

ticker: DHIL


text: We maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: BioAtla, Inc.

ticker: BCAB


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third-party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by specialized vendors that assist the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: Our Board of Directors oversees our cybersecurity risk management as part of its general oversight and management is responsible for the day-to-day management of material cybersecurity risks.

companyName: NovelStem International Corp.

ticker: NSTM


text: Engagement of Third Parties Information Security leverages third parties for cyber security services including but not limited to managed security services, external penetration testing, and tabletop exercises.

companyName: Independent Bank Group, Inc.


text: Our board of directors also monitors the Company's cybersecurity risks and exposures and ensures that the company has adequate cybersecurity resources and capabilities to protect its data and systems.

companyName: TELIX QSAM INC.


text: We are firm in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the continuously evolving cyber threat landscape, we are committed to continuous improvement in our cybersecurity practices. Regular assessments, testing, audits, and training are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We are exposed to cybersecurity threats or incidents."

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: Valvoline's Executive Information Security and Privacy Committee provides crucial oversight for cybersecurity risk management. On a monthly basis, the committee reviews key metrics, evaluates risk tolerance, and approves strategic direction to ensure the program aligns with the company's business objectives.

companyName: VALVOLINE INC

ticker: VVV


text: is responsible for the oversight of cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management program to the Information Security Oversight Committee ("ISOC"). The Chief Financial Officer ("CFO"), who serves on ISOC, provides updates to the Audit Committee on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on a quarterly basis.

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: To protect against cybersecurity threats to our business, our Board of Directors and management team take a comprehensive approach to cybersecurity risk management as part of our overall enterprise-level risk management program. Our Board and our management actively oversee the management of cybersecurity risks and have established processes for identifying, assessing and managing material risks from cybersecurity threats.

companyName: Six Flags Entertainment Corp/OLD


text: Our Corporate Information Security Group is led by our Chief Information Security Officer ("CISO") who is responsible for our information security strategy. This strategy includes policy management, security engineering, identity and access management, vulnerability management and cyber threat detection and response through our Security Operations Center. Our CISO has extensive information technology and program management experience as do many of our employees in our information security group. Our CISO, as well as others in our information security group, hold certifications such the Certified Information System Security Professional certification. We believe cybersecurity is a shared responsibility throughout the organization and thus we also manage cybersecurity risks, through a cross-functional committee of members of senior management known as the Enterprise Risk Steering Committee, which includes the CISO. The diversity of this group allows for identification of key enterprise risks from strategic, operational, financial, legal, information technology and compliance perspectives. These individuals receive reporting on our cybersecurity programs and also participate in table-top exercises relating to potential security incidents. The CISO is also the primary point of contact for reporting information security incidents and for coordinating information security activities including incident response and digital forensics. Our CISO reports to our Chief Security Officer who also has extensive experience in the information security space.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: Impact of Risks from Cybersecurity Threats We and the third parties with which we do business have been, and we expect will continue to be, the target of cyber attacks and other cybersecurity threats. To date, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our business, including our business strategy, results of operations or financial condition. However, large-scale cyber attacks perpetrated against other companies in recent years suggest that the risk of damaging cyber attacks is increasing. Notwithstanding our efforts to manage cybersecurity risks as described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, including our business strategy, results of operations and financial condition. See " Risk Factors — Operational and Model Risk " for additional discussion of cybersecurity risks to our business.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Our information security program's basis is a comprehensive set of policies and procedures covering various information security domains (collectively, "Information Security Policy"), including, but not limited to: Access control, Endpoint protection, Third-party oversight, Education, training, and awareness, Network security, Risk management, Incident response, Business continuity and disaster recovery, Data protection and privacy, and Other security domains. Other security assessments. All risks are documented in a central Risk Register and tracked for mitigation and other treatment decisions.

