text: Our CISO chairs our Cybersecurity Advisory Council ("CAC"), a cross-functional management committee that drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management. The CAC is sponsored by our Chief Financial Officer and is composed of senior leaders from our brand information security, data privacy, legal, internal audit and information technology teams. The CAC meets at least quarterly and has responsibility for oversight of our cybersecurity strategic direction, risks and threats, priorities, resource allocation, capabilities and planning. The CISO and her team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with our cyber incident response plan. Additionally, the CISO informs our Disclosure Committee on a quarterly basis, or more frequently if needed, of any cybersecurity risks or incidents or other information system matters that may affect our business strategy, results of operations or financial condition.

companyName: CARNIVAL PLC

ticker: CUK


text: The Senior Director of IT acts as the Incident Manager and meets regularly with our Incident Response Team, including members of Financial Risk Management, IT Security and Human Resources senior management to discuss the necessary measures to take prior to and during an incident. In the event of an incident, the Incident Manager meets regularly with the executive leadership team and keeps them apprised of the status of any incident during the incident response. Our Board and the Audit Committee also receive prompt and timely information from the Senior Director of IT and executive leadership regarding any cybersecurity risks that meet certain reporting thresholds, as well as ongoing updates regarding any such risk. Finally, the Incident Response Manager briefs corporate leadership on lessons learned from the incident during or after the recovery phase.

companyName: Scilex Holding Co

ticker: SCLX

secItem: Item 1C


text: The Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic training and testing for personnel regarding cybersecurity threats, which reinforce the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident; such plans are tested and evaluated periodically. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Company's executive leadership team and cybersecurity Steering Committee, which regularly interacts with the Company's Vice President of Information Technology and other members of the cyber team and management.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Cybersecurity is overseen by our Board of Directors with assistance from the Audit Committee. Our Board of Directors receives quarterly reports from management which may address a broad range of cybersecurity and IT topics, including trends, regulatory developments, data security policies and practices, cybersecurity incidents, current and projected threat assessments and ongoing efforts to prevent, detect and respond to critical threats.

companyName: FLUOR CORP

ticker: FLR


text: Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our information security team, internal governance processes, and by reviewing the results of internal and third-party assessments and audits. Our Chief Financial Officer regularly reports directly to the audit committee on our cybersecurity program and our efforts to prevent, detect, mitigate, and remediate cybersecurity risks.

companyName: Perception Capital Corp. IV


text: Our business operations rely on the secure processing, storage, and transmission of certain confidential, sensitive, proprietary, and other information, as well as personal information about our customers and employees.

companyName: CHARLES & COLVARD LTD


text: Our Board devotes significant time and attention to our cybersecurity and information technology risks. Our Board executes its cybersecurity risk oversight function as a whole and by delegating responsibility to our Audit Committee. Our CISO and Chief Information Officer present to our Board annually and to our Audit Committee at least twice each year on a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments and management's ongoing efforts to prevent, detect and address internal and external cybersecurity threats specific to us. These briefings also include periodic third-party cybersecurity program assessments and benchmarks and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented in an IT Risk Dashboard, which is shared with our Audit Committee for awareness several times each year. Our full Board also has access to these materials. Finally, we provide periodic cybersecurity training to our Audit Committee and Board to further cybersecurity awareness and risk oversight.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Our Information Security Department, reports to our Vice President and Chief Information Officer and is headed by our Director of Information Security. This team is comprised of full-time information security professionals, is responsible for the implementation of our cybersecurity strategy, including assessing and managing material risks from cybersecurity threats. Our Vice President and Chief Information Officer is an experienced information technology professional with 34 years of experience in the industry, including oversight of our cybersecurity department and has a degree in Management Information Systems. The Information Security Department ultimately reports to, and regularly informs, our Chief Information Officer and Chief Financial Officer with regard to cybersecurity risks and incidents. Our Chief Financial Officer is responsible for oversight of our response to cybersecurity incidents, as appropriate. In addition, our executive management discusses cybersecurity issues quarterly.

companyName: APTARGROUP, INC.

ticker: ATR


text: We are heavily dependent on information technology systems and networks, including the Internet, third-party services and artificial intelligence, across our supply chain, including for product design, production, forecasting, ordering, manufacturing, transportation, sales, and distribution, as well as for processing financial information, external and internal reporting purposes, retail operations and other business activities. We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including, but not limited to, risks from ransomware attacks, security breaches, cyber-attacks or other malicious activities by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations, computer viruses or other malicious codes, unauthorized access, phishing attacks or unauthorized uses, as part of our overall risk management framework and processes. Our risk management framework considers cybersecurity risks alongside other company risks to evaluate their nature and severity, as well as to identify mitigations and assess the impact of those mitigations on residual risk.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: As previously disclosed, we were targeted by a complex criminal scheme in March 2023, which resulted in fraudulently-induced outbound wire transfers to a third-party account (see Note 18 to the accompanying consolidated financial statements). The Company self-discovered the fraudulent activity and promptly contacted the remitting bank, receiving bank, dispute resolution experts, and federal and local law enforcement authorities. Moreover, we quickly informed the audit committee and regularly provided them with updates during investigation and recovery efforts. As a result of the fraud loss, net with funds recovered, and professional fees incurred related to an independent forensic investigation and efforts to recover the funds, we recognized $2.7 million of loss. We are unaware of any other significant security breaches at any of our business locations.

companyName: ARGAN INC

ticker: AGX


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology ("NIST"), employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act ("GLBA"), the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool ("RSAT"). Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits to regularly evaluate our cybersecurity posture in conjunction with obtaining cybersecurity insurance coverage to mitigate the potential financial impact of cybersecurity incidents.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: For additional description of cybersecurity risks and potential related impacts on Commvault, refer to the risk factor captioned "Risks Related to Technology and Security – We may be subject to IT system failures, network disruptions, cybersecurity incidents and breaches in data security" in Part 1, Item 1A. "Risk Factors."

