text: Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies for the use of our information assets (for example, TI business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including the employment of multiple layers of cybersecurity defenses, restricted access based on business needs, and integrity of our business information. Throughout the year, we also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks.

companyName: Rafael Holdings, Inc.

ticker: RFL


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks The security and integrity of our information and operational technology infrastructure is critical to our business and our ability to perform day-to-day operations and deliver services. In the normal course of business, we collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third party information and employee information, and certain personal identifiable information. To manage the risks associated with cybersecurity threats, we are continually assessing, reviewing and adopting new processes, systems and resources in an effort to protect our operations and the information in our possession. We have endeavored to implement policies, standards, and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment:

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI

secItem: Item 1C


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third -party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things:

companyName: SPAR Group, Inc.

ticker: SGRP


text: The ISSC includes key personnel including the vCISO, Chief Operating Officer, Technology Services Director, Information Technology Manager, Internal Audit Manager, Compliance Manager, and Information Security Specialists. The ISSC members bring diverse qualifications, certifications, and extensive experience to the table. This collective expertise ensures a comprehensive and well-rounded approach to our information security initiatives.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: IT Administrator reports quarterly to our Board of Directors on the information security program and related cyber risks and provides an annual update to the Board of Directors on our overall risk management strategy, which includes addressing cybersecurity risks. Any cybersecurity incidents at the Company are reported to the Board of Directors by the IT Administrator.

companyName: Mag Mile Capital, Inc.

ticker: MMCP


text: In accordance with the Gramm-Leach-Bliley Act, the Company undertakes periodic assessments to identify and assess risks to customer information and evaluate the effectiveness of security controls. The Company engages third parties in connection with such cybersecurity preparedness efforts. Ongoing audits, including vulnerability and penetration testing of the Company's computing infrastructure, are performed by independent third parties and by our internal cybersecurity personnel.

companyName: M&T BANK CORP

ticker: MTB


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: The members of the Cybersecurity Team have extensive on-the-job experience in cybersecurity matters, sharing responsibility for cybersecurity, as well as for regulatory, compliance and/or IT. Ladder's CTO has over 20 years of experience in the design, engineering, implementation, and management of information technology, including as the founder of an IT managed servicer provider for professional and financial services companies. The GC helped establish and continues to oversee the Company's cybersecurity risk management framework, including a best practice approach to cybersecurity governance, testing and diligence. The CCO helps ensure adherence to regulatory standards and helps refine our cybersecurity policies and training initiatives.

companyName: Ladder Capital Corp

ticker: LADR


text: Our cybersecurity function is part of our Information Technology Department and is managed by our CIO who oversees the management of cybersecurity risk and the protection and defense of our networks and systems. Our CIO has over 30 years of experience assisting IT leadership within the Department of Defense and other federal government agencies with IT architecture and solutions including cyber security. Within the Information Technology Department, these activities are orchestrated through cooperation between our cyber security group and our network engineering group. The individuals performing these functions include cybersecurity professionals with broad experience and expertise, including cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance and include professionals who are qualified as Certified Information Systems Security Professionals. The teams within our cybersecurity group and our network engineering group work together to: identify and mitigate risks; respond to active cyber activity on our networks; respond to recent activity publicized by the Center for Internet Security (CIS) or other reputable cybersecurity organizations; and respond to patches and updates provided by our vendors.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: We have developed an information security program that is designed to address material risks from cybersecurity threats. Our information security program is integrated into our overall enterprise risk management process, which the Board ultimately oversees. The Board has delegated its responsibility for cybersecurity risk oversight to the Technology Committee of the Board, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, and IT risks or exposures, and our policies and processes with respect to risk assessment and risk management of the same; (ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks; and (iii) regularly reporting to the full Board on such matters. As described in further detail below, our information security program is led by our Director of IT Security & Compliance ("DITSC"), who is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. The program includes policies and procedures that guide our implementation and maintenance of security measures and controls. Risk-based analysis and judgment of the DITSC and our management team, along with feedback from internal and third-party audits and assessments, are used to select security controls to address risks. The following factors, among others, are considered when identifying security controls: likelihood and severity of a risk, impact on the Company and others if a risk materializes, feasibility of controls, and impact of controls on operations and others. Third parties also play a role in our cybersecurity, as we engage security firms in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address and oversee cybersecurity threats related to the use of third-party technology and services, including a vendor risk management program.

companyName: Designer Brands Inc.

ticker: DBI


text: We assess the cybersecurity practices of third-party vendors and partners, particularly those with access to sensitive information or critical systems and require them to adhere to security standards that align with our own policies.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: Our operational cybersecurity team is led by the CISO. The CISO has 31 years of experience in Information Technology and Security, with extensive experience designing, operating and protecting satellite and terrestrial telecommunications networks. The CISO also leads Viasat's engagement with the private sector and government security communities, which includes facilitating active information sharing with these partners. With the Inmarsat acquisition, the Senior Vice President, Global Security of Inmarsat joined the cybersecurity team, bringing their experience including senior cybersecurity and intelligence roles within the UK Ministry of Defence and Central Government. The operational cybersecurity teams of both legacy organizations jointly participate in local and national cybersecurity organizations, teach classes on cybersecurity, maintain numerous relevant certifications, and participate in training relevant to their field of expertise.

companyName: VIASAT INC

ticker: VSAT


text: Our cybersecurity program's effectiveness is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including periodic evaluation against established quantifiable goals and other external benchmarks, including the Center for Internet Security (CIS), the National Institute of Standards and Technology (NIST) and several other security frameworks. The evaluation is conducted through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct evaluations and assessments and to advise us on the effectiveness of our cybersecurity program.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: Management's Involvement in Cybersecurity Risk Oversight The CISO, in coordination with the Information Security Management System Committee, which includes our Chief Executive Officer and Interim Chief Financial Officer ("CEO"), CIO, CRO and General Counsel & Corporate Secretary (the "GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the Information Security Management System Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Committee and/or the full Board when appropriate.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of the data. The Company will be looking to adopt cybersecurity processes, technologies and controls to aid in its efforts to assess, prevent, identify and manage such risks.

