text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. We assess ourselves against the National Institute of Standards and Technology Cybersecurity Framework, Payment Card Industry Data Security Standard and management's defined technology controls to support internal controls over financial reporting. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness, including network penetration assessments. The results of such assessments, audits, and reviews are reported to the Audit Committee of the Board and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Corporation, including its business strategy, results of operations or financial condition.

companyName: UNION CARBIDE CORP /NEW/

secItem: Item 1C


text: We have not identified risks from known cybersecurity threats within the prior fiscal year, including as a result of any prior cybersecurity incident, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Please refer to "Item 1A, Risk Factors" in this report for additional information about certain ongoing risks related to our information technology that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Management is responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our Chief Operating Officer ("COO") who serves as the chairman of the security steering team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. The security steering team also includes the leadership of our Information Technology ("IT") team. The IT team consists of seasoned security professionals well-versed in emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents. Precigen also employs the use of cybersecurity vendors to actively monitor and remediate cybersecurity threats and incidents. Management, including the COO, regularly updates the board of directors on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity updates. Such updates cover, among other topics, third-party assessments of the Company's cybersecurity programs, developments in cybersecurity and updates to the Company's cybersecurity programs and mitigation strategies.

companyName: PRECIGEN, INC.

ticker: PGEN


text: We maintain an information security program with a dedicated internal team that is tasked with leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our information security team is responsible for identifying, assessing, managing, and responding to cybersecurity risks, threats and incidents relating to the protection of our information assets, systems, and operations. The information security team also oversees the detection, prevention, mitigation, and remediation of all cybersecurity incidents.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: To enhance our defense mechanisms, we leverage third-party edge security tools. These tools play a crucial role in actively monitoring and mitigating potential threats to our sites and products, which we believe contributes to our security infrastructure. Our development teams also use proactive measures such as "Security as Code" to make sure that vulnerabilities are protected against at a deeper level, in addition to cloud-based security tools.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's chief executive officer and board of directors. The Company engages information technology "managed service providers" (MSPs) to manage the Company's computer and information systems at its three office locations and remote locations. The MSPs are responsible for evaluating and testing the Company's risk management systems and assessing and remediating potential cybersecurity incidents as appropriate.

companyName: BIOLARGO, INC.

ticker: BLGO


text: The Technology Committee and ORC, as appropriate, receive regular and prompt information from the Information Security area as reported by the ISO, which in turn provide periodic, regular and prompt reporting to the SRMC and SOMC on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted FHLBank, as applicable and needed. The SRMC and SOMC may escalate reporting as applicable and needed to the Executive Team or board of directors.

companyName: Federal Home Loan Bank of Topeka


text: Management considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. Once established, the cybersecurity governance committee will oversee the management's implementation of the cybersecurity risk management program.

companyName: High Roller Technologies, Inc.

ticker: ROLR


text: Protecting information, including that of our clients, is a top priority. Our overall cybersecurity and privacy strategy is to protect our customers' information and assets as well as ours to enable agility in the business. We have expertise, dedicated resources and technology to identify, assess, respond to and mitigate material risks from cybersecurity threats. Our Global Information Security organization (GIS), led by our Chief Information Security Officer (CISO), manages Unisys' cybersecurity risk identification, detection, assessment, response, mitigation and remediation processes, and interfaces with other departments, including business units, the information technology and legal departments, and enterprise risk management, to facilitate the risk management processes and ensure the policies and procedures established by GIS are integrated into our overall enterprise risk management system. GIS processes also work in tandem with the processes maintained by our Global Privacy Office (GPO).

companyName: UNISYS CORP

ticker: UIS


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform pre-engagement assessments for all third-party service providers based on the sensitivity of the data that will be handled and stored by that third-party service provider. Annually, we review Service Organization Control (SOC) 1 or 2 reports for certain outsourced service providers whose systems are utilized in processing and recording company or employee data.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: As part of the Company's enterprise risk management program, the Company maintains a comprehensive information security program that is designed to identify, protect against, detect and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program. We consult the National Institute of Standards and Technology Cyber Security Framework for guidance and leverage internal and external resources to design and execute our cybersecurity program.

companyName: Wingstop Inc.

ticker: WING


text: How the Enterprise Risk Committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents The Enterprise Risk Committee meets on a regular basis at least quarterly to review and assess the Company's cybersecurity threat risk and other risk posture, new controls and initiatives to prevent or mitigate cybersecurity threat risks and potentially evaluate relevant Company policies. Where appropriate, other managers and personnel participate in Committee meetings. Members of the Committee inform the Board, as noted above.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: These threats include but are not limited to ransomware and malware attacks, and compromised business email and other social engineering threats. Our suppliers, customers, contractors and business partners also face similar cybersecurity risks, which could have an adverse impact on our business. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - While we are not aware of any data breach in the past, future cyberattacks, computer viruses or any failure to adequately maintain security and prevent unauthorized access to our information technology system or data could result in a disruption of our business operations and materially adversely affect our reputation, financial condition and operating results."

companyName: Fortune Valley Treasures, Inc.

ticker: FVTI


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. All personnel are made aware of our cybersecurity policies through trainings.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Pursuant to its charter, the audit committee of our board of directors is responsible for the oversight of management's efforts to address cybersecurity risk. Management reports to the audit committee on cybersecurity risk matters periodically, typically twice annually. These reports normally address matters such as: the evolving cybersecurity risk environment and the emergence of new threats; outcomes and learnings from penetration testing, security audits or vulnerability assessments; evaluation of existing controls, tools and procedures and progress on implementation of any new initiatives to manage and mitigate cybersecurity risk. In addition, members of our board of directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: OMEROS CORP

ticker: OMER


text: The company maintains strategic relationships with third-party cybersecurity experts and coordinates with various law-enforcement partners, each of whom may be engaged to provide additional investigative and remediation support. The company's senior security leadership conducts periodic, in-depth reviews with the company's enterprise risk management team and internal and external auditors to evaluate the effectiveness of the company's cybersecurity systems, controls, and management processes.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: Our CISO, CRO, CIO, and Head of Internal Audit have nearly seven decades of combined work experience, including six decades in banking and financial services risk management and information security roles, and maintain several industry licenses and certifications through continuing professional education.