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly-evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP on our behalf to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo ' s risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Cybersecurity risk management is part of our Enterprise Risk Management (ERM) Program, which includes specific controls and processes for mitigation, monitoring and reporting associated with those risks. Those controls and processes include the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The Risk Oversight committee of the board of directors oversees and annually reviews and recommends for approval and the full board of directors annually reviews and approves our Enterprise Security Policy, Security Incident Response Plan, and Business Resiliency Management Policy.

companyName: Federal Home Loan Bank of Topeka


text: The Governance Committee is required by its Charter to consist of not fewer than three independent directors, and the committee currently consists of five independent directors. The Governance Committee typically meets on a quarterly basis. At each meeting, a written cybersecurity brief from IT leadership is provided. These reports include a review of emerging cybersecurity risks and developments and updates to our cybersecurity risk assessment program. The Governance Committee provides regular reports to the full Board of Directors on its oversight of the Company's cybersecurity risks and risk management system.

companyName: NEOGEN CORP

ticker: NEOG


text: While we develop and maintain protocols, controls, and systems, that seek to prevent cybersecurity incidents from occurring, we must constantly monitor and update these protocols, controls, and systems in the face of sophisticated and rapidly evolving attempts to overcome them. The occurrence of cybersecurity incidents could cause a variety of material adverse impacts on our business, although no such incident has had any such impact to date. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "Security breaches and other disruptions to our information technology infrastructure could interfere with our operations and expose us to liability." and Item 1, "Business – Environmental and Other Regulations - Safety Management System Requirements" in this report.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: The CIO monitors, evaluates and adjusts the Bank's Information Security Program, considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, technology development initiatives, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems. The Management Audit/Compliance Committee reviews and coordinates the status and results of information security controls, network penetration, business continuity/disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Technology Coordinating Committee of the Bank, and presents cyber/information security updates on a periodic basis to the Chief Executive Officer and the Bank's Board of Directors.

companyName: BankFinancial CORP


text: The Company also appointed a certified Chief Information Security Officer ("CISO") with significant public and private cybersecurity experience. The CISO is dedicated to assessing the Company's data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk. In addition, the Executive Risk Committee or ERC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, annually reviews the Company's cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company. The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company's CISO to assess the Company's vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business of cybersecurity threats. The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, report on material cybersecurity risks.

companyName: EVEREST GROUP, LTD.

ticker: EG


text: We engage in the periodic assessment and testing of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security controls and operating effectiveness. The results of such assessments, audits and reviews are reported to the Executive Compliance Committee and the Compliance Subcommittee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: UpHealth, Inc.


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigation strategies. We employ various tools and services for such purposes, including network, cloud and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We also have a cybersecurity risk assessment process, which helps identify our cybersecurity threat risks by considering certain industry standards as well as by engaging third parties to assess the security posture of our information security program.

companyName: Sunrun Inc.

ticker: RUN


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. We invest in cybersecurity to protect intellectual property, customer and employee data, manage reputational risk, and maintain business continuity across our environment. We strive to ensure ongoing compliance with the requirements under applicable standards including the Payment Card Industry Data Security Standards and relevant data privacy and protection laws and regulations. Additionally, our teams reference the standards, guidelines, and practices from the NIST Cybersecurity Framework (CSF) to align our cybersecurity program and risk management practices. The foundation of our cybersecurity framework is based on written policies that govern different cybersecurity process areas.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: The audit committee of our Board (the "Audit Committee") is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, Audit Committee members generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Executive Director of IT. Members of the Audit Committee and the full Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Materials of our cybersecurity threat risk management and strategy processes are also periodically reviewed with the full Board.

companyName: DURECT CORP


text: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner. Cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: The Company takes measures designed to mitigate risks associated with third-party vendors that have access to confidential information or provide business critical functions. Through its vendor management program, the Company screens these third-party vendors to assess their data security protocols both prior to initial engagement and periodically thereafter for compliance with the program standards.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Our cybersecurity risk management program is aligned to our business strategy and has been incorporated into our enterprise risk management process.

companyName: AGENUS INC

ticker: AGEN


text: Board considers cybersecurity risk as part of its risk oversight function and oversees our cybersecurity and other information technology risks and management's implementation of our cybersecurity risk management program.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our CIO, who reports to our chief executive officer. We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards. Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.

companyName: biote Corp.

ticker: BTMD


text: We face rapidly evolving and sophisticated threats of breaches of our systems and networks as well as those of our suppliers and third-party service providers. To mitigate this threat to our business, we take a comprehensive approach to cybersecurity and expend corresponding resources on cybersecurity risk management, strategy, and governance.

companyName: Elastic N.V.

ticker: ESTC


text: Tyler's governance practices are supported by several segments of Tyler's senior leadership, management, and teams. This includes security working groups and a security governance committee. The security governance committee, which meets on a quarterly basis to review the threat landscape and security initiatives at Tyler, is led by the CISO and includes senior leadership from Tyler's legal and operational teams, as well as the president of each of Tyler's three operating groups and Tyler's President & CEO.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: We employ a layered approach to cybersecurity, implementing a range of technical and procedural controls to protect critical systems and data. These controls include (i) firewalls and intrusion detection and prevention systems to monitor and block unauthorized access attempts, detect and prevent malicious activity and safeguard network infrastructure, (ii) encryption, including secure protocols and multi-factor authentication, to protect information in transit and at rest and (iii) secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to manage emerging cyber threats.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Members of the Information Security Governance Committee oversee communications with the Board of Directors regarding material cybersecurity incidents and provide the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to AMG's information security practices and procedures. The Board of Directors is also regularly provided with cybersecurity educational sessions, including perspectives from external advisors that are invited to present on current cybersecurity topics.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: As indicated above, we have an IT security team, led by our chief information security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. The security team's leadership has an average of 13 years of prior work experience in various roles including monitoring, response, compliance and privacy. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: GameStop Corp.

