text: Our CISO reports to our Chief Information Officer (CIO), who has held that role for 7 years and oversees our broader information technology program. He has over 30 years of information technology experience, including over 20 years in leadership roles.

companyName: PATTERSON COMPANIES, INC.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process. Our Board of Directors does not have a standing risk management committee, and administers this oversight function both directly as a whole, and through various standing committees that address risks inherent in their respective areas of oversight. Our Audit Committee is responsible for overseeing the Company's enterprise risk management processes as well as our policies with respect to risk assessment and risk management, which includes cybersecurity risk. A cybersecurity update is provided at least annually, or more frequently as needed, to the Audit Committee by members of management responsible for managing cybersecurity risks.

companyName: enGene Holdings Inc.

ticker: ENGN

secItem: Item 1C


text: Executive Experience and Qualifications Our CEO, CFO, each with over thirty (30) years of risk management experience, and the COO with over twenty (20) years of experience including cybersecurity, possess deep expertise in their respective fields, evidenced by their academic qualifications and professional trajectories. This collective experience underpins our robust approach to managing cybersecurity risks. In addition, we have numerous employees with experience and qualifications related to cybersecurity. We expect to name a Chief Information Security Officer during 2024 as part our cybersecurity program. Our executive officers are responsible for informing the Board and Governance Committee of any material cyber events or risks.

companyName: WIDEPOINT CORP

ticker: WYY


text: We have developed and implemented a comprehensive cybersecurity strategy and risk management program that is informed by the following key elements: • Periodic cybersecurity program maturity assessments to evaluate the overall controls, processes, skills and platforms leveraged to assess, identify and manage material risks from cybersecurity threats. • Periodic business impact assessments of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services. • An external assessment of the cybersecurity risks associated with our operations. • Periodic penetration testing of our internal and external IT environment to validate the real-world efficacy of our cybersecurity program and mitigate the risks of new cybersecurity vulnerabilities.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: To mitigate the occurrence of an incident as defined by the Company's formal documentation, which classifies and defines the properties of potential threats, the Company has in place a host of defenses which include, but are not limited to, the use of gateway consoles in all our global locations, limited access to key Information Systems from in-office networks or VPN with multi-factor authentication by means of a third -party mobile identity management tool to limit access to authorized users.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Our newly acquired businesses maintain separate cybersecurity programs and processes that may differ in scope and complexity from the Company's overall cybersecurity programs and processes.

companyName: CORPAY, INC.

ticker: CPAY


text: We are a special purpose acquisition company with no business operations. Since the IPO Closing Date, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since the IPO Closing Date.

companyName: Gores Holdings IX, Inc.


text: Important to these programs is Invesco’s investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors —Risks Relating to Our Technology and Our Platform" in this annual report on Form 10-K.

companyName: Katapult Holdings, Inc.

ticker: KPLT


text: The Board of Directors oversees cybersecurity-related policy and strategy. As part of this oversight, the CISO provides a cybersecurity dashboard that is reviewed by the Board at every regularly scheduled Board meeting, which includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward Transportation Security Administration (TSA) compliance. Additionally, the CIO and/or CISO presents to the Board bi-annually regarding the cybersecurity risks and strategies, including as part of the Board's annual long-term strategy session. The Audit Committee, comprised of independent directors, reviews the implementation and effectiveness of cybersecurity risk management protocols and reviews the effectiveness of cybersecurity as part of the Company's accounting and internal control policies. As part of this oversight, the CIO presents to the Audit Committee bi-annually, as well as periodically in conjunction with any internal audits related to cybersecurity. Additionally, management has protocols by which cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, are reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Cybersecurity represents an important component of our overall approach to business strategy, risk management and financial oversight. Our board recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees, and is actively involved in oversight of our risk management program. The board performs this oversight function at the full board level, as well as through its standing committees that address risks inherent in their respective areas of oversight. The audit committee is responsible for reviewing and assessing the quality and effectiveness of our cybersecurity policies, practices and procedures protecting our information technology systems, data, products and services across all business functions, and reporting its findings to the board, which has final oversight responsibility over cybersecurity-related matters.

companyName: HUBSPOT INC

ticker: HUBS


text: Our Cybersecurity Risk Management Protocols and Strategy Technology is essential to operating and growing our business, serving our customers, and continuing our digital transformation. ChampionX's cybersecurity structure and strategic efforts are designed to protect our assets, information, and reputation, as well as the privacy of employee, customer, and supplier data. Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and ChampionX's cybersecurity policies, standards, processes and practices are fully integrated into its ERM program. Our Enterprise Risk Committee, which consists of members from executive management, corporate compliance and internal audit, oversees our ERM program. Our Enterprise Risk Committee is responsible for, among other things, aligning risk decisions with the Company's values, policies and procedures and supports integration of risk assessment and controls into day-to-day business processes, planning and decision making. Our Enterprise Risk Committee has identified cybersecurity as a key enterprise risk.

companyName: ChampionX Corp


text: Following the conclusion of an incident, the incident response team will generally assess the effectiveness of the cybersecurity program and make adjustments as appropriate.

companyName: LXP Industrial Trust

ticker: LXP


text: Our Senior Vice President, Chief Information Security Officer ("CISO"), leads our cybersecurity team and has over 15 years of experience establishing and leading comprehensive cybersecurity programs. Our CISO retired from the United States Navy, where he served in various roles with increasing responsibility, most recently serving as the Director of Operations – Navy Cyber Defense Operations Command. In that role, our CISO led a team of 450 personnel overseeing networks with more than 800,000 endpoints and more than 200 IT, Cloud, Legacy, and Operational Technology networks globally. We believe that our CISO's technical expertise and background assist us with the navigation of the extensive regulatory framework to which we are subject as a federal contractor, including the achievement of the Cybersecurity Maturity Model Certification ("CMMC") program. We believe we are well-positioned to meet the requirements of CMMC and are preparing for certification.

companyName: Gogo Inc.