companyName: Capital Bancorp Inc

ticker: CBNK


text: We have a cybersecurity incident response and crisis management plan in place, which incorporates regular training and simulation exercises, including with senior management, to ensure readiness and efficacy in responding to cybersecurity incidents. Our incident response and crisis management plan coordinates the activities we will take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate reputational damage.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Our CDIO leads the Company's digital optimization and information technology initiatives. He is also responsible for driving the strategy, execution and integration of all banking and nonbanking technology, information and digital initiatives in alignment with the Company's corporate business strategy. Our CDIO assumed his current role in January, 2022. Prior to that, he served as the Company's Senior Vice President of Technology and Operations, where he lead the Company's core processing and operations functions, and the development of technology-driven products and services. Our CDIO has over 20 years of technology and operations experience in the banking industry.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC


text: We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks from nation state actors that might target our ecosystem through specific industry verticals. Any such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially adversely affect our business strategy, financial condition, performance, our brand and results of operations.

companyName: EPLUS INC

ticker: PLUS


text: When appropriate, we work with consultants or other third parties as part of our risk assessment processes. These partnerships are used to create and execute cybersecurity policies and procedures, including the notification of potential incidents. We ask key third-party service providers to confirm that they apply and keep appropriate cybersecurity measures in line with all relevant laws, to apply and keep reasonable cybersecurity measures when they work with us, and to promptly report any possible breach of their cybersecurity measures that could impact our Company.

companyName: Global Clean Energy Holdings, Inc.


text: Internal and third-party risks are reviewed, monitored, and managed by the Company's Cybersecurity and Privacy teams, audited by an Internal Audit team and various external experts, and tracked within an Enterprise Risk Management framework. The Company regularly engages third-party experts to assess the effectiveness of its cybersecurity programs. Biennially, an external independent consultancy team conducts a comprehensive review of the Company's cybersecurity program using the NIST Cybersecurity Framework. Targeted assessments are conducted regularly by internal and third-party experts to ensure compliance with specific federal and state laws and regulations. Additionally, the Company is assessed annually by an independent third party for compliance with the PCI-DSS standard, for which the Company receives an attestation of compliance.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, centralized log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage.

companyName: Guardant Health, Inc.

ticker: GH


text: Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, compromise personally identifiable information regarding customers or employees, delay our ability to provide critical services to our customers, and/or jeopardize the security of our facilities. We continuously seek to maintain a robust program of information security and controls, but the impact of a material information technology event could have a material adverse effect on our competitive position, reputation, results of operations, financial condition and cash flows. Governance.

companyName: ModivCare Inc

ticker: MODVQ


text: We also maintain an Executive Cyber Incident Escalation Team ("ECIET"), which consists of our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Senior Vice President - General Counsel, Chief Information Officer ("CIO") and the Chief Information Security Officer ("CISO"). The ECIET meets annually to practice and refine our processes through tabletop exercises simulating cyberattacks for incident response, management and escalation at both technical and executive levels in order to maintain readiness to respond and to identify any areas where improvements or updates to our cybersecurity infrastructure or procedures are required.

companyName: MOOG INC.

ticker: MOG-A


text: To facilitate the success of our cybersecurity risk management program, the CSIRT is composed of multidisciplinary teams throughout Redfin who are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The audit committee consists of at least three members of the Board. The ISSC includes our chief financial officer ("CFO"), our chief legal officer ("CLO"), and other key leaders across the company. Our chief technology officer ("CTO") oversees our security team. Our CFO has over 30 years of experience managing risks at Redfin, Zappos, Amazon (Home and Garden), Bain & Company and Accenture, including risks arising from cybersecurity threats. Our CLO has 16 years of experience managing risks, including risks arising from cybersecurity threats. Our CTO has over 24 years of experience, including experience managing risks arising from cybersecurity threats across several industries to include health care and business solutions.

companyName: Redfin Corp


text: In addition, our management team has established an internal Cyber Steering Committee (the "Cyber SteerCo"), which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks facing us, including cybersecurity risks. Each of the CDIO/CISO and PDSI/CISO sit on the Cyber SteerCo along with the our General Counsel and former CISO.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: The Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Our executive leadership team regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.

companyName: BioCardia, Inc.

ticker: BCDA


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Cybersecurity risks and cybersecurity incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results."

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: Our Chief Information Officer, who oversees our cybersecurity team, is responsible for assessing and managing our material risks from cybersecurity threats (as such term is used and defined in Item 106(a) of Regulation S-K). The Chief Information Officer and our cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel dedicated to cybersecurity as well as our engaged and retained external cybersecurity consultants. Our cybersecurity team is supported by the information technology department as well as our engaged third parties and our retained service providers and, in addition, is informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Officer has over 20 years of experience in managing large-scale information technology infrastructure and associated technologies and other members of our cybersecurity team have experience and certifications relevant to cybersecurity. In addition, all personnel involved in cybersecurity engage in regular training on cybersecurity matters.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Cybersecurity incidents are responded to in accordance with the Company's established Cybersecurity Incident Response Plan ("IRP"). In the event of an incident, we follow our IRP, which includes evaluation of the severity of the incident based on factors such as the number of assets affected, the extent of the incident, the likelihood of inappropriate data exposure, operational impact and/or reliability impact. Dependent upon the severity of an incident, the incident is escalated to the senior leadership, including the CEO and senior leadership. Senior leadership then determines whether, based on various factors, the incident requires immediate escalation to the Board of Directors and to third -party incident response organizations and notification to functional areas, such as legal and finance, as well as senior leadership and the Board, and external entities, as appropriate and required. We maintain relationships with third -party Digital Forensics and Incident Response ("DFIR") service providers to strengthen our incident response capabilities in the event that we determine the need to augment our effort during an incident and to provide us additional assurance that our responses to complex incidents or highly sophisticated threat actors have been effective and complete.