ticker: GME


text: We have not suffered any cyber incident that had a material impact on our business, operations, or financial condition. However, a security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Item 1A. Risk Factors – "We face risks associated with cyber-attacks, cyber intrusions, or otherwise, which could pose a risk to our systems, networks, and services" and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer." and "Security breaches could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: CENTERSPACE

ticker: CSR


text: We continually evaluate cybersecurity risks on an ongoing basis as part of our overall risk management strategy. We assess and identify cybersecurity risks through periodic risk assessments, penetration testing, and vulnerability scans, among other procedures and practices. We also receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity-related groups or associations. These and other measures are used to evaluate cybersecurity risks in a timely manner and to allocate resources in alignment with the overall risk management program. In the event of an incident, we intend to follow our detailed incident response policy, which outlines the steps to be followed from incident detection to eradication, recovery and notification. In addition, we regularly engage various third-parties to assess or test our systems and processes to enhance our detection and management of cybersecurity risks or assist with implementation of our risk management strategies, including consultants who assist with assessing risks, information security experts who conduct tabletop exercises with participation from company management, and our external auditor who performs cybersecurity reviews as part of our annual audit.

companyName: Installed Building Products, Inc.

ticker: IBP


text: The board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees. The board of directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The board of directors has established robust oversight mechanisms to ensure effective governance in managing risks.

companyName: CHUY'S HOLDINGS, INC.


text: In addition, we actively engage with key vendors and industry communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures and have processes in place to oversee and identify the risk of cybersecurity threats associated with our use of these third-party vendors. We generally require third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of material cybersecurity threats that may impact our business.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: Our Board of Directors considers information security to be an enterprise-wide risk management issue and oversees material cybersecurity risks through the Audit Committee. The Audit Committee is designated with the responsibility to monitor and periodically report to the full Board regarding management's risk management and information security processes. The ERM Committee and the Operational Risk Committee ("ORC") are the senior management-level entities designated with the responsibility to oversee the execution of our risk strategy, including as it relates to cyber risk. These Committees are composed of an enterprise-wide representative group of the Company's Executive and Senior Vice Presidents, as well as other essential directors and personnel. The ERM Committee is chaired by our CRO, and the ORC is chaired by our Chief Security Officer ("CSO"). The Chief Information Officer ("CIO") and CISO serve on both Committees. Our CRO has over a decade of experience managing risks at the Company, including risks from cybersecurity threats. Our current CIO has over 15 years of experience managing risks, including risks from cybersecurity threats. Our current CSO has a Certified Information Systems Security Professional certification, a Certified Information Systems Auditor certification, a Certified in Risk and Information Systems Control certification, and over 20 years of experience in cybersecurity. The CISO serves on both Committees and leads cyber governance and strategy, as well as cyber risk and incident management. The current CISO holds a master's degree in cybersecurity, has a Certified Information Systems Security Professional certification, and has over a decade of experience in cybersecurity.

companyName: GLOBE LIFE INC.

ticker: GL


text: Management and Strategy of December 31, 2023, we have implemented a set of cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities. Our employees have received cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. Important security measures such as multifactor authentication, firewalls, Endpoint Detection and Response (EDR), encryption, etc. have been implemented. We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Currently we are in the process of expanding our risk management procedure to include a broader cybersecurity risk management process. The updated risk management process will include annual review by our Board of Directors Governance

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: Our cybersecurity framework draws upon the National Institute of Standards and Technology ("NIST") cybersecurity framework, which provides guidance for identifying, assessing, and managing cybersecurity risks. While we are in the early stages of fully implementing this framework, we are committed to following its principles as we strengthen our cybersecurity measures to protect both our digital and physical assets.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: Our internal information security team oversees and works collaboratively with various information security service providers. Our cybersecurity program incorporates external guidance and expertise through the use of third-party service providers to assist in the identification, assessment and management of risks specific to cybersecurity threats, including vendors providing threat intelligence, risk mitigation, dark web monitoring, external scanning and scoring, threat and reputation monitoring, forensics, cyber-insurance, advisory services and legal counsel. We use a managed security service provider to augment our internal information security team and to provide additional monitoring capabilities. We also have a vendor management program addressing cybersecurity risk associated with application providers, hosting services and information technology support services we may retain. This program includes security questionnaires, review of vendor security programs, review of security assessments and assurance reports, vulnerability scans, and direct inquiries and collaboration with our vendors' security personnel. Our vendor management process involves different levels of assessment depending on the services provided by the vendor, the sensitivity of the related information systems and data, and the identity of the provider. It is designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: LEAR CORP

ticker: LEA


text: The Board of Directors is cognizant of the critical value of managing cybersecurity threat risks and is updated on such matters accordingly. Cybersecurity risks are reviewed by the Board of Directors, at least annually, as part of our enterprise risk management process and as part of a separate update by our SVP Chief Digital Officer. The Audit Committee assists the Board of Directors with its oversight of cybersecurity risks and the steps taken by the Company to monitor and mitigate such cybersecurity risks. The VP Cybersecurity and SVP Chief Digital Officer provide regular, periodic reports to the Audit Committee on cybersecurity metrics and matters. Senior management also keeps the Board of Directors apprised of cybersecurity incidents and related materiality assessments as appropriate.

companyName: TEREX CORP

ticker: TEX


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a business combination. However, because we have investments in our trust account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: ClimateRock

ticker: CLRCF


text: While we have experienced a cybersecurity incident in the past (see Risk Factors - "A cybersecurity incident, other technology disruptions or failure to comply with laws and regulations relating to privacy and the protection of data relating to individuals could negatively impact our business and our reputation.") and cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows. Even with the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: Pluri Inc.

ticker: PLUR


text: To address evolving security threats, Deutsche Bank Group continually reviews and enhances its information security controls into every layer of technology, including databases, infrastructure, devices, and applications. This is complemented by organizational controls and security training and awareness. The purpose of this layered approach is to strengthen end-to-end protection by utilizing multiple opportunities to detect, prevent, respond to, and recover from cyberthreats.

companyName: RREEF Property Trust, Inc.


text: The IT team including its executive leadership is in charge of managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to security incidents.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: Our risk management program also assesses risks associated with third-party service providers. Such providers are subject to an onboarding process and may be reevaluated periodically. We use a variety of inputs in such risk assessments, including information supplied by the providers themselves and other third parties. In addition, our contracts with our service providers require them to adhere to mutually agreed upon security requirements, controls and responsibilities, as applicable.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. We also use security tools intended to protect our information systems from cybersecurity threats, and to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

companyName: Argo Group International Holdings, Inc.


