text: During the year ended December 31, 2023, the Company experienced a cybersecurity incident that resulted in a $0.7 million loss as a result of a term loan payment being initiated in error to an account provided in a fraudulent email the Company received. As a result of this incident, with the assistance of an outside independent consultant, the Company reviewed and strengthened its procedures in and around the approval of wire transfers of funds, and believe that these enhanced procedures will protect the Company against the reoccurrence of such incidences in future periods.

companyName: MARIMED INC.

ticker: MRMD


text: During the fiscal year ended September 30, 2024, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations, or financial condition.

companyName: ESSA Bancorp, Inc.

secItem: Item 1C


text: Our management team, including our Chief Executive Officer and Executive Vice President of Quality and Information Systems, is responsible for assessing and managing our material risks from cybersecurity threats. In particular, our EVP of Quality and Information Systems, who reports directly to our Chief Executive Officer, oversees the implementation of controls designed to prevent, detect, mitigate and recover from cybersecurity threats and cybersecurity incidents. Our current EVP of Quality and Information Systems has a Bachelor of Science degree in Mechanical Engineering and over 14 years of experience building and executing information system strategies. The other members of our management team do not have specialized information systems or cybersecurity backgrounds but have general experience managing financial, legal and operational risks. Our EVP of Quality and Information Systems, along with his team, routinely monitors the Company's information systems for cybersecurity threats and will be notified upon the occurrence of a potential cybersecurity incident.

companyName: KEY TRONIC CORP

ticker: KTCC


text: Role of the Board Our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. Our Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for us. This involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and as otherwise needed, and are available to address any questions or concerns raised by our Board on risk management and any other matters.

companyName: Ubiquiti Inc.

ticker: UI


text: The Bank maintains a written Information Security Program based on a collection of information security policies, regulatory requirements, standards, guidelines, processes, procedures, third-party recommendations, and industry best practices. The purpose of this Program is to establish a company-wide approach for assessing and protecting the integrity, availability, and confidentiality of the Bank's information assets.

companyName: ENTERPRISE BANCORP INC /MA/


text: The Company's Cyber Security Committee, in coordination with the Board and Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes, and practices that the Company's Chief Information Officer and its Vice President of Information Security, in coordination with the Company's Cyber Security Committee, develop and implement to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each quarter, the Board discusses the Company's approach to cybersecurity risk management with the Company's Chief Information Officer, and at least annually, or more frequently as necessary, the Company's Chief Information Officer meets with the Audit Committee to discuss cybersecurity risk management.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: As part of its cybersecurity risk management strategy, Key regularly reviews its security and privacy controls in the context of industry standard practices, frameworks, evolving laws, and changing client expectations. Key engages external providers periodically to perform a maturity assessment of the IS Program against industry cybersecurity frameworks. Key also engages external advisors periodically to perform security posture assessments of our environment to proactively identify weakness within our security policy and/or configurations. Summary level results from these assessments are shared to internal stakeholders through Key's Risk Governance committee structure. Key is also subject to cybersecurity and privacy regulatory exams, as required by law for financial institutions.

companyName: KEYCORP /NEW/

ticker: KEY


text: The Board administers its cybersecurity risk oversight function directly as a whole, as well as through its Audit and Risk Committee, which is responsible for oversight of risks from cybersecurity threats. At least quarterly, the entire Board receives an update from the CISO of our cybersecurity program covering topics such as results from third-party assessments, progress toward strategic goals, compliance with regulatory requirements, and certain cybersecurity threat risks or developments, as well as the steps management has taken to respond to such risks. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Bakkt, Inc.

ticker: BKKT


text: Our Chief Information Security Officer ("CISO") partners with management in internal functions, such as finance, legal, and internal audit, in overseeing information security risks, as well as third-party consultants who perform risk-based assessments with recommendations for designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategies, which helps align our programs and strategies with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee and the Board of Directors.

companyName: AAR CORP

ticker: AIR


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: Our Senior Vice President of Business Operations who reports directly to the Chief Executive Officer and has over eight years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in "PART I, ITEM 1A, RISK FACTORS," under the heading "If we experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures;

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: Senior management is responsible for establishing, implementing, maintaining, and testing our policies and procedures related to cybersecurity, disaster recovery and business continuity. Reports on these matters are provided to the Information Security Committee. The committee reports its activities to the full Board of Directors. Our cybersecurity risk management program is built on lines of defense designed to assess, identify, assess, and manage our material risks from cybersecurity threats. Our VP of IT Operations is responsible for coordinating the implementation of cybersecurity framework and reports directly to our Chief Financial Officer.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: cybersecurity frameworks. In addition, Registrant has dedicated employees with cybersecurity technical expertise and also leverages outside cybersecurity firms. Registrant has adopted multi-layered safeguards and educational measures to protect its operations, assets and digital information. Registrant conducts mandatory quarterly cybersecurity training for all employees. Registrant also conducts specialized training for ASUS employees annually on protecting certain types of information relating to the work ASUS and its subsidiaries do with the U.S. government to comply with U.S. government contracting requirements. In addition, Registrant conducts periodic and unannounced phishing tests with all employees and vulnerability assessment and penetration tests.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: IT also provides guidance and support with respect to protecting our information systems from these various threats. This includes advising both management and other personnel on the best practices for keeping these systems safe and a training program that includes random testing for weaknesses.

companyName: APPLIED ENERGETICS, INC.

ticker: AERG


text: Although as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident.

companyName: Launch Two Acquisition Corp.

