text: We face a number of cybersecurity risks in connection with our business. For more information about the cybersecurity risks we face, see the risk factor entitled "We and the third parties that support us rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems could have a material adverse effect on our business, including by not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" in Item 1A- Risk Factors.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Our information technology networks, those of our operators and managers and those of third parties on whom we rely are important enablers to our ability to perform day-to-day operations of our business. Our business operations depend on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data.

companyName: American Healthcare REIT, Inc.

ticker: AHR

secItem: Item 1C


text: Cybersecurity Incident Response. The Company has an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The incident response plan indicates the vice president of support services, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, corporate controller and the board of directors are to be notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.

companyName: Knife River Corp

ticker: KNF


text: Our Chief Legal Officer, who serves as our Head of Information Technology (IT), with the assistance of and informed by our external consultants, is primarily responsible for overseeing our cybersecurity risk management framework, including assessing and managing our material risks from cybersecurity threats, as well as monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Legal Officer and Head of IT has experience as a senior legal, compliance and operations executive in highly regulated companies, including in roles with executive-level responsibility for overseeing data privacy and security compliance.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: The Company's Vice President of Information Technology, Director of Information Security, Director of Systems Engineering, and Director of Retail Platforms manage the Company's information security policies and have oversight of our cybersecurity systems and methodologies risks, as well as assessing and managing cybersecurity risk. The Director of Information Security holds cybersecurity certifications as a Certified Information Systems Security Professional and GIAC Penetration Tester. Risk is evaluated on an ongoing basis to determine the likelihood and magnitude of a potential impact. In addition, the Director of Internal Audit is a Certified Internal Auditor and is actively involved in the annual internal general IT controls audit and partners with a third party to assist. The results of all internal audits, including information technology issues, are shared with the Company's Audit Committee of the Board of Directors which reports to the full Board of Directors.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: We periodically assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Google, QuickBooks, and Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: Aeluma, Inc.

ticker: ALMU


text: Company's management is responsible for overseeing and managing our cybersecurity risks and activities as part of its overall risk assessment portfolio. Our management regularly evaluates and reviews the Company's cybersecurity posture and performance and reports to the board of directors on any material cybersecurity matters or developments. Our management also coordinates with our CROs, vendors, partners, and other third parties to ensure that they comply with our cybersecurity expectations and requirements and to address any cybersecurity issues or concerns that may arise.

companyName: Mitesco, Inc.

ticker: MITI


text: Our third-party IT service provider is a key part of our cybersecurity program. We partner with a cybersecurity company and leverage their technology and expertise to better protect the Company. From time to time, we engage this vendor to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. We intend to continue to work to formalize our cybersecurity program, including developing processes for third-party service provider cyber-risk oversight and management.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: We use service providers in an effort to identify, assess, and manage material risks from cybersecurity threats. These service providers may provide services related to: threat intelligence, cybersecurity practices, cybersecurity software, managed cybersecurity response, penetration testing, dark web monitoring, forensic investigation, and professional services (including legal counsel).

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: The Board executes its oversight responsibility for risk management both directly and through delegating oversight of certain risks to its committees. The Board has authorized the Audit Committee to oversee risks related to cybersecurity threats. Our Audit Committee has primary oversight responsibility for cybersecurity and information security risk management and controls. As part of its oversight function, the Audit Committee oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the overall data protection program.

companyName: CorMedix Inc.

ticker: CRMD


text: We use third-party service providers to perform a variety of security functions throughout our business, such as SaaS security providers, cloud-native application protection platforms, dark web monitoring, and software code scanning. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments and imposition of contractual obligations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, which may impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology, systems, or those of third parties upon which we rely or our data are or were to be compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences."

companyName: Freshworks Inc.

ticker: FRSH


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity program.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance: As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd., a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with the Company's executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach: Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with the Company's management and its board of directors, as applicable, in a timely manner. • Technical Safeguards: Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as the Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Realty Income Solutions, Inc.


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that summarizes the steps the Company will take to respond to a cybersecurity incident. The plan includes an Information Security Incident Response Team (ISIRT), which is responsible for addressing and coordinating all aspects of the Company's response to cybersecurity events. The ISIRT is supported by operating procedures and guidelines designed to outline the expectations and processes to be followed when responding to incidents of unauthorized access to confidential information maintained by the Company or its service providers. The ISIRT may consult legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other resources and appropriate reporting protocols at both the management and Board of Directors levels.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: Our Chief Executive Officer, or CEO, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The consultant that operates our SOC updates the CEO regarding the detection of cybersecurity risk exposure and provides advice on the prevention, mitigation and remediation of such risks. The CEO keeps the senior executive leadership team apprised, including our Vice President of Finance, on assessments of risk exposure to ensure that the highest levels of management are kept abreast of potential risks we are facing. The CEO has significant prior business experience in compliance and risk management and coordinates directly with the third party who operates our SOC on issues involving particular cybersecurity expertise.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: Danaher's cybersecurity strategy and risk management program focuses on seeking to maintain a secure environment for our data that complies with applicable legal requirements and effectively supports our business objectives and customer needs. Our commitment to cybersecurity emphasizes cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention and detection of, and response to, cybersecurity threats. Key elements of our program for identifying, assessing and managing material risks from cybersecurity threats are described below.

companyName: DANAHER CORP /DE/

ticker: DHR


text: The Business Resiliency Management Policy is designed to ensure our critical business functions remain available during business disruptions and to minimize the impact of such disruptions, including the unavailability of information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. The Business Resiliency Management Policy includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for FHLBank to operate.

companyName: Federal Home Loan Bank of Topeka


text: Members of Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring and evaluating Cohen & Steers' threat environment and enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from various professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting scans of Cohen & Steers' threat environment; (iv) evaluating Cohen & Steers' and its industry's risk profile; (v) evaluating threats that are reported to or discovered by Cohen & Steers; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of the information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Risk Identification: EQT utilizes a combination of internal processes and third-party services to identify potential information security vulnerabilities and threats. This includes threat intelligence, vulnerability management and various security assessments.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Business—Security breaches, loss of data, unauthorized uses or disclosures, and other disruptions involving our systems, products or data could compromise sensitive information related to our business or patients, result in operational disruption, or prevent us from accessing critical information, exposing us to liability, and adversely affecting our business, financial condition, results of operation and prospects."