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data entrusted to it, including by us and the Adviser, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Our board of directors has overall responsibility for risk management oversight, with its committees assisting the board in performing this function based on their respective areas of expertise. Our board oversees cybersecurity matters and risk, and the Audit Committee also oversees risk that includes cybersecurity risk. The board periodically reviews our processes for assessing and addressing key strategic, operational, compliance and risk management matters concerning cybersecurity, and as part of such assessment receives briefings on such matters from our Chief Information Security Officer ("CISO"). These briefings include reports on the threat landscape, our strategies, efforts and investments to address threats, and updates on incidents. The Audit Committee also receives reports from the Company's Vice President of Internal Audit assessing internal controls that include cybersecurity controls. Furthermore, our cybersecurity risk management processes are integrated into our enterprise risk management program and our compliance risk management program, both of which are also overseen by our board.

companyName: Sylvamo Corp

ticker: SLVM


text: In addition, we use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, CROs, distributors, and supply chain management resources. We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers, such as reviewing security questionnaires, reviewing the vendor's written security program, conducting risk assessments for certain vendors, arranging security assessment calls with the vendor's security personnel, reviewing security assessments, or imposing contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify and mitigate cybersecurity risks associated with a provider.

companyName: MACROGENICS INC

ticker: MGNX


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that can lead to exploits, security breaches and service disruption. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any known cybersecurity threats that have materially affected the Company.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: The Company's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Chief Information Officer ("CIO"). We believe that our employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques, including intrusion detection, malware analysis and penetration testing. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional. For a description of the relevant expertise of the CIO, see "Item 1. Business—Information About our Executive Officers."

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: For additional information on Sirius XM Holdings' cybersecurity program and risks refer to Item 1C in their 2023 Form 10-K, filed on February 1, 2024.

companyName: Liberty Media Corp

ticker: FWONA


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: Management and Strategy have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of any information residing therein.

companyName: Bone Biologics Corp

ticker: BBLG


text: As of the date of this report, cybersecurity threats have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors for information on the risks that cybersecurity threats pose to the Company.

companyName: CROSSFIRST BANKSHARES, INC.


text: During the period covered by this Annual Report, the Company has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, institutions like us, as well as our employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks. The Company describes whether and how risks from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Disruptions or failures in the Company's computer systems; cyber and other information security incidents" included as part of our risk factor disclosure at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: We rely on third parties, including cloud vendors and consultants, for various business functions. Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business operations. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, and scans or other technical evaluations.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct thorough security assessments of third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The Third-Party Risk Management department reports to our CISO.

companyName: FB Financial Corp

ticker: FBK


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. We have implemented cybersecurity policies, procedures, technologies and controls to aid in our efforts to access, identify and manage such risks. Material risks from cybersecurity threats are managed across GM, GM Financial, Cruise, service providers such as data processors, third-party suppliers, dealers and vendors, and monitoring such risks and threats are integrated into the Company's overall risk management program.

companyName: General Motors Co

ticker: GM


text: At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial conditions. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See " Risk Factors—If our security measures or those of our third-party cloud storage providers are breached and unauthorized access is obtained to customers' data or our data, our network, data centers and products and services may be perceived as not being secure, customers may curtail or stop using our service and we may incur significant legal and financial exposure and liabilities " and " Risk Factors—Catastrophic events could materially adversely affect our business, results of operations and/or financial condition. "

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's General Counsel ("GC"), Chief Technology Officer ("CTO"), other members of management and relevant management committees, including Company's Senior Leadership Team ("SLT"), regarding cybersecurity oversight and risk management. • Collaborative Approach: The Company, through its information technology partner, has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company, through its information technology partner, deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti- malware functionality and access controls, which are evaluated and improved through vulnerability assessments, penetration testing, and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company, with its information technology partner, maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident. • Education and Awareness: The Company, through its information technology partner, provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Longeveron Inc.

ticker: LGVN


text: Board of Directors has ultimate oversight responsibility for cybersecurity risk as part of its overall risk management and corporate governance framework. Management is responsible for the implementation and monitoring of cybersecurity controls and for reporting material developments to the Board.

companyName: SafeSpace Global Corp

ticker: SSGC


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our management-level Technology and Third-Party Risk Committee, which governs our technology and third-party risk tolerances, including cybersecurity. This committee includes the Chief Information Security Officer and is co-sponsored by the Chief Information Officer, the Chief Risk Officer, and the Director of Vendor Risk Management and Sourcing. These individuals have relevant financial, technical, and business degrees, hold relevant certifications, and each have over 20 years of experience in their respective areas of expertise, with a minimum of ten years in leadership roles, including multiple years at financial institutions. The Committee is responsible for escalating key risks to our Management Risk Committee, which includes all members of our Executive Leadership Team, as well as our Head of Business Risk, who operates within our first line of defense.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: The director of cybersecurity has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity has been involved in designing and evolving Dominion Energy's cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Our Chief Information Security Officer ("CISO") leads our cybersecurity program through our global information security operations team. Our CISO has over 20 years of experience in information technology security obtained in civilian and military roles, and regularly reports on cybersecurity matters to our Audit Committee. As of December 31, 2023, our Cybersecurity, Risk and Compliance team consisted of team members and contractors, many of whom have advanced degrees and cybersecurity-related industry certifications. Under the direction of our CISO, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to continually enhance our cybersecurity program in response to such developments.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: We maintain a cyber risk insurance policy, but costs related to cybersecurity threats or disruptions may not be fully insured. We acknowledge that successful cyberattacks could result in substantial costs, liability, reputational harm, and significant remediation expenses.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to our Audit Committee, but retains overall oversight responsibility for cybersecurity matters. The Board and Audit Committee periodically review the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the Board and Audit Committee receive reports from members of our team responsible for overseeing the Company's cybersecurity risk management, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee discusses with such members of our management team our information technology systems and procedures and will report to the Board on any material cybersecurity risks identified. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board and Audit Committee in a timely manner.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: Our Chief Information Security Officer ("CISO") is responsible for the assessment and management of cybersecurity risk. The individual currently serving as our CISO has over twenty-five years of experience in cybersecurity, information security, and risk management within the financial services industry. The CISO reports to our Chief Executive Officer ("CEO") and provides updates to him on a regular basis of any cybersecurity matters.