companyName: OptimizeRx Corp

ticker: OPRX


text: Management is actively involved in assessing and managing material risks from cybersecurity threats. The following processes are in place: • Responsible Positions/Committees: The Chief Transformation Officer, Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks. The individuals in these roles possess extensive expertise in cybersecurity. Specifically, the Chief Transformation Officer has over 30 years of experience in extensive technology and executive leadership experience across diverse industries, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private. • Monitoring and Response Processes: We have established processes to inform and monitor cybersecurity incidents for prevention, detection, and resolution using a 24/7 third-party SOC Managed Service. The SOC is responsible for providing alerts, updates, and remediation services as needed by monitoring all technology assets for potential signs of compromise and conducting threat hunt exercises. • Reporting to the Board: Information about cybersecurity risks is regularly reported to the Board of Directors or its relevant committee. This reporting includes updates on the Company's cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: Notwithstanding our commitments to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Please see Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: We have made cybersecurity and the protection of our customer's data a top priority. The critical areas that we consider for our evolving cybersecurity program include access control; data encryption; SSDLC/change management; BCP/DRP; endpoint security; patch management; vulnerability assessments; compliance management; data privacy; incident response; monitoring, alerting, and lodging; employee training; and cyber insurance.

companyName: Fluent, Inc.

ticker: FLNT


text: In addition, we have a management Cybersecurity Committee, which functions as a steering committee, to provide oversight and strategic direction for the cybersecurity program. The Cybersecurity Committee is comprised of our Chief Information Officer & Theatres Chief Information Technology Officer ("CIO"), Hotels Chief Information Technology Officer, Vice President of Information Security, General Counsel, and Chief Financial Officer. The Cybersecurity Committee meets quarterly to review the cybersecurity program, including risks and the status of key initiatives.

companyName: MARCUS CORP

ticker: MCS


text: These providers are selected based on stringent criteria for cybersecurity expertise, particularly their capability to implement and manage NIST and CMMC protocols.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: The Board of Directors of the Company maintains oversight of cybersecurity risks, ensuring the effectiveness of our risk management processes. The Audit Committee is specifically tasked with monitoring cybersecurity risks, evaluating our approach to cybersecurity, assessing emerging threats and ensuring appropriate measures are in place to mitigate risks.

companyName: KENNAMETAL INC

ticker: KMT


text: In response to the ever-evolving cyber threat landscape, Ball utilizes external experts to support continuous improvement across our cyber program, processes and operations. This includes involving independent cybersecurity assessors and auditors to perform ongoing evaluation of our cyber program and operational maturity. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on cyber enhancements. These partnerships enable us to leverage specialized knowledge and insights to ensure our cybersecurity strategy and improvements remain aligned to critical improvements and address relevant threats and risks for Ball. In addition, we also augment and extend our cyber team, using a select few, trusted third-party partners, integrated as members of our global operations. This provides us with expanded global threat intel and enhances our ability to deliver continuous, global cyber operations 24/7.

companyName: BALL Corp

ticker: BALL


text: Our Vice President, Information Technology, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Vice President, Information Technology is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for approving budgets related to the foregoing.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Our management team, in conjunction with the Chief Technology Officer and cybersecurity service providers are responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners. Management relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged in strategic cyber risk management, advisory and decision making.

companyName: Banzai International, Inc.

ticker: BNZI


text: Within the overarching enterprise risk management framework, we have an information security program designed to preserve the confidentiality, integrity, and availability of information or data on our systems and those of our service providers, as documented in our information security policy.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, we have a cybersecurity risk management strategy based on National Institute of Standards and Technology (NIST) Special Publication. 800-30 "Guide for Conducting Risk Assessments" that provide guidelines and principles for information technology security risk management.

companyName: Twist Bioscience Corp

ticker: TWST


text: See Risk Factors in this Annual Report on Form 10-K for a description of the risks from cybersecurity threats that may materially affect us and how they may do so.

companyName: Rekor Systems, Inc.

ticker: REKR


text: Cybersecurity Risks Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see the risk factor entitled "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches" in Item 1A, "Risk Factors."

companyName: Biohaven Ltd.