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: Our Board has risk oversight responsibility for the Company, which it administers directly and with assistance from its committees. In connection with its assessment of the Company's risk environment, the Board receives comprehensive updates on cybersecurity risks every quarter from the CISO.

companyName: DOC DR Holdco, LLC


text: Our Information Security and Privacy Team includes 70 full-time positions with at least 50% of our associates holding industry certifications, such as the Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Privacy Professional (CIPP). All associates and contractors with access to our Company's systems receive comprehensive initial and ongoing annual training on responsible information security, data security, and cybersecurity practices and how to protect against cyber threats.

companyName: Jackson Financial Inc.

ticker: JXN


text: EQT's technology systems and those of its, the Adviser's and our third-party service providers are vital for sustaining our operations and strategic initiatives. To manage the risks inherent in these vendor relationships effectively, EQT has established a series of processes. EQT and the Adviser engage only with third parties that align with our stringent cybersecurity standards, demanding that these providers demonstrate strong capabilities in key areas such as data protection, incident preparedness, continuity, and vendor risk management. Adopting a risk-based strategy allows EQT to prioritize its efforts, focusing on the most critical vendors to ensure its attention is directed where it is most needed. In regards to EQT's most critical vendors, EQT requires substantial and credible third-party assurances, such as Service Organization Control Type 2 certifications ("SOC 2") and International Organization for Standardization ("ISO") certifications, ensuring they meet its high cybersecurity standards.


text: Our Interim Chief Executive/Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: Risk Assessment, Identification and Management Processes We have implemented a cybersecurity risk management strategy to assess, identify and manage material risks from cybersecurity threats. This strategy is designed to protect our systems, data and operations from potential cyber threats and to ensure the continuity of our business operations.

companyName: Frontdoor, Inc.

ticker: FTDR


text: The cybersecurity risk management program is led by the Chief Information Security Officer (CISO). Our CISO has over 28 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. The CISO has held various executive level positions within Fortune 500 companies. Our CISO reports to the Chief Information Officer (CIO), who leads the Global Information Technology (IT) organization and works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes.

companyName: Medtronic plc

ticker: MDT


text: To augment internal knowledge, we have engaged a virtual Chief Information Security Officer ("vCISO") from a third-party firm that has provided IT and security services for over 18 years and utilizes industry expertise to recommend and implement best practice solutions for operational needs. The service provides a named vCISO as part of an advisory team to assess and help manage our cybersecurity program.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: In our retirement services business, our board of directors' oversight of cybersecurity risk management is supported by the AHL board of directors, the AHL board's audit, risk, and legal and regulatory committees, the AHL management risk committee, the AHL management operational risk committee and AHL management. AHL's Chief Information Officer ("CIO"), CISO, General Counsel and certain other members of AHL's senior management meet periodically with the audit, risk, and legal and regulatory committees of AHL's board of directors to review AHL's information technology and cybersecurity risk profile and to discuss risk mitigation plans.

companyName: Apollo Global Management, Inc.

ticker: APO


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and, • A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: AGM's board of directors is involved in overseeing the Company's risk management program, including with respect to cybersecurity, which is a critical component of the Company's overall approach to enterprise risk management ("ERM"). For additional information about our risk management framework, see "Part II—Item 7A. Quantitative and Qualitative Disclosures About Market Risk—Risk Management Framework." Our cybersecurity policies and practices are fully integrated into our ERM framework through our reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.


text: To minimize the risk to our core systems, we utilize well established enterprise-grade cloud service providers for our management and operational functions. We review Service Organization Control Type 2 audit report results from each of these service providers to ensure that their programs meet our requirements.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Our cybersecurity leadership team is made up of highly experienced professionals with a background in information security, risk management, and incident response. This background includes leading and developing cyber security operations and incident response programs for business organizations, developing comprehensive cyber security strategies, and managing complex cybersecurity projects across various industries.

companyName: OneWater Marine Inc.

ticker: ONEW


text: ransomware attacks; loss or theft of devices or media containing our data; human error or negligence; natural disasters; power outages; or sabotage. Our data and systems may also be subject to cybersecurity breaches or incidents at its CROs, vendors, partners, or other third parties that we interact with or rely on.

companyName: Mitesco, Inc.

ticker: MITI


text: iii. Targeted training for high-risk groups such as finance and accounting, including phishing email response checks, to proactively mitigate threats like business email compromise.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: We depend on and engage various third parties, including suppliers, vendors and service providers, to operate our business. We rely on the expertise of the third-party risk management, legal, information technology and compliance personnel of FS/EIG Advisor and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: Finally, our VP of Internal Audit leads an annual internal audit plan which includes a cybersecurity, privacy, or information technology security component. Internal audit findings are reported to the Audit Committee on a quarterly basis.

companyName: JFrog Ltd

ticker: FROG


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors—The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: We seek to routinely refine our cybersecurity approach to adapt to changes in the threat landscape and manage emerging security risks. In order to evaluate risks from cybersecurity threats associated with the company's use of certain third-party technology providers, we have incorporated a risk-based assessment into the corporate information technology (IT) procurement process designed to assess the security risk of certain third parties providing new technology solutions to our environment. THERMO FISHER SCIENTIFIC INC.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: In particular, the Audit Committee of our Board of Directors monitors and assesses our financial, legal and operational risks, and receives regular reports from the management team regarding comprehensive organizational risk as well as particular areas of concern, which includes, but is not limited to, cybersecurity risks, related mitigation, and other related responses and activities.