companyName: LendingTree, Inc.

ticker: TREE


text: Incident Response Planning: We have established and maintain an incident response plan that outlines our response in the event of a cybersecurity incident.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: At the management level, our CIO, who reports directly to the CEO, has over 20 years of experience serving in IT management, software development, and technology-based roles across a variety of industries, including publishing, media and entertainment, and financial and insurance services. Our Chief Information Security Officer (CISO), who reports directly the CIO, has extensive cybersecurity knowledge and skills gained from over 15 years of work experience serving in security roles for the Company and a variety of financial service firms. Our CISO is responsible for understanding, managing, and communicating cybersecurity risk internally to our management, and works closely with Legal to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: GARTNER INC

ticker: IT


text: In addition to our dedicated cybersecurity team, Wintrust's approach to cybersecurity is supported by dedicated risk management and internal audit teams. Our governance program maintains policies and standards, which are validated through risk-based assessments, reviews and testing. The CSO reports at regular intervals to the Wintrust Enterprise Risk Management Committee, the IT/IS Committee, and the Audit Committee of the Wintrust Board of Directors, as well as the full Wintrust Board of Directors, as necessary. The Audit Committee performs an annual review of our cybersecurity program, which includes a discussion of management's actions to identify and detect threats and incident plans in the event of a response or recovery situation. The Audit Committee receives an annual review that includes enhancements to the cybersecurity program and management's progress on its cybersecurity strategic roadmap. In addition, the Board of Directors receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and an overview of recent threats and how the Company is managing those threats. For more information on the material risks that cybersecurity threats pose to us, please see our risk factor disclosures under Item 1A of this Annual Report on Form 10-K.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Our strategy for responding to cybersecurity incidents involves a well-defined plan at each subsidiary that prescribes dedicated cross-functional personnel to each response team, ensuring a coordinated and premeditated response. These plans, which undergo regular review, assert the ability of system recovery processes and provide response frameworks for escalating issues. The plans are designed to minimize the impact to our operations and stakeholders, initiate appropriate communications both within and outside of the organization, and identify recommendations for improvement.

companyName: ARGAN INC

ticker: AGX


text: While the Board of Directors and Audit Committee oversee cybersecurity risk management, Entergy's management is responsible for managing cybersecurity risk. Entergy and the Registrant Subsidiaries' security-risk-management system, as discussed above, is comprised of a three lines of defense model to enhance risk management efforts and define roles in the security program. The first line of defense, comprised of business units performing operational functions, including the CISO, is responsible for identification and management of security and reliability risks directly through design, implementation, and execution of control activities. The second line of defense, comprised of the CSO and Chief Security Office, performs and supports security and reliability risk management and governs and oversees the execution of security and reliability controls by the first line of defense. Ownership of specific security operations may migrate from a business unit in the first line of defense to the second line of defense, as determined to be appropriate by the Chief Security Office. The third line of defense, which includes Internal Audit, independent third parties, and certain regulatory constructs, such as the NERC Reliability Standards and the NRC Cyber Rule, provides assurance of selective actions taken by the first and second lines of defense to senior management and the Board of Directors.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: We design and assess our program based on International Organization for Standardization ("ISO") 27001 and Payment Card Industry Data Security Standard ("PCI DSS") standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use ISO and PCI DSS as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ServiceTitan, Inc.

ticker: TTAN


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and endpoint detection and response systems, regular monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: The Board regularly receives reports and training from management and third parties on cybersecurity matters. Management is responsible for developing cybersecurity programs, as may be required by applicable law or regulation. Our cybersecurity personnel have the appropriate expertise in IT and cybersecurity, which generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. Our cybersecurity personnel, along with third parties, monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents as part of the cybersecurity programs described above. Incidents, if any, are escalated to management and the Board according to our incident response policy. There have been no material cybersecurity incidents in the periods presented.

companyName: STRATTEC SECURITY CORP

ticker: STRT


text: Our information technology representative, in consultation with our vCISO, is responsible for the day-to-day administration of our cybersecurity policies, processes and practices. The information technology representative and our vCISO meet regularly to review any outstanding cybersecurity risks and to discuss any recommended hardening or remediation measures. The information technology representative reports and provides periodic updates regarding the cybersecurity risk management program to our Chief Financial Officer. The individual currently operating as our information technology representative has 19 years of experience in information technology and information security, including at another public company.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: Related to Cybersecurity Risks Our Board holds oversight responsibility over our strategy and risk management, including risks related to cybersecurity threats. Under the oversight of the Audit Committee, we have implemented an ERM framework that includes processes for identifying, assessing, and responding to cyber risk exposures. The enterprise risk management process is led by our chief compliance officer, where team members are responsible for working with cross-functional counterparts at the Company to assess risks across designated verticals, including cybersecurity. The chief compliance officer reports on the ERM process to the Audit Committee of our Board regularly. In addition, we have established a working council, or our Enterprise Risk and Compliance Committee, that meets regularly to review and report on the ERM framework to senior leadership.

companyName: Toast, Inc.