companyName: TUCOWS INC /PA/

ticker: TCX


text: As detailed above, the CISO and the information security team regularly assess and manage cybersecurity risks. Voya's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. The CISO, who oversees the organization supporting the day-to-day operations of our information security program, brings over 30 years of professional IT experience in financial services. Before assuming his current role, the CISO served as Voya's Chief Technology Officer, where he was responsible for our infrastructure, cloud, and business resiliency office. Additional management of cybersecurity risks is conducted by Voya's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya.

companyName: Voya Financial, Inc.

ticker: VOYA


text: We maintain a cybersecurity program overseen by the Vice President, Information Technology that uses a risk-based methodology to support the security, confidentiality, integrity and availability of our information. The security of our field infrastructure and corporate network is a priority for our business. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. Our cybersecurity program utilizes a combination of automated tools, manual processes and third-party assessments with the goal of identifying and assessing potential cybersecurity risks.

companyName: Chord Energy Corp

ticker: CHRD


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has over 95 years of combined experience in IT and cybersecurity matters.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risks titled "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation or mass arbitration demands; fines and penalties; disruptions of our business operations; reputation harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Hudson Acquisition I Corp.


text: The CTO is responsible for managing our information security team to ensure they are assessing and managing cybersecurity risks in accordance with our processes and procedures. Our CTO has over 25 years' experience managing enterprise information technology systems.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Operations and a cross section of subject matter experts from Information Technology, Exensio Cloud Operations and Corporate Legal and team. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, data privacy risks and regulatory frameworks, developing cybersecurity strategy, implementing effective information and cybersecurity programs and experience in security controls testing and the planning and executing of independent cybersecurity assessments.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Cyber Risk Management and Strategy We rely on information technology systems that we or our third-party providers operate to process, transmit and store electronic information in our day-to-day operations. To help protect against risks from cybersecurity threats to these systems, we have implemented cybersecurity processes in accordance with our risk profile and business that are designed to identify, assess, and manage cybersecurity risks.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Our business strategy, results of operations, and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Item 1A, Risk Factors" in this Annual Report.

companyName: TaoWeave, Inc.

ticker: TWAV


text: The Board of Directors has responsibility for oversight of risks from cybersecurity threats. The Board receives a quarterly report from the Chief Information Officer and Chief Information Security Officer on risks from cybersecurity threats and, under the Company's incident reporting plan, the Board is informed by management of certain cybersecurity incidents as appropriate. In 2024, the Board participated in a facilitator-led training and simulation of an information security incident.

companyName: Primerica, Inc.

ticker: PRI


text: While we and our third-party vendors have experienced cybersecurity incidents, as well as adverse impacts from such incidents, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the firm, including our business strategy, results of operations, or financial condition. However, due to the evolving threat environment, we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third parties, will not have a material adverse impact on the firm, including its business strategy, results of operations, financial condition, and/or reputation. See Item 1A - Risk Factors of this Form 10-K for additional information on our cybersecurity risks.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Additionally, we assess our cybersecurity maturity annually and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed. We also execute employee cybersecurity training and awareness programs around various key cybersecurity topics, including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access and removable media.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and supply chain resources. We have a vendor management process to manage cybersecurity risks associated with certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of diligence designed to help identify cybersecurity risks associated with a provider such as risk assessments and reviewing security assessments and reports.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. The Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management methodology. Our Board and the Audit Committee receives periodic updates from our Chief Financial Officer and more frequently as needed, regarding the overall state of our cybersecurity preparedness, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents. The Audit Committee and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.

companyName: SurgePays, Inc.

ticker: SURG


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes, including by prioritizing our risk management processes and mitigating cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: PagerDuty, Inc.

ticker: PD


text: Microvast utilizes a set of policies, procedures, and technologies designed to prevent, detect, respond to, and recover from cybersecurity threats and incidents. These policies, based on the NIST Cybersecurity Framework, are regularly reviewed and updated to integrate industry best practices. Internal control evaluations are conducted routinely to ensure compliance and address any identified vulnerabilities.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator, and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, tests on our systems, review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including IT consultants and computer security firms, to enhance our cybersecurity oversight including by gaining valuable insights into the ever-evolving cybersecurity landscape. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: Our cybersecurity strategy is integrated into the company's broader enterprise risk management framework, ensuring that cybersecurity considerations are an integral part of decision-making at all levels of the organization. We collaborate with external experts, including cybersecurity assessors and vendors, to continuously evaluate and enhance our security posture and conduct regular risk assessments, penetration testing, and security audits.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: The Company's management team is responsible for the day-to-day assessment and management of cybersecurity risks. As mentioned above, a dedicated CISO leads the information security team and is responsible for the Company's cybersecurity risk management and strategy. The CISO has an MBA from Northwestern University's Kellogg School of Business, a master's degree in electrical and computer engineering from the University of Alberta and more than 20 years of experience in information security and risk management with companies in various sectors. The CISO reports to the CIO, who is responsible for global IT strategy and IT operations across the enterprise. The CIO has a degree in computer science and mathematics from Wofford College and has over 30 years of experience in the IT industry, spanning various roles and sectors.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. Responsible personnel regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.