ticker: GOGO


text: Having the appropriate governance structure in place is critical to the functioning of our cyber and information security risk framework. As noted above, our Board has primary oversight responsibility for our cyber and information security risk, and it performs this oversight function primarily through its Risk Committee, which reports to the full Board. Additionally, to keep pace with the speed of disruptive innovation and associated cyber risks, the Board has established a dedicated Cyber & Technology Risk Subcommittee (the "Cyber Subcommittee") that reports to the Risk Committee. The Risk Committee, through the Cyber Subcommittee, oversees the Company's cybersecurity risk profile, prevalent cybersecurity risks, our enterprise information security program and key enterprise information security initiatives.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: Our management, including our Chief Executive Officer and Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as regulatory compliance and corporate governance and rely on third-party service providers to provide expertise with respect to information technology and cybersecurity. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, primarily through the receipt of notifications from service providers.

companyName: PhenixFIN Corp

ticker: PFX


text: Our CIO attends regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer and other senior executive officers, and reports on cybersecurity matters as appropriate.

companyName: NCR Voyix Corp

ticker: VYX


text: Management and Cybersecurity Working Group Reporting to the Chief Operating Officer, our Vice President of Information Technology, with extensive cybersecurity knowledge and skills from over 15 years of relevant work experience at our company and elsewhere, leads the team responsible for developing and implementing our information security program across our business. This team comprises individuals with relevant educational and technical experience, including a dedicated IT Systems & Security Administrator, with responsibility for various aspects of cybersecurity within our organizations. This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. Our Chief Operating Officer also leads our Cybersecurity Incident Management Team, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Chief Operating Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: The Board of Directors is also responsible for the approval and oversight of the Information Security ("IS") Program. Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience. Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: We have an employee education program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions. Before contracting with certain third parties, such as our local property managers, or purchasing third party technology or other solutions that involve exposure to sensitive company or tenant information, we conduct diligence on those third parties, which includes a security review. We maintain back-ups and disaster recovery plans to restore our information in the event of an incident.

companyName: Terreno Realty Corp

ticker: TRNO


text: Recurring audit and oversight of all critical third-parties within the Company's digital ecosystem to identify risks and adverse trends. Our third-party risk management program is designed to ensure that our third-party providers meet our cybersecurity requirements. This includes conducting periodic risk assessments of our third-party providers requiring them to implement appropriate cybersecurity controls and monitoring third-party compliance with our cybersecurity requirements. Annual evaluation of the Company's cybersecurity insurance program, with coverage levels benchmarked against industry peers. Use of external subject matter experts to provide threat intelligence and updates on trends and emerging schemes.

companyName: National Bank Holdings Corp

ticker: NBHC


text: We have a Security Operations Center operating in multiple regions that provides daily monitoring of our global cybersecurity environment and coordinates real-time investigation and remediation of alerts. Identifying and assessing cybersecurity risks related to our business, operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT/OT security, governance, risk and compliance reviews. To deter, detect and respond to cybersecurity incidents, we conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and consultants, and conduct tabletop exercises to simulate responses to cybersecurity incidents. We also conduct and require our workforce to complete ongoing cybersecurity awareness education and training. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.

companyName: TIDEWATER INC

ticker: TDW


text: The Chief Compliance Officer of the Fund oversees the Fund's risk management function generally and relies on the Adviser's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Adviser's Chief Compliance Officer has 12 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Fund's Chief Compliance Officer has been responsible for the general oversight function as Chief Compliance Officer to the Fund for 3 years and has worked in the financial services industry for 18 years, during which the Fund's Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Fund.

companyName: AB Private Credit Investors Corp


text: Our information and cybersecurity program utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, and our security controls are mapped to the NIST Cybersecurity Framework 2.0 to ensure alignment with recognized industry best practices. Annually, we engage a third-party consultant to conduct an assessment of the effectiveness of our information and cybersecurity program against the NIST Cybersecurity Framework 2.0. This assessment is reviewed with the audit committee, and opportunities for further maturation are incorporated into our information and cybersecurity roadmap.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors and audit committee are responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has delegated administration of its cybersecurity risk oversight function to the audit committee.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. These and other risks related to cybersecurity matters are described in more detail in Item 1A. Risk Factors.

companyName: Aimco OP L.P.


text: In the event of a cybersecurity incident impacting us, the Corporation's cybersecurity risk management policy provides processes for responding to such an incident and facilitates coordination among the Corporation's officers and our third-party IT service provider. Depending on the nature of the incident, it may also be reported to the Board, if appropriate.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Our audit committee holds regular meetings to discuss issues including our cybersecurity threats and has a dedicated agenda during such meetings that are designed to assist our board of directors and our audit committee in exercising their oversight function. The meetings involve presentations and reports from our management and specifically includes updates of current cybersecurity threats faced by us and steps we are taking to address them.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: The Technology Committee is responsible for the oversight of Renasant's strategies and operations with respect to information technology. Although this committee's focus is broader than just information security and cybersecurity risk, at each meeting the CISO reports to the committee on, among other topics, the status of any cybersecurity and network security initiatives designed to enhance the Company's cybersecurity, emerging cybersecurity risks that may not yet be addressed by the existing risk metrics and management's plans to mitigate such risks, and employee training on cybersecurity and related issues.

companyName: RENASANT CORP

ticker: RNST


text: Our CIO and our Director of Cybersecurity, who reports in to the CIO, have extensive cybersecurity knowledge and skills gained from over 30 years of work experience at the Company and elsewhere, respectively, and head the team responsible for implementing and maintaining cybersecurity and data protection practices across our business. Reporting to our Chief Information Officer and Director of Cybersecurity are a number of experienced information security specialists responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals. The CIO and Director of Cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from this team and regularly review risk management measures implemented by the Company to identify and mitigate cyber security risks. The CIO also attends regular meetings of the Finance and Risk Committee to report information on material risks from cybersecurity threats.