ticker: TOST


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty Media's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. Tripadvisor's CISO is a Certified Information Security Systems Professional with more than 15 years of experience in building and leading information security teams. Both have worked at a variety of companies, including large publicly-traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Our Board addresses cybersecurity risk management as part of its general oversight function. The Cybersecurity Committee is tasked with assisting the Board in fulfilling its oversight responsibility for our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Management holds relevant expertise in assessing and managing cybersecurity threats. Numerous members of management and employees across the information security and risk functions hold nationally recognized designations or certifications, including the Certified Information Systems Security Professional designation, Global Information Assurance Certifications or Amazon Web Services Cloud Certifications. We also provide role-based security training to workers with assigned information security-related roles and responsibilities. This includes topics on social engineering tactics and other general threats posed for system compromise and data loss. The initiatives and processes discussed further below also contribute to the expertise and experience of management.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: Our ERM program is designed to identify, assess, and mitigate risks across our Company, including financial, operational, reputational, strategic, legal, liquidity, and credit. Cybersecurity is a critical component of this program as it is necessary for supporting our business and protecting our customers in an increasingly complex environment. The cybersecurity component of our ERM program is designed around the FFIEC Information Security IT Examination Handbook, the FFIEC Business Continuity Planning Handbook, and the FFIEC Cybersecurity Assessment Tool, and is designed to protect the security, availability, integrity, and confidentiality of our computer systems, networks, software, and information assets, including client and other sensitive data. Cybersecurity is an ongoing initiative that we monitor very closely. Threats to data security emerge and change rapidly. Cyber threats could include attacks that are common to most industries, such as ransomware attacks, unauthorized access, tampering, malware insertion, or other system integrity events, but could also include attacks from highly organized perpetrators targeting financial services companies.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: The Information Security Policy contains numerous distinct administrative and technical controls that govern data security for the organization and is based on the NIST Cybersecurity Framework. The policy is reviewed and approved by the Board annually.

companyName: Investar Holding Corp

ticker: ISTR


text: Our Head of Global Supply Chain and IT, Chief Information Officer, and Head of Information Security serve on our Cybersecurity Steering Committee (the "Cyber SteCo"), along with our Chief Legal Officer, who reports to our Chief Executive Officer, and our Head of Financial Processes, who reports to our Chief Financial Officer. The Cyber SteCo, which meets regularly, develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, and receives regular updates on cybersecurity-related matters.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our CISO provides quarterly and as-needed briefings to the audit committee regarding cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third party consultants. Our audit committee provides quarterly and as-needed updates to the board of directors on such reports and management provides annual and as-needed updates to the board of directors regarding our cybersecurity program.

companyName: Marqeta, Inc.

ticker: MQ


text: There have been no events in at least the last thirty years that have been considered material enough to warrant changes to systems, processes or controls.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: Our primary source of cybersecurity risk relates to security of our third-party service providers, whose activities and scale may present more desirable targets. However, we do maintain certain systems ourselves and appreciate the need to focus internally as well. We manage cybersecurity risk through a variety of tactics, including (i) the structure of our systems and platforms, (ii) the contractual terms with our third-party vendors, (iii) the proactive vulnerability assessments we conduct (or require our vendors to conduct), (iv) compliance with applicable regulations and continuous improvement around best practices, (v) mitigating user error and human vulnerabilities through training and guidance, (vi) attending security conferences and operationalizing new learnings and/or planning for environment changes in response to these learnings, and (vii) the placement of cybersecurity insurance policies. We also work with cross-functional partners and outside experts, including legal counsel and consultants to identify the legal requirements and industry practices and expectations that the Company's security measures should satisfy.

companyName: Portillo's Inc.

ticker: PTLO


text: Additionally, to minimize our enterprise-wide risk and exposure to material cybersecurity incidents, we conduct annual cybersecurity awareness training and education for our employees. By equipping our employees with the necessary knowledge and skills, we intend to cultivate a cybersecurity-conscious culture within our organization.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Vendor Risk Oversight Given the risks associated with using third-party service providers, we have developed stringent practices to oversee and manage these risks. We start the assessment right from the vendor onboarding stage, by conducting security and background assessments of vendors prior to their engagement, and we monitor ongoing relationships to ensure compliance with our cybersecurity standards. This practice is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: We have an information technology ("IT") security team, led by our chief information security officer, that is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. We seek to address cybersecurity risks through a cross-functional approach, including relevant training for applicable employees and regular reviews and tests of our cybersecurity program that leverage audits performed by our internal audit team. In addition to our in-house cybersecurity capabilities, at times we also engage consultants or other third parties to assist with assessing, identifying and managing cybersecurity risks.

companyName: GameStop Corp.

ticker: GME


text: Cybersecurity risk management, which involves resource commitments and management attention, is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents.

companyName: GARTNER INC

ticker: IT


text: S enior management is directly involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing incident response plans and engaging vendors to conduct penetration tests. Senior management participates in cybersecurity incident response efforts by being part of the incident response team and helping direct our response to cybersecurity incidents.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: The Audit Committee reports to our board of directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies, and ongoing developments, on a quarterly basis or more frequently as needed. The board of directors also receives updates from our CSO and CISO on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework. Members of our board of directors receive presentations that include cybersecurity topics and the management of key cybersecurity risks from our CSO and CISO as part of the continuing education of our board of directors on topics that impact public companies. Finally, our board of directors annually reviews and is required to approve our Global Information Security Program Policy and any changes recommended by our CSO.

companyName: Coinbase Global, Inc.

ticker: COIN


text: Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems and networks, or those of our managers, venture partners and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Ventas considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Ventas, Inc.

ticker: VTR


text: For further discussion of our risks related to cybersecurity, refer to Item 1A—Risk Factors—Material damage to, or interruptions in, information systems as a result of external factors, staffing shortages, cybersecurity breaches or cyber fraud, or difficulties in updating our existing software or developing or implementing new software could have a material adverse effect on our business or results of operations, and we may be exposed to risks and costs associated with protecting the integrity and security of our customers' information.

companyName: RH

ticker: RH


text: Our cybersecurity risk management program complements our overall enterprise risk management program, using similar methodologies and governance processes to identify risks and mitigating strategies.