ticker: BHVN


text: The Company maintains an Enterprise Risk Management ("ERM") program, which includes processes for key risk identification, mitigation efforts, and day-to-day management of risks, including cybersecurity risks. The ERM program is administered by our Internal Audit department and involves our global cybersecurity team, which possesses significant knowledge and expertise in the area of cybersecurity risks.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for information about our cybersecurity risks.

companyName: Regional Management Corp.

ticker: RM


text: The Company has integrated its processes for assessing, identifying, and managing material risks from cybersecurity threats into its overall risk management framework, including through coordination with the Company's internal leader of Enterprise Risk Management, and through quarterly reporting to the Company's Audit Committee. Cybersecurity threats, including as a result of any previous cybersecurity incidents incurred either by us or third parties, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, except as disclosed in the risk factor titled "Our systems, and those of our third-party vendors, contain personal information and payment data of our retail store and eCommerce customers, and other third parties could be breached, which could subject us to adverse publicity, costly government enforcement actions or private litigation, and expenses" in Part I, Item 1A, "Risk Factors".

companyName: CARTERS INC

ticker: CRI


text: We also seek to oversee and identify potential cyber and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party ' s cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We may also collaborate with third-party suppliers to develop and align incident response plans.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: Individual consent to the use of personal information Collecting the minimum amount of personal information Controls over the use and disclosure of personal information Use and retention of personal information related to a cybersecurity incident Transparency for certain cybersecurity activities

companyName: ATEL 14, LLC


text: Company's computer systems involve the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing passwords, protection of Company issued and use of personal devices, managing large data transfers. Employees are directed to immediately contact the Chief Executive Officer if they encounter any suspicious activity.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: Technical Safeguards and Risk Management Processes. We have implemented a risk management framework to identify, evaluate, and address cybersecurity risks. This framework includes the deployment of tools to detect potential threats, the maintenance of detailed incident logs, and the development of risk mitigation strategies. Our cybersecurity measures and policies are subject to regular testing and continuous improvement to adapt to new threats as they arise.

companyName: Axe Compute Inc.

ticker: AGPU


text: Consistent with overall ERM policies and practices, our cybersecurity program focuses on the following areas: • Vigilance: We maintain a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: We deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: We provide routine mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's ERM function, our Chief Information Officer, the Director of IT Security & Risk Management, other members of management and relevant management committees and councils, including the Information Security Governance Committee.

companyName: U.S. SILICA HOLDINGS, INC.


text: The Company has implemented a number of measures to mitigate cybersecurity risk in its operations, including annual cybersecurity awareness training for employees, regular internal phishing exercises, technical security controls, maintenance of certain backup and protective systems, physical and system securities measures, and data security protocols. Once fully integrated, all of our businesses have access to a "cyber risk dashboard" that monitors various risk indicators. The cyber risk dashboard is monitored by our business units. The Company's internal auditors periodically review and audit various processes and controls throughout the organization related to cybersecurity readiness.

companyName: IDEX CORP /DE/

ticker: IEX


text: We maintain a cybersecurity program that includes physical, administrative, and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating of our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Apollo Realty Income Solutions, Inc.


text: access control and CCTV systems (where appropriate) for the physical protection of Anteris systems; and incident response and recovery procedures, for cybersecurity incidents.

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: We periodically undertake cybersecurity audits or other independent assessments, the results of which are reported to our Audit Committee. We have also implemented security monitoring programs designed to alert us of any suspicious activity, and have developed an incident response program in the event of a security breach. We have also engaged a third-party vendor to, among other things, provide continuous monitoring and respond to cybersecurity events.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Systems Safeguards: The Company and its third party vendors deploy systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis.

companyName: Farmland Partners Inc.