companyName: FLOWSERVE CORP

ticker: FLS


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our audit committee, comprised of members with substantial experience in information technology governance and risk management, oversees our cybersecurity strategy. Our board of directors receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: The Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser potential impact. The Committee members also receive presentations on cybersecurity topics from our Chief Information Officer ("CIO"), who also serves as our Chief Information Technology Architect & Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: For this requirement in Item 601(c)(1), although the SEC opted not to adopt a proposal to require disclosure of the frequency of board and committee discussions, the SEC specifically noted in the adopting release that the disclosure may include discussion of frequency, including the board or board committee's reliance on "periodic (e.g., quarterly) presentations by the registrant's chief information security officer to inform its consideration of risks from cybersecurity threats." 18 Notably, the SEC also removed its proposed requirement that companies disclose whether any directors have cybersecurity expertise, noting that "effective cybersecurity processes are designed and administered largely at the management level and that directors with broad-based skills in risk management and strategy often effectively oversee management's efforts without specific subject matter expertise as they do with other sophisticated technical matters." 19 Governance Management Disclosure. Under new Item 106(c)(2), companies must: Describe

companyName: Energy & Water Development Corp

ticker: EAWD


text: Management's Role Managing Risk Our CIO is responsible for developing and overseeing matters related to cybersecurity and serves as the Company's Chief Information Security Officer. The CIO has over 25 years of experience in information technology and is certified as an IT Business Relationship Management Professional (BRMP), Six Sigma Blackbelt and Lean Office Champion. The CIO reports directly to the Chief Operating Officer, who is accountable for the overall information technology and security strategy and governance of the Company.

companyName: AGREE REALTY CORP

ticker: ADC


text: Risk Management Strategy The oversight of our cybersecurity risk is integrated into our Enterprise Risk Management ("ERM") function and processes and procedures. Our ERM framework integrates our information technology and data management systems and related policies and practices into the larger framework to help guide and prioritize our cybersecurity and information technology-related investments, activities, and risk management strategy. We leverage a variety of risk methodologies and technologies to mitigate the risk of cybersecurity threats and incidents. We have a multi-layer, in-depth approach to technology solutions, including employing applications and tool suites used for perimeter, network, end point and application security, as well as for data recovery, in each case tailored to our systems, data, risk profile and mitigation strategy. At least annually, we review cybersecurity risk as part of our ERM processes and integrate those findings into our overall cybersecurity strategy.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.

companyName: Gentherm Inc

ticker: THRM


text: Our security team has several touch points within the business in order to adequately address and mitigate risks. For instance, the team provides mandatory cybersecurity awareness training for all employees and a recurring phishing campaign. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive testing to detect vulnerabilities and respond. Our technical security teams also invest in building new tools and integrating solutions to improve our security posture on an ongoing basis.

companyName: Criteo S.A.

ticker: CRTO


text: Item 2. Properties. We maintain administrative offices and other facilities to support our operations. We have a lease for our principal executive office in Chicago, Illinois. In 2023, we ceased operations at our Naperville, Illinois office and terminated the lease effective February 2024.

companyName: Cars.com Inc.

ticker: CARS


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: We have not, to date, experienced a cybersecurity incident that was determined to be material, although, like any technology provider, we have experienced incidents in the past. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: To manage risks posed by third party vendors, the Company requires mutual non-disclosure agreements and master service agreements which include minimum requirements related to cybersecurity, data security, and breach of reporting. Potential threats posed by third party vendors are assessed according to potential level of impact and risk to our overall cybersecurity. Additionally, we obtain SOC-1 Type II and SOC-2 reports from vendors with a financial reporting impact.

companyName: WideOpenWest, Inc.

ticker: WOW


text: As part of our efforts to identify, assess, and manage material risks from cybersecurity threats, we engage third-party cybersecurity consultants and use them to, among other things, conduct a review of our cybersecurity program or conduct a tabletop exercise to help identify areas for continued focus, improvement and/or compliance. In addition to maintaining a robust incident response plan, we regularly test our response capabilities through real-world simulations, post-incident reviews, and lessons-learned exercises to ensure continuous improvement in our ability to respond effectively to cybersecurity incidents.

companyName: Sunrun Inc.

ticker: RUN


text: Our Board considers cybersecurity risk as part of its risk oversight function and has received briefings from management in the past as appropriate (for example, regarding the results of our previous cybersecurity risk assessment and ongoing enhancement efforts with the involvement of a third-party assessor). Our audit committee oversees management's implementation of our cybersecurity risk management program.

companyName: Smith Douglas Homes Corp.

ticker: SDHC


text: The ERM of the Board of Directors oversees risks resulting from cybersecurity threats. DIRTT's management, represented by the SVP of Technology, is responsible for identifying, assessing, and managing risks arising from cybersecurity threats. Quarterly, DIRTT's SVP of Technology reports to the ERM on the health of DIRTT's cybersecurity, incidents, and emerging threats and vulnerabilities that may impact the Company.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our global enterprise IT environment; • a security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to security breaches and cyberattacks; • the use of external service providers, where appropriate, to assess, perform tabletop exercises or otherwise assist with aspects of our security controls and designed to anticipate cyberattacks and respond to breaches, including an annual maturity assessment of our program by an external third-party; • cybersecurity awareness training of our employees and contractors, incident response personnel, and senior management to help them better understand the issues and risks relative to cybersecurity, as well as data privacy (for our employees); • Periodically throughout the year, our IT department performs phishing and other exercises to both test our systems and reinforce training of our personnel; • a cybersecurity incident response plan managed by our CISO that includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of all information possessed by the Company; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: The Information Security Program complies with all applicable regulations, including Section 501(b) of the Gramm–Leach–Bliley Act and Section 216 of the Fair and Accurate Credit Transactions Act of 2003. The Information Security Program aligns with National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security (benchmarks for device hardening).

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: As appropriate, the board also receives information regarding cybersecurity incidents as well as ongoing updates regarding mitigation of any such incidents until they have been resolved.

companyName: HUBSPOT INC

ticker: HUBS


text: In addition, if warranted based on our response plan, cyber security incidents will be escalated to the attention of the Audit Committee while such incidents are ongoing.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: Governance and Management's Responsibilities IT management is responsible for the cybersecurity program that assesses and manages cybersecurity risk. Specifically, the Senior Director of IT is responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents while at the executive level, the Chief Administrative Officer oversees the program and is the executive sponsor.

companyName: Third Harmonic Bio, Inc.