companyName: Avery Dennison Corp

ticker: AVY


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats to our business and operations and developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems. CoreCard's information technology network, infrastructure, and software systems, including integration points to third parties related to the FinTech services the Company offers, are critical to the Company's business and operations. The Company holds confidential, proprietary, and personal information about its customers, its customers' customers, employed or contracted personnel, and third-party vendors. In addition, the Company's business in the FinTech industry requires it to be compliant with Payment Card Industry (PCI) Data Security Standards and U.S. and foreign data and information security mandates specific to its operations and services. To address these items, CoreCard has developed a robust cybersecurity risk management program focused on identifying, assessing and managing cybersecurity risk. The program involves a dedicated team responsible for operational cybersecurity, and includes an internal IT Security Team, PCI Compliance Force, and Emergency Management Team, which together are responsible for developing and executing the Company's cybersecurity strategy and identifying and mitigating related risks.

companyName: CoreCard Corp

ticker: CCRD


text: As part of our overall risk management system, our dedicated information security team monitors and tests our cybersecurity policies and procedures through methods such as periodic reviews, targeted assessments, and tabletop exercises. All personnel are made aware of our cybersecurity policies and procedures upon hire and through periodic refresher trainings. Such policies and procedures cover areas such as identity and access management, vendor management, data governance and protection, vulnerability management, incident response, and operational risk management. Our cybersecurity policies and procedures are also incorporated into our broader risk management framework such that all enterprise and operational risks are evaluated in a holistic manner.

companyName: Beneficient

ticker: BENF


text: The Company conducts quarterly meetings of the IT and financial leadership of the Company's segments, including the CFO, and information from those meetings is provided to the Company's Audit Committee, which typically meets on a quarterly basis. At each Audit Committee meeting, the CFO provides an update to the Audit Committee on any relevant current and new IT risks and the general health of the IT risk management program, including cybersecurity risks. The CFO also provides the Audit Committee with a quarterly written cybersecurity brief from IT leadership, including an incident reporting log, a review of emerging cybersecurity risks and developments, an assessment of the overall effectiveness of our cybersecurity programs and recommended updates to our cybersecurity risk assessment program. Management, along with our CFO, is responsible for developing the cybersecurity strategy and supervising our cybersecurity risk management program. Our IT team supports these efforts by managing day-to-day operations, including threat detection, incident response and system monitoring. Our cybersecurity incident reporting and escalation plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior Company management and our Audit Committee and/or Board of Directors, as applicable.

companyName: JANEL CORP

ticker: JANL


text: We maintain a cyber-risk management program which is intended to assist in assessing, identifying, and managing material risks from cybersecurity threats to our data and information systems. This program is to ensure that cybersecurity considerations are included in decision-making processes throughout the Company.

companyName: Tenon Medical, Inc.

ticker: TNON


text: Our Board of Directors has overall responsibility for risk oversight in performing this function. Our Board of Directors assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our cybersecurity program is overseen by our Health, Safety, and Environmental Director, who has been a Heat Waves employee for over five years and has been in charge of our data protection and product and software security and compliance initiatives for the past several years. Our HSE Director meets regularly with the Board of Directors to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents. The Board of Directors is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.

companyName: Enservco Corp

ticker: ENSV


text: Our Board of Directors considers cybersecurity risk one of the significant risks to our business. As such, the Board of Directors has retained responsibility for overseeing policies and procedures related to cybersecurity and data privacy matters. The Board of Directors routinely evaluates our cybersecurity strategy to review its effectiveness. Management provides reports to the Board of Directors at least quarterly regarding cybersecurity and other information and operations technology risks.

companyName: ONE Gas, Inc.

ticker: OGS


text: We have developed and implemented cybersecurity risk management procedures ("CRMP") intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our CRMP consists of procedures designed for Graham Corporation and certain subsidiaries and separate procedures designed specifically for Barber-Nichols ("BN"). Our CRMP includes cybersecurity incident response plans ("IRPs") for Graham Corporation and BN. The purpose of the IRPs are to provide a structured and systematic incident response process for all Information Security Incidents that affect any of our or our subsidiaries' information technology systems, network, or data, including data of ours and our subsidiaries held, or IT services provided by, third-party vendors or other service providers.

companyName: GRAHAM CORP

ticker: GHM


text: Our Board and its committees have an active role in overseeing risk management and they have delegated to the Compliance Committee oversight over our cybersecurity and data privacy risks. The Compliance Committee oversees management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and services; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: TechnipFMC plc

ticker: FTI


text: We understand the critical importance of cybersecurity in protecting our operations, customer data, and the integrity of our services. Our commitment to cybersecurity is unwavering, and we adopt a serious, multi-layered approach to minimize the risks and potential impacts of cyber-attacks which has been integrated into our overall risk management process. Our strategies are designed to ensure the resilience and security of our systems, safeguarding against both internal and external vulnerabilities. We employ state-of-the-art technologies and practices to secure our systems. This includes deploying advanced encryption, securing network infrastructure, and implementing robust access controls and authentication mechanisms.

companyName: Paysign, Inc.

ticker: PAYS


text: Understanding the importance of cybersecurity, the Board maintains oversight of the cybersecurity risks and threats within the organization. Specifically, Board has delegated authority to the Audit Committee to oversee risk management relating to cybersecurity. The Audit Committee is composed of members with various expertise including risk management, technology, and finance.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored; • performance of security control assessments on an ongoing basis; • addressing results of analysis and reporting security status to the executive team; and • monitoring information systems to detect attacks and indicators of potential attacks.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: We conduct proactive cybersecurity reviews of our systems and applications, audit applicable processes and applications, perform testing on our security controls, conduct exercises to simulate cybersecurity incidents, conduct employee training, and monitor emerging laws and regulations related to data protection and information security. We evaluate the results and responses to these efforts and implement appropriate changes to improve our security measures.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Cyberattacks impacting our networks or systems may have a material effect on our operations."