companyName: Clarus Corp

ticker: CLAR


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors - Any failure, disruption or security breach or incident of or impacting our information technology infrastructure or information management systems could have an adverse impact on our business and operations." We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Cybersecurity | Cybersecurity Risk Management and Strategy • We conduct periodic monitoring reviews of these higher-risk third parties' cybersecurity policies and practices.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Our risk management processes and procedures include a cybersecurity risk management program as part of its multiple technical layers of defense. Through our cybersecurity risk management program, we have designed and implemented processes for identifying, assessing, preventing, and managing material risks from cybersecurity threats to our critical computer networks, third-party service providers, communication systems, hardware and software, and our critical data, including confidential company and customer information. As part of our cybersecurity risk management program, we evaluate our various technical layers of defense on an ongoing basis including performing incident response planning, frequent vulnerability testing, vendor risk management, intrusion monitoring, and maintaining a security awareness program. We invest in our people, processes and systems and maintain partnerships with appropriate government and law enforcement agencies to help monitor cybersecurity threats as well as prevent and respond to cybersecurity incidents.

companyName: Axos Financial, Inc.

ticker: AX


text: Process for Monitoring Cybersecurity Incidents The InfoSec Director and eRISC, as applicable, are continually informed about the latest developments in cybersecurity including potential threats and innovative risk management techniques. The InfoSec Director is an active thought leader and speaker within the CISO community, regularly participating in cybersecurity conferences such as FS-ISAC, and CISO summits. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The InfoSec Director implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the InfoSec Director is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: PROSPER MARKETPLACE, INC


text: We have not identified risks from known cybersecurity threats to date, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time, and we cannot anticipate when or the extent to which cybersecurity breaches will materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: Guidewire Software, Inc.

ticker: GWRE


text: The Company has deployed a layered security approach to identify, measure, monitor and control information technology risks. The Company also maintains a documented Incident Management Standard and Technology and Cyber Incident Response Plan. These documents address the detection, mitigation, and remediation of cybersecurity incidents, and include appropriate timely incident escalations to be followed during an incident, up to and including executive leadership, management committees and depending on incident severity, the Board, or a Board committee. The volume, severity, and root case of security incidents are reported on at monthly management committees. The Company will regularly engage independent third parties to assist in its cybersecurity preparedness, including but not limited to vulnerability scan assessments, secure code scan reviews, and cybersecurity incident response simulations. The Company's internal audit department also performs annual cybersecurity penetration testing over the Company's internal and external networks. Additionally, for third party related technologies, the Company's Third-Party Risk Management Program ("TPRM") is involved with onboarding all vendors, including ongoing monitoring of higher risk vendor relationships. TPRM documents the Company's view of applicable third-party vendors assessing the vendor's technological capability to provide products and/or services in a viable and risk adverse manner.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: The CTO, who serves as the Chief Information Security Officer ("CISO") for the Company, is the primary executive responsible for leading the Company's cybersecurity risk management program and has over 25 years of experience in various technology-related roles, including responsibilities related to managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Company's Computer Security Incident Response Team ("CSIRT") has primary responsibility for monitoring and enacting the incident response program and is led by the Senior Director of Information Security who reports to the CTO.

companyName: VALVOLINE INC

ticker: VVV


text: Critically evaluate and assess the direction and progress of major IT-related projects, IT security decisions, IT priorities, and overall IT and IT security performance. Review and approve significant IT and information security related policies, including annual changes. Review and approve IT and information security risk assessments on an annual basis. Discuss activities and requirements pertaining to the Information Security Program.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: Through our centralized enterprise risk management function, we also maintain processes for overseeing and identifying risks associated with third party service providers with whom we do business, including risks related to cybersecurity.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Chief Information Security Officer ("CISO"), in coordination with the Chief Information Officer and the Technology Risk Management Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current CISO has over 35 years of experience in information security and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee, the Audit Committee of our board of directors, and the Audit Committee chair.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: Our cybersecurity program is managed by a dedicated team, which is led by our Chief Information Security Officer, (CISO who reports to the Chief Operating Officer and has to the ability to communicate directly to our CEO if necessary. Our CISO has over 20 years of IT experience, including over 18 years of cybersecurity experience, holds an M.S. degree in Information Security, and is a Certified Information Systems Security Professional (CISSP). As discussed above, our CISO and/or General Counsel and Chief Privacy Officer report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: In addition, the Board will oversee any cybersecurity risk management framework and a dedicated committee of the Board or an officer appointed by the Board will review and approve any cybersecurity policies, strategies and risk management practices.

