text: We face cybersecurity risks due to the breadth of networks and systems we must defend against cybersecurity attacks and threat actors seeking to inflict harm on us; and the substantial level of harm that could occur to us were we to suffer impacts of a material cybersecurity incident. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended December 31, 2023, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we remain potentially vulnerable to known or unknown threats. In some instances, we and our suppliers may be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF


text: In the last three fiscal years, we have no t experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, cybersecurity threats, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation," in Item 1A. Risk Factors, which disclosures are incorporated by reference herein.

companyName: Wave Life Sciences Ltd.

ticker: WVE

secItem: Item 1C


text: The Board of Directors is responsible for overseeing our enterprise risk management program. The Audit Committee of the Board of Directors has been designated by the Board to oversee cybersecurity risks and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee receives updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer ("CFO").

companyName: CITIUS ONCOLOGY, INC.

ticker: CTOR


text: Our SVP, Engineering and our VP, Technology & CISO are the members of our management team who are primarily responsible for assessing and managing our material risks from cybersecurity threats. Their team has primary responsibility for our overall cybersecurity risk management program and they supervise our internal cybersecurity personnel and our external cybersecurity consultants. Our management team has deep expertise in e-commerce and consumer retail. In addition, our VP, Technology & CISO's experience includes developing secure products as well as head of security and CISO positions at both public and private companies.

companyName: Rent the Runway, Inc.

ticker: RENT


text: We have an information security program designed to identify, protect, detect and respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we utilize various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a reasonably timely manner. These include, but are not limited to, internal reporting and tools for monitoring and detecting cybersecurity threats.

companyName: Reborn Coffee, Inc.

ticker: REBN


text: Although we have not been materially impacted by any cybersecurity incident to date, we have been and continue to be subject to cybersecurity threats in the normal course of our business, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "We face continually evolving cybersecurity and other technology-related risks, which could result in the disclosure, theft, destruction, or misappropriation of, or access to, confidential information, disruption of our programming, damage to our brands and reputation, legal exposure and financial losses."

companyName: AMC Networks Inc.

ticker: AMCX


text: The Committee receives periodic reports from our Manager on our cybersecurity risks. In addition, our Manager updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Star Holdings

ticker: STHO


text: To optimize our information security management system, we undertake periodic updates as deemed appropriate. We incorporate relevant standards and frameworks to facilitate monitoring of compliance with regulatory, industry, and evolving data privacy requirements. Additionally, we engage in ongoing monitoring of our IT systems and processes to promptly identify and address actual and potential threats. Our approach includes regular adjustments to systems, procedures, and policies in response to identified threats and risks. This adaptive strategy ensures our resilience against emerging security challenges. organizational prioritize on addressing cybersecurity risks, with management playing a central role in assessing and managing these risks.

companyName: Intelligent Hotel Group Ltd.

ticker: ZHJD


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer. Our information technology team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems.

companyName: PlayAGS, Inc.


text: The Company has adopted the definitions present in 17 CFR 229.106 for the following cybersecurity terms: • Cybersecurity Incident: An unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through information systems that jeopardizes the confidentiality, integrity, or availability of information systems or any information residing therein. • Cybersecurity Threat: A cybersecurity threat as any potential unauthorized occurrence on or conducted through its information systems that may adversely affect the confidentiality, integrity, or availability of information systems or any information residing therein. • Information Systems: Electronic information resources owned or used by the organization, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information to maintain or support its operations.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: 2.Continuous Improvement: The insights and recommendations provided by external assessors and consultants inform our ongoing efforts to strengthen our cybersecurity defenses. We prioritize the implementation of their recommendations, ensuring that our cybersecurity measures remain robust and adaptive to evolving threats.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Additionally, we have established a Cyber Incident Response Plan that follows the structure of the Incident Handling Guide published by the U.S. National Institute of Standards and Technology (SP 800-61r2) and that serves as an operational guide for handling cybersecurity incidents at Western Digital. Our Cyber Incident Response Plan provides procedural and strategic guidance that is designed to be flexible enough to apply to a variety of different incidents, but also specific enough to provide guidelines for incident prevention, detection, analysis, escalation and notification, and containment, eradication and recovery.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Cybersecurity and risks related to our information technology and other computer resources are an important focus of our Board of Directors' risk oversight. Our Audit Committee receives materials on a frequent basis to address the identification and status of information technology cybersecurity risks, and management, including our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), provides quarterly updates to our Audit Committee and an update to our Board of Directors at least annually with respect to cybersecurity matters. Our Audit Committee regularly reviews and discusses with management the strategies, processes, procedures, and controls pertaining to the management of the Company's information technology operations, including cybersecurity risks. This enables management to provide oversight, set risk tolerances, and support a comprehensive cybersecurity program that manages material cybersecurity risks to the Company.

companyName: PULTEGROUP INC/MI/

ticker: PHM


text: We recognize the importance of managing cyber risks that we face and have established processes as part of our overall enterprise risk management, or ERM, program to identify, assess, and manage risks associated with cybersecurity. Our Board retains oversight of our cybersecurity risk management. Our cybersecurity program is informed by industry standards, including the National Institute of Standards and Technology, or NIST, Cybersecurity Framework. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the information that we collect and store.

companyName: Toast, Inc.

ticker: TOST


text: Since our formation, we have been primarily focused on research and development activities and pursuing FDA approval of our planned products, and recently commenced building our commercial team. We have 22 employees and currently use third-party vendors and service providers use a third-party sub-contractor to manage all Information Technology (IT) issues, including protection against, detection, and response to cyberattacks.

companyName: Microbot Medical Inc.

ticker: MBOT


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical information technology and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer and employee data ("Information Systems and Data").

companyName: Sweetgreen, Inc.

ticker: SG


text: As part of the above process, we engage third-party services to provide 24-hour, 365-day monitoring, escalation, and response to cyber incidents. In addition to consulting on best practices, we leverage a third-party expert security firm for independent evaluations of our security controls through penetration testing. These evaluations test both the design and the operational effectives of security controls.

companyName: I-ON Digital Corp.

ticker: IONI


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also periodically receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from our Executive Director Information Security as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: Ceribell, Inc.