ticker: FPI


text: In the event a cybersecurity incident occurs, our incident response plan provides guidance in assessing and responding to the incident. The incident response plan establishes mechanisms by which we determine the scope of and potential damage caused by the incident and determine and execute the appropriate response. The plan outlines roles and responsibilities and sets forth escalation points to ensure that appropriate individuals and groups are notified and provided relevant information depending on the type and severity of the incident. Cybersecurity incidents are reported to each of the Company's Chief Legal Officer, Chief Administrative Officer, Chief Operating Officer and the Chair of the Artisan Risk and Integrity Committee, who oversee the investigation and remain apprised of information regarding the remediation of the incident. This group, based on its assessment of the incident's potential impact to the Company and its stakeholders, will also make determinations regarding further escalation of the incident to the full senior leadership team. The senior leadership team is kept informed of the investigation and is responsible for making certain decisions throughout the course of the investigation, including whether it is appropriate to report the incident to the Board prior to its next meeting.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: While we face regular cybersecurity threats, including ransomware and data breaches, we have not encountered significant incidents during the year ended April 30, 2025. We believe our security measures are adequate, but we acknowledge the rising sophistication of threats. Despite vigilance, system disruptions or unauthorized disclosures remain possible.

companyName: J M SMUCKER Co

ticker: SJM


text: To support the Cyber Information Security Officer in managing cybersecurity and our Chief Risk Officer in managing cybersecurity risks, we have established a cross-functional cybersecurity team that includes experts in various aspects of information security. This team of employees includes individuals with many years of prior combined work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program, including providing immediate notice to our Cyber Information Security Officer and our Chief Risk Officer of any potential cybersecurity incidents. We employ robust and comprehensive processes to respond to cybersecurity risks.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: In addition, we undertake integrated planning activities to support business continuity and operational resiliency. We assess our program's effectiveness through various exercises, including active Disaster Recovery production environment tests, tabletop exercises, continuous vulnerability tests, and annual penetration testing. We conduct company-wide mandatory cybersecurity training as well as periodic employee education exercises, such as phishing simulation email campaigns designed to emulate real-world attacks.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: As of the date of this report, we are not aware of any known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, as discussed under Part I, Item 1A. "Risk Factors, specifically the risks titled " Disruptions to our operational systems could adversely impact our operations, our ability to report financial results and our business" and "Security breaches, cyber security attacks or other disruptions to our information technology systems and networks could adversely impact our operations or compromise the confidentiality of private customer data or our own proprietary information, " the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner, which could materially affect us, including our business operations, results of operations or financial condition.

companyName: Primoris Services Corp

ticker: PRIM


text: Security Event Monitoring. The Chief Technology and Information Security Officer and Information Security personnel work together as centralized security monitoring team and are responsible for the response to alerts generated from a consolidated log collection system. Log collection occurs from various assets and hosted environments. The 24 x 7 monitoring is third-party provided security information and event management tool, and enables threat identification, detects suspicious activity in the environment using a nationally recognized, third-party framework, performs user behavior analytics, and endpoint detection and response. Alerts are investigated to ascertain whether a cyber-incident is occurring or not.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the audit committee of the Board of Directors. The audit committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The audit committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. The audit committee receives periodic reports from our CISO and Chief Legal Officer, or CLO, on material cybersecurity risks, developments in cybersecurity, key cybersecurity initiatives, ongoing priorities and work of the governance, risk, and compliance committee, or the GRC Committee, updated risk assessments of our cybersecurity program, and mitigation strategies.

companyName: Olo Inc.


text: Cybersecurity is an important part of the Board's risk oversight. Although the full Board retains responsibility for cybersecurity oversight, the Audit Committee of the Board (the "Audit Committee") has authority to immediately assess and manage a cybersecurity incident if one were to occur. The Company's senior management briefs the Audit Committee and the Board periodically on cybersecurity matters and would promptly brief the Audit Committee if a cybersecurity incident occurred.

