text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continue to make proactive and strategic investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are imbedded into our overall risk management governance and are reviewed at least annually by the Audit Committee of our Board of Directors.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: The Enterprise Information Security Risk Assessment quantifies risk criteria utilizing the same impact measures, including financial, strategic, operational, and reputational, set forth by the Enterprise Risk Committee. The risk assessment is reviewed and approved by the B oard annually. The Enterprise Risk Committee includes members of management from various departments and members of the Board and oversees the overall risk management of the Company. The Enterprise Risk Committee meets as often as appropriate to perform its responsibilities, but no less than once per calendar quarter and reports findings and provides recommendations to the Board on a routine basis.

companyName: Investar Holding Corp

ticker: ISTR

secItem: Item 1C


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure related to cybersecurity risks, and our executive officers are responsible for the day-to-day assessment and management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.

companyName: VerifyMe, Inc.

ticker: VRME


text: Invesco's Board of Directors oversees cybersecurity risk across the entire organization and receives updates at a minimum of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this committee include Invesco's Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board of Directors to facilitate their oversight.

companyName: Invesco DB Multi-Sector Commodity Trust


text: The term "information systems" means electronic information resources, owned or used by the company, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of the company's information to maintain or support the company's operations.

companyName: Emeren Group Ltd


text: • Other Roles: The Cyber Risk Program includes engagement of other Company management employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management. That includes risk and security heads from our material business lines who implement and administer policies specific to those business lines.

companyName: E2open Parent Holdings, Inc.


text: The Company's cybersecurity risk assessment process involves considering risks associated with the nature of its business, receiving and processing inputs from internal and external stakeholders, monitoring industry trends and risks and engaging external advisors, to assist in aligning the Company's cybersecurity processes with industry best practices. Risk assessments are conducted quarterly and annually to evaluate the effectiveness of the Company's existing security controls and serve as the basis for additional safeguards, security controls and measures. Operational and technical security controls are deployed and integrated as safeguards against unauthorized access to the Company's information systems. These controls are aimed at (i) assuring the continuity of business processes that are dependent upon automation, (ii) maintaining the integrity of the Company's data, (iii) supporting regulatory and legislative compliance requirements, and (iv) maintaining safe and reliable service to the Company's customers.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Data Breaches: Unauthorized access to sensitive data, such as business strategy, financial records, or operational data, can lead to financial loss, legal repercussions, and damage to the organization's reputation.

companyName: International Seaways, Inc.

ticker: INSW


text: Consequently, we maintain comprehensive policies and procedures designed to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: • we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO); • we maintain a dedicated cybersecurity team under the direction of our Chief Information Officer (CIO), including our Chief Information Security Officer (CISO), each of whom has expertise related to data and network security, data governance and risk management; • we regularly test our internal IT controls; • we regularly conduct internal as well as third-party attack and penetration tests; • we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; • all employees are required to complete periodic trainings that cover security and privacy best practices and company policies; and • we have prepared and regularly review our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: Our cybersecurity incident response policy and security incident handling procedure are designed to escalate certain cybersecurity incidents to members of management who are part of the Incident Management Team. The Incident Management Team works to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, the cybersecurity incident response policy and security incident handling procedure include escalating certain cybersecurity incidents to our disclosure committee and, if appropriate, to the Privacy and Security Subcommittee.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: The Board provides regular oversight of the Company's cybersecurity risk management program. The CISO presents to the Board and the audit committee of our Board (the "Audit Committee") at least annually and quarterly updates via business review dashboards. The Board provides guidance to the CISO, including with respect to any changes to business priorities, risk tolerance, or security initiatives. These briefings are also augmented by ongoing and continuous interactions between the Board and the CISO, as needed.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. See ITEM 1A. RISK FACTORS for additional information regarding the Company's cybersecurity risks and which should be read in conjunction with this Item 1C.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or third-party partner could materially adversely impact us.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of material information security risks, including cybersecurity incidents and vulnerabilities. Our Audit Committee is responsible for overseeing our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, third-party compliance certifications, control maturity assessments, and relevant ServiceNow, customer and industry cybersecurity incidents.

companyName: ServiceNow, Inc.

ticker: NOW


text: Annual vulnerability assessments and penetration testing, as well as periodic web application scanning, is performed by third party service providers as directed by the Company's Managed Service Provider ("MSP"). The results of these tests are shared with the CFO by the MSP. We have processes in place to evaluate the potential risks from cybersecurity threats associated with our use of third-party service providers that have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring. The Company also recently partnered with a breach protection platform to provide security and phishing training to its employees.

companyName: KOSS CORP

ticker: KOSS


text: All of the Company's officers and employees are subject to its policies and procedures. The Company utilizes both internal and third-party cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. We engage in periodic assessment and training regarding the policies, standards and practices designed to address cybersecurity threats and incidents. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.

companyName: SHF Holdings, Inc.

ticker: SHFS


text: The Audit Committee is informed of material risks, if any, from cybersecurity threats pursuant to escalation criteria set forth in the Company's disclosure controls and procedures. Further, at least once per quarter, a member of the Company's Audit Committee reports material risks, if any, from cybersecurity threats to the Company's board of directors. The Company's management also assess and manage material risks, if any, from cybersecurity threats.

companyName: Sow Good Inc.

ticker: SOWG


text: The CISO has over 8 years of experience as a technology and information security leader. The CISO has served as the Advisor's CISO since 2023. Prior to this role, the CISO was the Deputy CISO for 3 years. The CCO has been responsible for this oversight function as CCO to the Fund for 6 years, and has worked in the financial services industry for over 30 years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.