text: Our Third-Party Security Management Standard provides a framework for managing third-party information security risks and defines controls to minimize risks to the Company. It applies to third parties who have access to or process Company information. This framework includes processes for conducting, as appropriate, due diligence, risk assessment and planning, contract management, access control, ongoing monitoring, and possible service termination of, or changes to the third-party as part of the selection and management process.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our enterprise risk assessment function, which is led by our General Counsel and Vice President of Internal Audit, we have implemented processes designed to assess, identify and manage the material risks facing the Company, including from cybersecurity risks. As part of this process, our IT organization assesses cybersecurity risk and evaluates our policies, procedures, skill sets and tools, with the aim to identify and address, as appropriate, areas of vulnerability. Our internal audit team performs testing to assess whether our program is appropriately designed and operating as intended.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Under the oversight of the Audit Committee, and as directed by the Company's Chief Executive Officer, the Company's Chief Information Officer (CIO) is primarily responsible for the assessment and management of cybersecurity risks. The CIO, who reports to the Chief Financial Officer, is aided by a third party Chief Information Security Officer with over 40 years of experience, in addition to other external professionals. Management's risk oversight is also accomplished through the Company's Strategic Risk Management Committee and Operating Risk Management Committee, which provides cross-functional support for cybersecurity risk management, as well as the Company's Chief Compliance Officer.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: Cybersecurity is integrated into the Company's Risk Framework through which the Company identifies, assesses, monitors, controls, communicates and escalates risks. The Risk Framework, which is reviewed and approved by the Risk Committee of the Board of Directors at least annually, represents the Company's overall risk management approach, including the policies, processes, controls and systems, through which the Company seeks to manage risk, including cybersecurity risk. It aims to provide a common foundation for all employees and officers as well as directors to help understand and communicate the types of risks that the Company faces in pursuit of its business objectives. The Risk Framework includes oversight by management through a multi-tiered committee structure responsible for overseeing proactive risk identification, developing an aggregated view of risks, and providing a consistent governance methodology across the Company. All such committees, including a management committee which has primary authority for oversight of cybersecurity, report up to the Management Risk Committee, which is chaired by the Chief Risk Officer, and serves as the executive level committee responsible for the implementation and oversight of the Risk Framework. The Risk Framework is designed to ensure the Board of Directors and its Risk Committee, which is the primary Board committee that oversees cybersecurity, are provided the information necessary to be effective in its risk management oversight responsibilities.

companyName: M&T BANK CORP

ticker: MTB


text: Dime considers Cybersecurity Risks as part of our strategic planning process. Management and the Board of Directors acknowledge that technology systems, managed both by Dime and third-party service providers, are critical to business operations and therefore require appropriate risk management.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against the NIST Cybersecurity Framework. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.

companyName: ServiceNow, Inc.

ticker: NOW


text: Cybersecurity-related risks are one of the key risks contemplated by our Enterprise Risk Management ("ERM") Framework. The ERM Framework informs our strategic planning activities through a collaborative risk management environment that proactively identifies and prioritizes our strategic, preventable, and external risks (including new or changing regulations). The ERM Framework enables a clear understanding of the top risks and the exposure they have to our performance and strategic decisions. The ERM Framework is reviewed annually as part of a risk assessment that is presented to our Board.

companyName: Kenvue Inc.

ticker: KVUE


text: BHE's CSO is responsible for cyber and physical security across BHE and its Subsidiary Registrants. The CSO reports directly to the Chief Executive Officer of BHE. The CSO is responsible for identifying, assessing and managing cyber risk for BHE and its Subsidiary Registrants. Management has evaluated the expertise of the CSO and determined that it possesses the knowledge and expertise necessary to oversee BHE's cybersecurity risk management processes.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: We have developed and continue to enhance our cybersecurity governance program to help protect the security of our computer systems, software, networks, and other technology assets against material risks from cybersecurity threats, including unauthorized attempts to access confidential information or to disrupt or degrade our business operations. Our cybersecurity governance program is strategically integrated into our broader risk management framework and aims to (1) proactively manage cyber and information security risks at AutoNation, (2) implement the internal controls required by cybersecurity regulatory requirements as well as AutoNation's information security control objective documents and information security standards, and (3) improve the efficiency, maturity, and effectiveness of technology functions and processes.

companyName: AUTONATION, INC.

ticker: AN


text: Incident Response and Reporting In the event of a cybersecurity incident, we follow an Incident Response Manual and process led by our CISO which governs our assessment, response, and notifications process, internally and externally. Depending on the nature and severity of an incident, this process includes review by an incident response team, made up of members of the Information Security Office, with escalating notifications up to our CIO, Legal Department, CFO, and CEO followed by our Audit Committee Chair and the full Board.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: The Company's Chief Information Officer (CIO) has primary responsibility for the Company's cybersecurity program and manages the implementation of the cybersecurity risk management strategy, coordinating efforts across technical and operational functions. Our CIO has over 12 years of experience leading information security functions, including over seven years with the Company in roles of increasing seniority. Cybersecurity oversight is coordinated through the Security Council, which meets regularly and consists of cross-functional leaders. The Security Council is advised by the CIO and the Director of Information Security and Compliance on strategic cybersecurity initiatives, emerging threats, and risk posture. The Security Council formulates our cybersecurity policies and determines the priorities of our risk management plan. The information security team, led by the CIO, executes the plan, uses automated tools, follows procedures to monitor and respond to cyber threats, and subscribes to reports and services to stay current on the threat landscape. In addition to full time staff with cybersecurity responsibilities, we engage qualified third-party partners, including assessors, auditors, consultants and other entities to support our cybersecurity processes for security engineering, security monitoring, incident response, security assessments, and independent audits of cybersecurity controls. Third-party partners work under the direction of the CIO or their designee.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: Use of Third Parties The Company engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and risk assessments to identify weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions. This includes a managed security service provider to augment the Company's dedicated security operations team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: The Company's management is responsible for implementing its strategic plans, including identifying, evaluating, managing and mitigating the risks inherent in them, such as cybersecurity risks. Within management, the Company's CISO has specific responsibility for cybersecurity risk management, reporting to the CIO.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: To date, there have been no known material cybersecurity incidents that have significantly impacted the Funds' business strategies, results of operations, or financial condition. The Sponsor continues to monitor systems and processes to mitigate potential cybersecurity risks actively.

companyName: Amplify Commodity Trust

ticker: BDRY


text: The Company's Board of Directors and Board Risk and Finance Committee oversee our integrated enterprise risk management and cybersecurity programs. The Board Risk and Finance Committee receives regular reports from the Chief Risk Officer and Chief Security Officer on key company risks and emerging threats. These reports also include cybersecurity monitoring and threat response metrics, industry trends and educational materials, risk mitigation strategies, regulatory requirements, corporate policies, third-party risk metrics, cybersecurity tools and resources, incident response plans, and other areas of importance.