text: Our Security Operations team, led by the VP of Information Security, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the executive management team. In addition, cybersecurity risks, emerging and existing threats and Asure's current security posture are presented to the board of directors quarterly. Our VP of Information Security holds a high-level certification relating to information security, Certified Information Systems Security Professional (CISSP) from the International Information Security System Security Certification Consortium, and has 17 years of information security, risk management, application security, security operations, and incident management experience. Our Executive Management receives regular monthly reports from the VP of Information Security.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: Our Chief Operating Officer ("COO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Incident Response Plans, including an assessment of the potential materiality of any cybersecurity incident. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the COO, Information Security, and Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Corporate Crisis Management Team and ultimately the Board when appropriate. We believe our Board and management, including the Chief Operating Officer, have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, internal and external training, and periodic discussions with consultants and peers with applicable knowledge and expertise. In addition, members of our management hold varying levels of relevant cybersecurity certifications.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: At each of their respective meetings, the Board and/or Audit Committee receive, and provide feedback on, reports on relevant data protection and cybersecurity matters. Additionally, two regular Board meetings each year and each Audit Committee meeting include additional, in-depth technology and cybersecurity briefings from senior members of our information technology department, internal audit function, and legal department. The topics covered by these reports and briefings include risk management strategies, data protection, ongoing risk mitigation activities, cybersecurity strategy, governance structure, and the results of security breach simulations.

companyName: Kimball Electronics, Inc.

ticker: KE


text: The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by Cybersecurity Leadership who are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department, including responsibility for leading organization-wide cybersecurity strategy, policy, and processes. Our CIO has served in this role since the 2017 Merger, has been at Swift since 2003, and has over 25 years of cybersecurity experience, including technology positions at AlliedSignal, Sara Lee, and J-Del. • The VPIT, reporting to the CIO, is responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Our VPIT has served in this role since 2020 and has significant relevant experience and professional certifications, including 18 years of cybersecurity and infrastructure experience. The VPIT, along with our cybersecurity team, has guided the organization through building a multi-layer cybersecurity program.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors" in this annual report on Form 10-K.

companyName: Payoneer Global Inc.

ticker: PAYO


text: Roper's Cybersecurity Program Roper maintains a global Cybersecurity Program supervised by the Vice President of Cybersecurity that outlines required cybersecurity controls for all Roper businesses. Given the decentralized nature of Roper's operating model, day-to-day management and implementation of the Cybersecurity Program and deployment of the program's cybersecurity controls are managed locally by each of Roper's 28 business units, including localized information security management. In addition, because Roper's businesses generally operate independently and maintain separate infrastructure and systems, we believe the risk of an enterprise-wide cybersecurity incident is somewhat reduced. While cybersecurity technologies and implementation may differ based on the needs and risk profile of each individual business, Roper has also implemented cybersecurity tools and managed services to centrally monitor certain aspects of the Cybersecurity Program.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Management's cybersecurity programs operate under the leadership of the Company's Chief Information Security Officer ("CISO"), who receives reports from his team of information and product security professionals and monitors the prevention, detection, mitigation and remediation of cybersecurity risks. The CISO provides quarterly updates to the Board on the advancing maturity of the Company's cybersecurity program, including reports on security controls coverage and effectiveness, secure software development and product security, vulnerability testing and remediation, and security operations. The updates also include reports on improvements to processes, technology and governance to mitigate residual cybersecurity risk.

companyName: BLACKBERRY Ltd

ticker: BB


text: The Audit Committee receives periodic reports from management or Connetic on our cybersecurity risks and cybersecurity risk management program. In addition, the executive management team is responsible for updating the Audit Committee, as necessary, regarding significant cybersecurity incidents.

companyName: Peakstone Realty Trust

ticker: PKST


text: As a large, multinational transportation and logistics company, we and our subsidiaries each face a range of risks from cybersecurity threats in connection with our operations due to our inherent dependence on information systems, software, and digital technologies to operate safely, efficiently, and effectively. Such risks include, but are not limited to, those related to cyberattacks, network breaches, ransomware, malware or denial-of-service attacks, phishing and other scams, theft, and unauthorized disclosure, any of which, if successful, could result in the disclosure of confidential customer or commercial data, loss of valuable intellectual property, or systems disruption, and subject us to civil liability, fines, penalties, damage of our brand or reputation, or otherwise harm our business, any of which, could be material. We and our subsidiaries are each exposed to such risks both through direct attacks on our own information systems and, indirectly, as a result of our engagement of third-party service providers, software vendors, and independent contractors, such as cloud computing providers. Certain of our third-party service providers or software vendors provide us with computing services which, in certain cases, involve hosting our data or processes on third-party servers, which exposes us to the risk that our data may be compromised or our operations disrupted if such third-party servers are compromised. Other third-party service providers provide us with contracted labor to whom we necessarily grant access to certain of our information systems, which indirectly exposes us to additional risks of network breaches and cybersecurity threats. In addition, because the trucking industry has been designated by the federal government as part of the critical U.S. infrastructure, as a leading provider of truckload, intermodal, and logistics services, we face increased risks from cybersecurity threats, cybercriminals, and bad actors, both foreign and domestic.

companyName: Schneider National, Inc.

ticker: SNDR


text: Risks from cybersecurity threats, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our and/or their business, results of operations, cash flows, financial condition and/or equity. For more information about these risks, see the risk factor titled "Failures or interruptions in or breaches to our or our subsidiaries' computer systems or information technology or communication infrastructure or those of our third party vendors could materially and adversely affect our or our subsidiaries' operations" under Item 1A.

companyName: LOEWS CORP

ticker: L


text: We rely on third-party service providers to perform a variety of functions throughout our business, such as contract manufacturing organizations, contract research organizations, suppliers and consultants, and third party logistics organizations and distributors to distribute RYTELO. We conduct quality audits of regulated vendors, which typically include an assessment of such vendor's information technology systems, and we impose appropriate contractual obligations on vendors pertaining to information security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our efforts may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: GERON CORP

ticker: GERN


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers, as well as third-party security firms used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, and threat intelligence to better inform the Company during contracting and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), the Company has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.