ticker: CBLL


text: Our Board of Directors, as a whole and through its committees, has responsibility for the oversight of our risk management. The Board is responsible to satisfy itself that the risk management processes designed and implemented by management are adequate and functioning as designed.

companyName: Dynatrace, Inc.

ticker: DT


text: To date, we have not experienced any cybersecurity threats or incidents that have materially affected our operations, business strategy or financial condition.

companyName: MOBIX LABS, INC

ticker: MOBX


text: While we are not aware of any material data security breaches to date, for additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors under the heading "Risks Related to Privacy, Data Protection and Cybersecurity," which is incorporated herein by reference.

companyName: Cricut, Inc.

ticker: CRCT


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats alongside other risks is an integral part of our overall risk management system. This process is achieved by implementing specific controls, continuous monitoring, collaborative response plans, and regular reviews. Integration ensures a comprehensive view of risk and facilitates informed decision-making and a proactive approach to risk management. We employ various cybersecurity frameworks to ensure comprehensive protection of our systems and data, such as the NIST Cybersecurity Framework and elements of the CIS Controls Framework. By aligning with these standards and leveraging industry-specific best practices, we create a cybersecurity strategy to address the challenges of the solar power sector.

companyName: Altus Power, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Market and Other External Risks—Failure to protect our information technology systems against security breaches, service interruptions, or misappropriation of data could disrupt operations, compromise sensitive data, and expose us to liability, possibly causing our business and reputation to suffer."

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include operational risks, intellectual property or trade secret theft, improper disclosure of confidential information, fraud, extortion, harm to employees or customers, and violation of data privacy or security laws.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: The Company's management, led by its Head of Corporate Information Security, has overall responsibility for identifying, assessing and managing any material risks from cybersecurity threats. The Company's Head of Corporate Information Security leads a dedicated Information Security team of highly skilled individuals with experience across industries that, among other things, develops and distributes information security policies, standards and procedures; engages in employee cybersecurity training; implements security controls; assesses security risk and compliance posture; monitors and responds to security events; and executes security testing and assessments. The Company's Head of Corporate Information Security has extensive knowledge and skills gained from over 25 years of experience in the cybersecurity industry, including serving in leadership positions at other large technology companies and leading the Company's Information Security team since 2016.

companyName: Apple Inc.

ticker: AAPL


text: Management's Role in Cybersecurity Risk Management The Company's Management, including the Company's CCO and the CISO of the Investment Adviser manage the Company's cybersecurity program, under the supervision of the Company's Chief Executive Officer. The CCO of the Company oversees the Company's risk management function generally and relies on the Investment Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Investment Adviser's CISO has 23 years of experience actively managing cybersecurity and information security programs for financial services companies with complex and evolving information systems. The Company's CCO has been responsible for this oversight function as CCO to the Company for 10 years and has worked in the financial services industry for over 20 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Security is an ongoing focus with continuous improvement to strengthen our security posture, strengthen data protection, eliminate gaps, and expand our security-as-a-culture. We are completing our control compliance development in preparation for our initial SOC 2 Type II audit. Having a SOC 2 Report will improve our ability to sell to large organizations and attest to our use of best practices for protecting sensitive data. SOC 2 compliant policies, procedures, and controls will make it easier to achieve other security certifications, further increasing customer confidence in our security.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Our Company is committed to continuously assessing cybersecurity risks, including the prevention, detection, and response to unauthorized actions within our information systems that may compromise the confidentiality, integrity, or availability of our data or systems. We are using Layer 7 firewall solutions which monitor all kind of web traffic and any kind of data leaks which may occur as well as a centralized automatic antivirus/antimalware/patch system in order to make sure that all servers and clients hold the latest patches in order to avoid security breaches. The Company has developed its own internal cloud system to avoid dependence on external parties and its email server is hosted on this cloud system therefore is not relying to third party solutions that may have a negative impact on security and reliability of data. The Company's data are stored daily on high quality magnetic tapes to ensure recovery in case of a serious malfunction. On a monthly basis, all the tapes are being transferred to a fireproof safe location and are replaced with new tapes.

companyName: Elvictor Group, Inc.

ticker: ELVG


text: We have not identified risks from known cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors – Our Risks Related to Our Business - Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity. "

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: As noted in Part I, Item IA, Risk Factors, Cabot recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we have taken measures to protect Company data and the continuing operation of our information technology and communications systems. Our cybersecurity program includes information technology ("IT") policies and standards and an IT risk management program. Our cybersecurity risk management program leverages standards established by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond and recover from cybersecurity threats.

companyName: CABOT CORP

ticker: CBT


text: Leet Technology Inc. recognized the importance of implementing and maintaining strong cybersecurity protocols to safeguard our information systems. This commitment is aimed at ensuring the confidentiality, integrity, and accessibility of our data.

companyName: Leet Technology Inc.


text: The Executive Committee meets with the Audit Committee of our Board of Directors on a quarterly basis to report on and discuss material updates to our cybersecurity program. The Audit Committee provides oversight of our cybersecurity program as part of its periodic review of enterprise risk management and provides regular reports to our Board of Directors regarding our cybersecurity processes, including updates on the status of ongoing cybersecurity projects, the results of cybersecurity risk assessments, and the emerging cybersecurity threat landscape. Additionally, the Board of Directors reviews the enterprise risk management program on at least an annual basis.

companyName: FATE THERAPEUTICS INC

ticker: FATE


text: The CISO provides regular (but not less than quarterly) updates to the Audit Committee. These updates include a broad range of topics, including the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives and strategies, incident reports, and the results of internal and external assessments of our information systems. The CISO, in his capacity, regularly informs our Chairman, President and Chief Executive Officer; EVP, Chief Financial Officer; and SVP, General Counsel and Secretary on aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management, including the Company's Disclosure Committee, are made aware of Hubbell's cybersecurity posture and potential cybersecurity risks. Furthermore, any material cybersecurity matters, and strategic cybersecurity risk management matters are promptly escalated to the Audit Committee of the Board.

companyName: HUBBELL INC

ticker: HUBB


text: As part of our cybersecurity risk management strategy, each cyber threat is evaluated for materiality and escalated based upon evaluation of the potential severity and risk impact on our operations. We have not experienced a material cybersecurity breach in the past three years. As such, we have not incurred any material expenses from cybersecurity breaches or any expenses from penalties or settlements related to a cybersecurity breach during that time. For more information regarding cybersecurity-related risks that could materially affect our business strategies, results of operations, or financial condition, please see Item 1A in this Form 10-K under the headings "Security breaches and other disruptions could compromise our information, which would cause our business and reputation to suffer."