companyName: Aditxt, Inc.

ticker: ADTX


text: Adtran maintains a cybersecurity governance structure led by its Information Security Management "ISM" team, which oversees the Company's cybersecurity risk management efforts. The ISM team ensures that appropriate controls are in place to protect Adtran's corporate assets, ensuring their availability, confidentiality, and integrity. This risk management approach informs strategic decision-making, resource allocation, and oversight mechanisms. The governance of Adtran's cybersecurity program is ultimately the responsibility of the Board of Directors, with the Audit Committee providing critical oversight through regular reviews and periodic updates at least quarterly, or more frequently as needed.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: Cybersecurity Risk Mitigation As one of the critical elements of our overall approach to compliance and risk management, our cybersecurity program is focused on the following key areas:

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Through policy and practice, classify information, restrict access, and require employees to treat sensitive data with care; and Conduct an annual employee training program, including regular phishing email simulations for all employees with access to corporate email systems to enhance awareness and responsiveness to such possible threats.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect and respond to cybersecurity threats, including threats associated with the use of third-party service providers, the Company has a robust cybersecurity program. The Company's global cybersecurity team, overseen by the CIO, implements policies and procedures and uses a balanced approach to validate the effectiveness of the program, leveraging third party expert security resources, information technology resources, executive business leadership, internal and external audit, third-party vendors and other IT and business partners. The program uses a combination of standards and best practices from the National Institute of Standards and Technology, Center of Internet Security, third-party vendor partners, and other industry forums. Annually, the program is assessed both internally and externally, including a thorough industry benchmarking, maturity assessments, best practice reviews, and risk assessments, with control validation occurring monthly internally (focused on core critical controls), quarterly (focused on vulnerabilities/cyber-incident simulations) and annually (focused on a review of best practices) via third-party vendors and partners, and annually via external third parties, including the conduct of internal/external penetration tests and tabletop exercises. Third-party service providers are assessed initially based on security questionnaires and the access of third-party service providers is audited annually and/or with any change in circumstances. Third-party service providers are also monitored through a combination of security information and event management technology and managed detection response services. The CIO provides key results and findings from these assessments to the cybersecurity governance council and Audit Committee. The Company has a robust incident response plan intended to help provide timely remediation to cybersecurity incidents and also to help provide notice of any material incidents to the appropriate internal and external entities.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient and customer data (Information Systems and Data).

companyName: Beta Bionics, Inc.

ticker: BBNX


text: Board regularly receive reports on such matters from our Information Security committee. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: The Audit and Risk Committee (the "ARC") has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The ARC reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Management regularly discusses cyber risks and trends and, should they arise, any material incidents with the ARC. Members of management overseeing cybersecurity threats report to our Chief Executive Officer and have experience in areas including management of information technology, data security, and cybersecurity.

companyName: T1 Energy Inc.

ticker: TE


text: The Company's Chief Technology Officer reports to the Executive Vice President – Operations. In addition, as discussed in more detail below, any cybersecurity incident is reported to the Company's legal department. While the Company's Executive Vice President – Operations and the members of its legal department do not have a technology services background, we believe that the Company's Chief Technology Officer and technology services team possess the requisite background and experience to effectively manage the Company's cybersecurity needs.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: We have in the past experienced, and may in the future experience, adverse impacts to our business strategy, operating results, and/or financial condition as a result of cybersecurity incidents. However, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business or our financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses under consumer protection laws or other laws or common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations."

companyName: Alteryx, Inc.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors."

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: We utilize a range of internal and external resources to assess and identify cybersecurity threats and vulnerabilities. We access and utilize information drawn from a range of publications, reports and services to assess our cybersecurity risk profile, develop awareness of emerging cybersecurity threats and threat actors and identify risk factors that are particularly relevant to the biotechnology and pharmaceutical sector and to our company. We also work with third parties that assist us to identify, assess and manage cybersecurity risks, including external auditors, consulting firms, managed security service providers and penetration testing firms.

companyName: OMEROS CORP

ticker: OMER


text: The Company relies upon internally and externally managed information technology systems and networks for the collection and storage of sensitive data and business information. Accordingly, the Company places an emphasis on managing cybersecurity risks by means of a comprehensive risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to the Company's business.

companyName: ENVIRI Corp

ticker: NVRI


text: Cyberattacks represent a potentially significant risk to the Partnership and our industry. We have implemented policies and procedures that are intended to manage and reduce this risk, including those managed by affiliates of Cheniere through our service agreements with them, as further discussed in Note 13—Related Party Transactions of our Notes to Consolidated Financial Statements.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: The Chief Technology Officer of Brighthouse Financial (the "CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity program. The Chief Information Security Officer of Brighthouse Financial (the "CISO") is directly responsible for the Brighthouse Financial cybersecurity program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. The CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; the CISO has over 30 years of information technology and cybersecurity program management experience. Prior to joining Brighthouse Financial, both the CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity programs at other public companies in the financial services industry. In addition, the CTO serves on a cross-departmental, management-level risk committee that oversees Brighthouse Financial's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect Bio-Techne, including our business strategy, results of operations or financial condition. However, please see Item 1A. Risk Factors – "A significant disruption in, or breach of security of, our information technology systems or data, or violation of data privacy laws, could result in damage to our reputation, data integrity and/or subject us to costs, fines, or lawsuits under data privacy or other laws or contractual requirements."