companyName: NELNET INC

ticker: NNI


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and we have processes in place to oversee and manage these risks. We conduct thorough security assessments of these third party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: We recognize the importance cybersecurity has to the success of our business. We also recognize the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, including customer records and information, against known and evolving cybersecurity threats.

companyName: MGM Resorts International

ticker: MGM


text: Cybersecurity Risks, Threats & Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition, and the Company does not believe that such risks are reasonably likely to have such an effect over the long term. As of the date of this report, the Company has not experienced a cybersecurity incident or third-party information security breach in the last three fiscal years that has materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Cybersecurity Threat Disclosure While we have not, at the date of this Annual Report, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. Refer to Part I, Item 1A. Risk Factors for further discussion of cybersecurity risks.

companyName: International Stem Cell CORP

ticker: ISCO


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Form 10-K, there have been no cybersecurity incidents that have materially affected, or are likely to materially affect the Company's business strategy, results of operations or financial condition.

companyName: INSEEGO CORP.

ticker: INSG


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data of our customers and employees ("Information Systems and Data").

companyName: Definitive Healthcare Corp.

ticker: DH


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including notification of and escalation to the appropriate team members as well as executive management and the Board of Directors. The Incident Response Plan is coordinated through the Director of Information Security and key members of management. The Incident Response Plan facilitates coordination across multiple departments and is evaluated at least annually.

companyName: FIRST OF LONG ISLAND CORP


text: We describe the risks from cybersecurity threats that may materially affect us and how they may do so under the heading "Risks Related to Our Business Operations" under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Sunrun Inc.

ticker: RUN


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take cybersecurity trainings and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of our cybersecurity training. We also conduct penetration testing of our network, hold tabletop exercises of cyber incidents, and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Information Services, with support from our entire Information Services department. Such individuals have collectively over 10 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications. These Information Services team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these Information Services team members report to our Chief Executive Officer, and ultimately to the Audit Committee of our board of directors about material cybersecurity threats.

companyName: EXAGEN INC.

ticker: XGN


text: To help address cybersecurity threats, Western Union has developed a strategy and implemented a program to identify, assess, and prioritize cybersecurity risks as part of our broader enterprise risk management processes. We recognize that cybersecurity threats are constantly evolving and that there is no single solution that can guarantee complete protection.

companyName: Western Union CO

ticker: WU


text: The VP of IT Operations and Strategy is promptly informed of potential cybersecurity risks, threats and vulnerabilities by the Company's IT security team or the Company's SIEM partner. Once an incident has been identified, the VP of IT Operations and Strategy and the IT security team assess the criticality and impact of the incident on the Company's business operations. The VP of IT Operations and Strategy then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the Audit Committee on all material incidents.

companyName: DallasNews Corp


text: The Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a Cybersecurity Incident Response Plan which contains processes and procedures related to security incident handling.

companyName: CORVEL CORP

ticker: CRVL


text: We maintain a cybersecurity risk program predicated on a risk-based approach. We use cost-effective controls that are commensurate with the risk and sensitivity of our specific information systems, control systems and enterprise data. Our cybersecurity program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The cybersecurity program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, log collection and analysis, threat hunting and intelligence surveillance, compliance monitoring and testing, and incident response.

companyName: SUPERIOR GROUP OF COMPANIES, INC.

ticker: SGC


text: As noted above, our business regularly uses and relies on third-party information systems and services to process, store and transmit confidential and other information. To support our cybersecurity oversight of third-party information technology providers, we have integrated automated processes to manage third-party cloud security. We also use an enterprise-wide third-party technology provider to assist in our identification and assessment of cybersecurity risks to the Company presented by third parties, and our contracts are vetted by our internal legal and compliance departments as part of a process designed to ensure that we are provided the right to audit and test the security and quality of each of our vendors. As part of our screening and evaluation processes, we conduct due diligence on our potential vendors, as well as regular assessments of current vendors, regarding compliance with law (including financial regulations, sanctions regimes and data privacy regulations) and cybersecurity standards, including background checks and system tests.

companyName: Lazard, Inc.

ticker: LAZ


text: Although we maintain a robust cybersecurity program, due to the evolving cybersecurity threat landscape, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. To mitigate against such risks, the company carries information security risk insurance that provides protection against potential losses arising from a cybersecurity incident. Refer to Item 1A. "Risk Factors" for additional information related to cybersecurity risks and the impact they may have on our operations.

companyName: MAGNITE, INC.

ticker: MGNI


text: The governance of our cybersecurity risks involves active and informed participation from our management team, our IT team and our board of directors. This oversight includes briefings by our IT team on the nature of the risks we face and the steps we are taking to mitigate these risks, as well as immediately reporting any significant cybersecurity incident that occurs to management and the board of directors.

companyName: SS Innovations International, Inc.

ticker: SSII


text: Risks related to Cybersecurity Incidents We face significant risks related to cybersecurity threats, which could adversely affect our business, financial condition, and results of operations. Cybersecurity incidents, including but not limited to unauthorized access, data breaches, and other malicious activities, could result in the loss or theft of sensitive information, disruption of our operations, and damage to our reputation. While we have implemented measures to protect our information systems, there can be no assurance that these measures will effectively prevent all cybersecurity incidents.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: The Company's cybersecurity risk management and strategy processes are overseen by leaders from the Information Technology team (specifically, the Company's chief technology officer, its chief information officer, and its senior manager for cybersecurity) who collectively have over 75 years of prior work experience in various information technology roles, including security, auditing, compliance, systems and programming, and whose credentials have included Certified in the Governance of Enterprise IT (CGEIT), Certified in Risk and Information Systems Control (CRISC) and Certified Information Systems Security Professional certifications. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Potentially significant cybersecurity incidents are reported to the Breach Response Team. If the Breach Response Team deems the incident material, it will promptly notify the Audit Committee or the full Board of Directors. The Audit Committee or Board receives updates regarding other incidents during management's regular quarterly cybersecurity updates. In addition, the Company's Internal Audit function, whose leader possesses a Certified Information System Auditor (CISA) certification, reviews certain cybersecurity controls in connection with its information technology audit procedures.