companyName: GUGGENHEIM CREDIT INCOME FUND 2016 T


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the Company's networks, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. This oversight has been integrated into the Company's enterprise risk management system. For example, the Company's management team reviews the findings, if any, of the internal audit team's assessments, analyzed the identified risks, and takes action based on the Company's overall risk profile. In order to assess the risks posed to the Company's information systems by third-party service providers and vendors, the information technology department, coordinating with the Company's internal audit services team, evaluates new software and network application vendors' contracts, internal policies, certifications, and System and Organization Controls ("SOC") reports during the procurement of solutions and services.

companyName: SITE Centers Corp.

ticker: SITC


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: Cybersecurity is an important component of our ERM framework and an area of focus for both our Board of Directors (Board) and management team. While management holds primary responsibility for our Company's risk management strategy, our Board, with the support of its committees, oversees the process to ensure that the framework designed, implemented and maintained by management is functioning as intended and adapts, when necessary, to our evolving strategy and emerging risks. The Board's Audit Committee is delegated responsibility for oversight of our ERM process, including our strategies to identify, detect and respond to cybersecurity and information technology risks and threats. Our Audit Committee's process includes an annual review of our ERM program to ensure appropriate practices are in place to monitor and mitigate identified risks on an ongoing basis. Additionally, our CIO meets with the Audit Committee or Board each quarter to discuss cyber hygiene, incidents (as needed), and provide updates on our enterprise-wide cybersecurity risks and strategies, including steps taken to mitigate and manage the same. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on current cyber topics, trends and best practices. We have established protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board.

companyName: OLIN Corp

ticker: OLN


text: We identify, assess and manage material risks from cybersecurity threats through our GIS Program as follows: • We deploy a defense-in-depth strategy, acknowledging the importance of people, processes and technology in upholding information security. The strategy incorporates multiple layers of controls, including, monitoring, vulnerability management, identity and access management and security assessments. • Our program is aligned with the National Institute of Standards and Technology Cybersecurity Framework (NIST) and other technical standards and frameworks. • We have a robust cybersecurity defense response plan that provides a documented framework for handling security incidents and facilitates coordination across multiple parts of the company. • We invest in threat intelligence and operate a Cyber Defense Center, which acts as our hub of information sharing and threat intelligence analysis. • We incorporate external expertise and reviews into our cybersecurity risk management program and continue to engage leading professional consulting firms to assist our company in incorporating cybersecurity best practices. • We provide annual cybersecurity awareness and ongoing phishing training, and we routinely conduct cybersecurity attack simulation exercises, which includes participation from various levels of management. • Following a risk-based approach, we conduct due diligence reviews of our third party providers for potential cybersecurity risks to the company. We also maintain a cross-functional Third Party Risk Management program, which partners with our GIS, Information Governance, and Operational Resilience teams, among others, to manage and monitor third party risk presented by CME Group vendors and certain third parties of third parties (fourth parties). The teams conduct initial due diligence on vendors and monitor cyber-related incidents and known vulnerabilities with the goal of enhancing processes, improving risk management and partnering on exit planning and testing for certain vendors associated with essential functions. • We have insurance against certain cybersecurity and privacy risks and attacks. • We are an active participant in the financial services industry and government forums and information sharing programs, designed to improve both internal and sector cybersecurity defense. These valuable external partnerships are established and maintained in order to gain more timely, comprehensive and actionable threat information across geographies and industries and to facilitate the exchange of best practices and security techniques. They allow for a high degree of collaboration and cooperation with local, state, federal, and international law enforcement and intelligence agencies, industry groups, and other private sector chief information security officers. • We regularly test the design and effectiveness of our information security controls and processes through a program of testing performed by internal and independent third-party teams. Remediation of gaps and opportunities identified through testing are tracked through to closure. Testing activities support a variety of regulatory requirements and external industry certifications held by CME Group.

companyName: CME GROUP INC.

ticker: CME


text: At the employee level, we maintain an experienced information technology team that is tasked with implementing our privacy and cybersecurity programs and supporting the cybersecurity consultant in carrying out reporting, security and mitigation functions. We also hold employee trainings on privacy, cybersecurity, AI, records and information management, conduct phishing tests, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population. The Governance, Environmental and Sustainability Committee was, and now the Audit Committee will be, provided with periodic reports on our employee cybersecurity awareness efforts.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: Our cybersecurity risk management strategies represent an integral component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and based on the recognized National Institute of Standards and Technology (NIST) Cybersecurity Framework. We continuously seek to adopt market-leading standards and procedures to protect our tower infrastructure, data, and carrier, vendor, and consumer information. Key elements of our cybersecurity risk management strategy include:

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the firm's data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with our business segment teams to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment, and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as our acceptable use policy, upon hire and annually.

companyName: Carlyle Group Inc.

ticker: CG


text: The Company has also established relationships with cybersecurity firms and internal cybersecurity experts, which it engages in connection with certain suspected incidents. The Company also regularly undergoes evaluation of its protections against incidents, including both self-assessments and expert third-party assessments, and it regularly enhances those protections, both in response to specific threats and as part of the Company's efforts to stay current with advances in cybersecurity defense.

companyName: NCR Atleos Corp

ticker: NATL


text: While we have implemented measures to safeguard our operational and technology systems and have established a culture of monitoring and improvement, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. However, our management has determined that, during the period covered by this Annual Report on Form 10-K, no cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, operating results, or financial condition.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Incident Response and Assessment Policies and Procedures We align with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we our in the process of implementing a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan will outline communication responsibilities during incidents of all severity levels.

companyName: 374Water Inc.