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: We employ a layered defensive strategy when designing our cybersecurity controls. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations, and tabletop exercises. We engage in regular monitoring and assessments of our technology infrastructure using internal staff and third-party specialists. We conduct ongoing social engineering testing and training across our entire employee base. We maintain a vendor management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Our independent auditors periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: Since 2023, we have engaged in periodic formal cybersecurity risk assessments conducted by an expert third party. The findings from that formal assessment have informed our ongoing cybersecurity roadmap which is updated at least annually. The Audit Committee plays a key role by ensuring that the prioritization of the roadmap supports our business objectives, and by making decisions, when called upon, of whether specific cybersecurity risks should be mitigated or if that risk is acceptable to the business.

companyName: Third Harmonic Bio, Inc.


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. We seek to address cybersecurity risks through a cross-functional approach.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: Our Board of Supervisors is responsible for overseeing our enterprise risk relative to cybersecurity governance through the Audit Committee of the Board, with specific responsibility for overseeing cybersecurity threats, among other things. Our CRT is led by the Senior Vice President of Information Services ("SVP, Information Services"), who reports to the Partnership's CEO and is responsible for assessing and managing material cybersecurity risks and threats, in coordination with the ISBRT and the IMT, and regularly reports to the Audit Committee with regard to the Partnership's cybersecurity governance efforts. The SVP, Information Services has served in this role since 2014, and has more than 27 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: We regularly assess and monitor our cybersecurity risks and incidents and report them to our senior management and Audit and Finance Committee. Our Audit and Finance Committee oversees our cybersecurity strategy and governance and reviews our cybersecurity policies and practices on a periodic basis. Additionally, and as further discussed above, the Audit and Finance Committee is briefed multiple times a year or as needed by the CISO and/or CIO and, if applicable as determined by the Company's senior leadership, external advisors on the current and emerging cybersecurity threats and trends and the effectiveness of our cybersecurity controls and response capabilities.

companyName: Endo International plc


text: Under the Cybersecurity and Privacy Programs, our Security Team monitors, prevents, detects, mitigates, and remediates cybersecurity risks and incidents via various means, including monitoring threat intelligence from various sources, internal and external vulnerability management, and alerts and reports produced by security tools. Reporting of such risks is regularly provided to the Board and the Compliance Committee, as applicable.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: To date, the company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the company, including its business strategy, results of operations or financial condition; however, the company has experienced and will continue to experience cyber incidents of varying degrees. Despite the cybersecurity measures that the company is taking to mitigate such risks, there can be no guarantee that such measures will be sufficient to protect the company's systems, information, intellectual property and other assets from significant harm and that future cybersecurity incidents will not have a material adverse effect on the company or its results of operations or financial condition or cause reputational or other harm to the company. Refer to Item 1A. Risk Factors on pages 21 through 22 for further discussion of cyberattacks and the associated risks to Chevron's business.

companyName: CHEVRON CORP

ticker: CVX


text: During the periods covered by this report, there were no cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "The Company's operations, including third-party and client interactions, are increasingly done via electronic means, and this has increased the risks related to cyber security," which are incorporated by reference into this Item 1C.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.

companyName: Nuveen Churchill Private Capital Income Fund


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Digital Officer/Chief Information Officer reports to the President, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Digital Officer/Chief Information Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Digital Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Partnership. Senior leadership including our Chief Technology & Digital Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Our Vice President of Information Security has served in various roles in information technology and information security for over 27 years, including as Vice President of Information Security for large public companies. In addition, our Vice President of Information Security has previously held roles including Vice President of Information Security and Technology, Senior Director Information Technology, Director IT Security and Compliance, and Senior IT Audit Manager. Our Vice President of Information Security has earned several certifications including CISSP, CISA, CISSM, and PCI-ISA. Our Vice President of Information Security holds a B.S. in Management Information Systems from Iowa State University and an MBA from Auburn University.

companyName: VAIL RESORTS INC

ticker: MTN


text: Juniata's policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats are based on the framework established by the Federal Financial Institutions Examination Council ("FFIEC") Guidelines and Cybersecurity Assessment Tool ("CAT"), which consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. The FFIEC CAT tool will no longer be updated after August 31, 2025, therefore, JVB will replace this tool with another tool such as the NIST 2.0 standard.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: We periodically assess our risks relating to cybersecurity threats, including risks relating to our reliance on third parties. In so doing, we consider the likelihood and impact that could result from the manifesting of such risks, together with the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks, together with the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks, including evaluating and if available obtaining cyber liability insurance, and aligning such cyber-risk management policies with the Company's business needs by integrating cyber-risk analysis into significant business decisions.

companyName: Kun Peng International Ltd.

ticker: KPEA


text: We have implemented and maintain a robust cybersecurity program to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Orion Group Holdings Inc

ticker: ORN


text: Board has delegated primary oversight of the Company's risks from cyber security threats to the Technology Committee. Our management team, including our Chief Information Security Officer (CISO), provides quarterly updates to our Technology Committee and annually to the full Board regarding our cyber security activities and other developments impacting our digital security. We have protocols by which certain cyber security incidents are escalated within the Company and, where appropriate, reported to the Board and Technology Committee in a timely manner.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: The Nominating/Corporate Governance Committee receives reports from the Global Chief Information Security Officer ("Global CISO") on the Company's information security program at each regular quarterly Committee meeting. In addition, management updates the Nominating/Corporate Governance Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The Nominating/Corporate Governance Committee chair then provides an overview of the information security reports to the full Board at each regular quarterly Board meeting.

companyName: DXC Technology Co

ticker: DXC


text: Our CISO has over twenty-five years of experience in cybersecurity and holds active Certified Information Systems Security Professional and Certified Information Security Manager certifications. Our policies require teammates, contractors, service providers and suppliers who become aware of a cybersecurity incident or the individual's supervisor to immediately report the cybersecurity incident to the appropriate reporting channels, which include the CISO. In the event of a cybersecurity incident, in addition to the standing members, teammates would be selected to serve on the Cybersecurity Incident Response Team (CIRT) based on the facts and circumstances of the particular cybersecurity incident. Additionally, our outside legal counsel is held on retainer to assist with our response to cybersecurity incidents.

