text: For the 2023 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director of Information Technology, who has more than 30 years of experience of building and managing critical systems that house sensitive data, and a dedicated information security analyst with more than 15 years of experience in providing protection and resilience against evolving threats. Our Executive Director of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. This member of the management team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: MANNKIND CORP

ticker: MNKD

secItem: Item 1C


text: Continuous monitoring systems are deployed to detect potential security incidents in real-time, ensuring a 24x7x365 capability to respond and mitigate. Cybersecurity Training and Awareness: New hire, annual, and ongoing security awareness training is given to all employees. Incident Response: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Paragon 28, Inc.


text: Bitwise, the parent of the Sponsor, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the Bitwise board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer of Bitwise and therefore is able to report directly to Bitwise's board of directors regarding cybersecurity risks to the Trust and the Sponsor.

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;

companyName: TMC the metals Co Inc.

ticker: TMC


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board of Directors has overall responsibility for risk oversight, the Board of Directors has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee of our Board of Directors. The Audit Committee reports to the Board of Directors at least annually, and notifies the Board of Directors as necessary regarding significant new cybersecurity threats or incidents. The Audit Committee meets annually to discuss our approach to overseeing cybersecurity threats with management, including with members of our internal cybersecurity team.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: Our cyber risk management program helps mitigate risks that could have a material adverse effect on our business, financial condition, results or operations, cash flows or reputation. See "Risk Factors – Risks Related to Our Business Operations – Security breaches and other disruptions could compromise our information and expose us to liability, and could cause our business and reputation to suffer."

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: While we have implemented extensive measures to fortify our defenses against cyber threats, it is important to acknowledge that the cybersecurity landscape is constantly evolving, with threat actors employing increasingly sophisticated tactics. Despite our best efforts, we cannot guarantee that our systems will be completely immune to cyber attacks. We remain vigilant in our efforts to protect our systems and data and continue to invest in our cybersecurity program to address emerging threats.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Our SVP, Engineering and our VP, Technology & CISO are the members of our management team who are primarily responsible for assessing and managing our material risks from cybersecurity threats. Their team has primary responsibility for our overall cybersecurity risk management program and they supervise our internal cybersecurity personnel and our external cybersecurity consultants. Our management team has deep expertise in e-commerce and consumer retail. In addition, our VP, Technology & CISOs experience includes developing secure products as well as head of security and CISO positions at both public and private companies.

companyName: Rent the Runway, Inc.

ticker: RENT


text: Our cybersecurity programs are under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and dedicated security leaders are certified and experienced information systems security professionals and information security managers each with well over a decade of experience. Our CISO and information security team, along with our management, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity programs.

companyName: MongoDB, Inc.

ticker: MDB


text: Mann, our Global IT Manager, is responsible for information security, and has 33 years of IT-related work experience. Our Chief Financial Officer leads our management's efforts to keep the Audit Committee informed regarding on cybersecurity risks and events, and will provide briefings to the Audit Committee on no less than an annual or ad hoc basis when needed. These briefings encompass: evaluation of existing cybersecurity risks; of ongoing cybersecurity initiatives and strategies, and incident reports and learnings from cybersecurity events.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Audit Committee and ultimately, the Board of Directors (the "Board") where that oversight and review takes place at a regular cadence. The Company's Security & Compliance Team ("S&C Team") has established policies, procedures, and controls to protect information assets, mitigate risks, and ensure compliance with relevant laws and regulations. The S&C Team regularly reviews and updates security practices, and stays updated on emerging threats, best practices, and evolving regulatory requirements to adapt Upland's security measures accordingly.

companyName: Upland Software, Inc.

ticker: UPLD


text: During the fiscal year ended December 31, 2024, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations, or financial condition.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: Our CEO has ultimate responsibility for developing strategy and overseeing execution to meet the firm's objectives. The CEO has delegated to our Chief Operating Officer (COO) oversight of this operational execution. The COO has several leaders within the COO organization who develop and oversee the firm's risk management, technology, and information security practices. These executive leaders play a critical role in cybersecurity risk management and strategy, as further described below.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: Our Systems Application Manager oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. Our Systems Application Manager also coordinates with our legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our management team is informed about the effectiveness of the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes.

