text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: Compass Group Diversified Holdings LLC


text: While we have not experienced any cybersecurity incidents that have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations, we did experience and incur costs related to a cybersecurity incident in 2023. Future incidents may interrupt our operations, cause reputational harm, subject us to increased operating costs or expose us to litigation. For additional discussion of the risks posed by cybersecurity threats, see Part I, Item 1A. Risk Factors – Risks Related to our Information Systems of this Annual Report on Form 10-K.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP

secItem: Item 1C


text: No cybersecurity incidents have occurred that materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition during the year ended December 31, 2023. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Garrett Motion Inc.

ticker: GTX


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: AirJoule Technologies Corp.

ticker: AIRJ


text: As a shell company with no current business or operations, our accounting systems are included in the accounting systems of our parent company, Vector Group Ltd. (Commission File No. 1- 5759). Consequently, our management team relies on the cybersecurity processes that our parent company has established to oversee and identify material risks from cybersecurity threats. Therefore, none of the committees are responsible for the oversight of risks from cybersecurity threats. See "Item 1C. Cybersecurity" of Vector Group Ltd.'s Form 10-K for the year ended December 31, 2023 for a discussion of its comprehensive cybersecurity approach.

companyName: MULTI SOLUTIONS II, INC


text: The Vice President of Information Technology, assisted by our broader IT team, is responsible for setting the strategic direction and priorities for information security, coordination of enterprise-wide compliance with information security policies and procedures, as well as day-to-day information security management. Our Vice President of IT has served in various roles in information technology and information security for over 20 years. Our information security team has an aggregate of more than 60 years of experience in information technology roles across several industries.

companyName: AtriCure, Inc.

ticker: ATRC


text: The Company's Security Manager reports to our CIO and is the head of our cybersecurity team. The Security Manager is responsible for assessing and managing our cyber risk management program, informs senior management, together with the CIO, regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our Security Manager has over 15 years of experience in technology and cybersecurity, a master's degree in information security and industry certifications, including CISSP, CDPSE, ITIL, and COBIT.

companyName: SHYFT GROUP, INC.


text: For additional information on our cybersecurity risks, please read Item 1A. Risk Factors - A breakdown or breach of our technology systems could subject us to liability or interrupt the operation of our business, included in this report.

companyName: BIOGEN INC.

ticker: BIIB


text: Cybersecurity risk management is an important and continuously evolving focus for the Company. Resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology assets. The Company's security efforts are designed and tested to protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems or cause other damage. The Company has implemented precautionary measures and controls reasonably designed to address this increased risk, such as enhanced threat monitoring. The Company continues to make investments and partner with qualified third parties to enhance its cyber defense capabilities to monitor the evolving spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency against cybersecurity threats. The Company actively participates in discussions and simulations of cybersecurity risks and has engaged in efforts to educate all employees on the topic of cybersecurity risks.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: Third parties also play a role in the Company's cybersecurity. The Company engages third-party contractors to assess cybersecurity controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These assessments include testing both the design and operational effectiveness of these cybersecurity controls. The Company engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in the Company's information technology environment. Management also shares and receives threat intelligence with our peers, local public companies, and cybersecurity associations.

companyName: Andersons, Inc.

ticker: ANDE


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected threats. We have established processes and systems designed to mitigate technology risk, including our corporate IT control system, to work towards a consistent minimal level of cybersecurity across all our subsidiaries. We engage in periodic or regular monitoring and assessments of our technology key infrastructure and processes using internal staff and third-party specialists. We assess and manage risks, including IT and cybersecurity risks, associated with external service providers and our supply chain. Our audit procedures include testing of IT and cybersecurity controls to ensure reliability. The type, maturity, and formalization of controls in our subsidiaries is informed by the level of anticipated threats and their impacts associated with each organization.

companyName: Freedom Holding Corp.

ticker: FRHC


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, suppliers, business partners, employees and investors with respect to cybersecurity matters. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, assessing, managing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: The Information Security leadership team that reports to the CISO is composed of four security leaders with over 80 years of combined experience and multiple professional certifications.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: These cybersecurity partners, including consultants and other third-party service providers, are a key part of bioAffinity's cybersecurity risk management strategy and infrastructure and provide services including maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access to privileged accounts, network integrity safeguarded by web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, management team, in conjunction with third-party IT and cybersecurity service providers, is responsible for oversight and administration of the cyber risk management program and informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources.

companyName: bioAffinity Technologies, Inc.

ticker: BIAF


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. We do not operate any enterprise information technology systems of our own and have only a limited number of personnel. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: ShoulderUP Technology Acquisition Corp.


text: The Board of Directors is responsible for reviewing and overseeing the long-term strategic plans and principal issues facing the Registrants and includes the oversight of the major risk exposures and the risk management activities of the Registrants. As part of its risk oversight role, the Board delegates specific roles to its committees to help ensure risks, mitigations and opportunities are appropriately monitored and managed. The Audit Committee has overall oversight responsibility over the Registrants' major financial risks, while the Nominating, Corporate Governance and Stewardship Committee oversees the Registrants' cybersecurity risk exposure and management. These Committees and the full Board of Directors are updated regularly by the Vice President of Technology, Data and Security and the Director of Enterprise Security on cybersecurity risks and related matters, including results from audits and assessments of the Registrants' cybersecurity practices and systems, as well as the results of their incident response and business resiliency exercises.

companyName: OGE ENERGY CORP.