ticker: LPBB


text: To mitigate cybersecurity risks introduced from our supply chain, we have a dedicated Cybersecurity - Supply Chain Risk Management team. This team assesses new suppliers against best cybersecurity practices, ensures cybersecurity regulations are contractually flowed down and coordinates mitigation actions across the company if a supplier is impacted by a cybersecurity incident. The Supply Chain Risk Management team utilizes industry monitoring services to identify potential supply chain incidents and works closely with our Cybersecurity Team to understand the latest threats affecting our industry.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Dominion Energy's current security posture and regulatory compliance efforts are intended to address the evolving and changing cyber threats. During the past three years, DESC has no t experienced any cybersecurity incidents resulting in a material impact to their business strategy, results of operations or financial condition. DESC has identified the risk that a hostile cyber intrusion could severely impair DESC's operations, lead to disclosure of confidential information, damage Dominion Energy's reputation or otherwise have an adverse effect on DESC's business as disclosed under the Operational Risks header within Item 1A. Risk Factors.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: The Company's IT department, under the direction of its Chief Financial Officer, is responsible for the assessment and management of material cybersecurity risks. The IT department has over 70 years of combined work experience in information technology, including security, auditing, compliance, systems, and programming. The IT department is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through management of and participation in the cybersecurity risk management process described above, and regularly reports to the Audit Committee.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: The Company's Information Security Program includes key program stakeholders who meet regularly to discuss and execute on continually improving the Company's Information Security Program through ongoing initiatives. The Company's Information Security Program focuses on the following key areas to mitigate cyber risks: i. Risk Assessment – At least annually, a risk assessment is conducted that incorporates security assessments and testing conducted throughout the year, ongoing and completed security initiatives, evaluation of the cyber threat landscape, compliance, incidents, etc. The assessment results are presented to executive management and the Board of Directors.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: We depend on information technology ("IT") and operational technology ("OT") for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, point-of-sale processing at our retail sites, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Pursuant to the Trust Agreement and other operational agreements among the parties, the Custodian is responsible for implementing and maintaining measures to protect the systems on which the Trust's operational data is stored and processed, including third party systems, and the information security risks associated with the same. There are no directors, executive officers or other employees of the Trust.

companyName: METLIFE POLICYHOLDER TRUST


text: Our Information Security team monitors alerts and meets to discuss threat levels, trends and remediation tactics. Every identified cyber event is evaluated, ranked by severity and prioritized for response and remediation in compliance with our global Security Incident Management Procedure. Significant events are evaluated for both quantitative and qualitative factors to determine materiality on a case-by-case basis, including, among other factors, potential privacy, operational, financial, or reputational impacts for the Company, and our customers, vendors, shareholders, or other external stakeholders. The Information Security team prepares a monthly scorecard for senior management, summarizing cyber events for the month and reporting on our remedial actions. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.

companyName: OLIN Corp

ticker: OLN


text: We have established a proactive approach to identify and manage material cybersecurity threats which includes, but is not limited to, the following: • Security policies and practices aligned with NIST Special Publication 800-171, Revision 2 (NIST 800-171 Rev 2) and the organization's enterprise risk management requirements; • Annual cybersecurity reporting and strategic update to ITT's Board of Directors; • Enterprise-wide centralized Security Information and Event Management (SIEM); • Regular red-team attack simulations led by industry-leading third-party cybersecurity firms; • Continuous internal and external facing vulnerability management scanning; • Threat intelligence feeds from various external sources (fee and non-fee based); • Threat hunting; • Strategically deployed artificial intelligence-based threat detection technology; • Cyber risk assessment and classification processes; • Cyber threat tabletop simulation exercises; • Cyber Incident Response Plan processes; • Externally led, targeted threat hunting exercises; • Engagement of forensic cybersecurity and data analysis firms (as needed) to conduct independent validation assessments if a breach is suspected and/or validated; • Engagements with third party consultants to build, design, and improve cyber risk management tools and processes; • Third-party technology and service provider risk evaluation process; and • Cybersecurity insurance coverage.

companyName: ITT INC.

ticker: ITT


text: Both the IT Steering Committee and the Board of Directors provide oversight and governance of the technology program and the information security program. Both committees meet at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan (part of the Plan) to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity incidents discussed at committee meetings and the actions taken to the IT Steering Committee on at least a quarterly basis, or more frequently as may be required by the Incident Response Plan, and to the Board of Directors on at least an annual basis. Additionally, the ISO reports directly to the Board of Directors, at least annually, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing security breaches or violations are discussed, as are management's responses and any recommendations for program changes.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Our Information Security team collectively has a combined experience of over 70 years managing and supporting information technology in the biotech industry and oversees our cybersecurity program. They have experience developing and leading cybersecurity programs, including evaluating and implementing tools and technologies that enable defense and response capabilities, and developing critical cybersecurity procedures and training and awareness programs. Our cybersecurity consultant has served in various roles in information technology and information security for approximately 25 years. We also consult with two different service providers who specialize in corporate cybersecurity.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to the Company's risk management, including risks associated with cybersecurity threats. The Chief Compliance Officer will periodically report to the Board on cybersecurity matters, such as the overall state of the Company's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and material cybersecurity incidents.

companyName: SARATOGA INVESTMENT CORP.

ticker: SAR


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. The Company takes very seriously the responsibilities to protect sensitive client information, technology resources, and shareholder value from the risk of cyber threats and incidents. The Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition or results of operation. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: The CSO chairs the Corporate Security Council, which holds regular meetings consisting of senior executive management and reviews and oversees cybersecurity risks. PPL and the other Registrants also maintain a process to review the cyber risks that arise from the use of third-party service providers as well as programs and procedures to mitigate such risks internally and to assess the extent to which such providers effectively manage their own cyber risks.

companyName: PPL ELECTRIC UTILITIES CORP


text: Cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Audit Committee and ultimately, the Board of Directors (the " Board ") where that oversight and review takes place at a regular cadence through quarterly reports. The Company's Security & Compliance Team ("S&C Team") has established policies, procedures, and controls to protect information assets, mitigate risks, and ensure compliance with relevant laws and regulations. The S&C Team regularly reviews and updates security practices, and stays updated on emerging threats, best practices, and evolving regulatory requirements to adapt Upland's security measures accordingly.

companyName: Upland Software, Inc.

ticker: UPLD


text: The Company engages a national security firm in an effort to improve its cybersecurity posture and keep current with evolving cybersecurity risks. The Company's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The Company's technology team tests the effectiveness of its tools with periodic exercises, such as an extensive, simulated attack exercise.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: Role of Management Our Chief Financial Officer is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our Chief Financial Officer works to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: Because of our company's small size and the nature of our operations, our information technology systems are minimal. The records stored on the company's systems are primarily non-financial in nature. We have outsourced all of our internal bookkeeping and accounting functions to a third-party accounting firm that maintains all of our financial records on its systems. We rely on the third party's cybersecurity protections and procedures to safeguard our information, and a consideration of the protections put in place by that firm and any other service provider that receives our information is a critical part of management's decision to engage the provider.