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees and third-party contractors of the importance of handling and protecting data, including through privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. All employees and third-party contractors are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident.

companyName: BTCS Inc.

ticker: BTCS


text: As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures related to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see "Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption" in Item 1A. Risk Factors of this report.

companyName: KEYCORP /NEW/

ticker: KEY


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Onyx Acquisition Co. I


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Park's business strategy, results of operations, and financial performance have not been materially affected by risks from cybersecurity threats. Park cannot provide assurance that business strategy, results of operations, or financial performance will not be materially affected in the future by such risks or any future incidents.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity program. Our Board of Directors (the "Board") is ultimately responsible for the oversight of the Company's security program. In the oversight of the program, the Board is focused on cybersecurity risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Primary management responsibility for assessing, monitoring and managing our cybersecurity risks rests with our chief information security officer ("CISO"). Our current CISO has over 30 years of experience in information technology including over 20 years in cybersecurity and oversees a team of cybersecurity professionals with over 140 security, risk, and compliance certifications. The CISO is regularly informed about recent developments in cybersecurity, including potential threats and innovative risk management techniques.

companyName: STRYKER CORP

ticker: SYK


text: Under the guidance of the Risk Committee of the board of directors and the Chief Financial Officer, we have adopted a cybersecurity risk management program that addresses four key areas:

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Material Effects of Cybersecurity Risks Our business strategy, results of operation and financial condition have been not been materially affected by risks from cybersecurity threats, nor did we experience any significant cybersecurity incidents in 2023. However, we cannot provide assurances that they will not be materially affected by such risks or material incidents in the future. We continually assess the material effects of potential cybersecurity risks on our financial and operational performance and maintain comprehensive insurance coverage to mitigate financial losses from potential cybersecurity incidents.

companyName: INNOVATE Corp.

ticker: VATE


text: is responsible for overseeing the Trust's cybersecurity practices. The CISO also manages IT affecting the Trust. The CISO is responsible for overseeing the ongoing adequacy of design and effective implementation of these policies and procedures and to review these procedures at least annually. The CISO is trained as a computer scientist (Master of Science) with extensive programming and system administration experience. The CISO's background includes study of many of the IT building blocks of a modern office infrastructure, including the study and programming of network protocols, information theory, public key cryptography.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our consolidated financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: Executive Team plays a primary role in informing the Audit Committee on cybersecurity risks. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: Current cybersecurity landscape and emerging threats; of ongoing cybersecurity initiatives and strategies; reporting, if any, and learning from any cybersecurity events; mitigation efforts and insurance, and with regulatory requirements and industry standard.

companyName: AVAX ONE TECHNOLOGY LTD.

ticker: AVX


text: Hubbell recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Cybersecurity related risks are included in the risk universe that our enterprise risk management program evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop mitigation plans, which are then tracked to completion. Cybersecurity related risks are also considered as part of our business continuity and resiliency planning. Business continuity plans establish risk management processes and procedures to mitigate interruptions to business activities, including from cybersecurity incidents.

companyName: HUBBELL INC

ticker: HUBB


text: The Partnership faces risks from cybersecurity threats that could have an adverse effect on its implementation of the Receivership Order, including liquidation and winding down, as well as its financial reporting. The Partnership has experienced, and may continue to experience cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not been determined to have been material to the Partnership's business, financial condition, results of operations, or cash flows. See "Item 1A. Risk Factors - Risks Related to the Partnership and Receivership Order". Breaches in our data security systems or in systems used by our vendor partners, including cyber-attacks or unauthorized data distribution by employees or affiliated vendors, or disruptions to access and connectivity of our information systems could impact our operations or result in the loss or misuse of customers' proprietary information" for more information about the cybersecurity risks the Partnership faces.

companyName: GPB Holdings II, LP


text: As of December 31, 2022, and 2023, GlobalX remains proud to report that it has not encountered any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, the Company.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: Our CIO has 36 years of experience working in information technology including roles in the commercial software development, healthcare, industrial and professional services sectors. While in those roles, our CIO has led governance, risk, and compliance technology programs and information security programs. The CIO currently reports to the CFO.

companyName: HORTON D R INC /DE/

ticker: DHI


text: Our Chief Executive Officer ("CEO") is responsible for assessing and managing overall material risks to the Company. With respect to cybersecurity risks, our CEO leverages the collective expertise of the Company's information security function which reports to our CEO through the Company's Chief Information Officer. The information security function is staffed with individuals with extensive information security employment experience, including in the financial services sector, educational experience and relevant credentials. The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for receiving periodic updates on cybersecurity and information security risks, reviewing and discussing with management the quality and effectiveness of the Company's efforts to mitigate such risks and reporting such findings to the Board of Directors. Management informs the Audit Committee about prevention, detection, mitigation and remediation of cybersecurity incidents at least semi-annually and monitors such matters continuously.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL


text: The Risk Management Committee ("RMC") and the Technology Committee of our Board of Directors oversee the company's approach to managing cybersecurity risks. On a quarterly basis, the Board committees receive a comprehensive update from management on our cybersecurity risk management program. This includes information on emerging threats, the company's cybersecurity posture, progress toward risk mitigation goals, significant cybersecurity incidents or developments, and the steps management has taken to address these risks. During these sessions, the Board committees typically review materials detailing current and potential risks, as well as the company's capacity to mitigate those risks. The committee members also engage in discussions with our Chief Information Security Officer and Chief Information Officer about these matters. Additionally, Board committee members are encouraged to engage in ongoing, informal conversations with management regarding cybersecurity news and updates to our risk management and strategy initiatives. Material cybersecurity risks are also reviewed during Board discussions on key topics such as enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, and brand management. Four individuals on the Board of Directors have deep technology expertise, while one of those individuals is responsible for leading cloud security at a Fortune 50 technology company.