ticker: OGE


text: We have policies and processes designed to protect our information technology systems, which are managed by outside consultants. Our cybersecurity consultants resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT


text: Duke Energy's first line of defense is the CIRT under the Office of the Chief Information Officer. The CIRT reports up to leaders in the Chief Security and Information Security Office, including the Chief Security and Information Security Officer (CSISO), Managing Director of Cybersecurity and Network Defense, and Director of Cybersecurity Operations, whose cybersecurity backgrounds include many years serving in operational cyber roles, leading incident response, participating in industry engagement, collaborating with federal and local cyber programs, and time analyzing security breaches across the industry. The CIRT oversees an enterprisewide process that identifies, assesses, responds to and resolves cyber incidents, both internal and those associated with the Company's use of third-party service providers, by defining roles, responsibilities and the process for problem source identification, mitigation, and eradication triggered by a suspected cyber incident. Duke Energy manages cybersecurity threats through its 24/7 Duke Energy Cybersecurity Operations Center (CSOC), which serves as the Company's central command center for monitoring and coordinating responses to cyberthreats. The CSOC engages in daily information sharing within the utilities industry and with government partners and monitors incoming intelligence and cyber incident impacts. The CSOC assesses the relevant information by assigning a CIRT Heat Map score, which results in CIRT activation if a certain threat level is met. It also results in the assignment of additional roles and responsibilities to enable the cybersecurity leadership and technical teams to collectively and regularly review incident information, score the impact, communicate to leadership, and respond appropriately. Another key component of Duke Energy's first line of defense against cybersecurity threats is its Third-Party Risk Management (TPRM) process, whereby third parties providing services that meet certain criteria such as storing or transmitting Duke Energy data, hosting an application, or connecting to the Duke Energy network are required to undergo a cybersecurity assessment primarily to ascertain the risk of a third party's proposed services to Duke Energy.

companyName: PROGRESS ENERGY INC


text: Our ERM Framework describes the roles and responsibilities of the Integrated Risk Management Council, a cross-functional group of senior enterprise risk leaders, which meets regularly to review and discuss significant risk facing our business, including cybersecurity risk. Our Integrated Risk Management Council, which includes our Chief Information Security Officer ("CISO"), proactively identifies, assesses, and prioritizes key or emerging risks, which are then escalated to senior management as needed and, in the case of cybersecurity risk, reported to our Board's Nominating, Governance & Sustainability Committee (the "NG&S Committee") or our full Board.

companyName: Kenvue Inc.

ticker: KVUE


text: Our cybersecurity team is primarily responsible for identifying, evaluating and responding to risks from cybersecurity threats. Our cybersecurity team reviews and assesses our cybersecurity profile against internal and external cybersecurity frameworks that are aligned with industry standards on an ongoing basis and conducts ongoing security management internally and through the engagement of third-party vendors and consultants. In addition, our cybersecurity team periodically engages independent third parties to conduct security assessments and internal and external penetration tests. Our cybersecurity team seeks to detect potential cybersecurity incidents through technical safeguards such as automatic detection systems, as well as through our policies and procedures that require internal and external notification of cybersecurity incidents. When a cybersecurity incident occurs, our cybersecurity team implements our incident management procedures and convenes an incident response team consisting of members of our IT team and other company representatives as appropriate based on the nature of the incident. The incident response team determines appropriate containment, eradication and recovery procedures based on the type of incident and recommends any corrective actions to the cybersecurity team following the resolution of the cybersecurity incident. Our cybersecurity incident management procedures also include a framework to assess whether a cybersecurity incident is material and subject to SEC reporting requirements. Such procedures include the involvement of senior members of our cybersecurity team and other senior leaders across various functions.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: Our Cybersecurity Committee also reviews cybersecurity incidents affecting our third party service providers as necessary. Upon being notified of a cybersecurity incident at a third party, our Vice President of IT or a designated point of contact will promptly contact the third party to understand the details and scope of the incident. An initial report outlining the nature of the incident, affected systems, and preliminary impact assessment will be provided to the Cybersecurity Committee, which will appropriately review the matter. Regular communication is to be maintained with the third party with updates provided to the Cybersecurity Committee to enable appropriate steps to be taken and timely public reporting if needed.

companyName: Celsius Holdings, Inc.

ticker: CELH


text: Our cyber security consultants operate a remote monitoring and management system which enables continuous monitoring of IT components, provides IT maintenance, and installs and maintains security and recovery capabilities, including patch management, antivirus, cloud data back up, and mobile device management.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: Annual risk assessments and penetration testing are primarily performed by our internal staff, and we have not engaged any third parties in connection with such processes except that we have an external Management Information Systems consultant, or MIS consultant, who provides advice to our CEO in the review of test results. We believe these tests are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. The results of these tests are presented annually to the CEO, with support provided by our external MIS consultant, for review to ensure compliance with cybersecurity standards.

companyName: Jerash Holdings (US), Inc.

ticker: JRSH


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Chief Technology Officer. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (1) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (2) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (3) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (4) incorporates advanced technologies such as identity management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.

companyName: World Gold Trust

ticker: GLDM


text: HTLF's first line of defense is led by our Chief Operations Officer and our Chief Information Officer. HTLF's second line of defense is led by our Chief Risk Officer ("CRO") and includes the Security function, led by our Chief Information Security Officer ("CISO") who is primarily responsible for the cybersecurity component. The primary responsibilities of the HTLF Security function are to protect HTLF assets including networks, systems, application, data, funds, and staff, and facilitate incident response and resolution. HTLF's third line of defense is led by our Chief Audit Executive.

companyName: HEARTLAND FINANCIAL USA INC


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: JetBlue management has overall responsibility for assessing and managing risks from cybersecurity threats to the Company and has an established cyber risk committee that consists of the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Chief Information Security Officer (CISO). Our CISO has primary responsibility for the design and execution of our cybersecurity risk management program, and helps the committee stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, including but not limited to briefings with internal security team members, threat intelligence obtained from public and private sources, and alerts and reports produced by security tools deployed in the IT environment. Our current CISO has nearly two decades of experience in IT risk and program management, threat intelligence, and cybersecurity governance; he also has several cybersecurity industry certifications and specialized training in cybersecurity.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: Security Program Overview The Company's cybersecurity program is framework-based, and risk and metrics-focused. The program uses and is measured against National Institute of Standards and Technology Standards ("NIST") 800-53(r5) and supporting standards. The Company utilizes a risk-based security program that strives for an effective balance of controls and processes across the Identify, Protect, Detect, Respond and Recover areas of the framework. As a service provider and technology partner, we have on-going initiatives that address the areas below to achieve a comprehensive security program.