companyName: CKX LANDS, INC.

ticker: CKX


text: We work to educate our employees about cybersecurity risk management and the latest threats to enhance their awareness and to foster a security-conscious culture throughout the organization. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.

companyName: Yext, Inc.

ticker: YEXT


text: Our Head of Information Security and Compliance provides quarterly and as needed briefings to the Audit Committee regarding our company's cybersecurity program and information security risks, including any recent AppLovin-related cybersecurity incidents and possible responses, internal and third-party cybersecurity systems testing, third-party risk management, and other topics related to cybersecurity. The Audit Committee provides updates to the Board on such reports. The Company has adopted an escalation process for review of cybersecurity incidents, based on severity level, by an internal cyber task force with oversight by the Audit Committee. In addition, our Head of Information Security and Compliance provides annual briefings to the Board on our cybersecurity program and risks.

companyName: AppLovin Corp

ticker: APP


text: The Audit Committee receives annual reports from the Security Management Team concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: aTYR PHARMA INC

ticker: ATYR


text: Insider Threats: Employees, contractors, or other trusted individuals may intentionally or unintentionally compromise security by stealing data, sharing sensitive information, or performing unauthorized actions.

companyName: International Seaways, Inc.

ticker: INSW


text: our PRC subsidiary has formulated a cybersecurity contingency plan and will conduct training and safety drills every year in preparation for any emergency cybersecurity incidents; and our PRC subsidiary has established data privacy policies to ensure that its collection of data is conducted in accordance with applicable laws and regulations and that the collection is for legitimate purposes as set out in its agreements.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: The Sponsor promptly eliminates access to all networks, devices, and resources as part of its HR procedures in the event a Supervised Person resigns or is terminated. Such Supervised Person is required to immediately return all Sponsor-related equipment and information to the CISO; The Sponsor has adopted procedures governing the use of mobile devices for the business purposes affecting the Trust;

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Our processes also allow for our Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the committee. Our policy is for the Board and the Audit Committee to receive prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents.

companyName: Expion360 Inc.

ticker: XPON


text: Management is responsible for the day-to-day management of the risks we face, while our board of directors has responsibility for the oversight of risk management, including risks from cybersecurity threats. The audit committee has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once a year and following any material cybersecurity incidents. Our board of directors receives periodic updates from our audit committee regarding matters of cybersecurity. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives.

companyName: Anebulo Pharmaceuticals, Inc.

ticker: ANEB


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages in coordination with our Risk Committee as part of our enterprise risk management program. The Risk Committee regularly reviews the Company's enterprise risk management program and Information Security Program with management and reports to the board of directors.

companyName: RADIAN GROUP INC

ticker: RDN


text: The ISSB is responsible for identifying, evaluating and monitoring information security risk across the Company. In order to fulfill this role, the ISSB engages in a variety of activities, including, but not limited to, the following: a. Review current status of the Company's overall information security program.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: The Company's cybersecurity process and its ability to assess, manage, and remediate cybersecurity risks further centers around good communication among management. Management stays informed on cybersecurity risks through open communication with the Risk Management team, including through various reports and weekly reporting by the Chief Risk Officer to the Senior Management Committee about cybersecurity matters, as necessary. In the event there is a material cybersecurity incident, the Company's policies and procedures set forth an action plan, which includes notification of the appropriate personnel and management within the Company as well as regulators and impacted customers, as applicable. For cybersecurity incidents, including, but not limited to, incidents that are deemed material pursuant to SEC cybersecurity disclosure rules or that significantly impact vital services provided by the Company, notification to the Board will occur at or about the time the incident is discovered. Less severe incidents will be reported by management at the next Board or Risk Committee meeting.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: As part of our overall risk management process, we have established a cybersecurity risk management program for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the Federal Information Processing Standards ("FIPS") Publication.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: The Company's chief executive officer ("CEO") and chief financial officer ("CFO") have primary responsibility for cybersecurity risk management and the implementation of processes for identifying, assessing, and managing material risks from cybersecurity threats. Officers of the Company and its Australian subsidiary review, at least quarterly, developments relevant to the Company's cybersecurity control environment. This group of officers has experience managing public companies and overseeing internal controls associated with cybersecurity. Additional support for information technology ("IT") general controls and specific cybersecurity matters is provided to the Company through third-party IT specialists. In accordance with the Company's policies, including its Disclosure Policy and Code of Business Conduct and Ethics, cybersecurity incidents are to be immediately reported to the Vista management team for resolution. Information technology general controls, including controls to mitigate cybersecurity risks, are considered by management during their assessment of the Company's design and effectiveness of internal controls over financial reporting. Findings from these control procedures are considered by management and, as deemed appropriate to reduce cybersecurity risks to an appropriately low level, are implemented. This may include modification of internal control procedures, adoption of technology solutions, and testing of specific elements of the system of controls.

companyName: VISTA GOLD CORP

ticker: VGZ


text: Our Board of Directors oversees cybersecurity risk as part of its risk management function and has delegated oversight of cybersecurity risk to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management and outside consultants regarding our information systems and procedures and overseeing our cybersecurity risk management processes.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: The Company takes very seriously the responsibilities to protect sensitive information, technology resources, and shareholder value from the risk of cyber threats and incidents.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: VORNADO REALTY LP


text: EOG's dedicated, in-house cybersecurity team, which is responsible for EOG's cybersecurity strategy and planning, oversees such efforts, with assistance from external threat analysts, consultants and service providers. As part of these efforts, such team seeks to identify potential cyber vulnerabilities and opportunities for improvement and then evaluates and implements different cybersecurity technologies to address any identified vulnerabilities and opportunities.

companyName: EOG RESOURCES INC

ticker: EOG


text: We have identified cybersecurity risk as one of our key enterprise risks. One of our Co-Presidents is responsible for managing cybersecurity risk. They develop mitigation strategies and implement controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should it occur. At least annually, they report on this risk and their mitigation work to the Audit Committee of our Board of Trustees, which is the committee that has primary responsibility for overseeing our enterprise risk management program and is composed solely of independent trustees. The Audit Committee reviews and discusses all of our key enterprise risks, including cybersecurity risk, and the enterprise risk management program itself. The chair of the Audit Committee may, at their discretion, report to the Chairman of the Board or the full Board of Trustees regarding any aspect of the program or risks.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: The Cyber Incident Reporting for Critical Infrastructure Act, enacted in March 2022, requires certain covered entities to report a covered incident to the U.S. Department of Homeland Security's Cybersecurity & Infrastructure Security Agency ("CISA") within 72 hours after a covered entity reasonably believes an incident has occurred. Separate reporting to CISA will also be required within 24 hours if a ransom payment is made as a result of a ransomware attack.