companyName: MOVADO GROUP INC

ticker: MOV


text: The CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company conducts regular risk assessments to identify, evaluate, and prioritize material cybersecurity risks to the Company, including its health plans and state contracts, shared services and IT operations, or business strategy. The risk assessments are informed by various sources of information, such as internal and external audits, vulnerability scans, penetration tests, threat intelligence, incident reports, industry benchmarks, and accepted industry practices. The risk assessments consider the potential impact and likelihood of various cybersecurity threats, such as ransomware, malware, social engineering, third-party incidents, supply chain attacks and insider threats, and contemplates the adequacy of controls to detect, prevent, respond, and recover to reduce the possibility of an adverse material cybersecurity event. The Company has in place processes to identify material risks from cybersecurity threats associated with its use of third-party service providers and as such, conducts assessments of such third-party service providers with respect to their cybersecurity programs and risks and requires third-party service providers to notify the Company if they experienced a cybersecurity incident. The Company hires experienced security professionals to conduct advanced and realistic cybersecurity attack simulations to verify its Program, and conducts regular cybersecurity tabletop exercises with executive management, which are coordinated by a third-party.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: We have processes and controls that oversee, identify, and manage cybersecurity risks with respect to our external service providers, including cybersecurity service providers. For example, we review and seek to negotiate terms and conditions in our legal agreements to provide for the adequate protection of confidential information and the Company's networks and systems and compliance with any applicable cybersecurity requirements, including with respect to any information exchanged. We also review the security controls of hosted solutions in an effort to ensure protection is commensurate with our security requirements. We periodically revalidate those cybersecurity control reviews commensurate with the risk identified. Further, we utilize an external security assessment service to produce security ratings that include detailed descriptions of deficiencies affecting the rating. We seek to respond accordingly to those deficiencies to the extent practicable. Lastly, as appropriate and when feasible, we may visit our service providers' facilities to observe security practices and physical security controls.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: We constantly monitor our cybersecurity environment and coordinate with third-party consultants to provide regular cybersecurity training and promote cybersecurity awareness across the organization.

companyName: CHARLES & COLVARD LTD


text: Entertainment, Inc. recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: Our Chief Executive Officer ( "CEO") conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third party providers. All employees and consultants are directed to report to senior management with any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.

companyName: BNB PLUS CORP.

ticker: BNBX


text: We share and receive threat intelligence with our peers in the defense industrial base, government agencies, information sharing and analysis centers, and cybersecurity associations. We have relationships with third-party service providers who also assess our security controls through penetration testing, independent audits, and consulting on best practices to address emerging challenges. These assessments evaluate the effectiveness of our security controls.

companyName: Science Applications International Corp

ticker: SAIC


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: As discussed in more detail below under the heading "Governance," our Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews operational risks. Our Chief Information Officer ("CIO"), together with our Head of Information Security ("HIS"), and other members of our management team meet regularly to review current cybersecurity risks. The CIO and management team representatives also meet with the Audit Committee at least on a quarterly basis to discuss and review our cybersecurity program and risk landscape.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Additionally, he holds a professional degree in Computer Science. Our CLO has been with WEX since 1996, serving as the Corporate Secretary and head of the Legal department since 2005. In this capacity, she has gained extensive experience coordinating with the Board on addressing numerous emerging risk areas and ensuring our governance processes are equipped to manage and mitigate such risks. In addition to the processes we have put in place to ensure our information systems and networks continue to evolve and adapt to the ongoing cybersecurity threat environment, we have designed an enterprise security architecture system that deploys layers of security controls to continuously monitor for potential cybersecurity vulnerabilities and threats in a situation when a potential incident does arise. Our systems are configured to generate alerts in the event of any potential breach or intrusion with a team in place to receive and act upon such alerts. Additionally, all WEX systems that store, process, transmit, or could affect the security of confidential data are logged and monitored, with our information security team conducting a daily review of any such systems. If an alert is triggered automatically by our system or as a result of our team's review and a potential cyber or information security incident is detected, the alert will be elevated within the information security incident response team and the CISO will become responsible for informing the crisis management team to facilitate the Company's assessment and response to the potential incident. The crisis management team along with the CISO will inform and coordinate with members of senior management and when appropriate, the Technology Committee, to evaluate the incident and consider potential response actions, including with respect to mitigation and containment actions. Furthermore, the crisis management team, in conjunction with members of senior management will determine whether to engage third parties, including outside counsel, consultants, law enforcement and external forensic firms, to provide support in the assessment of and response to the incident.

companyName: WEX Inc.

ticker: WEX


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols, including but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.

companyName: SAN JUAN BASIN ROYALTY TRUST

ticker: SJT


text: April 2024 Email Spoofing Incident. At 10:25 p.m., local Hong Kong SAR time, on April 9, 2024, the Company received information that indicated a possible email spoofing incident involving a wire transfer payment of accounting fees owed to the Company's public auditor. By April 11, 2024, the Company verified that the Company had wired $30,825 as an intended payment of accounting fees owed to the public auditor to a third-party bank account on March 27, 2024, as a result of email spoofing presenting an invoice under the identity of the public auditor. An internal incident report was distributed by the Company's Chief Information Security Officer about this email spoofing incident to Company's senior officers, finance department personnel, Audit Committee and the Board. Based on conversations with Company's bank and local law enforcement, the Company does not believe that recovery of the $30,825 payment is possible. As a result of an internal review of this email spoofing incident involving the senior officers of the Company, the Company's Chief Information Security Officer and Company's Audit Committee, the Company adopted the following actions as of April 12, 2024: - Only verified email addresses allowed for incoming and outgoing emails by the Company email system; - Briefing company personnel about the incident and cybersecurity safeguard measures adopted;

companyName: Value Exchange International, Inc.

ticker: VEII


text: The vast majority ( 98 %) of our restaurants are owned and operated by franchisees who themselves are at risk of cyber-attacks or security incidents. Whilst some of those franchisees do operate their restaurants utilizing the Company's networks and systems, many use networks and systems which they manage themselves. In such instances, there is limited direct connectivity between the networks that the Company manages and the networks which our franchisees manage. We have established minimum information security standards for our franchisees through our Franchise Agreement Policy Manuals and Brand Standards and those minimum information security standards are in the process of being adopted.

companyName: YUM BRANDS INC

ticker: YUM


text: Management's Role Managing Risk The Company's CIO plays a large role in informing the audit committee of the board of directors on cybersecurity risks. The audit committee of the board of directors receives presentations and reports from the CIO on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the CIO and audit committee of the board of directors maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Our Chief Information Security Officer is accountable for managing our enterprise information security function and delivering our information security program. The responsibilities of this position include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Technology Director, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Operating Officer. The function, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals responsible, including third-party vendors, are generally subject to professional education and certification requirements.