companyName: CINCINNATI BELL INC


text: Our process of identifying and remediating cybersecurity risks has been integrated into our overall risk management system and processes. It is overseen by our Chief Information Security Officer and Chief Risk Officer, who report to our Board of Directors and its Risk and Technology Committee on a quarterly basis. The Chief Information Security Officer provides ongoing oversight for the management of cybersecurity risks across the firm leveraging a series of qualitative and quantitative risk assessment routines. Risk escalations are facilitated through the enterprise risk management framework, including the Company's Enterprise Risk Committee and the Board of Directors via the Risk and Technology Committee. Facilitated via regular updates on cybersecurity risk, our Board of Directors takes an active role in overseeing, managing, and setting risk tolerances for our cybersecurity program. Our Chief Information Security Officer has over 15 years of technology and cybersecurity experience, including previous senior leadership roles at major financial institutions and possesses industry certifications such as the Certified Information Systems Security Professional (CISSP). Additional leaders and key contributors composing the cybersecurity leadership team possess specific expertise, certifications, and previous work experience aligned to their assigned responsibilities. Our Enterprise Risk Committee, responsible for providing oversight for cybersecurity risks, is a cross-functional representation of senior leadership with requisite experience and expertise to provide risk oversight, including the Chief Risk Officer, Chief Legal Officer, Chief Technology Officer, Chief Compliance Officer, Chief Privacy Officer, and FIS Business Presidents.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: We have implemented and maintain a formal information security program, designed to develop, and maintain privacy and data security practices to protect Silvercrest assets and sensitive third-party information, including personal information. This program is governed by employees comprised of members of senior management, including our Chief Information Security Officer ("CISO"), who meet regularly and provide reports to the Board of Directors at least annually. The CISO oversees communications with the Board of Directors regarding material cybersecurity incidents and provides the Board with a summary of risks from current cybersecurity threats on a regular basis, as well as updates on management's information security program oversight and maintenance activities, and any material changes to Silvercrest's information security practices and procedures.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: Currently, the security of our information is managed by Mr. Ryohei Uetaki, our sole officer and director. While Uetaki believes he can maintain adequate internal security measures at this stage, there is no guarantee that this will prevent potential breaches, disruptions to our operations, or other related issues.

companyName: Ultimate Holdings Group, Inc.

ticker: UHGI


text: In turn, through these processes, we improve our framework, remediate serious issues, and update organizational cyber risk governance roadmaps accordingly.

companyName: Zedge, Inc.

ticker: ZDGE


text: The Board of Directors is responsible for oversight of the Company's cybersecurity program and the Company's responses to cybersecurity risk. The Board of Directors has delegated to the Safety, Environmental, Technology and Operations ("SETO") Committee of the Board of Directors responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company's operational performance or risk profile. The SETO Committee meets at least quarterly and receives reports from the CIO and CSO related to cybersecurity threats, trends and risks, and related mitigation activities. In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company's cybersecurity program. The SETO Committee coordinates with the Audit, Finance and Risk Committee of the Board of Directors, as appropriate, on matters related to cybersecurity risk. The Audit, Finance and Risk Committee is responsible for, among other things, overseeing the adequacy and effectiveness of the Company's system of internal controls and the Company's risk assessment and management strategy, including with respect to cybersecurity risks.

companyName: American Water Works Company, Inc.

ticker: AWK


text: We have implemented and maintain various processes, procedures, and measures to support our overall risk management strategy and to manage and mitigate the material risks posed by cybersecurity threats to our systems and data. With respect to cybersecurity, these measures include conducting risk assessments of our operations and using a risk register to assess identified risks; developing business continuity, disaster recovery and incident response plans; implementing technical safeguards and tools; conducting ongoing cybersecurity awareness training; and using contractual protections where appropriate.

companyName: Celcuity Inc.

ticker: CELC


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology, Cybersecurity and the Cyber Incident" of this Annual Report on Form 10-K.

companyName: SolarWinds Corp


text: Our board of directors has overall oversight responsibility for our risk management and has charged our Audit Committee with oversight of our cybersecurity risk management program. The board and Audit Committee are responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess and respond to cybersecurity, data privacy and other information technology risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity threats and incidents.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: We have implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management. In addition, we have continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture. We also hired a information technology manager to oversee and identify any risks from cybersecurity threats associated with our use of third-party service providers.

companyName: 374Water Inc.

ticker: SCWO


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows and/or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: Employee Cybersecurity Training. The Company provides ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to the Company's data and critical systems. Employee phishing tests are conducted on a monthly basis.

companyName: Knife River Corp

ticker: KNF


text: The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging consultants to complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging a cybersecurity risk readiness and response company to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: Ashford Inc.


text: The Vice President of Information Technology (IT) and the Director of IT Security are responsible for overseeing our cybersecurity risk management program. This includes managing internal cybersecurity staff, consulting with external cybersecurity experts, and staying informed through governmental and private sources. They report regularly to executive management on cybersecurity threats, resources, and program updates.

companyName: STAR GROUP, L.P.

ticker: SGU


text: In 2023, we launched an ongoing enterprise-wide communication initiative focused on cyber threats, which aims to educate Li-Cycle employees on recognizing and responding to potential cyber threats effectively, and serves as a reminder of the critical role each individual plays in ensuring the safety of our organization.

companyName: Li-Cycle Holdings Corp.


text: Our Audit Committee, which is responsible for oversight of cybersecurity risks, periodically reviews and discusses with management, including the Chief Information Officer ("CIO") and the Chief Information Security Officer ("CISO"), risk issues associated with cybersecurity and policies and controls intended to mitigate those risks.

companyName: FLUOR CORP

ticker: FLR


text: Cybersecurity Risks Management assesses the top organizational risks for the Company on an annual basis. Our cybersecurity risk is a component of our overall organizational risk assessment. Management also performs a specific cybersecurity risk assessment based on the NIST cybersecurity risk framework. As part of our cybersecurity risk assessment, department leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. Our cybersecurity risk assessment helps to inform our risk mitigation strategies. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: NEE operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats, including those related to NEP, which is led by a cybersecurity incident response team. NEE uses these resources to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems and monitors for impacts to external vendors or suppliers, including those related to NEP. Assessment of an incident includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and individuals serving as officers and directors of NEP.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: While we experience cybersecurity threats during the normal course of business, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us and we do not believe are reasonably likely to materially affect us, including with respect to our business strategy, results of operations and financial condition.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues. However, there can be no assurance that our cyber risk insurance coverage will be sufficient to cover incurred losses in the event of a cyber-attack.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: Our board of directors recognizes the critical importance of cybersecurity in safeguarding our company's assets, reputation, and customer trust. Our board of directors addresses our company's cybersecurity risk management as part of its general oversight function.