companyName: WAFD INC

ticker: WAFD


text: We utilize a seasoned and mature artificial intelligence-based security system that learns and monitors the actions of individuals that have access to our networks and systems, including location of access (notably from international locations), email, and SAAS platforms that we do not host. The system not only protects based off of the specific rules implemented, it also takes action based on user activity (including remote access to our systems by our employees) that is outside their normal behavior pattern. Additionally, our employees go through cybersecurity awareness training as part of their onboarding procedures.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: The Board and Senior Management are tasked with comprehensively understanding the Company's risk environment. Incident management and response teams are in place to execute response protocols and strategies, mitigating business risk and supporting recovery initiatives. This team adapts based on the nature of incidents, ensuring a flexible and effective response.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We are exposed to data and cyber security risks," which should be read in conjunction with the information above.

companyName: SEI INVESTMENTS CO

ticker: SEIC


text: Third-party security firms are used in different capacities to provide or operate some of these programs, controls and technology systems, including cloud-based platforms and services.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: The Company's cybersecurity program is focused on the following key areas: • Departmental Collaboration: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats and are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, potential acquisition targets and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by members of management and relevant management committees.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: We assess, identify and manage material risks from cybersecurity threats and vulnerabilities according to our Cybersecurity Incident Response Plan (the "IRP"). The IRP uses the six-stage model of the National Institute of Standards and Technology Cybersecurity Framework (Preparation, Detection, Containment, Investigation, Remediation, and Recovery) to outline steps for reporting, responding, and mitigating various aspects of a cybersecurity incident. Execution of the IRP's incident response activities are coordinated by the Cybersecurity Incident Response Team, and communications planning via the Helix Crisis Assistance Team and the Cybersecurity Incident Communication Group. There are also separate processes in place for the effective management of cyber incidents involving our offshore assets and certain regional business units.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Related to Cybersecurity Risks Our Vice President of Enterprise Technology Solutions is responsible for the strategic leadership and direction of the Company's information technology organization and possesses over 25 years of tenure and experience with the Company in matters of privacy assurance, cyber, digital, and data security. As part of its risk oversight role, our Audit Committee of the Board of Directors oversees cyber risk, information security and technology risk, including management's actions to identify, assess, mitigate and remediate material cybersecurity issues and risks. The Audit Committee receives regular reporting from our Vice President of Enterprise Technology Solutions on our technology and cyber risk profile, enterprise cybersecurity program and key enterprise cybersecurity activities. We experienced no material cybersecurity incidents in fiscal 2025.

companyName: Vera Bradley, Inc.

ticker: VRA


text: Monitor Cybersecurity Incidents The Vice President of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Vice President of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of Information Technology is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Applying patches and upgrading: There is a risk that not applying patches and upgrades could leave the system vulnerable to attacks, allowing unauthorized access. We are taking measures by regularly updating the operating system and applying patches.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: Material Cybersecurity Risks, Threats and Incidents While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful. We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive or proprietary and other types of information. Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services. While we are not aware of any cybersecurity incidents that have materially affected us to date, there can be no guarantee that we will not be the subject of future attacks, threats or incidents, that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Cybersecurity incidents could disrupt our business and result in the loss of confidential information and legal liability," which should be read in conjunction with the foregoing information.

companyName: WELLTOWER INC.

ticker: WELL


text: Our CDIO has over 25 years of executive experience leading information technology teams and providing strategic vision for multiple Fortune 500 companies. For further details about our CDIO's background, see the "Information About Our Executive Officers" section of Part I of this Annual Report. Our CISO has over 25 years of industry experience, including in developing and leading cybersecurity risk management programs for Fortune 100 companies. Additionally, our CISO and members of the cybersecurity team hold a number of industry recognized certifications, such as Certified Information Systems Security Professional, Payment Card Industry Data Security Standard Internal Security Assessor, Certified Information Security Manager, Certified in Risk and Information Systems control, and Certified Ethical Hacker, among others.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response procedures and policies; disaster recovery/business continuity plans; risk assessments; implementation of certain security controls; encryption of certain data; network security, access, and physical controls for certain systems; management, tracking and disposal of certain assets; systems monitoring; employee training; penetration tests by third-party service providers; tabletop exercises conducted by third parties; and cybersecurity insurance.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or sensitive information, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences.

companyName: DBV Technologies S.A.

ticker: DBVT


text: Through the cybersecurity risk management and strategy processes described above, Cyber Risk Committee members remain informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents. Members participate in the management and operation of our Incident Response Plan, have oversight of our internal information technology departments that report to Cyber Risk Committee meetings, and oversee the implementation, review and revision of the policies underlying our cybersecurity program. Cyber-related incidents, including non-material incidents, typically have a post-mortem exercise completed to review lessons learned and adjust any policies and processes as needed.

companyName: Warner Music Group Corp.

ticker: WMG


text: Our information security team actively monitor and evaluate our networks, systems, data, and security risk profile to identify and assess cybersecurity risks. We use a variety of methods to identify and evaluate these risks using manual and automated tools and processes, including, network scans, vulnerability and maturity assessments, and subscribing to services and reports providing threat intelligence. In doing so, risks are assessed for criticality, prioritized in context of our business, and communicated to stakeholders for engagement as needed.

companyName: SPS COMMERCE INC

ticker: SPSC


text: We take a risk-based approach with our cybersecurity program that has been designed in accordance with the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our program focuses on a variety of potential material risks including operational (including unauthorized access), financial, reputational and compliance-related. We analyze these risks based on numerous factors and also weigh their likelihood and potential impact. This analysis is led by our Chief Digital Officer and Chief Information Security Officer as detailed below under "—Governance." Additionally, we have identified cybersecurity as a credible technology-related risk under our enterprise risk management ("ERM") program. Our Chief Digital Officer is the owner of our technology risks and is therefore charged with executing controls to monitor and mitigate cybersecurity risks through people, processes and technology. Our ERM Committee is comprised of Company leaders and meets at least quarterly to consider, among other matters, the effectiveness of the risk monitoring and mitigating and the expected frequency, severity and trend of our credible risks including cybersecurity.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: The Company maintains arrangements with third party information infrastructure (IT) vendors—including "cloud computing" vendors. The Company has processes designed to manage cybersecurity risks arising from our use of such vendors, including conducting risk assessments prior to integration into the Company's networks and additional assessments prior to contract renewals or extensions. Cybersecurity measures employed by significant third-party service providers are also further analyzed prior to introduction into our environment. The Company also commissions third-party risk assessments of certain IT vendors to identify and evaluate risks associated with each third party and to minimize potential disruptions and liabilities that may arise from external partnerships. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.