companyName: OLB GROUP, INC.

ticker: OLB


text: Our cybersecurity controls are monitored and refined based on learnings from regular red team engagements and analysis by threat hunters. All cyber defense operations are enriched through a dedicated cybersecurity threat intelligence function. We collaborate with information security peers across the industry to maximize threat intelligence. Our threat intelligence program helps create awareness and understanding of potential cybersecurity threats and adversaries. We proactively assess potential risks presented by new services or systems integrated with our network or data and ensure appropriate controls are applied under such circumstances. We perform due diligence and monitor third party relationships based on risk profile to assess the suitability of their cybersecurity controls and protocols for the business operations or services for which they are engaged.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: Global threat intelligence is monitored for potential Security risks or vulnerabilities. These threats are analyzed for potential impact to the bank and are addressed in accordance with Program requirements. b1BANK's Chief Information Security Officer ("CISO") presents Security reports to the Operating Committee and Risk Committee of b1BANK's board of directors on a quarterly basis or as needed. These reports consist of significant Security events and issues, vulnerability metrics, and material risks. Additional reporting representing the overall state of the Program is presented on at least an annual basis to the full board of directors, which is responsible for overseeing Security functions and associated initiatives.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: Risk Management, Strategy, and Governance Cybersecurity Integration with overall risk management Cleco's business operations rely on complex and evolving operational and information technology systems and network infrastructures. Digital information, information technology, and automation are essential components of Cleco's operations and growth strategy. Cleco continues to assess its cybersecurity tools and processes and has taken a variety of actions to monitor and address cyber-related risks. These cybersecurity tools and assessments are embedded in Cleco's overall enterprise risk management system. Cleco utilizes the following tools, methodologies, and standards to assess, identify, and manage material cybersecurity risks: • NERC CIP standards, which protect Cleco's operational technology and National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which provides frameworks to protect Cleco's operational and information technology, • Sarbanes-Oxley Act (SOX) regulations, which require Cleco to maintain access and security controls for certain systems that are essential to the completeness and accuracy of financial reporting, • internal and third-party assessments to identify, monitor, and defend against prioritized risks, • a unified Cybersecurity Incident Response Plan (CSIRP), • a Security Operations Center managed 24 hours a day by a third party, • other cybersecurity suppliers, and • relationships with various local, state, and federal law enforcement agencies.

companyName: Cleco Corporate Holdings LLC


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function through its audit committee.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: Commvault maintains a variety of third-party certifications and undergoes annual assessments for SOC 2 Type 2, ISO 27001, HIPAA, CJIS, and PCI DSS. In support of these certifications and assessments, our products also undergo security testing. Annually, internal auditors complete a risk assessment of specific business operations like privacy and sanctions compliance or travel & expense policy compliance, identify areas of heightened risk, and conduct dedicated audit engagements at the direction of Management. The findings, observations, and recommendations from these engagements are shared with Management and the Audit Committee, as appropriate.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: Management's Role Managing Risk Matthews' CIO and Director of IT Security are primarily responsible for assessing and managing material risks from cybersecurity threats. The CIO reports directly to the Company's Chief Financial Officer, and the Director of IT Security reports to the CIO. The CIO, Director of IT Security, and the Company's cybersecurity team have decades of experience in various roles managing information security, developing cybersecurity strategy, and implementing, planning and operationalizing a comprehensive global IT infrastructure.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: We have adopted a variety of data security controls, and we have a defined protocol for identifying, containing, and remediating cybersecurity incidents. Our cybersecurity program is aligned with our overall enterprise risk management strategy and leverages the National Institute of Standards and Technology security framework to drive strategic direction and maturity improvement. This program is led by our Chief Information Security Officer ("CISO"), who has served in the role since 2020, has over 10 years of experience leading cybersecurity programs at large enterprise organizations, and holds a Ph. D. and master's degree in Information Assurance and Security. We also utilize our Information Security Steering Committee ("ISSC"), a cross-functional group of senior internal stakeholders responsible for identifying and addressing significant security risks that could impact customers, our platform, or our corporate environment. The ISSC makes recommendations to escalate risks to senior leadership and our Board, and also determines, and reviews annually, our security risk tolerance including setting acceptance criteria for security related risks.