companyName: Moatable, Inc.

ticker: MTBLY


text: Some key safeguards we have undertaken to assess, identify and manage material risks from cybersecurity threats include, but are not limited to: • Engaging an independent audit firm to conduct a System and Organization Controls ("SOC") 2 audit of the Company in 2023; • Designing information security policies based on the International Organization Standardization ("ISO") 27001 framework; • Maintaining well-documented processes to provide and remove access, for security incident response, for IT change control and for secure software development lifecycle; • Conducting regular system patching; • Conducting frequent, independent third-party vulnerability and penetration testing; • Providing access on a "need to know" basis applied with "least privilege" principle; • Requiring multi-factor authentication for system access; • Protecting the use of data centers with physical and environmental controls; • Encrypting data at rest and in transit; • Requiring regular, independent SOC 1 and/or SOC 2 audits for key SaaS providers; • Requiring third-parties to have information risk management processes; • Requiring regular security awareness training, including annual online security awareness training, for all users of our systems, which covers topics like phishing, social engineering, mobile and device security and protection of sensitive information; • Testing awareness by sending regular test phishing emails; • Monitoring security 24/7/365; and • Providing for system redundancy and resilience to help ensure business continuity.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management process. In addition, we have implemented a cybersecurity third-party risk management process designed to assess the cybersecurity practices and monitor certain critical third parties, and to assist the business in making risk-informed technology services decisions. Our practice is to perform due diligence on certain third parties who maintain Sensitive Information, including CROs that manage and administer our clinical trials, and our CDMOs that manufacture our drug product to be used in clinical trials. Additionally, we monitor these third parties through frequent program management meetings as well as joint steering committee meetings in certain cases.

companyName: aTYR PHARMA INC

ticker: ATYR


text: At Avadel, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards.

companyName: AVADEL PHARMACEUTICALS PLC

ticker: AVDL


text: We have implemented and maintain processes designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third party hosted services, communications systems, hardware and software, and our data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal information of employees and others ("Information Systems and Data").

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Legal and Regulatory Compliance Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Company programs are discussed with the Board of Directors by the Chief Technology & Data Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.

companyName: Delek US Holdings, Inc.

ticker: DK


text: This framework includes regular assessments of its information systems, physical and virtual infrastructure, and the data therein, to identify potential cybersecurity threats and vulnerabilities. Our cybersecurity strategy is integrated into the Fund's overall risk management processes, with specific consideration given to the confidentiality, integrity, and availability of our information systems.

companyName: Dynamic Shares Trust


text: We have implemented incident response processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and review of an incident, 3) containment and remediation, and 4) post-incident review and analysis. Cybersecurity incident responses are managed by our Corporate Incident Response Team and overseen by our Vice President of IT.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Our CIO, who is a member of our management team, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has over two decades of IT experience, including in applications, infrastructure, development, security and governance, and has presented as a featured speaker at numerous IT and security conferences. Our management team, including our CIO, has overall responsibility for our corporate cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Response Team, which includes our CIO and other members of our management team, has primary responsibility for assessing and managing our response to cybersecurity events.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: The third-party risk management programs report functionally to our overall risk management function, led by our Chief Risk Officer. The information security program, led by our Chief Information Security Officer and our Chief Information Officer, evaluates internal and external cybersecurity threat factors according to a written policy statement approved by the Board periodically. We maintain processes to evaluate third parties whose information systems support our critical operations.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: The Company maintains a 24 x 7 operations center that monitors the Company's IT environment, and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.

companyName: Johnson Controls International plc

ticker: JCI


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: BALCHEM CORP

ticker: BCPC


text: Our Board of Directors ("Board") has overall oversight responsibility for our enterprise risk management framework and cybersecurity risk management. The Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Vice President of Information Technology with support from our Information Technology Council, updates the Board on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our Vice President of Information Technologies receives reports from our Information Technology Council and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our information technology council includes experienced information systems security professionals and information security managers. Our Information Technology Council, which is composed of technology leaders from each of our business units, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: Our information technology infrastructure includes firewalls, modern endpoint protections, intrusion detection tools and alerts, as well as multi-factor authentication to provide a multi-layered approach to protecting our information technology systems from unauthorized access, use, disclosure, disruption, or destruction. Such applications are regularly monitored and reviewed for adequacy and potential enhancements.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: No unauthorized access to customer, vendor, supplier, joint venture, employee or our data occurred as a result of cybersecurity incidents against us that has had a material adverse effect on our business, operations, or consolidated financial condition. If our systems, or our customers' or suppliers' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under General Risk factors in Item1(a) Risk Factors.

companyName: Smart Sand, Inc.

ticker: SND


text: We maintain a cyber risk management protocol designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process. employ a risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats.

companyName: Power REIT

ticker: PW


text: We have not identified any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the business strategy, results of operations or financial condition of the Company. Please refer to the risk factor captioned " We could be subject to losses and reputational harm if we, or our agents, fail to properly safeguard sensitive and confidential information against cyberattacks or other security breaches or if our business processes are not sufficiently resilient. " in Part I, Item 1A. Risk Factors, for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: The ISO Committee also includes the Co-Presidents of First American Title Insurance Company, the Vice-Chairman of our data and analytics business and the President of our international division, who bring deep operational experience specific to our businesses; the Chief Intellectual Property and Privacy Officer, who is responsible for protecting and advising on innovation, data privacy and intellectual property; and is chaired by the Company's Chief Risk Officer, who has over 25 years of experience in risk management. The Company's CISO and Chief Technology Officer ("CTO") are participants on the ISO Committee.

companyName: First American Financial Corp

ticker: FAF


text: Our cybersecurity risk management program is designed to identify, assess, and manage the cybersecurity risks that are relevant to our business and is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: Our information security team consists of dedicated personnel who are experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties. In particular, our vice president acting as chief information security officer has extensive experience in the management of cybersecurity risk management programs, having served in various roles in information technology and security for over 25 years. In addition, six of the eleven members of our board of directors have expertise in overseeing cybersecurity and information security management.