companyName: Strategic Education, Inc.

ticker: STRA


text: Our cybersecurity risk management program is designed to assess, identify and manage material risks from potential unauthorized breaches of or access to our electronic information systems and the information we store on our systems. Our program includes a wide variety of mechanisms, controls, technologies, methods, systems and other processes as further described below that are designed to prevent, detect or mitigate unauthorized access, data loss, theft, misuse or other security incidents and vulnerabilities affecting our systems and the information we store on our systems. The information we store includes confidential, proprietary, business and personal information of ours, our customers, our employees and other third parties that we collect, process, store and transmit as part of our business. Our program is aligned with the National Institute for Standards and Technology Risk Management Framework (NIST RMF), other industry-recognized standards and our contractual requirements. We also leverage government partnerships, industry and government associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds and other similar resources to inform and guide our cybersecurity processes and resource allocation. Additionally, we use processes and third-party technologies to oversee and minimize impact to our data, including two-factor authentication, encryption, Company secured email and dedicated cybersecurity support personnel.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Technology Officer Information Security Officer provide quarterly reports to the board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the board of directors reviews our cybersecurity risk profile on a quarterly basis.

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: Our cybersecurity policies, standards, processes, and practices are fully integrated into the Company's risk management and incident response program and are based on recognized frameworks established by the National Institute of Standards and Technology (NIST), the American Institute of Certified Public Accountants (AICPA), the International Organization for Standardization (ISO) and other applicable industry standards. We take a multi-layered approach to cybersecurity, continually updating, innovating, and refining our security practices, policies and procedures to mitigate risk, meet new industry standards and address the evolving threat landscape. The overall cybersecurity program is modeled on the NIST Cybersecurity Framework and customized to meet our specific needs.

companyName: Matterport, Inc./DE


text: We are also a strong proponent of defense in depth. By utilizing Enterprise Risk Management strategies ingrained in our protection, detection and response planning we are able to provide multiple layers of security to identify and mitigate protection points within our company.

companyName: HIGH WIRE NETWORKS, INC.

ticker: HWNI


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations, or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see Part I. Item 1A. "Risk Factors — Risks Related to Information Technology, Cybersecurity, and Data Protection."

companyName: Invitation Homes Inc.

ticker: INVH


text: Our cybersecurity risk management program includes a number of components, including information security maturity assessments, penetration testing, and vulnerability assessments, that are conducted periodically by both internal and external resources. We also conduct employee training and leverage third-party security tools, including but not limited to access controls, threat monitoring, and endpoint protection and response. We maintain a security operations center operated by a third party that collects cybersecurity threat data from multiple sources and determines if activity is potentially suspicious or malicious. We are in the process of developing and implementing additional cybersecurity policies and procedures.

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Prudential Financial's Audit Committee of the Board of Directors which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the CIO and Operational Risk Management throughout the year. At least annually, Prudential Financial's Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential Financial's annual external integrated audit.

companyName: PRUCO LIFE INSURANCE CO


text: With respect to third parties, the Company's cybersecurity program includes a cybersecurity supply chain risk management component aimed at identifying and mitigating risks from vendors, suppliers, and other third-parties. The supply chain risk management program is integrated into the Company's procurement workflow and includes conducting due diligence on select suppliers, vendors and other third parties. The cybersecurity risks of the vendor, supplier or other third party are evaluated by the Corporate Information Security Office when assessing the engagement and determining the appropriate oversight of the vendor, supplier or other third party. The Company also contractually requires suppliers, vendors and other third parties with access to its information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restricts their ability to use the Company's data, including personal information, for purposes other than to provide services to the Company, except as required by law. To oversee the risks associated with these service providers, the Company works with suppliers, vendors and other third parties to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of the Company's systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect the Company.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: Company faces risks associated with cybersecurity threats in carrying out its business operations. For more details regarding the risks related to PRC's cybersecurity regulation, see " Item 1A. Risk Factors—Compliance with China's new Data Security Law, Measures on Cybersecurity Review, Personal Information Protection Law, regulations and guidelines relating to the multi-level protection scheme and any other future laws and regulations may entail significant expenses and could materially affect our business. "; and "I tem 1A. Risk Factors—Recent greater oversight by the CAC over data security, particularly for companies seeking to list on a foreign exchange, could adversely impact our business and our offering. "

companyName: Senmiao Technology Ltd

ticker: AIHS


text: Our second line of defense includes our Cybersecurity Committee and the enterprise risk-management framework under the direction of the Chief Risk Officer to monitor cybersecurity functions and risk management. Our Cybersecurity Committee is composed of members of management including, but not limited to, the COO, Chief Risk Officer, General Counsel and Vice President, Internal Audit. The Cybersecurity Committee helps ensure corporate policy compliance and reports directly to the board of directors regarding material cybersecurity incidents and emerging threats.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Our CIO and CISO routinely inform our Chief Financial Officer and other members of management, as appropriate, about threats, including assessments of threat levels, trends, incidents and related remediation plans, including matters related to the prevention, detection and remediation of any incidents in accordance with our cybersecurity program.

companyName: MASTEC INC

ticker: MTZ


text: The Company outsources around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.

companyName: Nuburu, Inc.

ticker: BURU


text: Our finance and IT consultants have oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. They receive updates from management on our cybersecurity risks as may be required or prudent. In addition, management updates the home office executive committee as necessary, regarding any material cybersecurity incidents. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our home office executive committee. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership, as appropriate.

companyName: Salamander Innisbrook, LLC


text: Our Board of Directors and Management Leadership Team review cybersecurity risks as part of their oversight and execution of the Company's business operations and strategy. We have established oversight mechanisms intended to provide effective cybersecurity governance, risk management, and timely incident response.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: Our cyber incident response plan requires IT team members who detect suspicious activity in our IT environment to escalate that activity to a supervisor who then evaluates the threat. If necessary, the suspicious activity is reported to Energy Transfer's Chief Information Officer, if applicable. Management (including representatives from the legal, human resources and IT departments) is notified by the IT team whenever a discovered cybersecurity incident may potentially have a significant impact on us or our customers.