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all critical third-party providers to help ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: T2 Biosystems, Inc.

ticker: TTOO


text: Cyber security risk is an area of increasing focus for our Board, particularly as an increasingly significant part of our operations rely on digital technologies. As a result, we have implemented a cyber security program to assess, identify, and manage risks from cyber security threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. This program has been integrated into the Company's overall risk management process.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: The Company's processes are integrated into its overall enterprise risk management program, which includes financial risk, compliance risk and other strategic and operational risks that affect the Company. The processes compliment the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Cybersecurity Committee. In designing these processes, the Company takes into account industry frameworks such as the National Institute of Standards and Technology (NIST), Committee of Sponsoring Organizations (COSO), and International Organization for Standardization (ISO) 27001, and other industry standards. To further improve the effectiveness of its cybersecurity risk management framework, the Company has in the past, and may continue to do so in the future, engage third party consultants, to assist in testing and evaluating our security program.

companyName: N-able, Inc.

ticker: NABL


text: Key elements of our cybersecurity risk management program include, but are no limited to the following: risk metrics and self-assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Walker & Dunlop, Inc.

ticker: WD


text: All 3rd party vendors' security policies are reviewed and updated as part of our annual Security Risk Assessment. Access to sensitive data is strictly regulated and provided on a need to know basis. Access is granted for the express purpose of assisting our customers with technical and training issues related to the use of our SaaS products; or for the purpose of research, design and development of product related features and bugfixes.

companyName: iCoreConnect Inc.


text: Incident Management Plan Our cybersecurity policy includes an incident management plan ("IMP"), which consists of the following processes: • The development, documentation, review and testing of security procedures and incident management procedures, which are continually re-assessed, updated and tested; • The FRS Committee reviews any identified matters by assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The FRS Committee notifies the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately; • The FRS Committee consults with outside experts, if determined that the incident rises to a significant level; • The FRS Committee initiates containment by making tactical changes to the computing environment to mitigate active threats based on currently known information; • The FRS Committee establishes the root cause of incidents, identification and evidence collection from all affected machines and logs sources, threat intelligence and other information sources; • IT personnel recovers and restores normal business functionality, which includes the reversal of any damage caused by the incident and responding as needed; and • The FRS Committee reviews the closure of each incident and conducts a "lessons learned" analysis to improve prevention and ensure the IMP and cybersecurity plans are more efficient and effective.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: We also engage external cybersecurity consultants and use industry-standard tools to help monitor our networks, review vulnerability scans, and conduct penetration testing on a periodic basis. Our risk management practices and integrated into our overall enterprise risk management framework, as discussed in Item 1A – Risk Factors.

companyName: PORTSMOUTH SQUARE INC

ticker: PRSI


text: In addition, to help prevent and detect cybersecurity threats, we provide all employees, including part-time and temporary employees, with monthly cybersecurity and privacy training, which covers timely and relevant cybersecurity topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security.

companyName: Sage Therapeutics, Inc.


text: Our policies, practices, and standards for addressing material risks associated with cybersecurity are integrated into our overall risk management and are based on industry standards including the National Institute of Standards and Technology ("NIST") which aligns the prevention techniques, identification, protection, detection, response, and recovery related to an incident. These controls are tested by our information security organization and by independent third parties. We actively engage with industry groups for awareness of best practices and our third-party provides for industry benchmarking of critical areas within our cybersecurity posture.

companyName: Freshpet, Inc.

ticker: FRPT


text: The ISO leads program development, implementation, and reporting to the Board. The ISO possesses extensive experience with over 25 years securing information systems and data holding many industry certifications including Microsoft Certified Software Engineer + Security, Exchange Security, Comptia Security+, Pentest+, Cyber Security Analyst(CYSA+), Cisco Certified Network Admin + Security enhancement, Cisco Certified Design architect and Certified Ethical Hacker. Recognizing cybersecurity as a shared responsibility, the Company conducts periodic management-level simulations and tabletop exercises with external resources and advisors as needed.

companyName: California BanCorp \ CA

ticker: BCAL


text: The Trust has an Incident Response Plan and Business Continuity/Disaster Recovery Plan, which it relies on the Sponsor's plans. The CCO of the Sponsor is responsible for determining whether a cybersecurity incident is material to the Trust. Pursuant to the Sponsor's policies and procedures, an internal team at the Sponsor is tasked with investigating all reported and suspected security breaches. The Sponsor is required to provide the required notifications without unreasonable delay after the discovery of a breach.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: Cybersecurity Risk Management and Strategy BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of the Company's approach to enterprise risk management ("ERM"). The Company leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams across the firm and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. The Company's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.

companyName: BlackRock Finance, Inc.


text: We have a Cybersecurity Incident Response Plan ("CSIRP") to provide the organizational and operational structure, processes, and procedures for investigating, containing, documenting and mitigating cybersecurity incidents, including keeping senior management and other key stakeholders informed and involved as appropriate.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: The Audit Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's CSO and Company management. This discussion may include reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.

companyName: Upland Software, Inc.

ticker: UPLD


text: Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers. See Item 1A. "Risk Factors" for a further discussion of risks related to cybersecurity.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: We also maintain cybersecurity awareness and training programs through our learning management platform as well as through our internal policies and certifications, which are subject to review and oversight by our management and our Board of Directors. All newly hired team members are required to take training courses with a particular focus on the acceptable use of technology and related cybersecurity risks. E-mail phishing training and testing are performed routinely throughout the year.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as where it deems appropriate, regarding any material cybersecurity incidents. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Funko, Inc.