ticker: SCWO


text: Identifying, and Managing Material Cyber Threats have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy. We use a team of outside vendors and government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and user behavior analytics also support identification and management of cyber threats. Response to a broad category of threats is immediate and automatic. Security personnel and members of our management are alerted when cyber threats or anomalies are detected. Persistent threats or issues that, in the opinion of management, are material are immediately brought to the attention of our board of directors.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: As a financial institution we collect, store, and transmit sensitive, confidential, and proprietary data and other information, including intellectual property, business information, funds-transfer instructions, payment card data, and personally identifiable information of our customers and employees. This information can be of significant value to criminal actors, and, as described in Item 1A. Risk Factors, cybersecurity incidents and other security breaches involving this information at the Bank, at our service providers or counterparties, may negatively impact our business or performance.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.

companyName: KOHLS Corp

ticker: KSS


text: The CIO routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other their-party consultants in a number of areas to support the assessment, identification, and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, and incident response, among others.

companyName: ICC Holdings, Inc.


text: Tredegar entrusts its third-party service providers with the responsibility to institute security measure protocols that are appropriately and proportionally tailored to the corresponding risks. However, Tredegar also periodically conducts assessments of the third-party service providers' security frameworks to verify the implementation of adequate security measures, to safeguard Tredegar against potential vulnerabilities.

companyName: TREDEGAR CORP

ticker: TG


text: The Council meets monthly and updates key members of the Company's Executive Council on progress towards specific cybersecurity objectives. A strong partnership exists between Information Technology, Enterprise Security, Corporate Audit, and Law so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.

companyName: BOEING CO

ticker: BA


text: Due to the prevalence of cyberattacks and other cyber incidents directed at public companies, cybersecurity is a principal element of our overall enterprise risk management program. We have a multilayered approach for assessing, identifying and managing cybersecurity risks, which is designed to help protect the Company's information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while protecting employee and customer information from unauthorized access or attack, as well as secure our networks, systems and devices. Cybersecurity is one of the top enterprise risks that we have identified. As part of our quarterly enterprise risk management meetings, we discuss efforts to manage this risk and we assess the degree of risk and whether it is increasing or decreasing.

companyName: LL Flooring Holdings, Inc.


text: We have an established security program and framework based on ISO/IEC 27001 ("Security Program") and maintain ISO/IEC 27001:2013, SOC 1 Type 2, and SOC 2 Type 2 certifications. The Security Program has been established to allow management oversight of cybersecurity risks, institute directives and principles for information security, ensure alignment to regulatory and contractual cybersecurity obligations, and enable timely incident response and remediation.

companyName: SPS COMMERCE INC

ticker: SPSC


text: At the management level, the Company has established a Cyber Incident Review Committee consisting of senior executives including the Chief Legal Officer, Chief Financial Officer, Chief Accounting Officer, Chief Communications Officer, Chief Digital and Operations Officer, Director of Internal Audit and Deputy General Counsel, that meets regularly with the CISO to ensure identified issues are addressed expeditiously and reported to the appropriate regulatory agencies as required. In addition, the CISO escalates issues determined to be significant to the Chief Legal Officer in accordance with the Company's incident response processes.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: HARMONIC INC.

ticker: HLIT


text: Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The Corporation's Information Security Committee consists of members with diverse experience, including the Corporation's leaders from information security, enterprise risk management, legal, bank protection, internal audit and various business units. The Corporation's information security professionals have a range of varying cybersecurity experience and education, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold certain cybersecurity certificates. The Corporation uses multiple assessors, consultants, auditors and other third parties in the fulfillment of the information security program. These third parties participate in testing and validation processes, as well as the execution of certain program-related controls. The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board's Risk and Credit Policy Committee of the Board on a quarterly basis. At the Information Security Committee, security-related policies and standards are reviewed and recommended for approval, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, and relevant cyber risks and trends are presented.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: We have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email fraud. We have engaged consultants with significant expertise and certifications in cybersecurity related to our industry. For continuous cybersecurity monitoring across our information technology environment, we have invested in advanced technologies that are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: Management and Strategy periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Google, QuickBooks and Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats. from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition.

companyName: BranchOut Food Inc.

ticker: BOF


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Management's philosophy on cybersecurity is to be vigilant in protecting the Company and its constituents through robust investments and employee awareness to aid in the prevention, detection and mitigation of cyber threats, while recognizing that not all threats are preventable.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: With over 30 years of experience in the information technology space, including systems architecture, management, and cybersecurity risk management, the Director reports directly to the CIO and is responsible for day-to-day cybersecurity operations.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Our polices and processes address cybersecurity threat risks associated with the use of third-party service providers, including those who access, use and/or store our client, candidate, associate and employee data or have access to our network and systems. Third-party risks are included within our enterprise risk management assessment program, as well as our information security-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our systems, data or facilities that house such systems or data. This allows us to identify high-risk providers and continually monitor for cybersecurity threat risks appropriately. Additionally, we require contracts with all third parties that have access to our network and systems to include baseline security requirements for adequate data handling, as well as to provide the company with audit rights. Such contractual requirements are reviewed during each subsequent contract renewal process.

companyName: TrueBlue, Inc.

ticker: TBI


text: The execution of the ISP relies on our committed investment in people, processes, and technology. We have invested in market-leading technology and award-winning security partners to execute key processes that ensure the confidentiality, integrity, and availability of company assets. Recent investments have ensured the use of innovative technology and services with best-in-class providers.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: Material Cybersecurity Risks, Threats and Incidents While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful. We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive, or proprietary and other types of information. Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services. While we are not aware of any cybersecurity incidents that have materially affected us within the prior fiscal year, there can be no guarantee that we will not be the subject of future attacks, threats or incidents, that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Cybersecurity incidents could disrupt our business and result in the loss of confidential information and legal liability," which should be read in conjunction with the foregoing information.

companyName: WELLTOWER INC.

ticker: WELL


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our Senior Director of Information Technology and Senior Vice President, Quality Assurance, who report to the Chief Financial Officer and Chief Executive Officer, respectively, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The Senior Director of Information Technology and Senior Vice President, Quality Assurance have primary responsibility for our overall cybersecurity risk management program and supervises both our internal technology and quality assurance compliance personnel and our retained external cybersecurity consultants. Our Senior Director of Information Technology has more than 20 years of experience in IT Management, including cybersecurity, and our Senior Vice President, Quality Assurance has more than 20 years of experience in computerized system and IT infrastructure controls, compliance, and risk management.