companyName: USA Compression Partners, LP

ticker: USAC


text: Our steering committee includes our CISO, our Chief Information Officer, our Chief Risk Officer, our Chief Technology Officer, our Senior Counsel—Corporate Legal, CoreSite's Senior Vice President of IT & Digitization and CoreSite's Vice President of Information Security and IT Infrastructure, each of whom has experience, both at American Tower and in prior roles, related to cybersecurity. Our CISO has 25 years of experience in cybersecurity, previously holding positions in the cybersecurity service provider space and at a software security firm. Our Chief Information Officer has held IT leadership positions across large, multi-national companies for nearly three decades, where he has overseen cybersecurity programs. Our Chief Risk Officer has nearly 40 years of risk and audit experience, including oversight of IT audit, with experience at a leading public accounting firm as well as one of the world's largest computer storage and software companies. Our Chief Technology Officer has over 30 years of experience in the technology space, including leadership roles with wireless carriers and chip manufacturers, where cybersecurity was critical to the delivery of secure solutions. Our Senior Counsel—Corporate Legal also serves as our lead Privacy Officer and is a lawyer who has led our privacy program since its inception. CoreSite's Senior Vice President of IT & Digitization has led CoreSite's IT function for over 5 years, including having responsibility for securing the business's cybersecurity environment. CoreSite's Vice President of Information Security and IT Infrastructure has over 25 years of experience building secure IT solutions across large network and data center environments and has been responsible for the day-to-day operation of CoreSite's business-critical IT environment since 2015.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: We are committed to protecting our IT assets and the data stored within these assets. This commitment includes the protection of cyber assets relevant to our operations, stakeholder data (including employee, customer and supplier data), intellectual property and our products.

companyName: CUMMINS INC

ticker: CMI


text: CNX's cybersecurity team includes executive officers and dedicated cybersecurity personnel, such as our Vice President of Information and Technology, who has approximately 30 years of technical leadership and cybersecurity expertise, and multiple cybersecurity engineers. Led by professionals with deep cybersecurity expertise across multiple industries, the team takes a cross-functional approach to addressing risks and engages in discussions with the Board of Directors and executive management as needed.

companyName: CNX Resources Corp

ticker: CNX


text: o Board Training: Certain of our board members have received training to understand cybersecurity risks and their role in overseeing cybersecurity.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: The Company's risk management process includes assessing, identifying and managing material risks from various sources, including those related to cybersecurity. The Company uses information from incident history, industry publications and analysis centers, public news, government information sharing and recognized information security frameworks to inform its risk management program. Management employs a suite of detective and preventative cybersecurity measures including, but not limited to • Maintaining a vulnerability management program, • implementing and operating controls over logical access provisioning, • maintaining an enterprise-wide security awareness program and • administering periodic trainings.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL


text: We regularly evaluate our overall security risk posture to ensure appropriate security controls are in place to ensure confidentiality, integrity, and availability of the firms processing environment, including our business strategy, results of operations or financial condition, to ensure that we have an appropriate security program in place in order to manage materiality. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information, see " Item 1A. Risk Factors – Breaches of our data security could materially harm us, including our business, financial performance and reputation."

companyName: Cottonwood Communities, Inc.


text: Furthermore, management of Hanesbrands prepares, and the Audit Committee reviews and discusses, an annual assessment of our risks on an enterprise-wide basis. We conduct a rigorous enterprise risk management program that is updated annually and is designed to bring to the Audit Committee's attention our most material risks for evaluation, including cybersecurity risks.

companyName: Hanesbrands Inc.


text: Audit Committee reports to the full Board regarding cybersecurity activities. The full Board also receives briefings from management on cyber risk issues and best practices. Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for developing and maintaining our overall cybersecurity risk methodology and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: SurgePays, Inc.

ticker: SURG


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of engagement, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties, and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: The Audit and Risk Committee (the "Audit Committee") of our Board is responsible for the oversight of risks from cybersecurity threats. On a quarterly basis, our CISO updates the Audit Committee on the Company's IT risk program, including an overview of risks and trends, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat developments, as well as the steps management has taken to respond to these topics. This quarterly update is also made available to the full Board, and the Chair of the Audit Committee informs the Board of any key updates during quarterly reports to the Board. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related events and to discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity risks are also considered during Board and Committee discussions of important matters such as enterprise risk management, operational and strategic planning, business continuity planning, mergers and acquisitions, reputation management and other relevant matters. The Board also conducts an annual education session on cybersecurity trends and risks.

companyName: MSCI Inc.

ticker: MSCI


text: Our Board has delegated the primary responsibility for oversight and review of the Company's cybersecurity program to the audit committee. The audit committee actively participates in discussions regarding cybersecurity risk exposures and steps taken by management of Cohen & Steers to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to our Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with the Advisor and Cohen & Steers' CISO and its CTO Cohen & Steers' cybersecurity program, including the robustness and efficacy of Cohen & Steers' overall cybersecurity program, steps taken to enhance defenses and security measures in place and its established plans to identify, detect and respond to threats Cohen & Steers may encounter. The audit committee also annually reviews and discusses with the Advisor cyber insurance coverage. In addition, as necessary, our Board (or the audit committee) receives reports and communications from the Advisor regarding material risks and specific developments that may cover topics such as: the Advisor's computerized information system controls; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices, including with respect to peers and third parties. As of December 31, 2024, neither we nor Cohen & Steers had experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor qualification and management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process involves different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For example, we may conduct vendor qualification audits that assess a potential third party's cybersecurity risk potential. We may conduct a vendor risk assessment that evaluates the likelihood and potential impact of a cybersecurity threat involving the third-party service provider, based on factors such as the type and scope of services, the data processed, and the third-party service provider's security practices. We may request security attestations and certifications to verify that the vendor has met the relevant industry standards and best practices for cybersecurity. We may establish security clauses in our agreements with third-party service providers that address such matters as the roles, responsibilities, and expectations of both parties regarding cybersecurity, such as the security policies and procedures, the incident response and notification expectations, the remediation measures to be adopted, the responsibility for losses associated with incidents.

companyName: CHIMERIX INC


text: Everest has aligned and operationalized its cybersecurity program and controls to the National Institute of Standards and Technology ("NIST") Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company's risk management framework. As part of the Company's cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response. The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center ("SOC") as well as a incident response team ("IRT"), to further escalate to senior management and the Board, as appropriate. While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of incidents to law enforcement and regulatory bodies, as appropriate.