companyName: Turtle Beach Corp

ticker: TBCH


text: The Vice President of Information Technology is responsible for managing overall cybersecurity and cyber risks, including infrastructure, development, and cybersecurity. The Vice President of Information Technology has extensive and progressive experience in supporting information technology risks and objectives in manufacturing companies equivalent to the Company and is a Certified Information Systems Security Professional from ISC2, a leading association for cybersecurity professionals. The Company's Vice President of Information Technology is required to have the following qualifications: • Asset Security; • Security Architecture and Engineering; • Communication and Network Security; • Identity and Access Management; • Security Assessment and Testing; • Security Operations; and • Software Development Security.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: While the board of directors has not formally designated a cybersecurity expert under SEC regulations, the Technology & Cybersecurity Committee includes directors with backgrounds in technology, data governance, and risk oversight, and all directors participate in training sessions to continue to enhance their understanding of cybersecurity issues and their implications for the Company.

companyName: 8X8 INC /DE/

ticker: EGHT


text: Third Party Risk Management. Our vendor security risk management program covers vendors that require connectivity to our systems or access to confidential information. We utilize a trust intelligence platform for managing data privacy and data governance which includes third party risk management. Security reviews are performed periodically, based on vendor criticality, to identify potential security issues with the vendor systems or practices. New vendor contracts are reviewed by our legal and security teams, as appropriate, to confirm that security and data protection are appropriately addressed.

companyName: OneSpan Inc.

ticker: OSPN


text: The companies have an established cybersecurity incident response plan to provide structure and guidance when responding to cybersecurity incidents. In appropriate cases, an incident response team is activated to lead the companies' response. The team is composed of individuals from the cybersecurity team and other departments within the companies with relevant expertise, as well as third-party contractors and vendors.

companyName: IDACORP INC

ticker: IDA


text: The Risk Committee of the Board provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board Risk Committee reviews and approves the Information Security Program and receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board Risk Committee also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The full Board receives reports from the Board Risk Committee related to information cybersecurity.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible under its committee charter for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Vital Farms, Inc.

ticker: VITL


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and other vendors that help us provide critical business services. We have a risk management process to manage cybersecurity risks associated with our use of certain of these third-party providers. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, risk assessments that include a review of security risk and questionnaires.

companyName: EVERBRIDGE, INC.


text: The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program, which is supported by third parties, is designed to allow us to identify, assess, and manage cybersecurity risks. Our external partners include professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and security testing firms. We completed an external lead assessment to assess cybersecurity risks across our business that is informed by the Center for Internet Security Controls. Our Senior Director of IT has years of experience leading cybersecurity teams. We provide cybersecurity training to our employees to address matters such as phishing, email security, and training on data privacy.

companyName: Akero Therapeutics, Inc.


text: The CISO helps maintain a comprehensive security program that serves as a governance framework for information security at Criteo, supports the business goals of the company and details, across problem spaces and security core functions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.

companyName: Criteo S.A.

ticker: CRTO


text: The Audit Committee of our Board oversees our cybersecurity risk management program and meets on a quarterly basis with our Chief Information Officer (CIO) to review our cybersecurity programs and risks, including (as applicable) evolving cyber risks, status on addressing and/or mitigating those risks, significant cybersecurity or data privacy incidents (if any), and status on any key cybersecurity initiatives. These cybersecurity risks and programs are further reviewed and considered by the Board in connection with the company's overarching enterprise risk program.

companyName: TIDEWATER INC

ticker: TDW


text: Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors has ultimate oversight of the Company's risk management. Our Board receives regular presentations and reports on cybersecurity risks, prompt and timely information regarding cybersecurity incidents that meet specified thresholds, and updates on such incidents until they have been addressed.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: The Audit Committee of our Board of Directors has oversight authority to review our plans to mitigate cybersecurity risk. At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards risk-management-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. In such sessions, the Audit Committee generally receives materials including a cybersecurity risk profile scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer, our CISO, and our Data Privacy Officer. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Cybersecurity risks are also considered during separate Audit Committee, Technology Committee and Board of Directors meeting discussions of matters such as enterprise risk management, the annual planning process, our technology transformation, corporate development activity, and other relevant matters.