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: Our Senior Vice President of Information Technology (who is also a certified Chief Information Security Officer) manages our security program. Oversight of the program occurs via IT metrics-based updates provided to an Information Technology Steering team (consisting of the executive officers and other key employees of the Company) on a quarterly basis. Additionally, multiple elements of our cybersecurity security program are tested internally and externally on a bi-yearly basis in alignment with our Sarbanes-Oxley information security controls and we engage independent third parties annually to assess the risks associated with our information technology assets. Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets. Lastly, a cybersecurity risk assessment is provided to our Board of Directors on an annual basis which includes metrics, security incidents, key risk indicators, and risk mitigation plan as well as on the status of material risks, mitigation measures, and incidents related to such risks. Our Board of Directors has overall responsibility for risk oversight, with the Information Technology Steering team assisting the Board in performing this function based on its respective areas of expertise. As such, the Information Technology Steering team performs materiality determinations of cyber incidents and advises the Board of directors accordingly.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement.

companyName: Domtar CORP


text: We utilize third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external vendors to augment our internal security capabilities. Additionally, we engage third-parties to conduct independent assessments of our cybersecurity infrastructure to evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: Both the Enterprise and Product Cybersecurity functions administer policies related to cybersecurity in consultation with other stakeholders at the company. Our risk-based cybersecurity program is designed to protect, detect, and respond to cybersecurity threats and incidents. This program, developed alongside the National Institute of Standards and Technology Cybersecurity Framework, aims to protect the confidentiality, integrity, and availability of our IT assets and the data stored thereon. We also have a third-party risk management process, which is designed to assess and manage cybersecurity risks posed by third parties. This process is administered by the Enterprise Cybersecurity function, and through this program, the company evaluates the type of data that is shared with certain vendors with the goal of conducting risk-informed assessments. These assessments provide insights which the Enterprise Cybersecurity function uses to better manage third-party risks.

companyName: CUMMINS INC

ticker: CMI


text: The Technology and Cybersecurity Committee of the Board has direct oversight to the Company's (1) technology strategy, initiatives, and investments and (2) key cybersecurity information technology risks against both internal and external threats. The Technology and Cybersecurity Committee is comprised entirely of independent directors, all of whom have experience related to information security issues or oversight and meets and reports to the Board on a quarterly basis. The Audit Committee, which is also comprised entirely of independent directors, considers cybersecurity information technology risks in connection with overseeing our enterprise risk management system, and reports to the Board on enterprise risk management matters on a quarterly basis. We have processes in place for management to report security instances to the Technology and Cybersecurity Committee and Audit Committee as they occur, if material, and to provide a summary multiple times per year of other incidents to the Technology and Cybersecurity Committee. Additionally, our CISO attends each Technology and Cybersecurity Committee meeting and meets regularly with the Board of Directors or the Audit Committee of the Board of Directors to brief them on technology and information security matters. We carry insurance that provides protection against some of the potential losses arising from a cybersecurity incident. In the last fiscal three years, we have not experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. This includes penalties and settlements, of which there were none.

companyName: Gen Digital Inc.

ticker: GEN


text: Management is responsible for assessing and managing cybersecurity risk. Specifically, the Managing Director, Information Technology, is responsible for overseeing the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Managing Director, Information Technology, has over 16 years of experience, including prior industry experience consulting on various IT matters and developing and testing IT general controls and cybersecurity risk management programs. We maintain an internal staff of IT professionals who support our cybersecurity program and engage with third-party service providers to support specific areas of our cybersecurity risk mitigation and response.

companyName: Chord Energy Corp

ticker: CHRD


text: Our management team, including the Chief Information Officer ("CIO"), is responsible for identifying and managing our material risks from cybersecurity threats. The CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both the PECO cybersecurity team and our retained external cybersecurity consultants. The management team, led by the CIO and cybersecurity team, stay informed about cybersecurity risk including prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the PECO environment. The CIO works closely with members of PECO's cybersecurity team, who have years of experience working in cybersecurity, possessing industry certifications such as Certified Information Systems Security Professional ("CISSP") and Security+, and pursuing advanced degrees and studies in the field. Cybersecurity team members participate in recurring cybersecurity team meetings with the CIO and provide monthly executive leadership updates. The Board oversees our cybersecurity program and is periodically briefed by management, including the CIO, on cybersecurity risks and initiatives. In addition, management updates the Board as necessary regarding any significant cybersecurity incidents.

companyName: Phillips Edison & Company, Inc.

ticker: PECO


text: In connection with our processes for assessing, identifying and managing risk from cybersecurity, we engage various third parties to assist in managing these processes including: • Outside cybersecurity legal counsel to assist in updating our IRP and for consultation and coordination with other third parties in the event of a cyber incident; • Cybersecurity vendors that would perform various investigation services in the event of a cyber incident including assisting in determining the type of attack and impact to our information technology network, maintaining cybersecurity vigilance and assisting with the recovery and restoration of any impacted IT System services; • Cybersecurity experts who would, in the event of a cybersecurity incident, assist with validation of the incident; and • Vendors that would provide breach response services such as communications, notification to third parties and credit monitoring. In addition to our IRP, we have also implemented processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. For example, where appropriate, we seek to negotiate contractual terms with certain third-party service providers that impose obligations on such service providers with the goal of protecting our confidential information.