companyName: Palo Alto Networks Inc

ticker: PANW


text: Our Vice President of Information Technology and Facilities, who has over 20 years' experience with cybersecurity at public companies, in coordination with senior management including our Executive Vice President, Chief Business and Financial Officer, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, a cross-functional team throughout our company addresses cybersecurity threats and responds to cybersecurity incidents. Through ongoing communications with this team, the Vice President of Information Technology and Facilities and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: Zymeworks Inc.

ticker: ZYME


text: We leverage IT service providers to perform penetration testing and support our cybersecurity awareness training program. We oversee cybersecurity risks related to third-party IT cloud service providers who have access to our systems and data. We require certain IT cloud service providers to complete cloud-based cybersecurity assessments.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: Our information technologies, system networks, information technology infrastructure, enterprise applications and financial reporting platforms are critical components of our operations. Our business operations rely on the secure processing, transmitting, collecting and storage of sensitive and confidential data. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: We also monitor and oversee risks from cybersecurity threats associated with all third-party service providers that handle data or information for us. In connection with engaging any third-party service provider that will handle data or information for us, we review its internal controls, require that it fill out our security and/or privacy questionnaires and ensure there is appropriate contractual language regarding data privacy, security, and confidentiality. For example, we require all third-party service providers that handle personal data to sign data privacy addenda. We also annually audit compliance of those third-party service providers with these requirements, including through a review of their SOC 1 and/or SOC 2 audits, have them update our security and/or privacy questionnaires and, as appropriate, we conduct on-site audits for certain significant third-party service providers.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response process; disaster recovery/business continuity plans; encrypting certain data; using network security controls; maintaining access controls; managing assets; and maintaining cybersecurity insurance.

companyName: SCYNEXIS INC

ticker: SCYX


text: On July 26, 2023, the SEC adopted a final rule requiring, among other things, registrants to disclose certain information regarding cybersecurity risk management, strategy and governance annually and certain information about material cybersecurity incidents within four business days of the incident. The final rule became effective on September 5, 2023.

companyName: DT Midstream, Inc.

ticker: DTM


text: Our Risk Assessment Program The Company has a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks the Company faces include targeted attacks, ransomware, malware, phishing attacks, data theft, other data or security breaches, virus and intrusion software, as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Key aspects of the Company's cybersecurity program include the following: • layered technical protective capabilities and detective surveillance controls; • utilizing independent third parties to assess the Company's practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • courses and awareness training on information security for employees with Company email or access to Company devices, including phishing, social engineering and other cybersecurity training as well as targeted training for specific roles based on responsibilities and risk level; • global security and privacy policies; and • business continuity, incident response and disaster recovery procedures, including table top exercises involving senior leaders.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: The Company's business and proprietary information, information technology and operational technology assets are important to its success. The Company's cybersecurity program is designed to protect its information assets and operations from external and internal cyber threats by seeking to mitigate and manage risks while helping to ensure business resiliency. The program is applied across all levels of the Company.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: In accordance with our cybersecurity policy, we have established a monitoring strategy and program which includes: • Defined security metrics to be monitored; • Performance of security control assessments on an ongoing basis; • Engaging third party security consultants to, among other things, conduct periodic reviews of our cybersecurity program, which is overseen by the FRS Committee, for identifying any cybersecurity threats; • Addressing results of both internal and third-party cybersecurity analyses and reporting security status to the executive team; • Monitoring information systems to detect attacks and indicators of potential attacks; and • Identification of unauthorized use of information system resources.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: Additionally, we have implemented an enterprise risk management process, which addresses cybersecurity risks. This process is led by our General Counsel and includes participation by the board of directors, as appropriate. Our General Counsel reports regularly on the enterprise risk management process to executive leadership and the audit committee.

companyName: Korro Bio, Inc.

ticker: KRRO


text: Our approach to cybersecurity is tailored to suit the specific environment in which we operate. We implement and maintain an array of technical, physical, and organizational measures, processes, standards, and policies, designed to manage and mitigate material risks arising from cybersecurity threats to our Information Systems and Data. This includes a comprehensive strategy featuring a dedicated cybersecurity staff and a regularly tested IT Security Incident Response Plan. Regular risk assessments, tabletop exercises, threat modeling, and vulnerability testing form the backbone of our technical measures.

companyName: Cidara Therapeutics, Inc.


text: Our IRP requires prompt notification of our senior management in the event of a cybersecurity incident that has impacted or is expected to impact the Company and prompt briefings on subsequent developments as appropriate. The IRP also addresses senior management responsibility, subject to Audit Committee oversight, with respect to disclosure determinations related to the cybersecurity incident. The IRP provides for Audit Committee and Board briefings as appropriate.

companyName: Playa Hotels & Resorts N.V.


text: Management Oversight and Governance The CTrO, reporting to the Company's Chief Engineering & Customer Success Officer ("C/E"), is responsible for designing and implementing a security program and strategy based on the mandate provided by the Board and senior management. The CTrO has extensive experience in the management of cybersecurity risk programs, having served in various leadership roles in information technology and information security for over 15 years, including serving as the Chief Security Officer of two other large public technology companies. He also holds an undergraduate and master's degree in computer science. We believe the Company's business leaders, including our CEO, CFO, C/E and CLO, who have experience managing cybersecurity risk at the Company and at similar companies, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.

companyName: Salesforce, Inc.

ticker: CRM


text: Our information systems generally fall into two categories: our platform and our corporate systems. Each category has dedicated teams and processes in place to address cybersecurity risk. Our product security team, which reports into our SVP, Engineering and Support, works alongside our product and engineering teams to address how security is designed into our platform. Our corporate security team, which reports to our Chief Information Security Officer, is responsible for the secure design of our corporate systems. In addition, our Chief Information Security Officer manages a global security team that performs certain cybersecurity functions for both our platform and corporate systems, including certification management, incident response, threat detection, analytics, and offensive security (such as simulations and penetration tests).

companyName: Snowflake Inc.

ticker: SNOW


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures, and evaluating guidelines and policies with respect to our cybersecurity risk assessment and risk management. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and regarding its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. From time to time, third-party subject matter experts present to the Audit Committee on contemporary cybersecurity topics of interest.