companyName: SMARTSHEET INC


text: We regularly evaluate and adjust our information security procedures by integrating emerging technologies, revised frameworks and industry best practices. We require employees to participate in periodic training covering information security-related topics, maintain informational content on our internal portals and conduct ongoing simulated phishing exercises.

companyName: PRA GROUP INC

ticker: PRAA


text: We maintain an incident response and recovery plan (the "IRR Plan") that guides our activities in preparing for, detecting, responding to, and recovering from cybersecurity incidents. The IRR Plan identifies the working group responsible for the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRR Plan also covers the range of activities we undertake in connection with responding to cybersecurity incidents, including monitoring, identification, investigation, assessment, containment, remediation, and mitigation, as well as compliance with legal obligations including any necessary regulatory reporting. Incidents are evaluated, ranked by severity, and prioritized for response, remediation and reporting, if needed.

companyName: Karat Packaging Inc.

ticker: KRT


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. We also process anonymized information about participants in clinical trials involving certain of our product candidates. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: We believe cybersecurity plays a strategic role in ensuring smooth business operations. We are committed to developing, implementing and maintaining cybersecurity measures and processes that are designed to safeguard our information systems, data and operations, and to assess, identify and manage cybersecurity threats that may impact our business.

companyName: Clearfield, Inc.

ticker: CLFD


text: Our enterprise cybersecurity program is led by the CSO who oversees both information technology and information security functions. Our CSO brings more than 20 years of cybersecurity experience in various leadership positions, both in technology and finance industries. He holds a doctorate degree from the University of Michigan and holds over 100 US and global security-related patents. In order to assess and manage our material risks from cybersecurity threats, our CSO works with cross-functional teams, which are staffed with subject matter experts and leaders from each of the following areas: • Cybersecurity: We follow a defense-in-depth security model with a Joint Security Operations Center (JSOC), Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack. • Privacy and Governance: Our Data Privacy and Governance team helps our technology teams build a lasting roadmap to creating our products, services, and standards with privacy by design, and transparency at the forefront. • People Safety and Crisis Management: Led by federal law enforcement veterans, our People and Partner Safety team is responsible for ensuring the security of our team members across the US. We also conduct regular tabletop exercises to ensure we are ready to respond to crises, including cybersecurity incidents. • Fraud Prevention: Our Fraud Strategy and Prevention team leverages industry best practices of fraud prevention, identity and access management, and cybersecurity monitoring to protect the transactions of our members and Clients.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: We have a multilayered framework for assessing, identifying, detecting and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology, or IT, systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would conduct an assessment of the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage third-party security services for audit, benchmarking, and improvement and use various tools and methodologies to manage cybersecurity risks that are tested regularly, including a cybersecurity assessment guided by the National Institute of Standards and Technology (NIST) cybersecurity framework and ongoing security awareness training. We oversee third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring. Vendors are assessed for risk based on the nature of their digital footprint, company profile, domain name services health, internet protocol reputation, external access threats and social engineering landscapes, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, and scans or other technical evaluations. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, simulated phishing tests, penetration tests, and threat intelligence feeds. The results of these assessments are reported to the Audit Committee of the Board of Directors.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: The above cybersecurity risk management processes are integrated into the Partnership's overall risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered an important component of our enterprise-wide risk management approach. We have assembled a Cybersecurity Steering Committee comprised of IT management, cybersecurity specialists, and representatives of business management, including the CTO and internal legal counsel. The Cybersecurity Steering Committee reviews information security policies and cybersecurity risks in conjunction with other operational, financial, and strategic risks to ensure alignment with our business objectives. The Cybersecurity Steering Committee convenes regularly to review and monitor the Partnership's programs for the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Cybersecurity Steering Committee receives reports on security incidents, threat intelligence, and vulnerability assessments from our IT Security Department.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While the Company has taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: Our cybersecurity program is led by our Chief Information Security Officer, who is responsible for assessing and managing our information security and technology risks (including cybersecurity). He has more than 25 years of experience in information security and information technology risk management, holding chief information security officer positions with Fortune 500 companies in the retail, healthcare and life sciences industries. He has also served on the Health-ISAC board of directors and is a Certified Information System Security Professional (CISSP).