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: The Company, as an integral aspect of its regular operations and risk management processes, engages third-party entities and service organizations. The Company evaluates and selects these external partners through its due diligence process. This scrutiny is intended to provide alignment with the Company's standards for security, reliability, and compliance. Additionally, the Company engages third-party firms to augment the Company's cybersecurity defenses, leveraging external expertise to mitigate and prevent potential threats. Furthermore, the Company maintains ongoing oversight and monitoring of these third parties in an effort to mitigate potential risks and provide continued adherence to established protocols in order to foster an ecosystem of trusted collaborations within its operational framework.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: We have an Executive Compliance Committee consisting of executive officers and members from senior management across the regulatory, quality, legal, finance and people operations functions that supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which includes updates from our internal cybersecurity team, as relevant; review of any threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: Governance Disclosure Our Board is periodically informed of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: TRANS LUX Corp


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Vice President of IT, works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Management is actively involved in cybersecurity governance, ensuring alignment with our overall business strategy. Their responsibilities include: • Security Objectives: Establishing security goals that correspond with corporate objectives and risk appetite. • Resource Allocation: Providing adequate resources, including budget and personnel, to address cybersecurity risks effectively. • Policy Development: Developing and maintaining policies that meet industry standards. • Risk Management: Directing risk management initiatives and instituting control measures to mitigate recognized risks. • Incident Response: Overseeing the implementation and regular testing of incident response plans, with employee training to ensure effective response capabilities. • Compliance: Ensuring adherence to applicable regulations, while remaining vigilant about emerging threats.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: Our Chief Information Officer, or CIO, is responsible for day-to-day assessment, management of risks from cybersecurity threats our cybersecurity policies, standards, processes and practices which are based on applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Pluri Inc.

ticker: PLUR


text: Log Monitoring: We employ a reputable third-party managed security service provider ("MSSP"), who manages logs from all critical information assets of the Company. The MSSP's Security Operations Center ("SOC") assists the Company in detecting and preventing any potential cyberattack at an early stage by analyzing the log data and correlating that with the latest threat intelligence.

companyName: International Seaways, Inc.

ticker: INSW


text: Our information security team, led by our CIO and Senior Director, IT Security and Compliance, has over 75 years of collective cybersecurity experience and maintain numerous active industry-recognized cyber certifications, such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), and Certified Information Systems Auditor (CISA). Our information security team undertakes a variety of measures in the daily monitoring and management of cybersecurity risks across our business. For example, the information security team monitors our technology infrastructure with tools designed to detect suspicious behavior and decrypt VPN traffic on our systems globally. The information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in its cybersecurity systems. Some of these third-party monitoring functions continue throughout the year while other third-party security experts are periodically retained to audit specific areas of our cybersecurity program. In addition, our information security team works with our internal audit function to monitor reporting and escalation of cybersecurity incident reports from across our business.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our Board as a whole has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks, including oversight of cybersecurity risks. Our Board receives at least two updates each year on cybersecurity and information technology matters and related risk exposures from our Head of IT as well as other members of our senior leadership team.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Our Chief Platform Officer has 25 years of experience in information technology, including cybersecurity, and is supplemented by our VP of Devops, who also has over 15 years of experience in audit, compliance, and cybersecurity, and maintains IT and Ops professional certifications. In addition to the IT Department, the VP of Devops may call upon other business and legal stakeholders across our company to help manage cybersecurity threats and incidents. Our Audit Committee is responsible for oversight of our programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee meets periodically with the Chief Platform Officer to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Our Board also periodically participates in presentations on cybersecurity and information technology from internal leadership. In addition to periodic presentations, management promptly updates our Board and Audit Committee regarding significant threats and incidents as they arise.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Additionally, we conduct regular internal assessments and audits, complemented by insights from external experts. The outcomes of these evaluations are communicated to senior leadership. Based on these risk assessments, we redesign, implement, and maintain adequate safeguards to reduce identified risks, address gaps, and continuously assess the efficacy of these measures. Our engagement with our key partners, vendors, customers, industry stakeholders, and government bodies is relentless, aiming to improve our information security policies and procedures over time. We aim to diligently manage risks related to cybersecurity threats from third-party service providers, including, when possible, requesting our service providers to report incidents that may compromise the Company's data.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: The Information Security Program is supported by three lines of defense. The Information Security Team is the first line of defense under the Chief Information Security Officer and provides the day-to-day cybersecurity operations including identification and reporting of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, performing vulnerability and third party information security assessments, and employee awareness and training programs. In addition, the Information Security Team works in coordination with the individual business lines that have direct and primary responsibility and accountability for identifying, controlling and monitoring cybersecurity risk embedded in their business activities. The Information Security Team uses reputable industry service providers for security operations, monitoring, investigation and incident response. The internal Information Risk Management team conducts periodic assessments in collaboration with consulting services with expertise in the cybersecurity domains. Furthermore, the Third Party Risk Management Team, in conjunction with the Information Security Team, oversees, identifies, monitors, investigates and addresses material risks from cybersecurity threats associated with the Company's use of third-party service providers. As the second line of defense, the ERM Team under the Chief Privacy Officer independently monitors cybersecurity risk across the Company, as well as the effectiveness of the Information Security Program, third party vendors' vulnerability and penetration tests against the Company's network. The ERM Team reports the status of the annual assessment of the effectiveness of the Information Security Program to the Chief Privacy Officer, who reports to the Board's Risk Oversight Committee. When applicable, the Company obtains Statement on Standards for Attestation Engagement 18 reports or equivalent reports for vendor products and services hosted by third parties. Internal Audit serves as the third line of defense and provides additional independent assurance and evaluates the effectiveness of cybersecurity risk management.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.