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: Governance and Oversight of Cybersecurity Risks Our cybersecurity program is managed by IT Manager and our IT consultant, which together, are responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by our Manager's IT Manager who has a bachelor's degree in Information Systems from Xavier University and over 15 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures for financial services companies.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: Our management team, including our Director of Infrastructure and Cybersecurity, Senior Vice President of Business Technology, and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes demonstrated expertise in cybersecurity, life sciences, and security industry certifications such as CISM and CISSP.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal computer systems, or those of any of our existing or future CROs, manufacturers, other contractors, consultants, or collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of or destruction of our proprietary and confidential data, employee data or personal data, which could result in additional costs, significant liabilities, harm to our reputation and material disruption of our operations."

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: We have implemented hiring, onboarding and termination procedures that are designed to ensure our employees and contractors assist us in meeting our cybersecurity compliance objectives. All of our employees and contractors are required to complete security awareness training (which covers the policies and other information regarding our cybersecurity programs) both at the time of hire or engagement and then on annual basis. We also routinely disseminate cybersecurity and physical security educational materials to all employees and contractors.

companyName: Repay Holdings Corp

ticker: RPAY


text: Track Group's Chief Information Security Officer, Tim Hardy, has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and report any findings and recommendations, as appropriate, to the full Board of Directors for consideration.

companyName: Track Group, Inc.

ticker: TRCK


text: The Board of Directors is kept apprised of material risks from cybersecurity threats through the Audit Committee. The Audit Committee is responsible for overseeing threats to the Company, including those involving cyber threats, and reviewing the Company's protocols and procedures to mitigate those threats. On a quarterly basis, the SVP, Chief Privacy Officer, presents to the Audit Committee on the Company's cybersecurity compliance and risk management practices. These presentations address, among other things, the results of audits and reviews of our security information systems and other cybersecurity measures, the current threat environment and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. The Audit Committee discusses the adequacy and efficacy of the controls and shares the information with the Board as part of its risk oversight function. Outside of quarterly presentations, the Audit Committee is informed of incidents that in senior leadership's discretion require more immediate Audit Committee attention.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Our CIO reports to the Audit Committee at every regularly scheduled meeting (or more frequently, as needed) to discuss cybersecurity risk exposure and risk management strategy. Our CIO has over 25 years of experience in the information technology and security industry with global organizations. Our executive leadership team, which includes our CIO, reviews and manages implementation of our cybersecurity strategy and programs through regularly scheduled meetings.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Cybersecurity Risk Management Framework The Company employs a multi-faceted cybersecurity risk management framework, which is integrated into its enterprise risk management system. The Company aligns its security policies and practices with the ISO 27001 framework and manages its cybersecurity risks through a dedicated information security team, reporting to Mr. Preston. The information security team is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company's cybersecurity strategy. The Company's cybersecurity risk management includes, but is not limited to, the following elements.

companyName: IMAX CORP

ticker: IMAX


text: We engage in the periodic assessment and testing of our cybersecurity program. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. These activities may be performed by external cybersecurity and application security professionals.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: Additionally, in connection with our cybersecurity risk management processes, we engage third-party subject matter experts to supplement our dedicated internal resources and to provide independent review of the Tronox-specific threat landscape as well as our mitigation efforts to counter known threats. These activities include: • External penetration testing by certified third parties. • Independent review of the Tronox Information Security Management System (ISMS). • Participating in industry and government cyber incident exercises run by the National Cyber Security Center (UK Security Services). • Utilizing a third party (KnowBe4) for the cybersecurity training and phishing tests described above. • Regularly engaging with statutory auditors in support of specific activities such as SOX 404 audits. • Engaging outside counsel with expertise in the field to advise on critical IT contracts as well as reporting and disclosure requirements.

companyName: Tronox Holdings plc

ticker: TROX


text: The Company's Chief Information Security Officer, in coordination with Company management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Chief Information Security Officer and Company management monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our Board delegates to the Audit Committee oversight of certain aspects of our risk management process, including risks related to information technology, data privacy and cybersecurity.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: Our managed services provider assists us with our technology, infrastructure and risk management through the deployment of a number of security controls and tools, including, but not limited to, endpoint protection tools, phishing protection and access controls.

companyName: Vivani Medical, Inc.

ticker: VANI


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We have established and maintain comprehensive incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. We conduct regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.

companyName: Viking Therapeutics, Inc.

ticker: VKTX


text: Management's Role Managing Risk The chief information officer and the chief financial officer are responsible for updating the Nominating and Corporate Governance Committee on cybersecurity risks and our mitigation strategies. They provide quarterly updates to the Nominating and Corporate Governance Committee, as well as comprehensive briefings at least once per year and appropriate briefings during any potentially material cybersecurity incident. These briefings encompass a broad range of topics, including: • results of internal assessments and audits by third parties; • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • incident reports and lessons learned from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to regular scheduled meetings, the Nominating and Corporate Governance Committee, our chief information officer and our chief executive officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive periodic updates on significant developments in the cybersecurity landscape to support proactive and responsive board oversight. The Nominating and Corporate Governance Committee actively participates in strategic decisions related to cybersecurity, reviewing and offering guidance on major initiatives and any potentially material cybersecurity incident. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Management is responsible for assessing and managing any material risks to the Company from cybersecurity threats. However, management has no specific expertise in such matters, and there are no specific processes by which management is informed about or monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. If any such risks were identified, management would report such risks to the board of directors.

companyName: Unite Acquisition 2 Corp.