companyName: BIO-TECHNE Corp

ticker: TECH


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Cybersecurity threats, such as threats of attacks from computer hackers, cyber criminals, nation-State actors and other malicious internet-based activity, continue to increase. Cybersecurity threats may also include threats of attacks involving social engineering and cyber extortion to induce customers, contractors, business partners, third-party service providers, employees and other third parties to disclose information, transfer funds or unwittingly provide access to systems or data.

companyName: DIODES INC /DEL/

ticker: DIOD


text: At the management level, the Enterprise Risk Management Committee (the "ERMC") is primarily responsible for cybersecurity risk management. As it pertains to the information security program, the ERMC assesses and monitors information security risks and approves the information security policy on at least an annual basis. Certain instances of non-compliance with the information security policy are escalated to the EMRC, which may further escalate to the TOC as appropriate. Once escalated to a committee, the committee is responsible for overseeing related remediation.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Engagement with External Experts The Company engages top-tier external cyber security firms as needed and leverage their expertise. This is part of our ongoing effort to evaluate and enhance our cybersecurity program. The information security strategy includes assessments conducted by third parties and the engagement of specialized services for specific tasks, including:

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: The Audit Committee of the Board has direct oversight, regularly reviews reports on cybersecurity risks and vulnerabilities. The Audit Committee is informed about risk assessments, progress of risk reduction initiatives, and feedback from external auditors. Our chief compliance & audit officer ("CCO/CAO") and his direct report, chief information security officer ("CISO"), have primary responsibility for assessing and managing material cybersecurity risks. The CCO/CAO reports to the Audit Committee, which is the primary governing body that drives alignment on security decisions across the Company. The Audit Committee meets at least four times a year on cybersecurity and such meetings are attended by the CCO/CAO, CISO, in-house counsel, chief financial officer ("CFO"), corporate controller, associate general counsel, and other senior company executives as needed to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Audit Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: We have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, but we cannot guarantee that we will not be materially affected in the future by such risks or any future cybersecurity incidents. For more information, see "Part I, Item A. Risk Factors—Risks Related to Legal and Regulatory Compliance—We may be adversely impacted by a disruption or failure of our information technology infrastructure, data security breach, or failure to comply with privacy laws."

companyName: Solid Power, Inc.

ticker: SLDP


text: We identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and conducting risk assessments.

companyName: SOCIETY PASS INCORPORATED.

ticker: SOPA


text: Company's cyber risk management strategy has consisted of a focus on minimizing our attack surface and leveraging industry standard cyber threat prevention, detection, and remediation tools. The Company assesses cyber security risk as follows: have executed this strategy with a cloud-first approach, awareness training, and deliberate use of well-established vendors for software and hardware solutions.

companyName: BOXABL Inc.


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing our (i) cybersecurity risk assessment processes, (ii) security controls and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers and vendors, which includes a rigorous vetting process and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.

companyName: ALEXANDERS INC

ticker: ALX


text: Our CSO seeks to regularly obtain information about relevant developments in cybersecurity, including potential threats and risk management techniques to help shape our approach to preventing, detecting, mitigating, and remediating cybersecurity threats. Our CSO is also responsible for implementing and overseeing processes for regularly monitoring our information systems and data, including the conducting of periodic audits of certain systems to identify potential vulnerabilities. The CSO reports directly to our Co-Chief Executive Officer and Chief Operating Officer and provides regular updates to our Co-Chief Executive Officer and Chief Financial Officer and CLO on certain cybersecurity risks and incidents.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: key components of our future cybersecurity program will include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;

companyName: Idaho Copper Corp

ticker: COPR


text: Our Director of Information Technology Infrastructure and Operations, who reports to the Chief Financial Officer, is primarily responsible for assessing and managing material risks from cybersecurity threats. Our Director of Information Technology Infrastructure and Operations has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity resources. Our Director of Information Technology Infrastructure and Operations' experience includes information systems architecture, operations, cybersecurity, and data privacy protection.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: Our cybersecurity risk is affected by cyber threats that are proliferating and advancing their ability to identify and exploit vulnerabilities, requiring continuous evaluation and improvements to our security architecture and cyber defenses. We also face increased cybersecurity risk as we deploy additional mobile and cloud technologies. We are continuously hardening our infrastructure built on these technologies, monitoring for threats, and evaluating our capability to respond to any incidents to minimize any impact to our systems, data, or business operations. Because we service clients across multiple industry verticals — many of which are higher-profile cyber targets themselves — including financial services, technology, government institutions, healthcare and life sciences, this also may increase the risk that we are subject to cyber-attack incidents.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have had a material adverse effect or are reasonably likely to have a material effect on our business strategy, operations or financial condition.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our monitoring capabilities, including our internal auditing procedures, internal control over financial reporting and corporate compliance programs, are designed in part to inform management about our material risks, including those related to cybersecurity risks. In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information assets, and our risk management systems, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery or data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. Although the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CIO or another member of the cybersecurity executive steering committee and will include other information technology and legal personnel. In the event of a potentially material incident, the incident response team regularly reports to both the Company's Board and members of senior management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer to assist in making determinations regarding applicable SEC reporting requirements.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: Our board of directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Our management reports to our board of directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Jet.AI Inc.

ticker: JTAI


text: See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.

companyName: International Seaways, Inc.

ticker: INSW


text: As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to our company, including to our business, financial condition, and results of operations. There is no assurance that our cybersecurity risk management program will prevent cybersecurity incidents from having such impacts in the future.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Engagement with External Experts The Company engages top-tier external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cyber defense capabilities (including staff enhancement of certain functions) and transformation to mitigate associated threats, reduce risk, enhance our cybersecurity posture, and meet the Company's evolving needs.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: We have a documented Third-Party Risk Management Policy and Program to ensure that our vendor relationships are assessed, monitored and documented appropriately. It is our policy to exercise appropriate oversight and risk management of the activities conducted through significant third-party relationships, taking into consideration the nature, magnitude, complexity and risk potential of the arrangement. Vendors are monitored for cybersecurity issues during the initial onboarding processes and on an ongoing basis. We may review or require a SOC 2 Type 2 report, cybersecurity controls, cyber insurance and monitoring frequency depending on our assessment of the risk of any vendor.