companyName: VORNADO REALTY LP


text: The Company employs an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. The Company leverages people, processes, and technology as part of its efforts to manage and maintain cybersecurity controls. It also employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. The Company has established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. It engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also maintains a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and its supply chain. The Company also actively monitors its email gateways for malicious phishing email campaigns and monitors remote connections as a portion of its workforce has the option to work remotely. The Company leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its risk management program.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: Cybersecurity is an integral part of our risk management processes and an area of focus for the Board of Directors and management team. The Audit Committee is responsible for the cybersecurity component of our IT operations, and the Audit Committee reviews the status of ongoing efforts and incidents in Board of Directors meetings. The Board-level Audit Committee and management as a whole acts as the Cybersecurity Committee.

companyName: FlexShopper, Inc.

ticker: FPAY


text: We have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect our Company and how they may do so, please see "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Synergy CHC Corp.

ticker: SNYR


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and A third-party risk management process for essential service providers, suppliers, and vendors.

companyName: Arteris, Inc.

ticker: AIP


text: Our Chief Technology Officer briefs the Audit Committee of our Board quarterly, and our full Board annually, regarding cybersecurity risks and information security matters, including the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and projects, the results of any third-party security ratings or assessments of our cybersecurity program, and regulatory updates. Members of management also provide regular updates to the Audit Committee on the categorization and management of enterprise risks, including information security risks. In addition, the Board participates in ongoing education and periodic tabletop exercises on cybersecurity breach response planning.

companyName: QXO BUILDING PRODUCTS, INC.


text: The Board addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Willdan Group, Inc.

ticker: WLDN


text: Other than the Cybersecurity Incident, we have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition. Although we cannot eliminate all potential threats, our cybersecurity program is operated in a manner to minimize the likelihood of any threat becoming material and to keep pace with a constantly evolving cybersecurity landscape. For more information on risks from cybersecurity threats, refer to the risks described under "Risk Factors" included in Part I, Item 1A in this Annual Report.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: For additional information about cybersecurity risks, see Risk Factors, Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, harm to our reputation, disclosure or destruction of data, including user and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business.

companyName: CuriosityStream Inc.

ticker: CURI


text: Following this initial stage, we gather and update impact information and related documentation for such incident. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of "Red," "Yellow," or "Green" identifies next steps for escalation and communication following initial investigation of the potential incident. Upon escalation of an incident, a member of management who is identified as an Incident Response Contact per our Information Security Program reviews and validates the initial determination of the priority of the incident prior to entering into the subsequent stage, during which a response to the incident is determined and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, assign technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: The Vendor Management team ensures compliance with the organization's Vendor Management Policy, including initial and ongoing due diligence of all third-party providers.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Our chief information security officer ("CISO") leads our global cybersecurity program and oversees the global cybersecurity services team, which is responsible for monitoring, identifying, assessing and managing cybersecurity threats across ADP. Our CISO reports to our chief security officer ("CSO"), who leads our global security organization and is responsible for cybersecurity, fraud prevention, operational risk management, client security management, and workforce protection. Our CSO has over 25 years of experience in a range of security roles, including serving as a chief security officer at another public company, and participates in various cyber security organizations. The current CISO has served in various roles in cybersecurity and information technology for over 25 years and has attained the professional certification of Certified Information Security Manager.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: We engaged a third party to perform a cybersecurity audits in 2021 and in the fourth quarter of 2024. To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation, or financial condition. To date, we have not experienced a material cybersecurity attack, such as a cybersecurity threat, a ransomware attack, computer viruses or other malicious codes, security breaches, unauthorized access, phishing attacks, or system failures. The Company carries cybersecurity insurance and considers our coverage to be adequate.

companyName: MAXCYTE, INC.

ticker: MXCT


text: Through these processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors—We rely on information technology systems to support our business operations. A significant disturbance or breach of our technological infrastructure, or those of our vendors or others with which we do business, could adversely affect our financial condition and results of operations. Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation."

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: BancShares follows a defense-in-depth and layered-control framework to protect the organization against cybersecurity threats and attacks. ECSO remains committed to maintaining and improving preventative and detective controls and enhancing our defenses in response to the evolving threat landscape. This mission is supported by policy, standards, and procedures which align to industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework, and are executed through the firm's preventive and detective controls.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Following this initial stage, we gather and update impact information and related documentation for such incidents. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of severity level "One," "Two," or "Three" identifies next steps for escalation and communication following the initial investigation of the potential incident. Upon escalation of an incident, per our Information Security Program, the IRT and ISO review and validate the initial determination of the priority of the incident prior to entering into subsequent investigative and response stages. Upon validation, the IRT and ISO will engage the Company's technology service provider to respond to the incident and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, the Company's technology service provider assigns technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident and as determined by the Security Incident Forms, we engage in predefined follow-up activities to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.

companyName: Community West Bancshares

ticker: CWBC


text: Material Cybersecurity Risks, Threats & Incidents We are not aware of any cyber events that have had a material effect on our business. However, we cannot ensure that we will not experience any such event in the future. Any security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. In addition, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, results of operations and financial condition. See Item 1A. Risk Factors for further details on risks related to potential breaches of our information technology systems.

companyName: Research Solutions, Inc.

ticker: RSSS


text: The Board receives regular reports from the CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Tracon Pharmaceuticals, Inc.