companyName: Digital Media Solutions, Inc.


text: Our Cybersecurity Program is governed by the Company's IT, Legal, and Compliance teams. Our Chief Technology Officer ("CTO") has over 20 years of experience in marketing technology and analytics. Our Vice President of IT Governance, Risk and Compliance ("VP of IT") has over 20 years of experience in IT internal and external audits, IT consulting, and governance, risk, and compliance. Our General Counsel regularly coordinates with the IT team on data security and compliance issues. The CTO and General Counsel report directly to the Chief Executive Officer ("CEO"), so any material issues are raised to the CEO, and a status update of key cybersecurity projects and any material breaches is provided quarterly to the Board's Audit Committee, which includes both an internal and external audit.

companyName: Fluent, Inc.

ticker: FLNT


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The information security team consists of subject matter experts in the fields of security operations, governance risk and compliance (GRC), application security, fraud, identity and access management, and security architecture. Our security operation center (SOC) monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures and regularly reports to our CISO. Our CISO is part of the senior management team and regularly updates the Audit Committee on the company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Under the charter of our Audit Committee, the Audit Committee oversees management's development and implementation of policies with respect to risk assessment and risk management, which includes risks associated with cybersecurity threats. In 2023, the Audit Committee also discussed with management the Company's significant financial risk exposures and the actions management had taken to limit, monitor, control or mitigate such exposures. Our executive officers are responsible for managing risks from cybersecurity threats, which was primarily performed in 2023 by overseeing third parties involved in the management and monitoring of IT systems. Our executive officers also received reporting and information from third parties in 2023. Our management regularly reported to the Audit Committee on these risks. The Audit Committee also received reports from our legal counsel and internal auditors on cybersecurity matters. Currently, the Audit Committee also comprises the entire Board so we believe there is direct visibility by the Board to cybersecurity risk management.

companyName: Ampio Pharmaceuticals, Inc.

ticker: AMPE


text: Our Information Security team manages Edwards' Information Security Program, which is focused on assessing, identifying, and managing cybersecurity risk and information security threats. We evaluate cybersecurity risk on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and the Board of Directors, described below under Governance.

companyName: Edwards Lifesciences Corp

ticker: EW


text: The Company, our Manager and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our Manager's systems, train the Manager's employees and generally advise on cybersecurity processes. At least annually, our Manager has its information technology team make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and the Manager's employees, and the latest threats that have emerged, including a presentation from the third-party security firm.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: Allstate's Information Security Program outlines the responsibilities and expectations for the security of Allstate information systems. The Program includes standards, policies and procedures requiring the implementation of technical, administrative and physical controls to manage the risk to Allstate information and systems. These standards, policies and procedures cover industry-standard information security domains, including risk assessment, third-party supplier risk management, vulnerability management, identity and access management, application security, network security, cybersecurity awareness training, encryption and incident management.

companyName: ALLSTATE CORP

ticker: ALL


text: The audit committee receives periodic updates on our cybersecurity risks from our information security team, which include biannual presentations on the status of our cybersecurity risk management program by the SVP IS. These reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents, if any. In addition, as needed, management updates the audit committee regarding any notable cybersecurity incidents. We have also implemented an annual process for employees to complete security awareness training.

companyName: Blueprint Medicines Corp


text: Risk Management and Strategy rely on information technology systems and data processing that we or our service providers, collaborators, consultants, contractors or partners operate to collect, process, transmit and store electronic information in our day-to-day operations. Our internal computer systems and data processing and those of our third-party vendors, consultants, collaborators, contractors or partners, including future CROs, may be vulnerable to risks from cybersecurity threats. To help manage these risks, we engage and rely on external experts, including an information technology managed services provider. We are also in the process of developing additional cybersecurity policies and procedures, as we continually work to enhance and evolve our program in light of the constantly evolving threat landscape.

companyName: Vivani Medical, Inc.

ticker: VANI


text: In addition, our internal audit function periodically conducts independent testing of the overall operations of our cybersecurity program and supporting control frameworks, and reports the results to the Audit & Finance Committee. We also engage third parties to assess our cybersecurity program maturity and to perform audits of portions of our cybersecurity control environment based on risk or where necessary to ensure regulatory compliance.

companyName: NIKE, Inc.

ticker: NKE


text: Our internal audit function collaborates with the security teams to participate in an integrated cybersecurity assurance program. The internal audit function also performs its own cybersecurity audits and reviews certain cybersecurity-related practices, such as access controls, as part of their assessment of our internal control over financial reporting. From time to time we have taken steps to improve our practices and remedy deficiencies that have been identified. Our enterprise-wide information security program is also independently assessed every other year by a third party as part of our enterprise risk management, and our Cybersecurity Subcommittee reviews the assessment findings. We seek to advance our program maturity in line with our review and management of cybersecurity risks.

companyName: Booking Holdings Inc.

ticker: BKNG


text: As part of the company's global information security program, we leverage both internal and external assessments and partnerships with industry leaders to help approach information security company-wide. Additionally, the company maintains a comprehensive program that defines standards for the planning, sourcing, management, and oversight of third-party relationships and third-party access to its system, facilities, and/or confidential or proprietary data.

companyName: Corteva, Inc.