companyName: Sterling Bancorp, Inc.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages our day-to-day operations and has implemented a cybersecurity program that applies to us and our operations.

companyName: Muzinich BDC, Inc.


text: Insider Threats: Employees or contractors with access to systems might intentionally or unintentionally compromise security disrupting water supply and treatment processes or other utility services. Denial of Service Attacks: Attackers can overwhelm systems with traffic, rendering them unavailable and disrupting water services.

companyName: YORK WATER CO

ticker: YORW


text: Our processes also address cybersecurity threat risks associated with our selection and oversight of third-party service providers, including our suppliers and manufacturers or those who have access to patient and employee data or our systems. We generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: As part of the oversight process, the Risk Committee has the following responsibilities, among others: • reviews and advises on our cybersecurity and operational risk strategy, resiliency, crisis and incident management, and security-related information technology planning processes, and reviews strategy and implementation for investing in related systems, controls, and procedures with management; • reviews our compliance with applicable global data protection and security laws and regulations, and the Company's adoption and implementation of systems, controls and procedures designed to comply with such laws and regulations; • reviews plans for periodic assessments and related findings and remediation of our cybersecurity and operational risk and incident response and disaster recovery programs by outside professionals; • reviews analyses of our cybersecurity and operational risks by management and third parties, as applicable; and • evaluates our disclosure controls and procedures related to cybersecurity to ensure timely and accurate reporting of cybersecurity and operational risks and incidents, as appropriate.

companyName: F5, INC.

ticker: FFIV


text: Our IT Officer oversees the day-to-day management of the Company's cybersecurity risk management program. Our IT Officer has over 15 years of experience in IT leadership and has managed IT for our company for approximately 10 years. Our IT Officer reports to our Chief Operating Officer and Chief Financial Officer and is a member of our Compliance Committee. Our IT Officer coordinates with our legal department and relevant third parties, such as consultants and external legal advisors, to assess and manage material risks from cybersecurity threats. Our IT Officer is also supported by a cross-functional incident response team, which is empowered to review, assess, report, monitor and take action to mitigate or remedy any cybersecurity incidents pursuant to our business continuity and incident response plan. Our IT department further supports and has dedicated resources to assist our IT Officer in monitoring, preventing, detecting, mitigating, and remediating any cybersecurity incidents pursuant to our policies and procedures.

companyName: TELA Bio, Inc.

ticker: TELA


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as the personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.

companyName: ENB Financial Corp

ticker: ENBP


text: We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented certain technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. We have also implemented an Incident Response Plan and procedures that provide us with a framework for responding to cybersecurity incidents. The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s), all as appropriate depending on the nature of the incident. The Incident Response Plan is reviewed and updated, as necessary, under the leadership of Zoom's Chief Information Security Officer ("CISO").

companyName: Zoom Communications, Inc.

ticker: ZM


text: Our board of directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks, including cybersecurity risks. The board of directors receives regular updates on cybersecurity and information technology matters and related risk exposures from our executive team.

companyName: GAXOS.AI INC.

ticker: GXAI


text: The Cybersecurity Risk Management section within our 2023 MD&A (Item 7), beginning on page 86 of this report, is incorporated herein by reference.

companyName: FIRST HORIZON CORP

ticker: FHN


text: Our Chief Executive Officer and Chief Accounting Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: TRANS LUX Corp


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. Additional training mechanisms we may use to assess, identify, and manage risks from cybersecurity threats, include simulations, tabletop exercises and response readiness tests to test our preparedness and incident response process. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.

companyName: HERSHEY CO

ticker: HSY


text: In the event of a cybersecurity incident, the incident response team is responsible for following the steps outlined in our Advisor's incident response plan, including notifying our Audit Committee and Board, as appropriate.

companyName: Net Lease Office Properties

ticker: NLOP


text: To further protect their information systems, the Advisor and its affiliates structure and monitor relationships with various third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.

companyName: Lightstone Value Plus REIT II, Inc.


text: As part of our overall strategic initiatives, we have made significant investments in internal and external resources to support and enhance our technology infrastructure over the next several years. As part of this technology transformation, we plan to continue growing our information security team, enhance our cyber response plan and data privacy policies and evolve our procedures around third-party risk management.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: Cybersecurity Risks As of December 28, 2024, we have not had any material incidences involving cybersecurity attacks. However, we previously have faced, and anticipate we will continue to face risks associated with cybersecurity threats. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a cybersecurity incident or disruption as described above, there can be no assurance that our security efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "Risk Factors–Risks Related to Our Client Relationships–Information, technology systems or service failures, or a cybersecurity incident or other compromise of our or our client's confidential or proprietary information, as well as any violation of data protection laws, could have a material adverse effect on our reputation, business and results of operations."