text: Independent Assessments We engage third parties to perform assessments of our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: Jack Henry relies on third-party service providers to deliver certain services and products to our clients. We evaluate and seek to mitigate the cybersecurity risks associated with these providers through pre-engagement and periodic risk assessments to ensure our standards for security are maintained. Our strategic risk management committees review and address any identified risks.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Executive Risk Committee. The Executive Risk Committee ("ERC") is responsible for oversight of our bank subsidiary's enterprise risk management framework and overall risk management practices and includes members of our Board, the board of directors of our bank subsidiary, and both executive and senior level management of the bank. The ERC oversees the policy review and approval program based upon the risk appetite of the Board, assists in the development and monitoring of risk identification and escalation processes, ensures that ongoing monitoring is in place to identify risks that could affect the achievement of the Company's key strategic goals and objectives, and ensures that the Board has the proper information to adequately assess the risks facing the Company. Cybersecurity reports and issues are presented at least quarterly to the ERC.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: Governance & Board Oversight The cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"). The CISO plays a pivotal role in informing the audit committee and the Board on cybersecurity risks.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: The Audit Committee receives periodic reports from management on our cybersecurity risks, including written reports. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: 10x Genomics, Inc.

ticker: TXG


text: The Board, in coordination with management, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. Key members of the management team monitor and assess a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and key executives discuss the Company's approach to cybersecurity risk management.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: The audit committee receives quarterly or as needed reports from our SVP of IT and Facilities concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology and cybersecurity functions. By fully outsourcing our IT environment and placing it within expert third-party software-as-a-service, human resource, and clinical providers our primary means of avoiding cyber risk is not having sensitive data within our enterprise. All third parties are managed by our team, and we review our vendors to ensure that they have risk management procedures in place, including physical, procedural, and technical safeguards (such as: response plans, regular tests on the systems, third-party auditing, incident simulations and routine review of appropriate policies and procedures to identify risks and refine security practices). Our Director of IT Operations and Security is responsible for vendor management regarding our vendor risk experience and reports directly to our Chief Financial Officer. We track security risk as a company and review it annually at the senior management level.

companyName: Corbus Pharmaceuticals Holdings, Inc.

ticker: CRBP


text: We believe that the risks from cybersecurity threats thus far, including any previous cybersecurity incidents, have no material impact on our business including our business strategy, financial condition or results of operations. For additional information about the cybersecurity risks, see Item 1A. Risk Factors.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: While the Information Security team uses some third-party resources as part of its efforts to assess, identify and manage material risks from cybersecurity threats (e.g., certain third-party software tools, threat intelligence and periodic penetration testing), our cybersecurity efforts are predominantly conducted through our internal resources.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: At each regularly scheduled audit committee meeting, our chief financial officer provides an update on our cybersecurity position, and where necessary, the audit committee then provides an update to the board of directors. Our incident response process also contemplates that the executive team will notify the audit committee of a material cybersecurity incident.

companyName: Terns Pharmaceuticals, Inc.

ticker: TERN


text: Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they're a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it's a shared responsibility, woven into the fabric of our corporate culture.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: Our cybersecurity risk management is integrated into our comprehensive business continuity program and enterprise risk management. Our information technology team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness.

companyName: Adeia Inc.

ticker: ADEA


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • running tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • regular cybersecurity training programs for employees, management and directors; conducting annual customer data handling training for all our employees; • conducting annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • comparing our processes to standards set by the National Institute of Standards and Technology ("NIST"), International Organization for Standardization ("ISO"), and Center for Internet Security ("CIS"); • leveraging the NIST cybersecurity framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • operating threat intelligence processes designed to model and research our adversaries; • closely monitoring emerging data protection laws and implementing changes to our processes designed to comply; • undertaking regular reviews of our consumer facing policies and statements related to cybersecurity; • proactively informing our customers of substantive changes related to customer data handling; • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) requiring employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • maintaining a risk management program for suppliers, vendors, and other third parties, which includes conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident. These approaches vary in maturity across the business and we work to continually improve them.

companyName: Mechanics Bancorp

ticker: MCHB


text: Management's cybersecurity programs operate under the leadership of the Company's Chief Information Security Officer ("CISO"), who oversees a team of information and product security professionals and monitors the prevention, detection, mitigation and remediation of cybersecurity risks. The CISO provides quarterly updates to the Board on the advancing maturity of the Company's cybersecurity program, including reports on security controls coverage and effectiveness, secure software development and product security, vulnerability testing and remediation, and security operations. The updates also include reports on improvements to processes, technology and governance to mitigate residual cybersecurity risk.

companyName: BLACKBERRY Ltd

ticker: BB


text: The Company is committed to managing risks that may impact the Company and incorporating risk considerations into its business activities at all levels, including strategic planning, risk identification inventory and assessment, and day-to-day business decisions. The Company's Board of Directors has approved a risk management framework that establishes governance and risk management requirements for all the Company's key risk areas and risk-taking activities. The Board oversees management's performance relative to the risk management framework and risk appetite. Management is responsible for defining the various risks facing the Company, formulating risk management policies and procedures, and managing risk exposures on a day-to-day basis. The Company's Executive Risk Committee (ERC), which is chaired by the Chief Risk Officer, oversees execution of the risk management framework. The ERC is supported by management's senior operating committees, each responsible for a specified risk category. The Company's Information Security Risk Committee (ISRC), which is co-chaired by the Chief Information Security Officer (CISO) and the Chief Technology Risk Officer, is a senior operating committee under this risk governance structure and is responsible for the management of information security risk at the Company. The ISRC provides direction and oversight of the information security risk management framework and corporate control programs of the Company, including significant information security risk events, and mitigation strategies. Further, the ISRC facilitates communication across business lines to provide for effective and consistent information security risk identification and control infrastructure to mitigate and manage material information security risks. The ISRC serves as an escalation, decision making, and approval body for information security risk items, including key policies and programs, issue resolution, emerging risks, and key program adherence. The ISRC escalates matters as appropriate to executive management, the ERC, which reports to the Board's Risk Management Committee, or a relevant committee of the Board. Generally, each of the ERC and ISRC meet at least monthly.