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has been publicly recognized as a cybersecurity thought leader by leading industry analysts. Our CIO has over 24 years of technical leadership and industry experience, which is inclusive of global experience in managing and leading IT and cybersecurity teams. Our cybersecurity team holds industry standard certifications and participates in routine training.

companyName: Aimco OP L.P.


text: 3. Risk Committees: PyraMax Bank has established an IT Steering Committee responsible for overseeing cybersecurity risks and ensuring alignment with the Bank's overall risk management framework.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: The Company has not suffered any cybersecurity incidents that would affect its financial condition or results of operations. If a cyber breach were to occur, the management team is required to report it to the executive team (Joseph Ramalho, Charlene Magee, and Jamie Dickson) who would then inform CRSN and Andrew Glashow. Mr. Glashow would then inform the Board if necessary.

companyName: CLS Holdings USA, Inc.


text: Our Audit Committee receives reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks arising from cybersecurity threats. Our Chief Financial Officer and Chief Operating Officer are primarily responsible for assessing and managing material risks from cybersecurity threats on a day to day basis. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our management team is additionally responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole. The Company additionally utilizes the assistance of a third-party service provider, an information technology solutions service provider located in Richmond, BC, for purposes of broadly managing its cybersecurity risks.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: Monitoring Cybersecurity Incidents In addition to the monitoring and reporting described above, the Company maintains an Enterprise Information Security Response Program, which includes regular monitoring of information systems through deployment of security controls designed to detect and identify threats and sets forth immediate actions to mitigate the impact of cybersecurity incidents. The Company maintains a vulnerability management program to identify and remediate critical security vulnerabilities. An after-incident report is done to review critical events so as to inform long-term strategies for remediation and prevention of future incidents.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: We understand the importance of collecting, storing, using, sharing and disposing of personal information in a manner that complies with all applicable laws. We communicate our brands' data collection, use and processing practices through clear and comprehensive privacy notices. We empower our data subjects to exercise their privacy rights by contacting us through various channels, and we maintain procedures to honor their requests made pursuant to applicable laws. We continually evaluate our privacy notices, policies and procedures surrounding our handling of personal data and the measures and systems we have in place to help identify, assess, mitigate, respond to and remediate cybersecurity issues or personal data breaches.

companyName: Capri Holdings Ltd

ticker: CPRI


text: We maintain a comprehensive, risk-based approach to assess, identify and manage material risks from cybersecurity threats. Our controls are based on the NIST Cybersecurity Framework (CSF). Our cybersecurity risk management processes are integrated into our broader enterprise risk management framework and include: (i) regular assessment and monitoring of internal and external cybersecurity threats, (ii) evaluation of potential impacts on business operations, financial performance and stakeholder interests, (iii) periodic evaluation of control effectiveness to determine residual risk levels and guide program improvements, and (iv) integration of cybersecurity considerations into business strategy and technology decisions.

companyName: California Resources Corp

ticker: CRC


text: Furthermore, we are in the initial stages of developing our policies and processes for managing third-party risks. While we expect our partners to maintain appropriate security measures, we are actively working with our partners to improve alignment of their security protocols with our expectations and policies. We plan to introduce a risk assessment process to continuously monitor and remain vigilant against potential vulnerabilities. In preparation, we have completed the first draft of our IT risk management framework. This sets the stage for adopting a widely accepted risk quantification model, which will be done in alignment with our business readiness. The model will help us to prioritize cybersecurity risks and guide the development of our security controls.

companyName: META MATERIALS INC.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We maintain a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by our engagement of third parties, as well as the information systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Our vendor risk management program may involve different assessments designed to help identify cybersecurity risks including: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and our review of the vendor's written security program, security assessments and other reports; (vi) evidence of cybersecurity preparedness through a System and Organization Controls (SOC) 1 or SOC 2 report; and (vii) the imposition of contractual obligations on the vendor.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Blue Owl's Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and their team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: Blue Owl Real Estate Net Lease Trust


text: As an externally managed REIT, our day-to-day operations are managed by the Adviser under the oversight of our board of directors. Our executive officers are senior professionals of the Adviser. As such, we are reliant on the Adviser to provide to us with information regarding its cybersecurity program that is relevant to us.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. The Partnership has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Our information security program employs various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, encryption and multi-factor authentication. Further, we recognize the risks associated with the use of third-party service providers and have processes designed to identify material risks related to third parties.

companyName: NCR Voyix Corp

ticker: VYX


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives occasional briefings from management on our cyber risk management program. Our board of directors receives presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: Eventbrite, Inc.

ticker: EB


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors in Part I, Item 1A of this Annual Report, including in the section titled "Risks Related to Privacy and Security."

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Fortress's cybersecurity program, which is overseen by the ESSC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Fortress's Chief Technology Officer, who has over 30 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Fortress's Chief Information Security Officer, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The ESSC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Fortress's cybersecurity program.

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: Multifactor authentication is required for all authorized users to access network resources which adds a second layer of protection from unauthorized entry to our systems. Associates are required to complete mandatory cybersecurity awareness training annually.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: actively monitoring and mitigating cybersecurity threats and risks with a three lines of defense structure to provide oversight, governance, challenge and testing; using a third-party cybersecurity oversight program;

companyName: Village Bank & Trust Financial Corp.


text: The Chief Financial Officer, Chief Business Officer, Chief Accounting Officer, and Head of Legal form our Cybersecurity Risk Management Committee and help identify, assess and manage the Company's cybersecurity threats and risks. This Cybersecurity Risk Management Committee, which reports to our overall risk management committee, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, conducting scans of certain threat environments, analyzing reports of certain threats and actors, evaluating certain cybersecurity threats reported to us, and conducting internal and external audits of certain environments and systems.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: Cybersecurity Risk Management and Oversight The Board is responsible for overseeing the Company's cybersecurity program and ensuring that it is aligned with our strategic goals and risk appetite. The Board has diverse expertise on topics including accounting and financial management, corporate governance, global business, technology and innovation, human capital management, ESG, and cybersecurity. The Board also reviews the strategic direction of the Company's cybersecurity program and ensures that adequate resources and budget are allocated to address cybersecurity threats.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: For further discussion of the risks related to cybersecurity, see also Item 1A. "Risk Factors – Risks Related to our Business - Failures or security breaches of our information technology systems could disrupt our operations and negatively impact our business".