companyName: Rubber Leaf Inc

ticker: RLEA


text: In accordance with our policies and procedures, we investigate any technological, computer, or network security event or incident within our networks or involving confidential and sensitive data maintained by Oncor, including events or incidents involving third-party vendors that interface with our networks or otherwise hold confidential and sensitive data maintained by Oncor. With respect to certain of our third-party vendors, we may also require such third-party vendors to notify us of any cybersecurity incident that may impact our operations or involve confidential and sensitive data maintained by Oncor. Multiple security operations centers monitor our digital environment at all times for anomalies, threats, and indicators of compromise. We have a variety of tests performed by internal and external parties related to the integrity of our networks, cyber protections and policies and procedures. Third-party security tests of our network, applications, perimeter, physical equipment and other areas of security are used to test cybersecurity readiness. When a cybersecurity threat either newly materializes or escalates, we elevate communication both internally and externally to ensure situational intelligence is both known and shared to help in defending against that threat.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Our vendor management program is designed to ensure that our vendors meet current cybersecurity and information security standards. This includes conducting periodic reviews of independent control audits of the security, infrastructure, application standards or controls, and recovery plans of our most critical vendors.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: Our SIRP is dynamic and adaptable, evolving in tandem with the ever-changing cybersecurity landscape. By regularly updating and refining our response strategies, we remain prepared to confront emerging threats.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: The Head of Information Technology has served in various roles in information technology and information security for over 20 years, including serving as Vice President, Information Technology at three public companies. The Head of Information Technology holds an undergraduate degree in Business Administration, Management Information Systems. The Company's CEO, COO and CFO, and General Counsel each hold undergraduate and graduate degrees in their respective fields, and have extensive experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: As a company externally managed by the Advisor, we rely on Starwood Capital's information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third-party service providers, to assist in conducting our businesses. Starwood Capital's IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cybersecurity incidents, or a series of related cybersecurity incidents, that could adversely impact our financial condition, results of operations, cash flows or business strategy, including our ability to operate core business functions. In the last fiscal year, Starwood Capital continually monitored the risk landscape and did not experience any cybersecurity breaches, including malware and computer virus attacks that have materially affected, or are reasonably likely to materially affect our financial condition, results of operations, cash flows, or business strategy. For more information on our cybersecurity-related risks, see Part I, "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: We have a dedicated cybersecurity team, composed of individuals with a diverse set of information security, cybersecurity, and governance, risk and compliance backgrounds, collectively giving our cybersecurity program significant experience. Our CISO leads our day-to-day data security and customer privacy efforts — overseeing operations, cybersecurity, privacy risk and compliance. The CISO, who has more than 30 years of experience reports daily to our chief information officer (CIO), monthly to the risk and compliance committee (consisting of the president and executive leadership) and quarterly to our board.

companyName: Allegiant Travel CO

ticker: ALGT


text: We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools. We subscribe to reports and services that identify cybersecurity threats, analyze reports of threats and conduct vulnerability assessments to identify vulnerabilities.

companyName: OPAL Fuels Inc.

ticker: OPAL


text: We also receive and participate in other third-party cybersecurity assessments, such as: quarterly vulnerability scanning as part of our PCI DSS compliance requirements, annual network assessments, annual penetration testing, and vulnerability scans as part of our cyber insurance underwriting process.

companyName: Silk Road Medical Inc


text: The Audit Committee, which is tasked with oversight of certain risk issues, including cybersecurity, receives reports from the Executive Vice President, Global Chief Information Officer and the Vice President, Chief Information Security Officer each quarter. At least annually, the Board of Directors and the Audit Committee also receive updates about the results of exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and our internal response preparedness. The Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board also receives periodic briefings regarding our Information Security Program and cyber threats, including threats faced by our peers, in order to enhance our directors' literacy on cyber issues. In addition, management will update the Audit Committee, as necessary, regarding cybersecurity incidents, that we may experience.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Our cybersecurity program, which is managed by our information security team, includes: • efforts to comply with prevailing cybersecurity standards; • regular risk assessments, security assessments and penetration tests designed to help identify potential cybersecurity risks to our critical systems, networks, products, services, and our broader enterprise information technology environment; • a cybersecurity incident response plan and procedures for responding to cybersecurity threats and incidents; • a security operations team responsible for detection of, and response to, cybersecurity threats and incidents; • a third-party risk management process for third-party service providers, suppliers, and vendors; and • annual cybersecurity awareness training of our employees, including senior management.

companyName: Rapid7, Inc.

ticker: RPD


text: To reduce the likelihood and severity of cybersecurity incidents, we established a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our technology systems and business operations more broadly. For a discussion of the risks associated with cybersecurity threats, see Item 1A. Risk Factors.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: There have not been any breaches at the Sponsor or the Trust during the year ended September 30, 2025. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal and financial data regarding our crew members and farmers, which we collectively refer to as "Information Systems and Data."

companyName: Vital Farms, Inc.

ticker: VITL


text: The CISO, in coordination with the Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: We take seriously the security of the data entrusted to us by our customers and the confidentiality, integrity, and availability of our platforms. We have integrated cybersecurity risk management into our broader enterprise risk management framework in an effort to protect our applications, networks, systems, and sensitive data from the risks of cybersecurity threats. This strategic integration allows cybersecurity risk management to inform early decision-making processes across the organization.

companyName: MeridianLink, Inc.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to management depending on the circumstances, including the individuals named above, who work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our security incident response plan provides for reporting certain cybersecurity incidents to the cybersecurity committee of the board.

companyName: Snowflake Inc.

ticker: SNOW


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, along with personal data and other sensitive information, including our trade secrets, data we may collect about trial participants in connection with clinical trials, and other sensitive data ("Information Systems and Data").

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Monitor Cybersecurity Incidents The Chief Information Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Officer implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: Cybersecurity for Systems used in Support of U.S. Government Customers. With respect to products and services provided to, and IT systems used in connection with programs for, the U.S. government, our cybersecurity program aligns with the NIST standards and meets the requirements of 32 CFR Part 117 and other applicable U.S. government guidance. The program includes authorization and assessment of new and existing IT systems by our customers and third parties. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.

companyName: RTX Corp

ticker: RTX


text: The Company remains vigilant in its efforts to protect its systems, data, and stakeholders from cybersecurity threats and believes that its proactive and comprehensive approach positions it well to manage these risks effectively.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: The Director, IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Director, IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Cidara Therapeutics, Inc.


text: Global IT Manager, with over 34 years of IT-related experience, continues to lead our information security efforts, working closely with third-party experts and consultants, and regularly briefs our CFO on any related matters. Our CFO then ensures the Audit Committee is regularly briefed on cybersecurity matters, including risks, initiatives, and incidents. advanced employee training programs that include phishing simulations and scenario-based threat responses. security monitoring and incident response plans. encryption protocols and performing regular system updates to address potential vulnerabilities. Global IT Manager oversees all vendor-related cybersecurity work, focusing on process evolution, risk remediation, and employee training.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: We have also adopted a cybersecurity incident response plan which provides for controls and procedures in connection with cybersecurity incidents, including these escalation procedures.