companyName: AbbVie Inc.

ticker: ABBV


text: Our Director of Cybersecurity has over 20 years of relevant experience and is responsible for managing our cybersecurity program and team, which monitors the day-to-day risks using the approach described above. Material near-term and long-term risks are communicated with senior management and the Board of Directors. The Company's Board of Directors is engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and exposures. While the Board of Directors retains oversight over policy and strategy related to cybersecurity, it has delegated the responsibility for the oversight of the Company's cybersecurity program to the Audit Committee. The Audit Committee is responsible for reviewing and discussing the Company's policies regarding risk assessment and risk management, major accounting risk exposures and the implementation and effectiveness of risk management protocols with respect to information technology security and cybersecurity risks, as well as reviewing material breaches and attacks, as applicable.

companyName: DT Midstream, Inc.

ticker: DTM


text: In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third -party cybersecurity firms. Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting its customers and stakeholders' interests. A cybersecurity policy should be designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.

companyName: NETWORK CN INC

ticker: NWCN


text: Risk Management and Strategy DTE Energy maintains cybersecurity measures designed to protect its physical and digital infrastructure in order to provide safe and reliable delivery of energy to customers. These measures serve to maintain compliance with regulations and protect the confidentiality, integrity and availability of confidential and proprietary information, DTE Energy's computing resources, and the electrical and gas systems.

companyName: DTE Electric Co


text: We have a third-party vendor management program that oversees the identification and assessment of cybersecurity risk for the Company's use of all third-party service providers. This program evaluates third-party vendors based on their level of access to the Company's data and the level of potential risk the third-party service providers create for the organization through reviews of their security program and systems architecture. The Company identifies monitoring and mitigating controls and implements such controls where appropriate for any identified risks, including adding robust security terms in agreed contracts. We also monitor and periodically reassess third-party service vendors to ensure controls are maintained to expectations.

companyName: Jackson Financial Inc.

ticker: JXN


text: As part of our overall risk management system, we monitor and test our safeguards and we train our relevant employees on these safeguards, in collaboration with our third-party IT provider and management. Since users are typically the weakest link in any information system, we periodically train all our employees on good cybersecurity practices, including password management, phishing prevention, and other security awareness issues. have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could materially affect us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.

companyName: Replimune Group, Inc.

ticker: REPL


text: We rely heavily on third-party suppliers and vendors, and a cybersecurity incident at one of our suppliers or vendors could have a material adverse impact on our business operations. We evaluate third-party cybersecurity risk controls through various assessment activities carried out by LP employees and by third-party service providers acting on our behalf. We engage an independent third party to conduct an annual Security Program Assessment under the Capability Maturity Model Integration framework. For incident alerts and response, we outsource around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. In 2023, we also engaged a specialized third-party assessor to perform an operational technology security assessment for a subset of our manufacturing facilities. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration results in cybersecurity considerations as a key part of our decision-making processes. Our cybersecurity team considers emerging threats and new vectors of cyberattack and pursues a deliberate risk-avoidance approach. We also maintain our written security incident response runbook detailing the response and notifications involved with various security events.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including, but not limited to, financial, operational, regulatory, reputational, and legal risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer and Chief Technology Officer are primarily responsible for this cybersecurity component. The Chief Technology Officer is responsible for the first line of defense and has assembled a capable team of professionals with expertise in cybersecurity. The Chief Information Security Officer is a key member of the Risk Management organization, reporting directly to the Chief Risk Management Officer and, as discussed below, provides updates to the Audit & Risk Committee of our Board of Directors.

companyName: National Bank Holdings Corp

ticker: NBHC


text: We have a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: AMERIGUARD SECURITY SERVICES, INC.