companyName: EVEREST GROUP, LTD.

ticker: EG


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: Board of Directors' Oversight of Cybersecurity Risks and Management's Role in Assessing and Responding to Cybersecurity Risks Cybersecurity risks are overseen at the board level through the Audit Committee. Our CAO, together with the security and compliance team, is responsible for the monitoring, assessment and management of cybersecurity risk, and seeks to maintain the security and continuity of our operations. Our CAO oversees the Company's cybersecurity strategy, cybersecurity and data privacy policies, measures and controls, and Board of Directors and Audit Committee communications on cybersecurity matters. Our CAO regularly briefs senior management, the Board of Directors and the Audit Committee on cybersecurity issues as part of our overall enterprise risk management program, including quarterly updates to the Audit Committee, which may include information regarding our exposure to privacy and cybersecurity risks, plans and activities to monitor and mitigate privacy and cybersecurity risks, IT governance policies and programs, including our cybersecurity incident response plan, and legislative and regulatory developments that could impact our privacy and cybersecurity risks. Additionally, our Vice President – Risk Management oversees our enterprise risk management process and apprises the Audit Committee and our Board of Directors of all significant risks facing the Company, including cybersecurity risks.

companyName: Antero Midstream Corp

ticker: AM


text: Our Board of Directors (our "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee primary responsibility for overseeing our CSRM program and engaging with management on cybersecurity and other risks related to our IT controls and security at least twice per year. Management updates the Audit Committee, if and as needed, regarding any significant cybersecurity events, as well as events that may have had lesser potential impact. In addition to reports from its Chair on the Audit Committee's discussions on cybersecurity, our Board members receive periodic presentations on cybersecurity topics from our Chief Information Officer and our Information Security Officer ("ISO") as part of their continuing education on risks impacting public companies.

companyName: Avery Dennison Corp

ticker: AVY


text: Employees, including representatives of management, conduct an annual cybersecurity incident response tabletop exercise to review our processes and procedures in the event of a material information or cybersecurity incident, including the process for assessing the materiality of an incident and communication of an incident to the audit committee and, as appropriate, the board of directors. In 2024, our board of directors also participated in the cybersecurity incident response tabletop exercise. In addition, to promote a company-wide culture of cybersecurity risk management, we conduct regular phishing email simulations for employees to enhance awareness and responsiveness to possible threats and other kinds of preparedness training. We also require all employees to complete an annual cybersecurity and privacy awareness training.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: The Company's CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Company's CFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Our Vice President, Network Engineering, Product Development and Operations serves as the leader of our cybersecurity team and has over 25 years of experience working in information technology, specializing in network security. The leader of our cybersecurity team has spent the last 17 years working for us in a variety of roles and as a result has in-depth knowledge of the Company's IT and Cyber ecosystem. We believe that his technical expertise combined with his business acumen and education, positions him well to lead Gogo's cybersecurity program. In addition to oversight of cybersecurity, our Vice President, Network Engineering, Product Development and Operations oversees (i) infrastructure management, (ii) the implementation and compliance of our information security standards, and (iii) mitigation of information security related risks. We also have management level committees and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The Cybersecurity Cross Functional Team (the "Cybersecurity CFT"), led by our Vice President, Network Engineering, Product Development and Operations, brings together IT, legal, compliance and other function heads. The Cybersecurity CFT provides a forum for these cross-functional members of management to: consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Gogo Executive Cybersecurity Committee (the "GECC") is comprised of executive leadership and members of the cybersecurity, operations, risk, legal, and internal audit teams. The GECC liaises with the Cybersecurity CFT and provides oversight of all aspects of Gogo's cybersecurity program and, at regular intervals through the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks. • The Incident Response Management Team (the "IRMT"), which includes senior executives and members of our cybersecurity leadership team, was established to support our incident response plan and reports into the GECC. Members of the IRMT are alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The IRMT annually assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. The IRMT also engages with the Company's Board and the Audit Committee depending on the severity of the cybersecurity incident.

companyName: Gogo Inc.

ticker: GOGO


text: Oceaneering's cybersecurity risk management program is overseen by management at multiple levels. The CITO and the Director of IT Security play key roles in assessing, monitoring and managing the Company's cybersecurity risks with support of the Enterprise Risk Committee, as well as dedicated information technology and security personnel. Our CITO has over 18 years of experience as an information technology executive, and earned a Bachelor's and Master's degrees in Management Information Systems. Our Director of IT Security has almost 25 years of experience managing global information technology security and has served as Oceaneering's CISO since 2018. Our Director of IT Security earned a Bachelor's degree in Business and has several relevant certifications including Risk and Information Systems Control ("CRISC"), Information Systems Auditor ("CISA"), Information Systems Security Architecture ("ISSAP"), Security Certified Network ("SCNP"), Information Systems Security ("CISSP") and Cisco Certified Network Associate ("CCNA").

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: The Company's assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is identified in the Company's risk register detailing certain known and potential risk items; the Company's IT operations department works with its MSSP/MSP vendor partners to review certain identified threats and its cybersecurity practices in an effort to prioritize and mitigate cybersecurity threats that are more likely to lead to a material impact on its business; and its CIO regularly presents to senior management, the Board and Audit Committee to evaluate material risks relative to its overall business objectives.

companyName: TerrAscend Corp.

ticker: TSNDF


text: Management has implemented a program to protect the confidentiality, integrity and availability of our information systems and to identify, assess, manage and report on material risks from cybersecurity threats. The program is managed by an in-house cybersecurity team, and the program includes risk management and mitigation processes, such as malware protection, access management, technical vulnerability management and security incident response among other processes and technical safeguards; communication with third-party providers of services regarding their information security practices and disclosed cybersecurity incidents; the use of third-party service providers, as appropriate, for monitoring and mitigating cybersecurity threats and conducting penetration tests; education and training across the organization to mitigate cybersecurity threats to employees and our company; the maintenance of cybersecurity breach insurance; and disaster recovery and business continuity arrangements to minimize the potential impact to our operations in the event of a cybersecurity incident.

companyName: Trade Desk, Inc.

ticker: TTD