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: Entergy's CIO is responsible for ensuring that the organization's information technology systems, infrastructure, and applications are designed, implemented, and maintained to provide secure and reliable performance in support of Entergy's business objectives. The CIO establishes and enforces IT policies, procedures, and controls to mitigate information technology policies, procedures, and controls to mitigate information technology-related risks and provides guidance and support to the business units in the effective use of information technology resources and the management of information technology-related risks. By fulfilling these responsibilities across the three lines of defense model, the CIO plays a critical role in ensuring that Entergy's information technology-related risks are effectively identified, managed, and mitigated, thereby supporting Entergy's overall risk management and governance framework. The CIO's background includes serving in senior leadership roles, including CIO for multiple global manufacturing companies, serving on the board of directors for a telecommunications company, and consulting leadership positions providing services for numerous large, global organizations.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes and internal IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan to respond to cybersecurity incidents; and • a third-party risk management process for service providers.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: As of December 31, 2024, we have implemented a set of cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities. Our employees have received cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. Important security measures such as multifactor authentication, firewalls, Endpoint Detection and Response (EDR), encryption, etc. have been implemented. We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Currently we are in the process of expanding our risk management procedure to include a broader cybersecurity risk management process. The updated risk management process will include annual review by our board of directors.

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: Our Senior Vice President of Information Technology, who has over 20 years of experience in the information technology sector, leads our global information security team responsible for overseeing the Emerald information security program. In addition, the team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. This team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, analysis of threat intelligence and review of other information obtained from governmental, public or private sources (including external consultants engaged by us), and alerts and reports produced by security tools deployed in the IT environment. The team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.

companyName: Emerald Holding, Inc.

ticker: EEX


text: Material Cybersecurity Risks and Threats Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A—Risk Factors of this Report under the heading "Our business is subject to cybersecurity and information technology system disruption risks," which should be read in conjunction with the foregoing information.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: We deploy a number of safeguards and processes designed to identify cybersecurity risks and protect our information systems from cybersecurity threats. For example, we maintain data encryption, monitoring, data storage, identity / authentication controls, including two-factor authentication tools, and anti-malware and anti-virus solutions. Additionally, for providers of software-as-a-service and other services that hold or process our data, we review and assesses industry standard certifications provided by such third-party service providers. We perform periodic penetration tests to identify and address vulnerabilities and perform cyber simulations to practice our cybersecurity incident response procedures. We train employees on cybersecurity risks at least semi-annually and generate internal phishing campaigns to assess the effectiveness of the training. We also maintain written information technology and cybersecurity policies that are reviewed regularly and are available to employees on demand. In addition to internal resources and expertise across our information technology, internal legal and compliance and internal audit teams, we use a variety of industry standard security products and consultants and other third-party service providers to inform our understanding of the threat landscape and to assist us with protecting our technology infrastructure and data. Such security products cover data security, application security, endpoint security, and other security functions. We utilize third-party service providers to assist with the construction and maintenance of such defense system, as well as for assistance with respect to threat identification, response and, if necessary, remediation. We also engage third-party cybersecurity experts to conduct tabletop exercises to enhance incident response preparedness.

companyName: AZEK Co Inc.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations to store and transmit sensitive data. We employ a layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our clients. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.

companyName: BayCom Corp

ticker: BCML


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of service providers when handling and/or processing our employee, business or customer data. Further, in February 2024, we formalized our policy of monitoring third-party cybersecurity risks by requiring its consideration and approval by the IT change control board as a part of vendor selection and solution procurement.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: Overall, we devote significant resources to network security, data encryption, employee training and other measures to protect our systems and data from unauthorized access or misuse. The Audit Committee and full Board of Directors receive quarterly reports on cybersecurity risks and annual reports on management initiatives to promote cybersecurity.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: The board of directors' audit and compliance committee receives periodic reports from our CIO concerning significant cybersecurity threats and risk and the processes we have implemented to address them. The audit and compliance committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Immunocore Holdings plc

ticker: IMCR


text: Our SVP-GIS works closely with our Law Department and regularly engages expert consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to oversee compliance with legal, regulatory and contractual cybersecurity requirements. The EVP-CIO and SVP-GIS also periodically attend Audit Committee meetings to report on any material developments.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: The Company's CISO has extensive experience in the field of cybersecurity and is responsible for managing the Company's cybersecurity risks and ensuring that the Company's security posture is aligned with its business objectives. Our CISO's technical and business experience is helpful for developing and executing our cybersecurity strategies. The CISO helps to oversee the Company's information security policies and programs, perform risk and vulnerability assessments of the Company's information systems, and coordinate responses to cybersecurity incidents in conjunction with the CDO, the Company's Incident Response Team (the "IRT"), the IMT and management.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the board, as appropriate.

companyName: LUXURBAN HOTELS INC.

ticker: LUXH


text: Our information security and cybersecurity program is based on a cybersecurity framework that is designed to protect against operational risks related to cybersecurity.

companyName: CORVEL CORP

ticker: CRVL


text: The CISO has appointed experienced security leaders over the North American and International regions to create additional alignment and collaboration.

companyName: APi Group Corp

ticker: APG


text: The CSC is chaired by a member of the Office of the Chief Information Security Officer ("Office of the CISO") and includes members of senior management from operations, finance and legal. The CSC is expected to meet quarterly. In coordination with the Office of the CISO, the CSC reviews and reports on the Company's cybersecurity activities to the ARC on a quarterly basis and to the full Board of Directors on at least an annual basis.

companyName: HYSTER-YALE, INC.

ticker: HY


text: The Corporation's Information Security Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Information Security Officer has over a decade of experience leading cyber security oversight, and others on our IT security team have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings on an annual basis and have access to more frequent cybersecurity trainings through online trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: Meridian Corp

ticker: MRBK


text: T&S also partners with a dedicated engineering team, Security and Fraud Engineering, which reports to our CTO and is responsible for building libraries, services, and integrations that interface with both backend and vendor systems to support the objectives of T&S.

companyName: CHEGG, INC

ticker: CHGG


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: SKYWEST INC

ticker: SKYW


text: We also require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.

companyName: Sharplink, Inc.