ticker: AGSS


text: We have established monitoring procedures in our effort to mitigate risks related to cybersecurity incidents. As part of our cybersecurity risk management, we have adopted a business continuity and incident response plan, which is designed to establish our processes for identifying and responding to significant events that may lead to a business disruption or crisis, including those arising from or related to cybersecurity threats.

companyName: TELA Bio, Inc.

ticker: TELA


text: For additional information, see Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk Management.

companyName: Federal Home Loan Bank of Indianapolis


text: The full Board of Directors receives reports from the Technology Committee and the Risk and Compliance Committee about the Bancorp's cybersecurity programs as a result of the above-described oversight. In the event of a material cybersecurity incident, the Bancorp's incident response procedures include notifications to the Technology Committee, Risk and Compliance Committee and full Board of Directors, when appropriate and necessary.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company- wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our Risk Management Team (see " Management's Role Managing Risk " below for details regarding the team members and scope) works closely with our Information Technology ("IT") team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Energy Recovery, Inc.

ticker: ERII


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Chief Financial Officer. This team is at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats.

companyName: Onconetix, Inc.

ticker: ONCO


text: The oversight of the Company's cybersecurity risk management process is integrated into our annual Enterprise Risk Management ("ERM") process. Our ERM process is designed to enable leaders to identify and assess leading risks facing the Company, including risks related to cybersecurity, and work collaboratively to implement plans to mitigate these risks. We also utilize third-party experts to evaluate the Company's security program and test operational effectiveness of our security controls.

companyName: TRIMAS CORP

ticker: TRS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer, Vice President of Information Technology and Senior Vice President of Legal, working closely with our third-party information technology team; the senior staff members of our third-party information technology team have been in business providing services to similarly situated companies in our industry for more than approximately 28 years, including extensive experience addressing complex information technology and cybersecurity matters. Company management has over 27 years of experience in cybersecurity and information technology matters, including multiple senior information technology leadership roles supervising cybersecurity teams and establishing cybersecurity risk assessment programs in the biotech industry.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: Cybersecurity is the responsibility of our information security team, overseen by our Chief Information Security Officer ("CISO"). Our CISO reports to our Chief Information Officer ("CIO"), and our CISO and CIO regularly meet with our General Counsel to review cybersecurity risks, and evaluate their nature and severity, as well as identify potential mitigation and assess the impact of those mitigations on residual risk. Our enterprise risk management program also considers cybersecurity risks, including risks associated with our use of third-party service providers, alongside other company risks, and as part of these efforts, we gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. Our enterprise risk management program is reviewed annually with our Board.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: Our CISO and CDTO have extensive experience and expertise in developing, implementing, and operating security policies and procedures covering our network and critical data. Our CISO has 35 years of experience in information technology systems and is a 25-year military veteran of the U.S. Navy and Navy Reserves with a Top Secret/Sensitive Compartmented Information (TS/SCI) U.S. security clearance and multiple combat deployments in information warfare. Additionally, our CISO holds several certifications, including, among others, the following security certifications: Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Network Defense Analyst (CNDA), Disaster Recovery Institute International (DRII), and CompTIA – Network+ and Security+. Our CDTO has over 25 years of leadership experience across all aspects of technology-enabled digital transformations, including leading multiple transformations at a major airline prior to his role at AAR. He previously advised companies across multiple industries in collaboratively developing and executing their digital and technology roadmaps as a consultant at a major firm.

companyName: AAR CORP

ticker: AIR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CFO who serves as our CISO. Our CISO relies on both internal and external cybersecurity resources to manage overall cybersecurity risks.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: The Company recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks affecting the Company. The Audit Committee and senior management are actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: 22nd Century Group, Inc.