companyName: CoreCivic, Inc.

ticker: CXW


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Technology, leveraging information and analysis from external experts as part of the Board's continuing education on topics that impact public companies.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: The CTO leads management's assessment and management of cybersecurity risks. The Company's Head of Information Security leads the information security team, which is responsible for managing day-to-day cybersecurity risks and implementing and maintaining the Company's cybersecurity strategy. The Head of Information Security reports to and regularly briefs the CTO on cybersecurity matters, including results of vulnerability testing and remediation, cyber incident responses, and progress on cybersecurity infrastructure initiatives. The CTO and Head of Information Security update the Audit Committee about cybersecurity risks and any investigation of a material cybersecurity incident.

companyName: IMAX CORP

ticker: IMAX


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented and utilize a risk-based approach that incorporates various information security processes designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity and availability of information technology systems and the data residing therein. The critical data contained on our information systems include intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive, personal information that we collect, use, store and transmit digitally in the ordinary course of our business. These processes are managed and monitored by a dedicated information technology team, which is led by our Senior Vice President of Information Technology, and include mechanisms, controls, technologies, systems, and other processes designed to monitor and evaluate our threat environment, prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Our cybersecurity program is informed by certain industry standards and best practices as outlined by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We use email security tools, managed detection and response, third party managed security services, regular vulnerability scans and threat intelligence feeds. We also have an incident response plan designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We assess third-party service providers with a cyber security questionnaire and a follow up meeting or audit based upon the risk profile of the third party with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices intended to be consistent with applicable legal standards and industry best practices.

companyName: Apogee Therapeutics, Inc.

ticker: APGE


text: Leveraging threat intelligence and other signals, the Company undergoes periodic testing, audits and reviews of its policies, standards, processes and practices to identify, assess and address cybersecurity risks and events. The Company also undergoes routine internal and external penetration testing. The results of such tests and assessments are evaluated by management and periodically reported to the Committee. The Company further adjusts its cybersecurity policies, standards, processes and practices based on these results. The Company also publishes attestations of its various certifications, audits, and penetration tests on its global compliance webpage.

companyName: Salesforce, Inc.

ticker: CRM


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "We are exposed to risks related to information technology infrastructure, information management and protection, cybersecurity threats, and cyber incidents." and "Our business is subject to evolving corporate governance and public disclosure regulations and expectations, including with respect to environmental, social and governance matters that could expose us to numerous risks." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K. For more than 5 years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: The Board, in coordination with the Audit Committee, oversees the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee must review and discuss with the Company's management team the Company's privacy and cybersecurity risk exposures, including: the potential impact of those exposures on the Company's business, financial results, operations and reputation; the steps management has taken to monitor and mitigate such exposures;

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Risks from Cybersecurity Threats We have not been subject to cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Matador Resources Co

ticker: MTDR


text: We have a thorough process for identifying, assessing, and managing cybersecurity risks within our broader risk management framework. We gather insights from external experts and internal threat intelligence teams for our cybersecurity risk management program. A dedicated team oversees cybersecurity risk management, led by professionals with deep expertise, including our Vice President, Cybersecurity and Information Security Officer. Our executive leadership, supported by our cybersecurity team, oversees our enterprise risk management and regularly considers cybersecurity and other material risks.

companyName: BIOLIFE SOLUTIONS INC

ticker: BLFS


text: The Company depends on and engages various third parties, including service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with its reliance upon such third parties.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: We have not identified and are not aware of any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about the cybersecurity risks we face, see "Item 1A — Risk Factors — Any failure by us to maintain the security of the information we hold relating to our Company, Members, employees and vendors, could damage our reputation with them, could disrupt our operations, could cause us to incur substantial additional costs and to become subject to litigation and could materially adversely affect our operating results."

companyName: PRICESMART INC

ticker: PSMT


text: As part of the Company's overall approach to cybersecurity, the Company's cybersecurity risk management processes are focused on the following key areas.

companyName: WillScot Holdings Corp

ticker: WSC


text: Our enterprise cybersecurity program is designed to monitor and continually enhance our enterprise security posture, with the goal of preventing cybersecurity incidents to the extent feasible, including assessments to better understand our readiness for cybersecurity threats and the resilience of our critical business functions, with the goal of avoiding or reducing the impact if such an event were to occur. We have implemented cybersecurity policies mapped to industry and government standards and frameworks, such as U.S. National Institute of Standards and Technology (NIST) and International Standard of Organization (ISO). Our cybersecurity strategy and maturity is aligned to the NIST-Cybersecurity Framework (NIST CSF). This framework provides us a structured approach to managing our cybersecurity risk through its five core functions: Identification of digital assets, their risks, and business context; Protection, by implementing safeguards such as firewalls, network segmentation, and email security; Detection: through monitoring for anomalies and potential threats on the network, endpoints and data; Response, by having up to date incident response plans and skilled teams in place, including utilizing a crisis committee to respond in the event of a cybersecurity incident; and Recovery, achieved through ensuring data and system backups as well as testing our disaster recovery procedures. We also regularly review our cybersecurity policies and require annual cybersecurity training for our employees. Our product cybersecurity focus begins with our design protocols and is supported by quality testing, provider education, and packaging and distribution standards. We use penetration testing to simulate cyberattacks and better understand our exploitable weaknesses, and we monitor threat intelligence feeds, including avenues for product users to report vulnerabilities directly to us, and use scanning tools to detect and assess vulnerabilities that could affect our products. In addition, we conduct product, enterprise and vendor/third party risk assessments, vulnerability assessments and analyses to gain insights into potential vulnerabilities and their impact on critical functions, and leverage their outcomes to prioritize our security investments and balance our resource allocation.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: The Cybersecurity Program is supported by other members of Uber's senior management team as well, including the Chief Legal Officer, Head of Platform Engineering, and EU Data Protection Officer. Uber's Board of Directors oversees the Cybersecurity Program through regular updates.