ticker: FNKO


text: The Board's Oversight of Cybersecurity Risk To ensure thorough oversight of the Company's cybersecurity policies and processes, the Audit Committee is responsible for overseeing our cybersecurity risk and, pursuant to its charter, establishes and oversees procedures for the Company's plans to mitigate cybersecurity risks and respond to data breaches. The Audit Committee receives quarterly reports from the CISO on the Company's cybersecurity risks and enterprise cybersecurity program. The Audit Committee also receives prompt information and periodic updates by the CISO regarding material cybersecurity incidents that meet reporting thresholds. The Audit Committee reports out to the Board as necessary to keep the Board informed of issues or risks relating to the Company's cybersecurity.

companyName: MGM Resorts International

ticker: MGM


text: The Company's Chief Operating Officer ("COO"), Chief Financial Officer ("CFO") and retained third party cybersecurity providers work collaboratively across the Company to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communications, this group monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board when appropriate.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: We have developed and implemented a cybersecurity risk management program intended to materially protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes policies and processes for assessing, identifying, and managing risk from cybersecurity threats as well as a cybersecurity incident response plan.

companyName: Cerevel Therapeutics Holdings, Inc.


text: The team devotes significant resources to our cybersecurity risk management, which focuses on developing and implementing strategies and processes to protect the confidentiality, integrity, and availability of our assets and those of our consumers, customers and employees and seeks to continually improve our policies and practices to protect our platforms, adapt to changes in regulations, identify potential and emerging security risks and develop mitigation strategies for those risks. As part of this effort, the team periodically benchmarks our practices against the NIST Cyber Security and Privacy Frameworks, and other good practice control methods, which include updating technology, developing data privacy and security policies and procedures, implementing and assessing the effectiveness of controls, monitoring and routine testing of our information systems, conducting risk assessments of third-party service providers, providing data privacy and cybersecurity awareness training to employees and designing business processes to protect private data and mitigate the risk of cybersecurity incidents. We periodically conduct tests on our systems to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. We believe that these actions provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks, and we have not had a material cybersecurity threat or attack to date.

companyName: MCCORMICK & CO INC

ticker: MKC


text: Our cybersecurity program is led by our senior vice president, chief information security officer ("ciso"), who is responsible for identifying, assessing, and managing our collective information security and technology risks. Our ciso has more than 20 years of experience in the information security and technology fields, including various leadership roles in several large companies across multiple industries. Those roles have included leading various cybersecurity capabilities and managing information security, business intelligence, and data analytics teams.

companyName: STARBUCKS CORP

ticker: SBUX


text: As of the date of this Annual Report, we have not yet adopted a formal, written cybersecurity risk management policy or enterprise-wide cybersecurity governance framework. However, we are aware of the growing risks associated with cybersecurity threats and are in the early stages of assessing and developing appropriate controls to identify and mitigate such risks in proportion to our size, scale, and operational complexity. We intend to implement a formal cybersecurity risk assessment and governance policy by Q1 2026. This process will include third-party vendor risk assessment, incident response protocols, and reporting mechanisms to management and the sole director.

companyName: VITASPRING BIOMEDICAL CO. LTD.


text: The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with external consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry best practices and regulatory requirements. Our cybersecurity program includes systems and processes for assessing, identifying, and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with information technology controls, information systems configuration management and infrastructure security systems. We also have implemented processes to oversee and identify such risks from cybersecurity threats associated with the use of third-party service providers. We conduct periodic testing of these controls and systems, including vulnerability scanning and penetration testing. We strive to foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training. Additionally, we maintain cyber insurance coverage, including protection against social engineering fraud, to further mitigate potential financial losses from cybersecurity incidents.

companyName: KEWAUNEE SCIENTIFIC CORP /DE/

ticker: KEQU


text: As referenced above, our Risk Council is responsible for day-to-day cyber risk management, and reports to the Audit Committee on these matters. Our management team, including our General Counsel, who serves as the lead of our Risk Council, and our CIO are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our internal security team is made up of experienced professionals that have an average of more than 25 years of IT and security experience, including certifications such as CISSP, CompTia Security+. We also have developed an internal training program to develop new talent within our organization and work with vendor and third-party training programs to mentor and educate these team members to expand and enhance the capabilities of our team.

companyName: ATN International, Inc.

ticker: ATNI


text: We are currently not aware of any cybersecurity incidents or threats that have materially impacted us or our business, financial condition, and results of operations. However, we and our clients routinely face risks of cybersecurity incidents, and there can be no assurance that our security efforts and measures, and those of our third-party providers, will prevent or mitigate a cybersecurity threat or incident that could adversely affect our business. For a discussion of these risks and others that we face, see "Risk Factors" in this Annual Report on Form 10-K.

companyName: Concentrix Corp

ticker: CNXC


text: We maintain a cybersecurity program designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: While we have not, as of the date of this Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, we cannot assure you that we will not experience such an incident in the future. Any cybersecurity incidents, whether or not successful, could result in our incurring additional costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, responding to regulatory inquiries or actions, paying damages or making payments to obtain access to our computer systems, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our business partners and our customers can be unaware of a threat or incident or its magnitude and effects. Further, there are increasing regulation requirements regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm.

companyName: QDM International Inc.

ticker: QDMI


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF


text: The Board and management define risk tolerances in the policies of the Company. The Board maintains oversight of risks from cybersecurity related threats, primarily through the Audit and Risk Committee and the directors that serve on the bank's Executive Risk Committee. The CISO reports to the Executive Risk Committee. The Company's Information Technology/Security Committee and the CISO provide periodic reports to directors that permit them to understand the cybersecurity risk landscape, assess the Company's strategies and resources for addressing cybersecurity threats, measure management's compliance with the defined risk limits and gauge the changing nature of risk inherent in the Company's chosen lines of business and operations and as a result of changing factors within the Company, such as management and personnel changes, and technology changes. This includes an annual program update to the Executive Risk Committee and the Board. All Board members undergo annual cybersecurity training by third-party cybersecurity experts on cybersecurity threats, industry trends, and other topics relevant to financial institutions. This training and their overall knowledge of the financial industry provides a solid foundation for understanding cyber risk and their oversight responsibility.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: To date, risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. For more information about the cybersecurity risks we face, see the risk factor entitled "Our business and operations would suffer in the event of a significant computer system failure, cyber-attack or deficiency in our cyber-security" in Item 1A. Risk Factors.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described in "Risk Management and Strategy" above.

companyName: NextTrip, Inc.