ticker: CTVA


text: In the ordinary course of business, we rely heavily on electronic communications and information systems to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. A variety of preventive and detective tools are used to monitor, block, and alert us to suspicious activity, including potential advanced persistent threats. Despite our defenses, the severity and sophistication of cyber-attacks are on the rise. Attackers adapt quickly to changes in defense measures. While we have not identified significant compromises, substantial data losses, or major financial setbacks from cybersecurity attacks so far, our systems, along with those of our clients and service providers, face constant threats. There is no guarantee that our cybersecurity risk management program will completely safeguard the confidentiality, integrity, and availability of our information systems and solutions. Cybersecurity risks are anticipated to stay elevated due to the evolving nature of threats and the increased use of online and mobile banking services. See "Risks Related to Cybersecurity, Data and Fraud" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Company has established an Incident Response Policy and recovery plans to address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. This includes continuous security operation centers monitoring of the Company's systems and accounts.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Cyber Risk Management and Strategy We have developed and maintain processes designed to assess, identify, and manage cybersecurity risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The scope of these processes includes risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by or maintained at third-party service providers. These processes are managed and monitored by a dedicated information technology team, which is led by our Vice President, IT, who reports to our Chief Technology Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. We constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We also conduct periodic employee trainings on cyber and information security, among other topics. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: Identifying potential cybersecurity threats that could disrupt our IT systems, cause a data breach or compromise data security by implementing the following protective measures: patching and updating systems and applications, monitoring our email systems, endpoint protection, Domain Name System (DNS) filtering, Security Information and Event Management, and Multi-Factor Authentication (MFA). Conducting periodic assessment of protections to prevent or mitigate cybersecurity threats.

companyName: Altimmune, Inc.

ticker: ALT


text: Risks from Third Party Service Providers and Others Our cybersecurity team, under the oversight of the SVP, performs risk assessments on third party service providers and other third parties (such as partner companies), as well as third party software and hardware utilized in its operations, that may have the potential to create cybersecurity threats to our data and operations.

companyName: E2open Parent Holdings, Inc.


text: Our CTO and CISO have extensive experience in cybersecurity. Our CTO has served in his role since 2014. He has also served in various roles in Information Technology for over 25 years, including the oversight of Information Security for 15 years. Our CISO has served in various roles in Information Technology for over 25 years, including 15 years in Information Security. He holds a B.S. in Cybersecurity and Information Assurance, along with industry certifications that include the Information Systems Audit and Control Association Certified in Risk and Information Systems Control, Certified Information Security Manager, and International Information System Security Certification Consortium Certified Information Systems Security Professional certifications.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: Our cybersecurity measure is primarily focused on ensuring the security and protection of computer systems and networks. All pertinent domestic operating entities of the Company shall adhere to a standardized Company Confidentiality System, which shall be centrally overseen and enforced by Shuhai Beijing, subject to oversight by our management and Board of Directors. This Company Confidentiality System shall include specific provisions for information pertaining to network security, data security, and information that, if disclosed, could have detrimental effects on the public interest and the Company. We plan to establish an appropriate confidentiality framework and adhere to relevant document management regulations. The Company and its employees are also required to sign confidentiality agreements for purposes including ensuring cybersecurity.

companyName: DATASEA INC.

ticker: DTSS


text: Our senior management reports at least annually to the audit committee and such reporting includes an overall assessment of the Company's compliance with our cybersecurity policies and procedures as well as topics including existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.

companyName: iTeos Therapeutics, Inc.


text: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by our Chief Financial Officer to the Board's Audit Committee and senior management annually. Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually. In this way, our program to manage cybersecurity risk integrates with our overall risk management processes.

companyName: CODEXIS, INC.

ticker: CDXS


text: Each employee is responsible for taking proper security precautions when using the Company's network and IT systems. ChampionX provides IT and cybersecurity training to employees at least once a year, regularly distributes cybersecurity tips, and conducts regular education campaigns to heighten employee awareness of phishing and other cybersecurity threats.

companyName: ChampionX Corp


text: Program Assessment We continuously evaluate and seek to improve and mature our cybersecurity processes and controls. Our cybersecurity program is regularly assessed through management self-evaluations and ongoing monitoring procedures to evaluate our program effectiveness, including vulnerability management through active discovery and testing to validate patching and configuration. Additionally, InfoSec regularly assesses our program effectiveness through audits of our entities, systems, and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall effectiveness of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the U.S. Defense Contract Management Agency ("DCMA") and Cybersecurity Maturity Model Certificate or "CMMC" Third Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Anti-Phishing Training: Our employees undergo targeted anti-phishing training to identify and respond appropriately to phishing attempts. This training is crucial in cultivating a vigilant and informed workforce capable of recognizing and thwarting phishing attacks.

companyName: AIBOTICS, INC.

ticker: AIBT


text: The Evergy Companies have been subjected to attempted cyber-attacks from time to time, and will likely continue to be subject to such attempted attacks, but these prior attacks have not had a material impact on the Evergy Companies' operations or financial results to date. However, because technology is increasingly complex and cyber-attacks are increasingly sophisticated and more frequent through the use of such tools as AI, there can be no assurance that such incidents will not have a material adverse effect on the Evergy Companies in the future. See Item 1A. Risk Factors – Operational Risks for additional information.

companyName: Evergy, Inc.

ticker: EVRG


text: The Board of Directors has assigned the Audit Committee to be responsible for reviewing our cybersecurity risk management and strategy program and is presented, at least annually, with a review of our environment and reported incidents. Part of our IRP also calls for the elevation of any necessary incidents to upper management in a timely manner whenever they occur.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: As part of our management team, Leiv Lea, our Chief Financial Officer, who has over fifteen years of experience overseeing information technology systems for public companies, is responsible for assessing and managing our material risks from cybersecurity threats. Mr. Lea has primary responsibility for our overall cybersecurity risk management program and supervises our retained external information technology and cybersecurity consultants. Mr. Lea supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from security personnel and alerts and reports produced by security tools deployed in the Company's information technology environment.

companyName: Corvus Pharmaceuticals, Inc.

ticker: CRVS


text: The CSDC monitors and responds to actual and potential compromises from third-party service providers. Access from a potentially compromised third-party is restricted until DTE Energy receives confirmation the compromise has been mitigated.

companyName: DTE Electric Co


text: Cybersecurity Risk Management Strategy We have implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect our systems, identify and remediate on a regular basis vulnerabilities in our systems and related infrastructure and monitor and mitigate the risk of data loss and other cybersecurity threats. We have engaged third-party consultants to conduct penetration testing and risk assessments. Our cybersecurity program is informed by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and measured by the Maturity and Risk Assessment Ratings associated with the NIST Cybersecurity Framework and the Capability Maturity Model Integration.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer ("COO"). Our COO, assisted by our Senior Vice President for Operations, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our COO and Senior VP for Operations are responsible for reviewing security assessments and other security-related reports.