companyName: Uber Technologies, Inc

ticker: UBER


text: Our employees receive regular training on cybersecurity best practices, emphasizing the protection of financial information. We foster a culture of cybersecurity awareness and responsibility throughout the organization.

companyName: BLUE BIOFUELS, INC.

ticker: BIOF


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. In addition, our Legal and Information Technology (IT)/Information Security (IS) teams work together to oversee our compliance with applicable laws and regulations and coordinate with subject matter experts throughout our business to identify, monitor and mitigate risk including information security risk management and cyber defense programs.

companyName: Arista Networks, Inc.

ticker: ANET


text: We conduct an initial assessment on the cybersecurity profile of our third party vendors as they are onboarded and evaluate their cyber security programs and safeguards before utilizing them in our environments. We utilize cyber intelligence to provide continuous monitoring and scanning of systems to provide awareness if any of our vendors have security incidents. Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services to maintain certain security protections including compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including storage, transmission, and access.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: We have not experienced any material information security breaches in the last three years, nor are we aware of any cybersecurity risks that are reasonably likely to have a material adverse affect on us. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. For additional information about our cybersecurity risks, refer to "Item 1A. Risk Factors - Risks Related to Our Business and Operations - We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, or financial loss."

companyName: CIVITAS RESOURCES, INC.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: Our cybersecurity program framework is based on the Center for Internet Security's ("CIS") Critical Security Controls. We have policies and procedures in place based on best practices and guidelines from the National Institute of Standards and Technology ("NIST"), an agency of the United States Department of Commerce, and the Cybersecurity & Infrastructure Security Agency, an agency of the United States Department of Homeland Security. Our Information Technology ("IT") team works to protect not only our information, but also the information of third parties we may hold or control, including by implementing physical, electronic, and procedural safeguards to protect the confidentiality, integrity, and availability of Company computer systems. We also limit physical access to server, storage, and network equipment to necessary staff.

companyName: ALAMO GROUP INC

ticker: ALG


text: Premier addresses third-party risks as part of Premier's Vendor Risk Management ("VRM") Policy and Program. The purpose of the VRM is to provide a consistent framework to direct Premier in the assessment, measurement, monitoring and control of risks related to vendors and third parties with whom Premier does business. Premier assesses and monitors the cybersecurity controls of third party service providers and partners. As part of the initial and regular monitoring of the vendor, the Company reviews a vendors internal controls based on the COSO framework in alignment with their formal SOC II assessments. The focus of the review is on a vendor's internal management and security practices including but not limited to, physical/systems security, business resiliency, application programming practices, systems security monitoring, and systems change control/authorization.

companyName: PREMIER FINANCIAL CORP


text: Our Board of Directors has delegated its oversight of risks associated with cybersecurity to its Audit Committee. Generally, each quarter, the Audit Committee reviews and discusses with our Chief Information Security Officer material cybersecurity risks and our processes for assessing, identifying, and managing such risks, and the Audit Committee will receive updates as necessary between each quarterly meeting. In the event of a material cybersecurity incident, the Audit Committee will be notified, and the Board of Directors will also receive updates on cybersecurity risks and incidents, as appropriate.

companyName: Datadog, Inc.

ticker: DDOG


text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of a variety of security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: ITEM 3. Legal Proceedings. None. From time to time we are involved in matters that involve governmental authorities as a party under federal, state and local laws that have been enacted or adopted regulating the discharge of materials into the environment or primarily for the purpose of protecting the environment. We will report such matters that exceed, or that we reasonably believe may exceed, $1.0 million or more in monetary sanctions.

companyName: Parker-Hannifin Corp

ticker: PH


text: The Company maintains various role-based access controls to safeguard data and systems. Data center assets are protected and monitored by badged key systems and video surveillance. Access is periodically reviewed and updated.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: At the management level, we have established a Global Security Governance Council (the Council) to further strengthen our cybersecurity risk management activities across the Company, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Council is responsible for developing and coordinating enterprise cybersecurity policy and strategy, and for providing guidance to key management and oversight bodies.

companyName: BOEING CO

ticker: BA


text: TEGNA has documented and tested incident response plans, which outline the steps to be followed from incident detection to containment, recovery, and notification, including notifying functional areas, as well as senior leadership and the Board, as appropriate. With assistance from third-party cybersecurity experts, TEGNA regularly conducts cybersecurity tabletop exercises with leadership and technical teams. TEGNA conducts compliance reviews of all cybersecurity policies and procedures at least annually and utilizes an outside cybersecurity firm to evaluate the overall program. Business units are required to attest to applicable TEGNA security controls monthly.

companyName: TEGNA INC

ticker: TGNA


text: We engage assessors, consultants, or other third parties for supplemental cyber monitoring and assessment of cybersecurity policies and controls in support of the risk assessment. We contractually require key and/or relevant third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company. Depending on the severity of the suspected breach, these reports may be among the information supplied to our Chief Information Officer.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: Cybersecurity threats, including previous incidents, have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the evolving nature of these risks and remain vigilant in our efforts to mitigate potential impacts.