companyName: Sabre Corp

ticker: SABR


text: In addition, our Chief Technology Officer has extensive experience in running and managing cyber risks at large U.S. telecommunication companies and, prior to joining our company, had led the cybersecurity practice at a business unit at a large telecommunications company and established cyber risk identification, detection and protection practices for enterprise and government customers. Our Chief Technology Officer holds undergraduate and master's degrees in electrical engineering and has served in various roles in information technology at several telecommunications companies for over 30 years, including serving as either the Chief Technology Officer, Chief Information Officer or Chief Product Officer of three public companies.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Security Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Management's Assessment and Management of Cybersecurity Threats. Members of Manhattan's executive management team, along with others from Company senior management, and others with varying areas of expertise, are engaged as part of our Cyber Program: • Chief Financial Officer and Chief Information Officer – Direct management of our Cyber Program falls within our Information Technology department, which reports up through our CIO, who reports to our CFO. Both our CIO and CFO have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as Manhattan. The CFO is a member of our Disclosure Committee, which is responsible for determining whether a Cybersecurity Incident is "material" for purposes of publicly reporting cybersecurity incidents, and is a member of our "Core Response Team" under the Company's Crisis Response Program. Our CFO also chairs our management Cybersecurity Committee. • Chief Legal Officer – Our CLO has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims, and loss mitigation. Our CLO also is member of the Disclosure Committee and the Core Response Team. • Senior Director, Global Security – Our Senior Director, Global Security, has managed our Cyber Program for seven years. He manages its day-to-day operations, oversees our security analysts and engineers, and leads our Cybersecurity Committee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Committee – Members include, in addition to the CFO and SD, Global Security, business representatives of Manhattan's material business lines and administrative departments, cyber-risk operational heads from our material business lines, and our VP, Contracts and Administration (or their designee). The Cybersecurity Committee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts, and make recommendations to leadership. • Crisis Response Team – Pursuant to our Crisis Response Program, our Crisis Response Team, which comprises the CLO, CFO, Chief People Officer and Chief Marketing Officer, and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the CLO, on behalf of the Team, will report to or engage the CEO and the Chairman of the Board if and when an incident becomes a crisis or potential crisis.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: Our business continuity program follows industry standards for disaster recovery practices. Our program includes multiple components that act as an additional line of defense among them are regular functional recovery and tabletop exercises; cybersecurity exercises; protected backups for critical data; recovery time objectives; and recovery point objectives including achievability metrics, application criticality, program audit and maintenance, awareness and training, business impact analysis, and risk evaluation and controls. Board of Directors is tasked with oversight of the Company's cybersecurity, information governance, and privacy programs.

companyName: Unique Logistics International, Inc.


text: Our Risk Oversight Committee provides a quarterly report to the Board of Directors on enterprise risk management matters overseen by that Committee, including cybersecurity-related matters. Our Board of Directors also periodically participates in tabletop exercises conducted by senior management, with the assistance of outside counsel as needed, as part of risk management and disaster-related planning to validate, test, and assess the effectiveness and adequacy of certain roles and decision-making processes in the event of a cyber-incident.

companyName: ETSY INC

ticker: ETSY


text: We are a blank check company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software in. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with. We may also consider in the future whether to engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our processes.

companyName: Battery Future Acquisition Corp.


text: In the event of a significant cybersecurity incident that escalates to a corporate crisis, the executive team and the Board will be engaged in alignment with the corporate compliance and risk protocols.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Related to Cybersecurity Risks The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management, including from our Vice President, Information Technology (the "VP of IT"), regarding cybersecurity matters, such as relevant cybersecurity risk assessments, as applicable. We have established a process for the Audit Committee to be notified in the event of significant cybersecurity threats or incidents.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: While we have not yet experienced any material impacts from a cyber attack, any one or more future cyber attacks could materially adversely impact the Company, including a loss of trust among our customers and consumers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands. In addition to the risk management processes identified above, Whirlpool also maintains active knowledge security and data privacy programs. Leveraging policies and governance, ongoing training and awareness as well as strong controls and systems-based approaches, these programs focus on protecting Whirlpool confidential information and compliance with applicable data privacy and data protection laws in all countries where we do business.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Testing of our security controls in connection with the auditing of our financial systems is completed annually. At least annually, we conduct training and awareness for our employees to help identify, avoid and mitigate cybersecurity threats.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: We have also established an Incident Response Team and associated protocol led by AES' CISO that governs our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this protocol provides for escalating notification to our CEO and the Board. We regularly practice our incident response through executive tabletop exercises.