ticker: NTRP


text: We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical, and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk monitoring process related to cybersecurity includes conducting periodic vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to: (i) identify and assess threats and (ii) establish a thorough, risk-based cybersecurity program, including the potential adoption of a formal cybersecurity policy if deemed necessary by the Board, aimed at safeguarding our data, along with the data of our customers and partners. We anticipate that such a program will follow well-organized cybersecurity frameworks and be managed by a central control figure with Board oversight.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: Risk Management and Strategy Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Despite our efforts to ensure the integrity of our computer systems, software, networks, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventative measures against all cyber threats, especially because the techniques used are increasingly sophisticated, change frequently, are complex, and are often not recognized until discovered.

companyName: LogicMark, Inc.

ticker: LGMK


text: Proactive Monitoring and Threat Detection We leverage advanced security technologies and tools to continuously monitor our IT systems and networks. Our 24/7 Security Operations Center is equipped to detect anomalies and respond to emerging threats in real-time, aiming to minimize the risk of undetected cyberattacks.

companyName: Astrana Health, Inc.

ticker: ASTH


text: Cybersecurity oversight at Estrella is integrated into Eureka's IT governance framework. Eureka's IT Governance Committee, which consists of the CEO from the third-party IT provider and Eureka's operations team, oversees cybersecurity risk assessments and controls. The third-party IT provider has more than three decades of experience in providing strategic planning and IT outsourcing to companies, with cybersecurity professionals on staff that specialize in NIST compliance.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect.

companyName: NPK International Inc.

ticker: NPKI


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-term member of both ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.

companyName: Nextpower Inc.

ticker: NXT


text: At the management level, our CIO, who reports directly to the CEO, has over 20 years of experience serving in IT management, software development, and technology-based roles across a variety of industries, including publishing, media and entertainment, and financial and insurance services. Our Chief Information Security Officer (CISO), who reports directly to the CIO, has extensive cybersecurity knowledge and skills gained from over 15 years of work experience serving in security roles for the Company and a variety of financial service firms. Our CISO is responsible for understanding, managing, and communicating cybersecurity risk internally to our management, and works closely with Legal to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: GARTNER INC

ticker: IT


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including service providers, franchisees and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct due diligence of third-party vendors that we engage.

companyName: POTBELLY CORP

ticker: PBPB


text: The Company's cybersecurity function, led by our Chief Information Officer ("CIO") and Director of IT Operations, helps identify, assess, and manage the Company's cybersecurity threats and risks. The Company's CIO has over twenty-five years of technology leadership experience including infrastructure design and management, software development, system implementation, cybersecurity, and network design administration. The Company's CIO has proven success in data protection for systems and has supported a complex global public enterprise environment with operations in over 200 countries. The Company's Director of IT Operations has over ten years of experience developing and leading healthcare solutions and has led the development in web and infrastructure design, serverless architecture, database integrations, SMS, mass-email and mass phone notification solutions. The Company's Director of IT Operations has dealt directly with numerous cyber security threats, breaches, detection and containment activities and strategies under strict requirements and expectations for HIPAA covered entities. The Company's cybersecurity team works in partnership with our managed security service provider ("MSSP") and managed service provider ("MSP") to help identify, assess, and respond to risks from cybersecurity threats. The Company's Security Incident Response Team leverages a cybersecurity managed detection and response partner, which monitors certain of our endpoints, cloud infrastructure, and networks for irregular activity.

companyName: TerrAscend Corp.

ticker: TSNDF


text: One of the key functions of the Board is informed oversight of the risk management process, including risks from cybersecurity threats. The Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect it or its business strategy, results of operations, or financial condition. For more information regarding the expertise of the Board as it relates to cybersecurity, see the section entitled "Governance" in the Company's definitive proxy statement relating to the 2024 Annual Meeting of Stockholders filed with the SEC on April 29, 2024.

companyName: GOLD RESOURCE CORP

ticker: GORO


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see "Risk Factors."

companyName: ImageneBio, Inc.

ticker: IMA


text: Our Board of Managers (the "Board") considers cybersecurity risk as part of its risk oversight function. In March 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Chief Financial Officer on our cybersecurity risks. In addition, our Chief Financial Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems. Our Board of Directors will also receive briefings from our Chief Financial Officer on our cybersecurity risk management program as part of our overall business risk updates.

companyName: New York REIT Liquidating LLC


text: Graphjet Technology recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our risk management team is evaluating and addressing cybersecurity risks in alignment with our business objectives and operational needs.

companyName: GRAPHJET TECHNOLOGY

ticker: GTIJF


text: Our Board has overall oversight responsibility for our risk management, including our cybersecurity risk management. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored. We have not experienced any cybersecurity incidents in fiscal year 2024.

companyName: Minerva Gold Inc.

ticker: MINR


text: Our Chief Business Officer and other members of senior management oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Business Officer and other members of senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: rollout and expansion of cyber security tools and cyber industry awareness and trends.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: Our management team, including Chief Financial Officer and Vice President of Data and Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's collective experience includes over ten years of leading cybersecurity oversight and conducting table-top exercises of incident response scenarios.

companyName: Omega Therapeutics, Inc.


text: Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions. As part of our risk management process, we conduct application security assessments, vulnerability management, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually. We have a unified and centrally coordinated team, led by our Chief Technology Officer and our General Counsel, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Aterian in close coordination with senior leadership and other teams across Aterian. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. These third parties also consult on best practices to address new challenges upon request. Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the Audit Committee and our Board of Directors. As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company or its stakeholders.

companyName: Aterian, Inc.

ticker: ATER


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's use of vendors and other third-party service providers, we conduct continuous passive scanning of the Primoris network, as well as Primoris vendors' external perimeter, on a regular basis to assess any potential vulnerabilities and weaknesses.

companyName: Primoris Services Corp

ticker: PRIM


text: As a regulated financial institution, Trustmark is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation – Financial Privacy Laws and Cybersecurity" included in Part I. Item 1 – Business of this report.