ticker: XXII


text: As part of our overall risk management system, we assess our safeguards in collaboration with various functional teams, including Information Security, Information Technology, Risk and Legal, and train our employees on these safeguards. Personnel at all levels and teams are required to receive periodic security awareness training to ensure that they understand our cybersecurity policies and their roles in protecting our information systems or any information residing therein.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our vCISO at DeepSeas Security. With over 20 years of global leadership and management experience in the field of cybersecurity, our vCISO brings a wealth of expertise to his role. His experience includes prior CISO leadership roles in the fintech sector, where he developed an expert level of understanding of the intersection between financial regulations and cloud-based technologies. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our vCISO oversees our governance programs, works with our technology-focused leaders and partners to align security and compliance, and has helped define our employee security awareness training program.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: Effective risk management is a critical component of our operations. The ISC conducts a formal cybersecurity risk assessment annually. The assessment methodology is designed to identify cybersecurity threats to our information systems and considers a range of relevant risk factors that include both intentional and unintentional human acts by our or our vendors' personnel, or malicious third-party actors, risks inherent to technology/equipment we and our service providers use, as well as natural and environmental risks. The ISC discusses and documents mitigation strategies based on the risks identified. Results of assessments are reported to senior leadership and our board of directors. To the extent that any control deficiencies or material changes in the threat environment are identified, the ISC may make recommendations for new or improved controls and threat mitigation strategies.

companyName: MARCHEX INC

ticker: MCHX


text: For the year ended December 31, 2024, Everest has not experienced any cybersecurity incident that materially affected the Company, including its business strategy, results of operations or financial conditions.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: Our employees are required to take annual cyber security training designed to help employees guard our cyber and physical data. Employees are tested on this training.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and risks incidents. The Company's Chief Information Officer is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Chief Information Officer and his team have over 40 years of experience in information security and possess the requisite education, skills, experience, and industry certifications expected of individuals assigned to these duties. The Chief Information Officer provides regular updates on our cybersecurity risk profile to the Audit Committee of our Board.

companyName: NET Power Inc.

ticker: NPWR


text: The Risk Committee of the Board has oversight of the Bank's Risk Management Program which includes risks from cybersecurity threats within cybersecurity risk management. The Technology Committee of the Board has responsibility for the strategic design, direction and oversight of the Bank's information and cybersecurity program.

companyName: Federal Home Loan Bank of New York


text: Senior management regularly discusses on at least a quarterly basis and otherwise as needed, cyber risks and trends and, should they arise, any material incidents with the Audit Committee.

companyName: Digital Turbine, Inc.

ticker: APPS


text: We have a written cybersecurity incident escalation process overseen by senior leadership, and when senior leadership deems appropriate, a materiality committee is convened comprised of certain members of management who assess whether incidents must be reported to the SEC and/or the appropriate authorities.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: The Board, in coordination with our Global Data Governance Board (GDGB) and the Audit Committee, oversees our risk management program, including the management of cybersecurity threats. The GDGB receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security.

companyName: Live Nation Entertainment, Inc.

ticker: LYV


text: In addition, we utilize a third-party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. The TPRM program is designed to help ensure proper controls and measures are in place to manage the potential risks and vulnerabilities associated with third parties. Our policies and procedures aid in the governance from initial due diligence, selection, and contracting to termination.

companyName: Phillips 66

ticker: PSX


text: We rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" under the heading "Risks Related to Cybersecurity and Technology," which should be read in conjunction with the foregoing information.

companyName: Innovex International, Inc.

ticker: INVX


text: We recognize the critical importance of maintaining the confidentiality, integrity and availability of our information systems and data, and of effectively, assessing, identifying and managing cybersecurity and related risks. Our cybersecurity risk management program is integrated into our Enterprise Risk Management framework and utilizes a holistic approach to addressing cybersecurity risk, and it is supported by our employees, cybersecurity team, senior management, the Enterprise Risk Management committee (a committee comprised of primary corporate functions) and our Board of Directors. The underlying controls for the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) and the Center for Internet Security Benchmark (CIS).