companyName: EXPONENT INC

ticker: EXPO


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations and financial condition.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Additionally, we employ innovative technology solutions designed to identify, protect, detect, and mitigate cybersecurity threats through the use of firewalls, intrusion detection systems, patching, endpoint detection and response, encryption, multi factor authentication, and data backups to immutable storage.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: The Bank engages with third parties to assess and test its cybersecurity posture including having independent third parties perform internal and external penetration testing as well as social engineering and phishing testing of teammates. Results of third-party testing are reported to the Management Committee and Risk Committee of the Board.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: We have engaged a specialized consulting firm from India to enhance and develop the cybersecurity framework for our products with the aim of protecting sensitive patient data and proprietary device information from cyber threats and ensuring compliance with the latest cybersecurity standards including, HIPPA, FDA regulations, IEC 62443, and NIST guidelines for medical devices.

companyName: SS Innovations International, Inc.

ticker: SSII


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Risk Management Committee of the Board (the "Risk Management Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Information Security Officer ("CISO"), the Company's Chief Information Officer ("CIO"), other members of management. • Incident Response and Recovery Planning: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that establish a structured approach for the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Outside Experts. The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Personnel primarily responsible for security, risk and compliance matters meet periodically to develop strategies for preserving the confidentiality, integrity and availability of Company and tenant information, identifying, preventing and mitigating cybersecurity threats, and responding to any cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our data security governance, infrastructure security, product security, applied security engineering and security operations teams report directly to our CISO and provide regular updates on significant or potentially significant threats and incidents. Additionally, we have an incident response team and an incident response plan that outlines the roles and responsibilities of key personnel, including representatives from information security, compliance, and counsel, that are involved in responding to, remediating and escalating such incidents to the CISO, as appropriate. Our CISO reports directly to our Technology + Engineering Lead and indirectly to our audit and risk committee. Our CISO provides updates on significant or potentially significant threats and incidents to our Block Head and leadership team, in addition to the audit and risk committee and our board of directors as appropriate and in accordance with the processes detailed in the prior paragraph.

companyName: Block, Inc.

ticker: XYZ


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: • our security incident response and communication plan; • our disaster recovery plan; • ongoing risk assessments; • implementation of security standards; • encryption of data; • network security controls; • access controls; • physical security; • asset management, tracking and disposal; • systems monitoring; • employee training; • penetration testing; • cybersecurity insurance; and • dedicated cybersecurity personnel.

companyName: MANNKIND CORP

ticker: MNKD


text: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management, mitigation, remediation and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We also disclose information regarding our security and privacy program and practices on our website and in our public-facing notices.

companyName: Certara, Inc.

ticker: CERT


text: As discussed in more detail under the heading "Governance" below, as part of its general oversight duties, the Board oversees the Company's risk management, including the cyber security risks.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: The Company's Board of Directors oversees our enterprise risk management ("ERM") program and has delegated the primary responsibility for its oversight, which includes oversight of cybersecurity risk, to the Audit Committee. The Audit Committee is informed of material risks from cybersecurity threats through regular discussion with management regarding cybersecurity risk mitigation and cybersecurity incident management. Executive management, including our VPoC, regularly presents to the Audit Committee regarding cybersecurity matters, including program updates, key metrics, and developments.

companyName: TransDigm Group INC

ticker: TDG


text: The Company regularly evaluates its cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise in consultation with members of our senior management team. On an as needed basis, the Company engages external advisors and consultants to assess our internal cybersecurity programs and compliance with applicable regulatory requirements and industry standards have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Standard provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which includes our CIO, Chief Executive Officer, Chief Financial Officer, and outside legal counsel, would respond to such incident in accordance with our Cybersecurity Incident Response Standard. Any cybersecurity incident that is designated by the CIRT with a "High"

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: At the management level, our cybersecurity program is managed by our CIO, reporting into the executive leadership team. Our CIO has over 30 years of experience managing IT operations and cybersecurity within the pharmaceutical, biotechnology and high-tech industries.

companyName: Verastem, Inc.

ticker: VSTM


text: We are a special purpose acquisition company with no business operations and therefore, prior to the completion of a business combination, do not have any operations of our own that face cybersecurity threats. Since our initial public offering, our sole business activity has been identifying and evaluation suitable targets for a business combination. Therefore, the Company does not consider that it faces significant cybersecurity risk and has not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board of directors is ultimately responsible for overseeing the Company's risk management activities in general and will be informed, promptly and as deemed necessary by our management team, of any cybersecurity threats or risks that may arise, cyber incidents and industry trends, including regarding the appropriate disclosure, mitigation, or other response or actions that our board deems appropriate to take. As of the date of this Report, the Company did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy and results of operations. However, any such attack could adversely affect our business. We depend on the digital technologies of third parties and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. A penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. For more information about the cybersecurity risks we face, see the risk factor entitled " Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss. " in " Item 1A. Risk Factors—General Risk Factors. "

companyName: Oaktree Acquisition Corp. III Life Sciences

ticker: OACC


text: We sustained a cybersecurity attack in May 2022 involving ransomware that caused a network disruption and impacted certain of our systems. Upon detection, we undertook steps to address the incident, including engaging a team of third-party forensic experts and notifying law enforcement. We restored network systems and resumed normal operations. The Company did not pay any ransomware and the attack did not materially affect the Company's business strategy, results of operations, or financial condition. We have taken actions to improve our existing systems such as adding multi-factor authentication and to improve employee training and security competency. We have not identified any other cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Please refer to our Risk Factors in Item 1A for more information on the risks associated with cybersecurity attacks.

companyName: AIR T INC

ticker: AIRT


text: The CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CISO and CTO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Tempus AI, Inc.