companyName: GRIFFON CORP

ticker: GFF


text: We rely heavily on information technology systems to operate our business, including processing and monitoring a large number of transactions across markets and in multiple currencies. To date, we have not experienced a cybersecurity incident that we deemed to be material. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Cybersecurity and Technology Risks," which is incorporated by reference into this Item 1C.

companyName: PRA GROUP INC

ticker: PRAA


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Also see Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. For more information, please see "Item 1A, Risk Factors."

companyName: HUBSPOT INC

ticker: HUBS


text: While such technologies, controls, and procedures cannot entirely eliminate cybersecurity threats, EOG believes the risks from cybersecurity threats (including as a result of previous cybersecurity incidents) have been effectively managed and contained, and have not materially affected, and are not reasonably likely to materially affect, EOG and its business strategy, results of operations or financial condition. See ITEM 1A, Risk Factors, for related discussion.

companyName: EOG RESOURCES INC

ticker: EOG


text: We generally seek to address cybersecurity risks by implementing security measures on our internal computer systems and ensuring that third parties and business partners implement similar measures. These security measures include firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated by our external IT consultant and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: ORAMED PHARMACEUTICALS INC.

ticker: ORMP


text: Our Incident Response Plan ("IRP") has evolved with our cyber environment and consists of a set of state-of-the-art-tools capable of monitoring, reporting and alerting, as well as regular reviews. The IRP also sets forth guidelines on how to triage, assess the severity and materiality of findings, and remediate and escalate findings to upper management in a timely manner, as necessary. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. However, such insurance may not be sufficient to cover us against all possible claims related to security breaches, cyber-attacks and other related breaches. As of the date of this report, we have not identified cybersecurity threats that we believe are reasonably likely to materially affect us. However, cybersecurity risk is dynamic, and future incidents could materially affect our operations, financial condition, or reputation.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: The CIRT is led by our Vice President and Chief Information Officer and Director of Cybersecurity Risk and Business Continuit y. Together, these professionals are responsible for assessing and managing cybersecurity risks and they lead a team of specialized technologists entrusted with ensuring the functionality, continuity, and security of our technology infrastructure and data. Our Vice President and Chief Information Officer is a seasoned IT professional with over 29 years of experience encompassing all facets of IT within the energy industry. His extensive background comprises managing IT service delivery, designing and administering secure solutions, establishing robust IT and Internet of Things infrastructures, and effectively managing technology-related risks. His skill set includes proficiency in threat mitigation, comprehensive risk assessment, and integration of cybersecurity strategies into business operations designed to safeguard critical assets and sensitive data. He reports to our Executive Vice President and Chief Financial Officer. Our Director of Cybersecurity Risk and Business Continuity has over 24 years of experience in the IT field with a majority of that time focused on designing, building and maintaining technology systems. His experience includes implementing security solutions and processes with a focus on adapting to the evolving cybersecurity threat landscape. He is a skilled leader and reports to our Executive Vice President and Chief Financial Officer.

companyName: SM Energy Co

ticker: SM


text: The annual report to the Audit Committee includes an overview of multiple topics, such as current cybersecurity threats; other cybersecurity risks, including operational, legal/regulatory, and reputational risks; a status summary of company-wide metrics relating to information security controls (e.g., controls addressing vulnerability and patch management, web and mobile application security, administrative access, incident response capability, compliance activities, disaster recovery, sensitive data inventory, and phishing prevention); and planned information security initiatives.

companyName: Graham Holdings Co

ticker: GHC


text: Processes for the Identification, Assessment, and Management of Material Risks from Cybersecurity Threats Although Global Payments is unable to eliminate all risks associated with cybersecurity threats and we cannot provide full assurance that our cybersecurity risk management processes will be fully complied with or effective, we have adopted policies and procedures that are designed to facilitate the identification, assessment, and management of those risks, including any such risks that have the potential to be material.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Currently, our CFO and Senior Director, Information Technology are collectively responsible for hiring appropriate personnel, managing external third-party providers, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: The Audit Committee provides oversight of our cybersecurity program, which includes annual and periodic reviews of our cybersecurity program and cybersecurity risks. As part of its oversight responsibility, and pursuant to its charter, the Audit Committee reviews with management and reports to the full Board with respect to significant cybersecurity matters and risks and management's actions to monitor and address identified issues. The Internal Audit team also meets periodically with the VP, Information Security and Compliance officer along with key IT leadership to discuss open cyber or data security risks. This effort is to help ensure items of risk are addressed and resolved in a timely manner. The Audit Committee receives updates from the Company's recently appointed Chief Digital and Technology Officer ("CDTO"), VP, Information Security and Compliance, and/or members of our executive leadership team. Management also reports to the full Board at least annually regarding a comprehensive overview and status of the Company's information security program. The Audit Committee is also apprised of cybersecurity incidents consistent with the provisions of our recently enhanced cybersecurity incident response plan ("IRP") pertaining to escalation of more significant cybersecurity incidents.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: During the reporting period, we did not experience any cybersecurity incident that has materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."

companyName: Playtika Holding Corp.

ticker: PLTK


text: Board Oversight and Governance Getty Images' Board of Directors has delegated the oversight of cybersecurity risks to the Audit Committee. The Audit Committee assists Getty Images' Board of Directors in its oversight of the policies and practices used by Getty Images to identify, assess and manage key risks facing Getty Images, including cybersecurity risks. Members of management, including the Company's Chief Technology Officer ("CTO"), provide the Audit Committee with updates on cybersecurity and information technology matters. In turn, the Audit Committee and management also provide updates to Getty Images' B oard of Directors. In addition to reporting to the Audit Committee and Getty Images' Board of Directors, the CTO provides periodic reports to our Chief Executive Officer and other members of our senior management as appropriate. The Audit Committee, or Getty Images' Board of Directors, is notified of cybersecurity incidents, as appropriate, in accordance with the Company's incident response processes.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: Our board of directors and Audit Committee receive periodic updates on developments in our cybersecurity risk management practices, evolving standards, third-party vulnerability assessments, and information security issues. On an annual basis, our board of directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with senior management, including our Chief Executive Officer ("CEO"). At the direction of the Board of Directors, the Company is in the process of strengthening its risk management procedures.