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: Our cybersecurity program, and its associated CSMS, is led by an experienced team of cybersecurity professionals headed by the Vice President of Cybersecurity. In the event of a cybersecurity incident, we have a dedicated Cybersecurity Incident Response Team that is responsible for identifying, escalating, responding to and managing cybersecurity incidents, including interdiction and remediation, as well as conducting the initial investigation, gathering and analyzing data, mitigating damage to the informational assets and infrastructure of Ansys, restoring normal services and system integrity and implementing actions designed to prevent future cybersecurity incidents. This team reports to the Vice President of Cybersecurity. In the event of a significant cybersecurity incident, a cross-functional team comprised of cyber, legal and finance personnel work together to determine the materiality of an incident.

companyName: ANSYS INC


text: Third Party Risk Management Because we are aware of the risks associated with third-party service providers, we have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such third-party service providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of any heightened risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and certifications by third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and we investigate security incidents that impact our third-party providers, as appropriate.

companyName: Sezzle Inc.

ticker: SEZL


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. We have engaged a third-party vendor to provide a variety of cybersecurity services ranging from ongoing security advisory services to cybersecurity monitoring and response management.

companyName: Sphere 3D Corp.

ticker: ANY


text: We have implemented a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity incident to provide a standardized framework for responses. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel, including third-party contractors, vendors and partners, that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to our data and systems, including malware, phishing, and other types of cyber-attacks. For more information about the cybersecurity risks we face, see the risk factors described in Part I, Item 1A, Risk Factors in this Annual Report on Form 10-K.

companyName: Workhorse Group Inc.

ticker: WKHS


text: The Company's Third-Party Risk Management program is designed to ensure that its vendors meet its cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with the Company's cybersecurity requirements.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: We design and assess our information security program with reference to the ISO 27001:2022 standard. For interoperability, our controls leverage the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use ISO 27001:2022 and NIST CSF as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TechnipFMC plc

ticker: FTI


text: The cybersecurity committee of our board of directors has oversight responsibility for cybersecurity risks. The CISO provides updates at least twice a year to the cybersecurity committee regarding matters related to information technology and cybersecurity risks including the state of our cybersecurity programs, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risk. Additionally, the full board of directors receives updates on our cybersecurity program twice a year as part of the enterprise risk management meetings.

companyName: TE Connectivity plc

ticker: TEL


text: Material cybersecurity incidents are required to be reported to the Board of Directors and to the SEC on Form 8-K. Our systems and services are vulnerable to interruptions or other failures resulting from cybersecurity attacks, such as computer viruses, ransomware, phishing, hackers, or other security issues. In addition, the rapid evolution and increased adoption of new technologies, such as artificial intelligence, may intensify our cybersecurity risks. An interruption or cybersecurity breach, disruption or misuse of our information systems, or the information systems of our third-party service providers, could have a material negative effect on our business, financial condition and results of operations but we have processes in place to mitigate these risks. As of the date of this report, in the past twelve months, we have not experienced material business disruption, monetary loss, and/or data loss as a result of phishing, business email compromise or other types of attacks, and we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we cannot guarantee that material incidents will not occur in the future.

companyName: Primo Brands Corp

ticker: PRMB


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Refer to the risk factors under "Operational Risks" in Part I, Item 1A, "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Argo Group International Holdings, Inc.


text: Our Cybersecurity Incident Response Team ("CIRT") is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify our Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.

companyName: Level 3 Parent, LLC


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools and third-party managed security services that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. We also evaluate the information security of potential partners and vendors as part of our selection process and attempt to negotiate adequate protections from such third parties when we enter into contracts with them. Although our security program is designed to identify, prioritize, assess, mitigate and remediate third party risks,, we rely on our partners and vendors to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: AGILYSYS INC