ticker: TEM


text: The Company's Audit Committee has the responsibility to review and discuss with management the Company's guidelines, policies, and governance with respect to financial risk exposures and ERM, including with respect to cybersecurity, and to report to the Board annually. The Audit Committee is also responsible for overseeing the integrity and effectiveness of the Company's disclosure controls and procedures, which are designed to ensure that information related to cybersecurity risks and incidents is recorded, processed, summarized, and reported accurately and on a timely basis, to allow for timely decisions regarding disclosure of any such incidents. Our Audit Committee receives regular presentations and reports on cybersecurity risks from the executive management leadership team, which address recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee is also made aware of any potential material cybersecurity incident as well as ongoing updates regarding any such incident until it has been addressed by the executive management leadership team. On an annual basis, the Board discusses the Company's approach to cybersecurity risk management with the Audit Committee members and management (including members of the Cybersecurity Committee). Throughout the year, the Board and its committees engage with management to discuss a wide range of enterprise risks related to the Company's businesses, including cybersecurity, and they confirm the alignment of risk assessment and mitigation with business strategy.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, business continuity planning, brand management, and other relevant matters.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: The IRP generally is overseen by our Incident Response Team ("IRT"), which has designated an Incident Response Team Coordinator ("IRTC"). The IRTC is responsible for maintaining the IRP as well as testing and reporting to the appropriate internal committees, and our Board and its designated committee. Our Information Security Officer is the primary IRTC, however, if necessary we may assign the specific IRTC duties to a different staff member (technical staff or outsourced vendor if appropriate) for specific matters.

companyName: CapStar Financial Holdings, Inc.


text: Our Audit Committee works with members of our management to identify and manage these risks, including cybersecurity risks. We currently outsource a qualified Information Technology Administrator who reports to our Chief Executive Officer. This consultant has over 25 years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management. Our Information Technology Administrator regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. To the extent necessary, our Chief Executive Officer reports such risks to our Board of Directors.

companyName: RenovoRx, Inc.

ticker: RNXT


text: See also " Item 1A. Risk Factors – Risks Related to our Business and Industry – We rely on information technology systems and any inadequacy, failure, interruption or security breaches of those systems may harm our reputation and ability to effectively operate our business ".

companyName: U.S. GoldMining Inc.

ticker: USGO


text: Procedures Governing our Cybersecurity Incident Responses. Our multi-layered, cross-functional approach to cybersecurity governance provides adequate checks and balances on the implementation of our cybersecurity protocols, enables us to effectively monitor both internal and external cyber risks, and allows for the swift escalation of any potential cybersecurity incidents to the appropriate levels of management so that assessments concerning materiality, potential disclosure, and possible responsive actions can be timely made. Our approach to cybersecurity governance is modeled in the Incident Response Team (IRT) that we have established to timely address cybersecurity incidents and minimize any disruptions to our business operations and customer activities caused by cyber threats or attacks. Designated IRT personnel are available 24 hours per day, seven days per week to respond to potential incidents. Having an integrated team for incident response facilitates information sharing, which allows organizational personnel, including developers, implementers, and operators, to leverage the team knowledge of the threat in order to implement defensive measures that will deter intrusions more effectively. In the event of a potential cybersecurity incident, our IRT is responsible for implementing our Security Incident Response Policy, in accordance with which the following steps occur:

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: The Audit and Risk Committee and management's Cyber Governance Committee receive regular reports from our CIO and CISO on our information security program including our top cybersecurity risks, cybersecurity strategy, information system controls and related security measures and improvements, cyber incident response plan, cyber incidents and cyber defense metrics, and cyber security protocols and trainings. These regular reports also are shared with the full Board of Directors.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.

companyName: SHOREPOWER TECHNOLOGIES INC.

ticker: SPEV


text: The InfoSec Leadership Team is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such material cybersecurity incident.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: The current cyber threat environment presents increased risk for all companies, particularly companies in our industry, as the volume and intensity of cybersecurity attacks on hospitals and health systems has continued to increase. We are regularly the target of cybersecurity attacks and other threats that could have a security impact, and we have experienced security incidents from time to time.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Third-Party Vendor Risk Management Our Vendor Risk Management (VRM) program supports PTC in meeting its cybersecurity, privacy, regulatory and compliance obligations and managing risk associated with third-party vendors who have access to PTC IT systems and data. Prior to outsourcing or allowing third-party access to PTC or customer systems, IP, or data; risks associated with such activity are clearly identified and documented. The process of selecting a third-party vendor includes due diligence of the vendor service or product in question. Third-party companies using PTC facilities or accessing PTC's IT Systems are subject to PTC's VRM review and are required to demonstrate that proper security measures are in place before they have access to any PTC IT systems or data. All such vendors are to be approved by PTC's VRM process and contractually bound to maintain appropriate cybersecurity technical and organization measures and to protect PTC's data to which they may have access.

companyName: PTC INC.

ticker: PTC


text: Encryption of computing systems To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems.

companyName: Vivani Medical, Inc.

ticker: VANI


text: Oversight of Third-party Risk The Company's Third-Party Relationship Risk Management ("TPRM") Policy governs of all aspects of third-party risk management. The Board has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to the Audit Committee and management regarding the Company's strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews the TPRM Policy on at least an annual basis and ensures that appropriate implementation procedures and practices have been established by management. The Chief Risk Officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Company's strategic goals, risk appetite and the level of risk and complexity of its third-party relationships. The Chief Risk Officer periodically provides reports to the Audit Committee on third-party risk management activities. The Company's Internal Audit department determines the frequency and scope of independent third-party audits of the TPRM program and its effectiveness.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Cyber Security Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: With respect to incident response, we have adopted a Cybersecurity Incident Response Plan that applies in the event of a significant cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: Innovex International, Inc.

ticker: INVX


text: We believe cybersecurity is a critical part of our overall risk management and key to enabling our digital operations. As a company that heavily relies on our website to buy and market powersports, we face a multitude of cybersecurity threats common to most industries, such as phishing/malware, ransomware and denial-of-service, as well as threats common to retailers, such as theft of customer and employee data. Our customers, suppliers, and subcontractors face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats necessitate an appropriate focus on cybersecurity.

companyName: RideNow Group, Inc.

ticker: RDNW