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: The Company's board of directors, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: As a financial institution in today's digital landscape, we understand that cybersecurity and data protection are of paramount importance to our business, our customers, and our reputation. With the proliferation of online banking and the digitalization of financial services, we recognize that our policies and procedures for safeguarding sensitive customer data must be as sophisticated as the cyber threats we are defending against. Accordingly, cybersecurity is a high-priority component of our overall risk-management system and risk-control infrastructure. We have implemented robust, multi-layer security procedures and defense strategies that aim to proactively mitigate cyber risks, enable our early detection and prevention of security incidents, minimize our vulnerability to attacks, and protect us from both internal and external cybersecurity threats.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Our ISP is benchmarked against the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Additionally, various aspects of the ISP are subject to periodic audit by the Company's Internal Audit department or third-party professionals engaged by the Internal Audit department. Such audits vary from year-to-year but are generally focused on compliance with stated control activities, standards, and internal policies, as well as maintaining the integrity and independence of the audit process. Cybersecurity risk reviews such as SOC2, SOX controls, penetration tests, and regulatory controls are conducted by independent third parties.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2024 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: ECA Marcellus Trust I

ticker: ECTM


text: As of the date of this report, the Sponsor has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or that the Sponsor believes are reasonably likely to materially affect, GLDM, including its operations, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this Annual Report for a discussion of the risks related to cybersecurity.

companyName: World Gold Trust

ticker: GLDM


text: The Audit Committee oversees the design and operation of the Company's enterprise risk management program, including, in conjunction with the Board, oversight of its cybersecurity framework and the strategy, policies and practices implemented by the organization to appropriately mitigate such risks. Such oversight includes discussions with management and the Company's internal auditors on the magnitude and steps taken to address and mitigate any such risks. As a regular part of its meetings, risks related to cybersecurity are reviewed by the committee as part of the internal and external audit reports to the committee.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: Our Information Security ("InfoSec") Governance, Risk and Compliance ("GRC") organization leverages multiple methods and overlapping capabilities to protect the confidentiality, integrity and availability of our data, information and intellectual property. Assessments of Wolfspeed's cyber program are conducted by internal audit and third-party information and cyber experts to monitor the effectiveness and maturity level of Wolfspeed's cybersecurity program.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have established processes to assess, identify, and manage significant risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board. Our cybersecurity policies, standards, processes, and practices are part of our information security management program, which is aligned to ISO 27001, an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC). Mitek uses guidance from standard bodies such as the NIST (Cyber Security Framework). Mitek also adheres to Service Organization Control (SOC2) security framework for securing customer data.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Enterprise Risk Management Omnicell utilizes a structured, biannual ERM process to identify, assess, and address material risks facing the Company, including cybersecurity risks, during which business leaders across the Company are surveyed about current and emerging risk areas. After the ERM survey is completed and risk areas are identified, the results are discussed with the relevant management personnel across the organization in the key risk areas, root causes are analyzed and risk mitigation plans are developed. The Chief Information Officer works closely with Omnicell's management team in all facets of its ERM risk mitigation activities related to cybersecurity and information security risks.

companyName: OMNICELL, INC.

ticker: OMCL


text: Management holds relevant expertise in assessing and managing cybersecurity threats. Numerous members of management and employees across the information security and risk functions hold nationally recognized designations and certifications, including the Certified Information Systems Security Professional designation, Global Information Assurance Certifications and Amazon Web Services Cloud Certifications. We also provide role-based security training to workers with assigned information security-related roles and responsibilities. This includes topics on social engineering tactics and other general threats posed for system compromise and data loss. The initiatives and processes discussed further below also contribute to the expertise and experience of management.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The Company has implemented information security programs to, among other actions, assess, identify and manage material risks from cybersecurity threats. These programs include periodic risk assessments, firmwide testing initiatives, periodic phishing tests and annual audits. As the Company assesses its risks and determines how to implement risk management programs, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. The Company also utilizes an independent cybersecurity advisor to provide periodic objective assessments of the Company's capabilities and to conduct advanced attack simulations.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: The Information Security function is led by the Company's Director of Cybersecurity & Architecture, under the direction of the Chief Information Officer ("CIO"). The Director of Cybersecurity & Architecture, assisted by a third-party fractional Chief Information Security Officer retained by the Company in August 2024, manages the Company's Cybersecurity program. The Company's cybersecurity management team includes members with relevant cybersecurity experience who hold cybersecurity certifications. Key responsibilities of this Information Security function include developing cybersecurity strategies; managing cybersecurity governance; performing cybersecurity risk assessments and tabletop exercises; ensuring compliance with security standards and regulatory requirements; managing identity and access; monitoring cybersecurity threats; validating cybersecurity alerts; preparing for and responding to cybersecurity incidents, business continuity and disaster recovery plans; and creating security awareness through periodic trainings of both Company leadership and Associates. The Company's CIO, Director of Cybersecurity & Architecture, and Chief Legal Officer ("CLO") have shared oversight responsibilities of the Company's Cybersecurity program.