companyName: TRUSTMARK CORP

ticker: TRMK


text: We face a number of cybersecurity risks in connection with our business. We have, from time to time, experienced threats to and breaches of our data and systems. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K. Cybersecurity Governance Cybersecurity is an area of focus for our board of directors and management.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: OPKO Health, Inc.'s strategic approach to cybersecurity governance, characterized by our rigorous third-party assessments, industry certifications, and a clear organizational reporting structure, underscores our unwavering dedication to safeguarding sensitive information and maintaining trust.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Cybersecurity Program: CMS Energy's and Consumers' security function, led by the Vice President of Information Technology and Security and CIO, is accountable for cyber and physical security and is subject to various state, federal, and industry cybersecurity, physical security, and privacy regulations. Their cybersecurity program is responsible for assessing, identifying, and managing risks from cybersecurity threats using industry frameworks, as well as best practices developed by government and industry partners. All employees and contractors are required to complete annual trainings on a variety of security-related topics. Additionally, the companies continuously upgrade technological investments designed to prevent, detect, and respond to attacks. The companies' electric, natural gas, and corporate systems each follow standards, controls, and requirements designed to maintain compliance with applicable regulations and standards, such as MPSC, NERC critical infrastructure protection, and payment card industry regulations. Technology projects and third-party service providers are reviewed for adherence to cybersecurity requirements.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluation suitable targets for an initial business combination. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors is ultimately responsible for overseeing our risk management activities in general and, as deemed necessary by our management team, will be informed of any cybersecurity threats or risks that may arise. Since our initial public offering, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy and results of operations.

companyName: DevvStream Corp.

ticker: DEVS


text: Cybersecurity Governance Management's Role in Cybersecurity Risk Management The Company's chief compliance officer (the "CCO"), in partnership with the Adviser's Chief Information Security Officer (the "CISO"), oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company.

companyName: First Eagle Private Credit Fund


text: For additional information on cybersecurity risks and the impact they may have on our business strategy, results of operations or financial condition see "Risk Factors – Business and Operating Risks – A significant cybersecurity incident, or increased data protection regulations, could materially adversely affect us".

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: Quality Control of Security To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third- party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization for Standardization 27001 Information Security Management System Requirements ("ISO 27001") and the American Institute of Certified Public Accountants' Service Organization Control Type 2 ("AICPA SOC 2"). Various parts of our business maintain independently assessed security certifications, and we also run certification programs to expand the scope of our existing security certifications.

companyName: Criteo S.A.

ticker: CRTO


text: The Company has integrated our cybersecurity prevention and mitigation processes into our overall risk management system and processes. The Chief Technology Officer of Roto-Rooter and the Chief Technology Officer and Chief Information Officer of VITAS are senior executives, with decades of experience in preventing, assessing and managing cybersecurity threats in the private sector as well as government. Both Roto-Rooter and VITAS employ teams of experienced cybersecurity professionals who report to the respective Chief Technology Officer and Chief Information Officer. Both businesses have security incident response plans, pursuant to which they report on the cybersecurity status of the businesses to the Company's Chief Financial Officer and Controller and Chief Legal Officer both regularly as a matter of course, as well as in the event of any potentially material incident. Additionally, Company senior management reports to the Audit Committee on cybersecurity issues on a regular basis, multiple times a year. The Audit Committee's reports to the board after these sessions, include the discussions of the cybersecurity risk management process.

companyName: CHEMED CORP

ticker: CHE


text: Monitoring Cybersecurity Incidents The Head of Information Security implements and oversees processes for the monitoring of our information systems. This includes, but is not limited to, the deployment of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have implemented an incident response plan, which includes actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Board of Directors The Audit Committee oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Company's Senior Vice President Head of Information Technology ("SVP IT") provides reports on cybersecurity matters, including material risks and threats, annually or more frequently as appropriate to the Board, including to the Audit Committee.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: In the three year period ending December 31, 2023, we have not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For additional information regarding whether risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, see Item 1A. Risk Factors — "Risks Related to Our Business," included in this Annual Report on Form 10-K.

companyName: Whole Earth Brands, Inc.


text: At the Company's corporate level, the Information Security and Privacy team monitors the prevention, detection and remediation of cybersecurity incidents and coordinates with the Company's business units to assess information security posture and risk. This coordination includes, for example, performing business impact assessments, conducting risk assessments, and testing and evaluating key aspects of business units' information security programs, the results of which are reported to the Company's senior management and the Audit Committee as appropriate.

companyName: Graham Holdings Co

ticker: GHC


text: During the year ended June 28, 2025, the company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the company, including its business strategy, results of operations, or financial condition. Nevertheless, the company recognizes cybersecurity threats are ongoing and evolving and has seen an increase in cyberattack volume, frequency and sophistication. We are committed to supporting the governance and oversight of cybersecurity risks and to implementing mechanisms, controls, technologies, and processes designed to help the company assess, identify, and manage these risks. For more information on the company's cybersecurity risks, refer to Item 1A, "Risk Factors."

companyName: SYSCO CORP

ticker: SYY


text: Our Cybersecurity Council, comprised of cross-functional senior leaders from operations, finance, internal audit, product management, and information technology teams, also reviews and assesses security risks and issues from a business and technology perspective across all organizations within Watts on a quarterly basis, with the guidance and input of the CIO and VP of Information Security. Our executive management team is responsible for assessing our material, or reasonably likely to be material, risks from cybersecurity threats with the advice and input of the CIO and VP of Information Security, including based on the above and from external advisors as necessary.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For example, we have engaged a multifaceted cybersecurity advisory firm specializing in risk management and compliance, to perform annual cybersecurity risk assessments utilizing industry standard cybersecurity frameworks.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Cybersecurity threats have not significantly impacted our operations, and we do not anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cybersecurity threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures. See

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: Our board of directors maintains oversight of our risk management and the audit committee of our board of directors maintains primary responsibility related to overseeing our cybersecurity risk. One member of our audit committee has experience in cybersecurity and provides perspective regularly. We maintain a cybersecurity program to identify, assess, and manage our cybersecurity threats that is led by our Chief Information Security Officer ("CISO") and General Counsel / Chief Compliance Officer. These individuals regularly engage with the audit committee and other members of senior management to discuss cybersecurity risks.

companyName: Accolade, Inc.