companyName: IPALCO ENTERPRISES, INC.


text: Our management recognizes the importance of implementing and maintaining robust cybersecurity measures designed to address cybersecurity threats that pose risks to our business and operations. Therefore, we have established a comprehensive framework to identify, protect against, detect, respond to, and recover from cybersecurity incidents ("Incidents"). Our cybersecurity measures are designed to provide a structured approach to managing cybersecurity risks for an effective, efficient, an orderly response to any Incident.

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, disaster recovery plans, risk assessments, network security controls, access controls, systems monitoring, and cybersecurity insurance.

companyName: Gamida Cell Ltd.


text: Employees are the first line of defense against cybersecurity measures. Every employee is responsible for protecting Bank and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.

companyName: BV Financial, Inc.

ticker: BVFL


text: The Company has developed and implemented a cybersecurity program (the "Program") designed to identify, assess, and mitigate material cybersecurity related risks. The Company's program leverages recognized frameworks and standards, including National Institute of Standards and Technology Cyber Security Framework, the Center for Internet Security Critical Security Controls, and the Payment Card Industry Data Security Standards, to assess, organize, and improve our program. As part of the Program, the Company maintains various safeguards to help protect the confidentiality, integrity, and availability of its information systems and data, including: • layered technical controls designed to help detect, prevent, and mitigate cybersecurity threats to Company assets; • utilization of a third-party managed detection and response service provider to monitor for cybersecurity threats, ingest threat-intelligence, and coordinate incident response efforts; • policies, procedures, and standards that are utilized to outline the Company's expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity training and education for our employees; • practices for monitoring cybersecurity risks of key third-party service providers; and • incident response plans that provide a framework for the Company's response to cybersecurity incidents.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: Cybersecurity is an integral part of the Company's overall risk management program. The Company takes a comprehensive approach to cybersecurity and involving key stakeholders in oversight and decision-making processes.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I. Item 1A. "Risk Factors—General Risks—Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: Information security, which includes cybersecurity, is a significant operational risk facing our business. Cybersecurity risks result from intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our or our clients' or third parties' operations, systems or data.

companyName: SANDY SPRING BANCORP INC


text: The CISO will review and update the risk assessment at least annually. Additionally, at least annually (for external hosted applications) and following any significant change in operations (for all applications), the CISO is responsible for gathering information about the operation of previously identified risk mitigation strategies and any changes to information classification, identified risks or risk mitigation strategies. The CISO must evaluate the risk mitigation strategies for ongoing adequacy. The evaluation must be documented in a form prescribed by the CISO. If the CISO concludes that risk mitigation strategies are inadequate for an Information System containing confidential or internal information, action will be taken to either correct the inadequacy in a timely manner or discontinue use of the Information System.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated the oversight of cybersecurity and other IT risks to the Board's Risk and Audit Committee. As part of this oversight, we created the ISAT. The ISAT is comprised of cybersecurity consultants and senior managers and executives from multiple functions within MARA, including IT, finance, legal, internal audit and operations. Members of the ISAT have extensive professional experience in cybersecurity, software engineering and information technology and hold industry-recognized certifications, including Certified Information Systems Security Professional (CISSP) and Systems Security Certified Practitioner (SSCP). The ISAT oversees our information security program and our strategy, including management's implementation of cybersecurity risk management. The ISAT meets at least semi-annually to discuss matters involving cybersecurity risks.

companyName: MARA Holdings, Inc.

ticker: MARA