text: Enterprise Risk Management Process Integration The Company has implemented layered security approaches for all electronic delivery channels to detect, prevent and respond to rising cybersecurity risks. Management utilizes a combination of third-party information security assessments, key technologies, and ongoing internal and external evaluations to provide a level of protection of non-public personal information, to continually monitor and attempt to safeguard information on its operating systems, in cloud-based solutions, and those of third-party service providers, and to prevent, quickly detect and respond to attacks. The Company also utilizes firewall technology, multi-factor authentication, complex password construction, and a combination of software and third-party monitoring to detect and prevent intrusion, and cybersecurity threats, guard against unauthorized access, and continuously identify and prevent computer viruses on the Company's information solutions. To minimize debit card losses, the Company works with a third-party provider to establish parameters for allowable transaction activity, monitor transactions, and alert customers of potentially fraudulent activity.

companyName: ENTERPRISE BANCORP INC /MA/


text: In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors, our partners, and our employees, contractors and temporary staff. We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, tax authorities and other payees. As the global environment continues to grow increasingly hostile and attacks on information technology systems continue to grow in frequency, complexity and sophistication, we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Although this is a global problem, it may affect our businesses more than other businesses because unauthorized parties may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information and Technology Officer ("CITO"), who has been designated as our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Shake Shack Inc.

ticker: SHAK


text: Cybersecurity Risk Management and Strategy operations are managed by Blackstone Private Equity Strategies Associates L.P. (the "General Partner") subject to certain oversight rights held by the Board of Directors. The General Partner has delegated BXPE's portfolio management function to Blackstone Private Investments Advisors L.L.C. (the "Investment Manager"). The General Partner and the Investment Manager are individually and collectively referred to as the "Sponsor." The executive officers are senior Blackstone professionals and our General Partner and Investment Manager are both subsidiaries of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Private Equity Strategies Fund L.P.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Onex Corp. and its affiliates in managing these risks, see "Item 1A. Risk Factors— Risks Related to Our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information" in this Annual Report on Form 10-K.

companyName: Onex Direct Lending BDC Fund


text: Allient has processes in place to assess, identify, and manage material risks from cybersecurity threats. We regularly undertake audits and evaluations (including to the National Institute of Standards and Technology (NIST) SP 800-171 standards) and enhance our security framework based upon the results of those audits and evaluations. For new associates, and on an annual basis thereafter, we require associates to take security awareness training and conduct on-going phishing recognition training and testing programs.

companyName: ALLIENT INC

ticker: ALNT


text: The Company's CIO reports directly to the Company's Chief Executive Officer and is responsible for managing, designing, and implementing all aspects of the Company's day-to-day cybersecurity programs and initiatives. The CIO and the dedicated cybersecurity team have appropriate levels of expertise, certifications, and previous work experience to effectively develop and oversee the Company's cybersecurity efforts.

companyName: LINDSAY CORP

ticker: LNN


text: A dedicated team, led by the Senior Vice President of Information Technology and Information Security Officer (the "SVP of IT and ISO") manages the day-to-day cybersecurity risk program and supervises internal personnel and relationships with external technology and security consultants. The SVP of IT and ISO has over 18 years of experience in the banking industry as it relates to strategy and cyber security and reports to the Chief Operating Officer, the IT Steering Committee, the Audit Committee, and the Board of Directors.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: We rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan; (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.

companyName: INCOME OPPORTUNITY REALTY INVESTORS INC /TX/

ticker: IOR


text: Our management team, including our Director of Information Technology and our Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team’s experience includes 30 years of professional experience in all aspects of IT including enterprise software development, enterprise infrastructure design and configuration, development of integration infrastructure for health care systems and financial trading systems and technical support.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: As of December 31, 2024, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, our results of operations, or our financial condition.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: Cybersecurity incidents are managed through the ICIRP, which provides direction to management allowing for the timely transfer of information throughout the organization. Our policy requires material incidents to be reported within four business days after an incident is determined to be material with the materiality determination to be completed without unreasonable delay. Management's Disclosure Committee has developed a plan to facilitate making timely determinations as to whether and when incidents should be disclosed. If a material incident occurs, the Corporation will describe in detail the material aspects and nature, scope and timing of the incident, along with the impact to its financial condition and results of operations.

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: 6. Impact of Cyber Incidents Cybersecurity incidents, if material, could affect the Company's financial condition, operational stability, and reputation. Risks include: • Direct financial losses from remediation costs, potential ransomware payments, or legal expenses. • Operational disruptions affecting vehicle production and supply chain logistics. • Regulatory fines and penalties for non-compliance with data protection laws. Reputational damage impacting customer trust and investor confidence.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Upon receiving notification of a cybersecurity incident, the cybersecurity operations team acts to isolate and contain the threat. The CISO, along with the Chief Safety & Security Officer, will consult and determine the incident severity level, which determines whether the incident should be escalated. Critical and high severity incidents must be reported to the General Counsel. The Company may engage third party experts for assistance with crisis management, including forensic investigations, ransom negotiation, or crisis communication. During this process, the cybersecurity operations team will take steps to preserve evidence as soon as possible, including, but not limited to, memory dumps, log preservation and forensic hard drive collection. In addition, the General Counsel, in consultation with the CISO and others as necessary and appropriate, will promptly evaluate whether the incident requires legal notifications or disclosure, including whether the incident requires disclosure under the U. S. securities laws.

companyName: UNITED STATES STEEL CORP


text: Cybersecurity risk is tactically and strategically managed by TEP's Enterprise Cybersecurity team comprised of experienced professionals with various cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) and Global Industrial Cyber Security Professional (GICSP). This team uses governmental and industry threat intelligence, such as the Electricity Information Sharing and Analysis Center, Cybersecurity and Infrastructure Security Agency, and internal cybersecurity tools to proactively identify, assess, manage, and respond to risk, including network monitoring and vulnerability scanning.

companyName: TUCSON ELECTRIC POWER CO


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.

companyName: KLA CORP

ticker: KLAC


text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We also perform formal risk assessment activities annually, aligned to the National Institute of Standards and Technology (NIST) 800-171 Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information security professionals monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.

companyName: Avantor, Inc.

ticker: AVTR


text: In addition, we require Affirm employees to participate in cybersecurity awareness training. These training sessions are designed to enhance our employees' awareness of cybersecurity threats and provide information about best practices to protect Affirm's information systems. We require additional tailored cybersecurity training for certain employees based on their specific job responsibilities.

companyName: Affirm Holdings, Inc.

ticker: AFRM