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), who manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • risk assessments designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls; • annual cybersecurity awareness training for our employees; • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team as well as external consultants; and • a risk management process for third-party service providers and vendors that includes due diligence in the selection process and periodic monitoring regarding adherence to applicable cybersecurity standards.

companyName: FLEX LTD.

ticker: FLEX


text: cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; a security team responsible for managing our cybersecurity risk assessment processes and security controls;

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. We use people, process, and technology controls to manage and mitigate cybersecurity risk. Our Chief Operations Officer is primarily responsible for this cybersecurity component and is a key member of the Information Technology ("IT") Committee, reporting directly to the Chief Executive Officer and, as discussed below, periodically to the board of directors. Our Chief Operations Officer has more than 15 years with the Company.

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: Our Board of Directors (the "Board") has not delegated responsibility for cybersecurity matters to a committee. Rather, the Board believes that due to the importance and continually evolving nature of cybersecurity threats, all members of the Board should participate in the oversight of these topics. As a result, management briefs the Board on cybersecurity matters during regularly scheduled Board meetings. Roper's Vice President of Audit Services also periodically briefs the Audit Committee on cybersecurity matters and related risks, as needed.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: -party Security Risk Assessment the potential impact and the this our cybersecurity roadmap and strategies to ensure a robust IT security environment is implemented at our company. We use various tools cybersecurity risk—including, not the the use Managed Endpoint Detection and Response ("EDR") software and Managed Network Detection and Response our Local Area Network ("LAN") ("SOC")

companyName: LESAKA TECHNOLOGIES INC

ticker: LSAK


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Security Officer (CSO), as part of the Board's continuing education on topics that impact public companies.

companyName: Beachbody Company, Inc.

ticker: BODI


text: The Company reports on its information security program, including the results of periodic testing, to the Audit Committee of the Board of Directors. Our Board's Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reviews management presentations concerning cybersecurity-related issues, including information security, technology risks, policies, and risk mitigation programs. The Audit Committee reports matters to the Board of Directors as needed. Our Chief Operating Officer, with the support of our Senior Director IT and third-party consultants, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Operating Officer also works closely with other management positions and external legal counsel to ensure that the Company understands its cybersecurity risk management responsibilities.

companyName: Akero Therapeutics, Inc.


text: We maintain incident response and recovery plans that address our response to cybersecurity incidents, including incidents that we become aware of at third parties that support our operations. These plans guide how we evaluate and assign incident severity levels and reporting thresholds; escalate and engage incident response teams; and manage and mitigate the related risks.

companyName: Walmart Inc.

ticker: WMT


text: The VISEC addresses relevant cybersecurity issues and provides guidance and updates on information security programs and projects. Additionally, the VISEC oversees the coordination of information security mitigation efforts arising from internal assessment, including from the RAP, as applicable. The Board has delegated to the Audit Committee the responsibility of exercising oversight with respect to the Company's cybersecurity risk management and risk controls. Our CIO provides multiple updates each year to the Audit Committee regarding cyber risk management governance and the status of projects that strengthen cybersecurity effectiveness. The full Board regularly receives briefs from the Audit Committee and management regarding the Company's cybersecurity program, including the Company's monitoring, auditing, implementation and communication processes, controls, and procedures.

companyName: Vontier Corp

ticker: VNT


text: oversees our policies and practices with respect to risk assessment and risk management, including the review, in coordination with our management, of our management of cybersecurity. The Audit Committee receives regular updates from the Cybersecurity Committee on the state of cybersecurity risks we face. This includes briefings on any significant cyber incidents and ongoing risk management efforts. These updates enable the Audit Committee to provide informed reports on cybersecurity matters to the full Board.

companyName: Ispire Technology Inc.

ticker: ISPR


text: We also rely on third parties to provide hardware, software, and services relating to our cybersecurity program. We apply similar controls to third-party providers of cybersecurity services that we apply to other IT hardware, software, and services described above. Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

companyName: GoDaddy Inc.

ticker: GDDY


text: Our Chief Technology Officer ("CTO") is responsible for assessing and managing our material risks from cybersecurity threats. We have also established a cross-functional Cyber Steering Committee, which includes our CTO, Chief Information Security Officer ("CISO"), General Counsel, certain business leaders on a rotating basis and representatives of human resources and communications. The CISO, supported by inputs from the CTO team leads, delivers quarterly updates to the Committee on key risks and overall security program posture, as well as monthly strategic updates to the CTO on high visibility and key action items. Our CTO regularly reports to our Board and the Audit Committee.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: Management Oversight The Company's cybersecurity operations are overseen by the Director of Technology, who possesses twelve years of experience in cybersecurity management, information technology infrastructure, and risk mitigation. The Director of Technology participates in industry committees, reports to executive management, and updates Board committees and the Board of Directors. Reporting to the Chief Executive Officer, and working with executive leadership, this role supports cybersecurity risk management and helps aligns them with the Company's broader risk framework. Issues are elevated to the Board by either the Director of Technology or by the Chairs of the IT Committee and Risk Committee, the Chief Risk Officer, or the CEO.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cyber and data security threats. Members of the Board or Audit Committee receive periodic updates from senior management regarding our cybersecurity processes and risks. Members of management that comprise our incident response team include the following officers (or those with similar responsibility): Senior Director of Information Technology, Chief Operating Officer, Chief Financial Officer, Customer Success (if customers are affected), and Vice President of Human Resources (if employee data is affected). As part of our internal response policy, upon confirmation of a breach, a remediation process is initiated, led by our Principal Privacy Officer who chairs an incident response team. This team may include members from relevant departments such as Product Development, Information Technology, Finance, Legal, Marketing, Client/Customer Services and Human Resources, any other relevant units or departments affected by the breach and any additional personnel as deemed necessary.

companyName: AUDIOEYE INC

ticker: AEYE


text: The Company's Chief Information Security Officer (" CISO ") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's Chief Risk Officer ("CRO"), who oversees and supervises the risk function, including the information security, compliance, legal, operational (which includes business continuity, model risk, and third party risk functions) and enterprise risk areas. Our CISO has over 20 years of experience in information technology leadership, eight years of which is experience in leading information security oversight, and others on our information security team have various information security degrees and certifications within applicable disciplines. Our CISO receives reports from our information security team on a regular basis and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: SouthState Bank Corp

ticker: SSB


text: Patnaik worked at Goldman Sachs Asset Management rising to the Global Head of Institutional/Fund Reporting and Reference Data Technology after spending several years developing and leading middle and back-office technologies. Mr. Verizon.

companyName: Lafayette Square USA, Inc.