companyName: EMERSON RADIO CORP

ticker: MSN


text: Our IT management team, with oversight by our board of directors ("Board") and audit committee of the Board ("Audit Committee"), helps identify, assess, and manage risks from cybersecurity threats by monitoring and evaluating threats through our cybersecurity risk management program, which leverages the National Institute of Standards and Technology Cybersecurity Framework.

companyName: SITIME Corp

ticker: SITM


text: Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our VP of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Management maintains an inventory of third parties and completes an annual third-party cyber risk assessment. In addition, employees participate in mandatory annual cyber training and management conducts routine social engineering tests to monitor employees' awareness of cyber risks and to train employees on how to identify potential cybersecurity risks.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity risk oversight. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Executive Vice President, Chief Administrative Officer, Senior Vice President, Corporate Counsel and Vice President, Enterprise Applications as part of the Board's continuing education.

companyName: KILROY REALTY CORP

ticker: KRC


text: The Audit and Risk Committee receives quarterly reports from our Chief Information Security Officer ("CISO") and our Chief Information Officer on our cybersecurity risks and meets in executive session with our CISO following such reports. In addition, management updates the Audit and Risk Committee, as necessary, regarding significant cybersecurity incidents. The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: Hyperfine, Inc.

ticker: HYPR


text: RGA utilizes third-party partners, including leading national and international companies specializing in cybersecurity and software development, to supplement its security operations team to provide monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. The Company also engages third party partners to assist in evaluating and testing the Company's cybersecurity infrastructure. These partners are subject to the Company's third party due diligence process that includes security and privacy assessments, legal reviews, and ongoing assessments and performance reviews to ensure compliance with the Company's policies and standards.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or cash flows.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Board of Directors, along with its Audit Committee, oversees the management of cybersecurity risks and receives quarterly reports from management on the detection and remediation of cybersecurity incidents, as well as on material security risks and vulnerabilities. Through our outsourced managed service provider, we are informed about, and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of, and participation in the monitoring systems and processes described above. The information about such incidents is reported to the Company's Chief Executive Officer and Chief Financial Officer, who then would report such information to the Company's Board of Directors, in some cases, earlier than the regular quarterly reports depending on the nature and severity of the incident.

companyName: Motorsport Games Inc.

ticker: MSGM


text: In the event of a potentially material cybersecurity incident, the Company's incident response plans establish escalation protocols for relevant IT leaders and functional leaders within Legal, Compliance and Internal Audit to engage management as appropriate.

companyName: BERKLEY W R CORP

ticker: WRB


text: • The Council includes the CIOs and is led by the Chief Information Security Officer ("CISO"). Our CISO joined the Company in 2018 in connection with the acquisition of ECS Federal, LLC ("ECS") and has decades of experience in oversight of cybersecurity operations. Collectively, the Council represents ASGN and its brands, and reports to the Chief Executive Officer and the Board's Strategy and Technology Committee. The Council members bring a wealth of experience in security operations, business process re-engineering, software development, ERP systems, and the management of multinational wide area networks. Complementing this expertise, the Council also includes a dedicated team of Cybersecurity Information Security Professionals, consisting of brand-specific system engineers and security administrators. The Council's primary mandate is to formulate comprehensive data protection and cybersecurity policies for ASGN, oversee the management of emerging security threats, proactively mitigate security risks, and safeguard our valuable assets. • ECS, ASGN's Federal Government Segment, plays a vital role in safeguarding ASGN through its essential security control function. Serving as a managed services provider for both clients and internal operations, ECS oversees the SOC which is dedicated to monitoring, detecting, and responding to cybersecurity threats across our organization. Operating 24 hours a day, seven days a week, our SOC diligently filters system logs, leveraging proprietary AI/ML tools to identify global threats. We conduct continuous active hunts and forensic analysis inspections on our network, proactively seeking out malware and intrusions.

companyName: ASGN Inc

ticker: ASGN


text: Security Assessments – Various company environments are regularly audited by a third-party AICPA- and PCAOB-registered certified public accounting firm and has consistently obtained PCI DSS 3.2, SSAE18 SOC1, SOC2, CSAE34-16 SOC1 and SOC2 certifications and HIPAA compliance. The Company currently holds 20 such certifications.

companyName: CINCINNATI BELL INC


text: We use a third-party security operations center and endpoint management and response service to continuously monitor information systems for emergent events including anomalous, suspicious, and unauthorized network activity. Detected events are immediately triaged and evaluated for threat potential and impact. We also engage third-party providers to perform penetration testing designed to identify vulnerabilities for remediation. We rotate penetration testing providers to diversify testing approaches.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: See Item 1A. "Risk Factors — Risks Related to our Data Platform, Information Systems and Other Technology — Security incidents and other network and information systems disruptions could affect our ability to conduct our business effectively and damage our reputation" and "— Failure to comply with laws and regulations with respect to privacy, data protection and consumer marketing and subscriptions practices could adversely affect our business" for a discussion of cybersecurity risks that may impact us.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Disclosure of the Board's Responsibility While management is primarily responsible for assessing and managing cybersecurity risks on a day-to-day basis, the Company's Board of Directors oversees management's efforts to assess and manage risk. The Board of Directors (through the Audit Committee) monitors the cybersecurity risk assessment and response process. The Audit Committee is briefed by our Chief Financial Officer on our cybersecurity ISMS program and the overall cybersecurity risk environment. The briefing may include discussions on topics such as: information security and technology risks, cybersecurity risk assessment process and updates, information risk management strategies, and progress on cybersecurity and data protection training initiatives for employees, among others.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Our Chief Risk Officer provides reports at each meeting of the RSC on areas of potential risks to us, including cybersecurity risk, and our Chief Information Security Officer provides quarterly reports to the RSC on the key performance indicators of our information security program to facilitate the RSC's oversight of the program through objective measurements, including metrics regarding software patching, IT asset management, cyber incident management and cybersecurity training. Reports by our Chief Information Security Officer also include detailed information on the activities of our cyber incident response team to allow for analysis of trends and the identification of any control gaps that require remediation.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: Over the past year, our team has implemented, optimized, and matured our cybersecurity practices, aiming to meet all major industry benchmarks.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: The Corporation regards information as one of its most valuable assets. As a result, safeguards have been implemented to protect corporate informational assets and associated technology resources have been established to maintain the integrity, availability, and privacy of confidential information of those assets. The Corporation has established an Information and Cyber Security Program ("Program") that includes standards and procedures to ensure that all information belonging to or held by the Corporation will be appropriately evaluated, classified, and protected against likely forms of unauthorized or inappropriate access, use, disclosure, modification, destruction, and denial.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: The TDS Chief Information Security Officer (CISO) and UScellular Senior Vice President of Information Technology are responsible for assessing and managing cybersecurity risks. Each has over twenty years of experience at the company, encompassing network engineering, information technology and cyber security. Management has a depth of cybersecurity experience focused on increasing the organization's resilience to security threats and stays current on new developments through continuing education and monitoring of the cybersecurity landscape. As part of their accountability for incident response, significant incidents are communicated to an internal committee including the Chief Financial Officer and general counsel to assess their materiality and if materiality is confirmed it is reported by the defined process. To date TDS has not identified nor become aware of any cybersecurity incidents that individually or in aggregate have materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations, or financial condition.