companyName: US BANCORP \DE\

ticker: USB


text: The cybersecurity team of Onex Corp. is headed by the Managing Director – Enterprise Technology who has 18 years of IT experience across financial services, healthcare and manufacturing industries in Canada including as the VP Financial Crimes and Enterprise Risk Technology at CIBC that provided cybersecurity platforms and services to protect the bank. Reporting to the Managing Director – Enterprise Technology, is the Manager, Cybersecurity who has over 15 years of experience in cybersecurity including Incident Readiness and Response, Strategy, GRC, Vulnerability and Threat Management, Business Continuity, Disaster Recovery. The Manager, Cybersecurity also has a BSc in Business Information Systems, and a Cybersecurity Bootcamp Certification from the University of Toronto. Reporting to the Manager, Cybersecurity is an IT Security Analyst who has over 5 years of experience in cybersecurity, including Digital Forensics, Identity and Access Management, Third-Party Risk Management. The IT Security Analyst also has a BSc in Forensic Science, an MSc in Information Security and Digital Forensics, and is currently pursuing a PHD in Information Systems and Design.

companyName: Onex Direct Lending BDC Fund


text: Our executive and senior management teams, including our chief executive officer, chief financial officer and CISO, supervise these efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents and the risk assessments and disclosure required if cybersecurity incidents do arise, through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: Our information security function, supported by members of our IT department and our third-party IT service providers, helps identify, assess and manage our cybersecurity threats and risks. This team helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats and analyzing such reports of threats and actors, conducting scans of our threat environment, evaluating threats reported to us, conducting vulnerability assessments, and working with third parties to conduct certain tests of our environment.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: We have established programs in place to proactively mitigate and respond to cybersecurity risk. The Vendor Management Program provides management with a framework to evaluate new vendors and ensure ongoing monitoring of third parties, including the evaluation of cybersecurity risk. The Incident Response Plan provides a framework for management to respond to and minimize the impact of an incident involving our information technology systems, or that of one of our third-party providers. The Business Continuity Plan provides information to prepare for and manage a business disruption.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: We employ a range of tools and strategies to mitigate cybersecurity risks, regularly testing them for effectiveness. Additionally, we continuously assess and improve our cybersecurity stance by conducting vulnerability scans, internal and external network penetration tests, and by integrating threat intelligence updates. We also have specific tools to provide real time, continuous monitoring and protection of our endpoints. To the extent that our proactive monitoring and testing identifies weakness in our cybersecurity readiness, these weaknesses are tracked and remediated as part of our cybersecurity program. Our employees receive security awareness training on an annual basis and are subjected to phishing training and phishing tests throughout the year. Annually, we perform tabletop exercises to test our cybersecurity incident response plan that is kept within our written information security program (WISP). Our cybersecurity program is aligned with industry standards and best practices such as the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our strategic objectives, business environment and operational needs.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its VP of IT, who reports to the Company's President. The qualifications of the VP of IT include 26 years of IT management, cybersecurity and information governance experience. The VP of IT is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. Management's role includes:

companyName: DallasNews Corp


text: Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its Head of Product and Operations, who reports to the CEO. The qualifications of the Head of Product and Operations include over 20 years of IT management, cybersecurity, and information governance experience. The Head of Product and Operations is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Management's role includes:

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, notification from external parties (e.g., our third-party information technology provider), and proactive threat hunting in conjunction with our external partners. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.

companyName: Public Storage

ticker: PSA


text: We require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.

companyName: IMPINJ INC

ticker: PI


text: Our policies and processes also address cybersecurity threat risks associated with our use of third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our data to ensure they have adequate cybersecurity safeguards in place and continually monitor cybersecurity threat risks identified through such due diligence.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: Our information security program coordinates the activities we take to prepare for, detect and respond to cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have such a material effect.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: We operate in the artificial intelligence sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers;

companyName: Global AI, Inc.

ticker: GLAI


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel to manage our risk assessment and mitigation processes, including our Vice President of Operations (VPO), who serves as our acting Chief Information Security Officer (CISO), as well as external information technology consultants who help manage our information technology systems and our information security.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: Our cybersecurity program aims to incorporate industry best practices, including standards such as ISO 27001 and the NIST Cybersecurity Framework, and focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address cybersecurity risks, threats and incidents. Our practices include, among other things, security awareness training and simulations, technologies and processes to monitor our systems, assessments of controls, and incident response processes. We engage with industry groups and forums to stay informed of industry practices and developments. We monitor developments in the threat landscape that may affect our systems or services and assess their potential impacts on and risks to our cybersecurity posture. We engage external service providers, where appropriate and from time to time, to assist us with aspects of our program, such as assessing and testing controls, providing threat intelligence information and incident response. We also have processes in place to manage cybersecurity risks associated with third-party service providers. Certain key security controls are tested annually by independent third-party auditors as well as our internal auditors. We regularly refine our cybersecurity processes as we determine necessary to address developments in the threat landscape, advance our control and technology capabilities, respond to regulatory requirements and standards, and implement improvements based on the results of internal and external assessments.

companyName: Genpact LTD

ticker: G


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Scorpius Holdings' management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: Scorpius Holdings, Inc.

ticker: SCPX