companyName: I-ON Digital Corp.

ticker: IONI


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Risk and Security Committee, comprised of independent directors from our Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from our Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews risk assessments from information security, privacy, and internal audit management teams with respect to cybersecurity, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, our Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Our cybersecurity management team, lead by our CIO, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and reports produced by security tools deployed in the IT environment. Our CIO reports to the Company's Chief Executive Officer, as well as to the Board and Audit Committee. The CIO has served as our CISO for three years and has more than 20 years of experience in various roles involving managing cybersecurity functions, developing strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The CIO holds a bachelor's degree in computer science and various certifications which include Certified Ethical Hacker and Certified Chief Information Security Officer, and has 25-plus years of previous software and hardware systems engineering experience.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: We have developed a cybersecurity risk management program to regularly assess risks from cybersecurity threats and monitor our systems to manage those risks. Our cybersecurity risk management program is an important component of, and integrated with, our overall enterprise risk management framework, which addresses legal, compliance, operational, and financial risks, alongside cybersecurity risks. Through this integration, we aim to optimize resource allocation, improve risk identification, and strengthen our cybersecurity governance.

companyName: Waystar Holding Corp.

ticker: WAY


text: Our board of trustees is responsible for overseeing the assessment and management of enterprise-level risks that may impact us, including cybersecurity. Two board members have information security expertise from their professional experience. Nathaniel A. Davis has expertise in information technology and experience reviewing and addressing cybersecurity risks. Patricia L. Gibson also has experience assessing and addressing cybersecurity risks through her past professional experience.

companyName: RLJ Lodging Trust

ticker: RLJ


text: The Audit Committee, composed entirely of independent directors, is responsible for organization-wide oversight regarding information security and reports to the full Board. All directors typically attend our committee meetings, which we believe creates transparency and a more collaborative and informed Board. The Audit Committee receives reports on at least a quarterly basis from the Company's chief information security officer, who is typically accompanied by the Company's chief security officer and chief information officer, on the Company's latest information security risks and mitigation strategies.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The Audit Committee receives reports as part of its quarterly meetings from our CISO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board also receives periodic reports (at least annually) from our CISO regarding the our overall cybersecurity landscape, including material related to cybersecurity threats, risk, and mitigation.

companyName: Freshworks Inc.

ticker: FRSH


text: We have implemented policies, standards, and technical controls based on the National Institute of Standards and Technology ("NIST") framework with the aim of protecting our networks and applications, to safeguard the confidentiality of sensitive information entrusted to us. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our critical service providers and we, have security measures and programs in place designed to prevent, detect, and respond to cyber-attacks, security-related incidents, and other similar threats. However, our ability to monitor our vendors' cybersecurity practices is limited, therefore we cannot guarantee that our measures and programs will prevent a cyber-incident impacting our systems or information.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: The Company's cybersecurity program is designed to protect and preserve the confidentiality, integrity, and availability of our networks and systems, as well as information that we own or is in our care, through a risk-based approach. The Company's program is based on the U.S. National Institute for Standards and Technology standards and other applicable industry frameworks. Our cybersecurity program identifies, assesses, and manages material risks from cybersecurity threats by implementing a comprehensive set of practices, processes, and technologies designed to protect our data digital assets and data.

companyName: Strategic Education, Inc.

ticker: STRA


text: Our cybersecurity risk management program is dependent on the use of external service providers to assist with our information technology security controls. Our cybersecurity policy includes a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and a third-party risk management process for relevant third-party service providers.

companyName: Highlands REIT, Inc.


text: The Company performs assessments of certain third-party vendors prior to establishing a business relationship as part of our efforts to evaluate whether such vendors demonstrate appropriate commitments related to data security, availability, and confidentiality. This process is designed to be calibrated to the identified risk level associated with each vendor.

companyName: SpringWorks Therapeutics, Inc.


text: The Bank's Information Security Officer (or ISO), who reports to our Chief Compliance & Risk Officer, is directly responsible for assessing and managing cybersecurity risks pursuant to the Company's Information Security Program, which is approved by our Board of Directors periodically. The current ISO has more than 5 years of cybersecurity experience and holds multiple industry certifications.

companyName: Finwise Bancorp

ticker: FINW


text: At the direction of the Audit Committee, the CIO and SIRT monitor internal and external cybersecurity threats and review and revise the Company's cybersecurity defenses on an ongoing basis. The Company's CIO, together with other members of the SIRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; risk management and incident response. The CIO prepares reports on IT general controls and cybersecurity metrics for the Audit Committee on a regular basis, and the CIO presents those reports to the Audit Committee and addresses any questions and concerns raised by the Audit Committee. At least annually, the Audit Committee meets with the CIO in person to discuss cybersecurity in greater detail. The Audit Committee reports to the Board regarding cybersecurity matters, and the Board addresses cybersecurity issues either directly with management or through the Audit Committee.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: Our Information Security and Compliance teams, in coordination with the Board and Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes, and practices that our CIO and our Vice President of Information Security, in coordination with our Information Technology Senior Leadership Team, develop and implement to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least once each quarter, the Audit Committee discusses our approach to cybersecurity risk management with our CIO, and at least annually, or more frequently as necessary, our CIO meets with the Board to discuss cybersecurity risk management.