companyName: TELEPHONE & DATA SYSTEMS INC /DE/

ticker: TDS


text: Our cybersecurity strategy focuses on striking a balance between data barriers and access, and promoting vigilance among our employees, contractors, and business partners. We monitor and implement procedures, policies, and activities designed to manage our data and to maintain a high level of privacy and security within our systems. In 2024, we continued the development of our enterprise risk program, which integrates cybersecurity.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: Our cybersecurity and privacy policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our information technology, privacy, product, and operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed cybersecurity and privacy laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to the GDPR, as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor, we are required to comply with extensive governmental regulations and standards regarding cyber security.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: NIST SP 800-34, Rev 1, "Contingency Planning Guide for Federal Information Systems," November 2010 NIST SP 800-37 Rev. 2, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," December 2018 NIST SP 800-53, Rev. 5, "Security and Privacy Controls for Information Systems and Organizations," September 20, 2020, updated December 10, 2020 NIST SP 800-61, Rev 2, "Computer Security Incident Handling Guide," August 2012 Our approach to cybersecurity aims to protect the confidentiality, integrity, and availability of the data we handle. This process involves measures to identify and prevent cybersecurity threats and mechanisms to mitigate and respond to cybersecurity incidents.

companyName: WIDEPOINT CORP

ticker: WYY


text: We operate through our subsidiaries and affiliate and receive services through our intercorporate services agreement (ISA) with Contran (see Note 16 to our Consolidated Financial Statements). We recognize the importance of proactively assessing, identifying and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis and response to cybersecurity alerts and incidents, and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: NL INDUSTRIES INC

ticker: NL


text: Our Board of Directors considers cybersecurity risk within the Board's risk oversight function. The board of directors has charged management with responsibility for oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. The Board and its Audit Committee oversee management's implementation of our cybersecurity risk management program.

companyName: Tianci International, Inc.

ticker: CIIT


text: We maintain an Enterprise Risk Committee, composed of our Chief Financial Officer, General Counsel, Chief Information Officer and other members of senior management, which oversees the identification and management of corporate-level risks, including cybersecurity risk, using the COSO Enterprise Risk Management Framework. To support the identification of emerging risks and align our focus on our primary business risks, our Manager Enterprise Risk, whose job responsibilities are dedicated to enterprise risk management, surveys senior leaders at least annually to assess our most significant, or "Tier 1," enterprise risks. Based in part on this survey, our Enterprise Risk Committee assesses our most significant risks and considers the effectiveness of our risk mitigation efforts, and the Manager Enterprise Risk leads a presentation to our Board of Directors covering this information on an annual basis. Our Enterprise Risk Committee also oversees periodic follow-up assessments to analyze changes in existing, evolving and emerging risks and identify new or more effective measures for mitigation.

companyName: EQT Corp

ticker: EQT


text: Our Director of Information Security ("DIS") coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond to, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The DIS also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The DIS and the Chief Information Officer ("CIO") have shared responsibility for overseeing day-to-day operations of the Information Security Program; coordinating or contributing to reviews, audits, risk assessments, and other risk management material; development of departmental policies and procedures for board approval; and periodic updates to our information technology steering committee and/or the full board of directors. The CIO reports to the President and Chief Executive Officer, while the DIS reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: The CRMC is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Trust's reliance on Fidelity and its Enterprise Cybersecurity organization, the CRMC relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Trust's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024.

companyName: Fidelity Ethereum Fund

ticker: FETH


text: The Company uses data loss prevention and web filtering software to ensure malicious data does not enter the Company's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. All Company networks are secured behind firewalls. Additionally, Security Information and Event Management (SIEM) technology, an Intrusion Detection System (IDS), and an Intrusion Prevention System (IPS) are used.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: Related to Cybersecurity Risks Roivant's board of directors oversees our overall risk management strategy, including with respect to cybersecurity risks. Cybersecurity risk management policies and procedures are integrated into our overall risk management strategy, which is overseen by the audit committee of the board of directors ("Audit Committee"). At least annually, the Audit Committee discusses our risk management program, including any information security and technology risks and findings from any audits, with our internal audit staff, including our Chief Accounting Officer.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: The Board of Directors has established its CIT Committee with specific responsibilities for overseeing the cybersecurity risk management program, among other things. Our Chief Information Security Officer ("CISO") provides the CIT Committee with periodic reports on cybersecurity risks, threats and any material cybersecurity incidents. The CIT Committee also retains an independent external cybersecurity consultant who attends all CIT Committee meetings and reports directly to the CIT Committee Chair. In addition, the external cyber security consultant provides periodic training to the CIT Committee and to our Board of Directors.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and bad actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. Moreover, the nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue.

companyName: QCR HOLDINGS INC

ticker: QCRH