ticker: SBET


text: As part of our overall risk management program, we provide required training to employees in high risk areas on cybersecurity and will distribute standard operating procedures to all employees. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: Under our "Cloud First, Cloud Now" strategy, we are increasingly relying on cloud-based technology to enable more innovation, enhance customer service, and keep up with the complex demands of the ever-changing trucking and logistics landscape. We are incorporating cybersecurity into this strategy by investing in key technology and skillset development to help protect the confidentiality, integrity, and availability of our systems and electronic data. In addition, we are committed to using reasonable efforts, given identified or reasonably anticipated threats, to prevent information security breaches. We have not experienced any such breach in any of the three years shown in the financial statements in this filing or in 2024 through the date hereof, and cybersecurity threat risks have not materially affected our business strategy, results of operations or financial condition. Based on our analysis of the current threat environment, we do not believe that any such material impacts are reasonably likely to occur. See Item 1A of Part I of this Form 10-K for a discussion of risks and uncertainties related to our information systems and technology infrastructure.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: We engage our information technology consultants, including dedicated on-site consultants as well as other third parties, in connection with our risk assessment processes. These partners assist us to help design, implement, monitor, and test our cybersecurity policies and procedures. We also require key third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: systems and key business functions and sensitive data operated or managed by or maintained at third-party service providers. These processes are managed and monitored by a dedicated information technology team, which is led by our head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. We constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third party service providers that have access to the personal information we collect, use, store, and transmit. We also conduct periodic employee trainings on cyber and information security, among other topics. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy.

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: Cybersecurity Risk Governance and Oversight The Company's Board, in conjunction with its Audit Committee, oversees management's approach to cybersecurity risk and its alignment with the Company's risk management program. The Board and Audit Committee receive reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and vulnerabilities. Additionally, management provides the Audit Committee with updates on cybersecurity risk assessments, risk mitigation strategies, and relevant internal and industry cybersecurity matters. The Company's Chief Information Officer ("CIO") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board and Audit Committee. The Company's CIO has 25 years of experience in the information technology industry. The CIO reports to the Chief Executive Officer and is supported by a dedicated cybersecurity team within our information systems department, as well as a multidisciplinary incident response team. Employees across the organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity posture.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: The Company engages third party assessors, consultants and auditors in connection with its information security program, including to conduct external penetration testing, independent audits and risk assessments. The Company also utilizes third party service providers in the ordinary course of business. The Information Security Department performs information security assessments for third party service providers that store or process Company confidential data. These information security assessments include a review of any systems and organization control reports, proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes and third party data protection controls (which can include, but is not limited to: access reviews and controls, backups, monitoring, encryption standards and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: The Company also employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. The Company established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. Juniata engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also actively monitors its email gateways for malicious phishing email campaigns and remote connections as some of its workforce has the option to work remotely.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Our CISO heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. Our CISO has extensive background, knowledge and skill in cybersecurity, with over 12 years of experience in establishing and maturing cybersecurity programs in the advertising technology space, from small startups to Fortune 500 companies. She holds a bachelors degree, with a certificate in architecture and systems engineering, and a professional education certificate in AI and machine learning.

companyName: MAGNITE, INC.

ticker: MGNI


text: The Company has established an information security program and related processes for assessing, identifying, and managing material risks from cybersecurity threats to the Company, including governance at the executive and Board level of the Company's cyber risk management strategy and the controls designed to protect its operations. The Company's information security program is managed at the executive level, with regular reporting to, and oversight by, the Board as described below. The Company's program includes multi-layered governance by management, the Audit and Finance Committee of the Board and the Board, as described in greater detail below.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: CNA monitors information security metrics globally. To elevate this information within the organization, our Chief Risk & Reinsurance Officer (CRRO) and Chief Compliance Officer (CCO) present cybersecurity reports and metrics to the Audit Committee of our Board of Directors every quarter. Reports address security events, third-party risk and vulnerabilities, including material risks from cybersecurity threats, and any significant unauthorized occurrences. These discussions are part of our overall enterprise risk management and also take place on at least an annual basis with the full Board of Directors, which is responsible for overseeing material risks, including cybersecurity risk, on an enterprise-wide basis.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: We engage various third parties to assess, test, or assist with the implementation of our risk management strategies, policies, and procedures to enhance our detection and management of cybersecurity risks, including but not limited to: consultants who assist with assessing risks, assist with our PCI compliance assessments, assess our systems alignment with the NIST Cybersecurity Framework, and test and/or scan for vulnerabilities.

companyName: MEDIFAST INC

ticker: MED


text: In order to manage these cybersecurity risks, including our use of third-party software and cloud vendors, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. We take a cross-disciplinary approach to cybersecurity and physical security. Our cybersecurity risk management program is integrated with our ERM program and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal compliance, strategic, operational and financial risk areas. Our program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements. In addition, we conduct risk assessments of third-party software and cloud vendors by utilizing security questionnaires prior to procurement. On a regular basis, we engage consultants to conduct penetration tests and architecture design reviews. As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, may materially affect us, including our operations, business strategy, results of operations or financial condition. See Part 1, Item 1A "Risk Factors" for a discussion of risks factors related to cybersecurity.

companyName: ONEOK INC /NEW/

ticker: OKE


text: Risk Mitigation: We implement layered security controls, including firewalls, encryption, multi-factor authentication, and network segmentation. Patch management, access controls, and a robust incident response plan ensure proactive risk reduction and rapid recovery from incidents.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: At the employee level, we maintain an information technology team tasked with implementing our privacy and cybersecurity program and who support management in reporting, security and mitigation functions. We also hold employee trainings on privacy and cybersecurity, records and information management, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.

companyName: Falcon's Beyond Global, Inc.

ticker: FBYD


text: Cybersecurity Risks Our senior management identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Senior management is asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience.

companyName: Perspective Therapeutics, Inc.

ticker: CATX