companyName: SpartanNash Co


text: We have developed a cybersecurity program for identifying and mitigating risks to our information and information systems, including guarding against increased cybersecurity threats. We have a comprehensive cybersecurity program which includes risk management to identify cybersecurity threats that could adversely affect our information systems and compliance.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. At December 31, 2023, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion regarding cybersecurity risks, see "Cybersecurity Risk" in Risk Factors on page 19.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: Our Board of Directors, through its Audit & Risk Committee, provides oversight and oversees management processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management, including our Vice President of Technology and our Audit & Risk Committee members, regularly brief our board of directors on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the Board's involvement in cybersecurity governance ensures that we adequately focus resources to protect the Company's assets and reputation.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: We have a dedicated team that is led by the CISO, who has a technical degree in computer science from an accredited public university and extensive experience in information technology and cybersecurity across multiple industries, including financial services and defense. The team comprises security engineers, detection specialists, and business cybersecurity experts. When the team identifies credible risks, we invoke our incident response process to track and manage the details, quickly manage exposures, assess potential customer impact, and facilitate consistent reporting to our CEO and to our Audit Committee.

companyName: TRIMBLE INC.

ticker: TRMB


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our customers and other stakeholders, as a top priority. Our board of directors (in particular our audit committee) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Cybersecurity threats and incidents could have a material impact on our financial condition and results of operations. A successful cyber-attack could lead to operational disruptions, financial losses, regulatory penalties, reputational damage, and legal liabilities. In some cases, the costs associated with investigating and remediating a cybersecurity incident, as well as potential litigation and regulatory fines, could result in a material impact to our financial condition and results of operations. During 2023, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Risk Factors in Part 1, Item 1A of this report.

companyName: SM Energy Co

ticker: SM


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, and notification from external parties (e.g., our third-party information technology provider). Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event and sensitivity of any compromised data.

companyName: LXP Industrial Trust

ticker: LXP


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. GCI's CISO has more than 20 years of experience and hold multiple certifications including Certified Information Security Systems Professional and Certified in Risk and Information System Control. Both have worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: The work done by the Information Security team integrates into the LNC's overall Enterprise Risk Management ("ERM") program. Data is contributed to the ERM team in support of our broader operational risk framework and processes through completion of the Risk and Control Self-Assessment for IT and cyber, which is aggregated into the larger operational risk program. Members of IT and Information Security senior leadership participate on LNC's Operational Risk Committee ("ORC"), which is a standing committee whose purpose is to review and monitor threats to our business operations and strategy that manifest from inadequate or failed internal processes, controls, people or systems or from external events. In addition, LNC's Internal Audit team performs an annual security audit that focuses on cybersecurity risks, the results of which are reported to the IT leadership team and the Audit Committee of LNC's Board of Directors. This audit process provides an additional layer of support to help ensure that cybersecurity risks are managed and responded to appropriately.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: We have a dedicated Information Security and Compliance organization ("ISC") that owns and operates the ISMS. The ISC organization reports directly to Keysight's Chief Information Security Officer ("CISO") and includes functions such as information security policy management, risk management, vulnerability management, compliance assurance, identify and access management, incident management, security awareness and education and information technology ("IT'') disaster recovery. Our management team has relevant expertise and experience in understanding risks from cybersecurity threats and overseeing risk management processes. Our CISO is an experienced cybersecurity senior executive with more than 25 years experience in building and leading cybersecurity, risk management and information technology teams.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: Because the Company is not reasonably likely to be materially affected by cybersecurity threats at the current stages of its development, there are no particular director's oversight of risks from cybersecurity threats and management does not have an active role in assessing and managing the Company's material risks from cybersecurity threats.

companyName: NIKA PHARMACEUTICALS, INC

ticker: NIKA


text: The Company's Chief Information Security Officer (CISO) is responsible for management of material risks from cybersecurity threats. The CISO has multiple years of experience working in information and network security management, and has in-depth knowledge of compliance requirements and standards set by various regulatory agencies. The CISO leads a team dedicated to the prevention, mitigation, detection, and remediation of any cybersecurity incidents. If a potential incident is identified, the CISO is notified and engages the cybersecurity incident response team (CyberSIRT). This team is responsible for declaring a cybersecurity incident and is comprised of individuals from multiple relevant departments. In the event the CyberSIRT declares an incident, the CISO provides overall direction for the response and mitigation of the threat. This response includes actions taken to protect our data and networks, evaluation of the potential materiality of the incident, and the communication of the incident to critical parties, including senior leadership and the Board of Directors.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: We are not aware of any unmitigated risk or any prior incident that may have materially affected the Company's data integrity, confidentiality, operations, business strategy or financial reporting. Given our reliance on modern systems, we are aware a significant incident could impact the Company's overall goals so we strive to provide modern counter measures to manage this risk.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: We work with third parties from time to time to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing. To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, IT asset management, cloud-based infrastructure, data center facilities, content delivery, encryption and authentication technology, corporate productivity services, and other functions.

companyName: Leatt Corp

ticker: LEAT


text: As of the date of this Annual Report, the Company has not experienced any known cybersecurity incidents that had a material effect on our business, operations, or financial condition. During the reporting period, no cybersecurity breach or attack has been identified that resulted in significant data loss, financial costs, or operational disruptions for Spectral. Nevertheless, cybersecurity threats continue to evolve rapidly, and no security program can guarantee absolute protection against all attacks. A significant cybersecurity incident in the future could potentially cause substantial harm to the Company, including business interruptions, remediation costs, reputational damage, loss of sensitive information, or legal and regulatory consequences. Spectral remains proactive in updating and strengthening its cybersecurity measures in light of new threats and technological changes. For further information on the risks associated with cybersecurity and data protection, refer to the "Risk Factors" section of this Annual Report (Item 1A) which discusses these risks in more detail.

companyName: SPECTRAL CAPITAL Corp

ticker: FCCN


text: Voya Financial's Board committees include the Risk Committee, which provides support to the Voya Financial Board in its oversight of information technology, including cybersecurity risk. The Risk Committee is responsible for overseeing cybersecurity risk and collaborates with the Voya Financial Audit Committee on the disclosures thereof. The Risk Committee receives regular updates from the CISO on cybersecurity-related matters.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co