companyName: VAIL RESORTS INC

ticker: MTN


text: Led by our Director of Information Technology and Security ("Director of IT") with years of experience in Information Technology, our CSIRT, comprising cross-functional professionals, collaborates to execute our cybersecurity risk assessment and management processes by reviewing and assessing cybersecurity initiatives, including the incident response plan, cybersecurity compliance, training, and overall risk management efforts. The collaborative efforts of the Board and our skilled CSIRT team underscore our commitment to effectively addressing and mitigating cybersecurity risks within the organization.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: Risks from Cybersecurity Threats The Company does not believe that it has experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company and its business strategy, results of operations and/or financial condition. These types of events, which could lead to business disruptions, unplanned downtimes or outages, particularly in critical systems or services, may impact our ability to operate efficiently, affecting business continuity.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: Our risk mitigation process assesses, prioritizes, and monitors information security risks and vulnerabilities and helps ensure risk mitigation efforts are embedded across our business. Among other things, our internal experts regularly conduct audits and tests of our information systems and our cybersecurity program is periodically assisted by established, independent third party consultants, who provide assistance through tabletop and other preparedness exercises. We also review information security threat information published by government entities and other organizations in which we participate and actively engage with suppliers, industry associations, key thought leaders and law enforcement communities as part of our continuous efforts to evaluate and enhance the effectiveness of our cybersecurity program. In 2022, we launched and required all salaried employees to complete a mandatory Global Cybersecurity and Privacy training, covering information security, end-user security policies, remote working, phishing and email security and digital threats. This training was enhanced with additional topics in 2023 around social media, social engineering, and breach response, among others. Additionally, we maintain regular publications on cyber awareness on our Company portal and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies. In 2023, we implemented additional management governance through the creation of a Global Cybersecurity and Data Privacy Steering Committee, which meets periodically to help ensure information security risks and vulnerabilities are being appropriately managed and mitigated. In addition, we maintain insurance to protect against potential losses arising from an information security incident.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Our Chief Financial Officer and members of our audit committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Financial Officer and members of our audit committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following:

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: We do not presently have any general processes for assessing, identifying, and managing material risks from cybersecurity threats. As we expand our business operations, we plan to develop processes that will allow for the identification and assessment of cybersecurity risk that will be integrated into an overall risk management system, which will be managed by senior management and overseen by the Board of Directors. As part of this development, we plan to identify and address cybersecurity risks related to our business, privacy and compliance issues through a multi-faceted approach that is expected to include third party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with these planned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things, will consider: conducting proactive privacy and cybersecurity reviews of systems and applications, audits of applicable data policies, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security, and implementing appropriate changes.

companyName: Bimergen Energy Corp

ticker: BESS


text: The Board of Directors is responsible for overseeing and reviewing with management the Company's InfoSec risks and the policies and practices established to manage such risks. In that effort, the Board of Directors delegates certain responsibilities to our Audit Committee. This committee-level focus on InfoSec allows the Board to further enhance its understanding of these issues as it continues to have overall oversight responsibility for risk.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: The Company has established polices, processes, controls and systems designed to identify, assess, measure, manage, monitor and report risks related to cybersecurity and help prevent or limit the impacts of potential cyber threats and attacks. As cyber threats continue to evolve, the Company expects to continue to expend significant resources to adapt to changes in the threat environment and enhance its measures to detect and prevent cyber attacks or to investigate and remediate known information security vulnerabilities and incidents. The risks faced by the Company from cyber threats that could materially affect the Company, including its business strategy, results of operations or financial condition, are discussed in Part I, Item 1A, "Risk Factors" within this Form 10-K.

companyName: M&T BANK CORP

ticker: MTB


text: We maintain an active cybersecurity risk management and strategy program to address the risks of cybersecurity threats to our business. Our cybersecurity program aligns with the NIST Cybersecurity Framework, and we conduct reviews of its effectiveness on a regular basis through annual testing, periodic third-party evaluations of our processes and controls, and ongoing surveillance. This program involves the use of cybersecurity tools to identify, protect, detect, respond, and recover from cybersecurity threats. Additionally, we engage with third-party cybersecurity consultants and other professional advisors to gain insight and knowledge into emerging threats, industry trends and emerging practices. Annually, we review cybersecurity risk in the context of our overall enterprise risk management assessment. As a component of these processes, our management team, including our Senior Vice President and Chief Technology Officer, identifies and assesses the likelihood and magnitude of risks, on both inherent and residual basis. These evaluations inform our overall cybersecurity strategy.

companyName: AGNC Investment Corp.

ticker: AGNC


text: Seaboard engages independent third parties to perform some services such as penetration testing and monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment and investigation by Seaboard's Information Security Team. Seaboard maintains end user and administrative user policies governing the use of company technology. Seaboard conducts risk assessments of certain of its third-party service providers with attention to cybersecurity risks.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: The Board of Directors, including its Risk Subcommittee provides oversight of Company cybersecurity risks. The Board of Directors receives periodic reports on cybersecurity threats, awareness training, and key risk indicators related to cybersecurity. Additionally, the Company's Audit Committee provides oversight as it relates to annual audits related to information technology and cybersecurity. Management promptly reviews results of these audits to initiate necessary remediation, which are then reviewed by the Audit Committee.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Although we expend significant resources to protect against security breaches, our existing security measures have not been and may not be successful in preventing all attacks. We have experienced cybersecurity incidents and threats, including malware, phishing, account takeover attacks, denial-of-service attacks, and inadvertent disclosures of data. We do not believe these cybersecurity incidents have had a material adverse effect on our Company, including our business strategy, results of operations, or financial condition. However, the cybersecurity threat environment is increasingly challenging, and we, along with the entire digital ecosystem, face a constant and increasing threat. For further discussion, see Part I, Item 1A, Risk Factors - "Information Security, Cybersecurity, and Data Privacy Risks."

companyName: Booking Holdings Inc.

ticker: BKNG


text: Our cybersecurity risk management program also assesses third party providers, such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party providers and potential risks when handling and/or processing our employee, business or customer data.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: We incorporate external expertise and reviews as part of our cybersecurity program. For example, we have engaged an independent cybersecurity advisor to review, assess, and make recommendations regarding our information security program and information technology strategic plan. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party service provider for information technology ("IT") services, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to security standards and protocols. Further, we request that third-party service providers with access to personally identifiable information enter into data processing services agreements and adhere to our policies and standards.

companyName: CSI Compressco LP


text: The Fund depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Fund, the Advisor oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers, the frequency of such reviews is generally based on the nature of the the Advisor's information processed by the vendor and the vendor's criticality to business operations.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our SVP IT Infrastructure & Security, who reports to our Senior EVP IT. Additional oversight for assessing and managing cybersecurity risk include Executive sponsors, IT, Human Resources, IT Governance Risk and Compliance, Internal Audit, and Legal, as well as members of our Information Security Risk Council, IT Risk Committee, and ERM teams.

companyName: FASTENAL CO

ticker: FAST


text: Our Board of Directors delegates the responsibility for cybersecurity oversight to the Audit Committee and our VP of Integration and IT Operations, who also manages our general technology risk.

companyName: Lowell Farms Inc.

ticker: LOWLF