ticker: AGYS


text: Julie A. McAlindon, age 57, is Senior Vice President, Regions and Chief Supply Chain Officer. Ms. McAlindon has responsibility for overseeing global supply chain, sourcing and procurement, and regional leadership outside of North America. Ms. McAlindon also leads the transformation of Eastman, building the capabilities and culture required to support Eastman's strategy. Prior to this role, Ms. McAlindon was Chief Procurement Officer and Vice President, Transformation. Ms. McAlindon joined Eastman in 2016. Before joining Eastman, Ms. McAlindon was with Avient Corporation as senior vice president, designed structures and solutions; and vice president of marketing. Prior to that, Ms. McAlindon's work experience includes a variety of leadership positions with The Dow Chemical Company. Ms. McAlindon was appointed to her current position effective June 2021.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: As part of our cybersecurity program, we maintain various protections designed to safeguard against cyberattacks, including firewalls, anti-malware, intrusion prevention and detection systems, access controls and other encryption configurations and cybertechnologies, and continuously monitor and audit our information technology and data assets to detect any anomalies and to respond quickly to threats that may arise. We periodically conduct intrusion and penetration testing through third parties to evaluate our cybersecurity response capability. We also regularly conduct employee awareness training on email management (phishing), safe internet browsing, malware, and other cybersecurity risks and routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques, and how to avoid them through our established communications channels.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, we have not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2023. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: The prevention, detection, mitigation and remediation of cybersecurity incidents at Dexcom is accomplished pursuant to various policies, procedures and processes, including incident response plans and the cybersecurity and privacy programs and controls described above under "Risk Management and Strategy." These measures include escalation protocols through which the Cybersecurity and Privacy Committee is informed about cybersecurity and incidents by our ISO and PSO, who are informed through our business units. As described above, members of the Cybersecurity and Privacy Committee provide updates to the Technology Committee of the Board on a regular basis, and the full Board receives updates from the Technology Committee. In addition, there are protocols in place for immediate escalation in the event of any cybersecurity issues or developments that may require consideration between regularly scheduled Technology Committee or Board meetings.

companyName: DEXCOM INC

ticker: DXCM


text: Cyber Expertise & Experience As discussed above, EOG's cybersecurity team consists of in-house cybersecurity professionals and external threat analysts, consultants and service providers. EOG's in-house professionals and external threat analysts possess various cybersecurity certifications.

companyName: EOG RESOURCES INC

ticker: EOG


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Kronos Bio, Inc.


text: Our Chief Executive Officer and Chief Accounting Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: TRANS LUX Corp


text: While to our knowledge no previous cybersecurity incidents have occurred, we seek to continuously expand and improve our information technology systems, including implementing new internally developed and/or external industry standard enterprise resource planning systems ("ERP systems"), to assist us in the management of our business. We maintain information technology measures designed to protect us against intellectual property theft, data breaches and other cyber-attacks. The implementation, maintenance and improvement of these systems require significant management time, support and cost. Moreover, there are inherent risks associated with developing, improving and expanding our core systems as well as implementing new systems, including the disruption of our data management, procurement, manufacturing execution, finance and supply chain processes.

companyName: Cenntro Inc.

ticker: CENN


text: We have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Employing appropriate incident prevention and detection safeguards; • Maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; • Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • Reviewing and evaluating new developments in the cyber threat landscape.

companyName: LGI Homes, Inc.

ticker: LGIH


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the members of senior leadership, which includes the Company's Vice President of Information Technology.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: We maintain cybersecurity programs that include physical, administrative, and technical safeguards, and we maintain plans and procedures with the objective of helping us prevent and timely and effectively respond to cybersecurity threats or cybersecurity incidents. Through our defense strategy and cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors to Company systems. We evaluate the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. We integrate our cybersecurity practices into our Enterprise Risk Management ("ERM") program, which is overseen by our Audit Committee and provides central, standardized frameworks for identifying and tracking cyber-related business and compliance risks across the Company. In addition, we periodically engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents. This process includes regular penetration and vulnerability testing.

companyName: HIBBETT INC


text: We have a global cybersecurity program designed to identify, protect, detect, respond to and recover from cybersecurity risks and threats. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our cybersecurity program and also leverage audits by our internal audit team, penetration and vulnerability testing and other exercises to evaluate the effectiveness of our cybersecurity program and improve our security measures and planning.

companyName: AVIENT CORP

ticker: AVNT


text: Our board of directors considers cybersecurity risks as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management efforts.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: We are subject to numerous cybersecurity threats which could result in equipment or network failures, loss of information (including sensitive personal information of customers or employees or proprietary information) as well as disruptions to our or our customers', suppliers' or vendors' operations. Cybersecurity risks we face include threats from entities and persons that may seek to target our information technology ("IT") or operational technology ("OT") infrastructures or use malware, computer viruses, denial of services attacks, ransomware attacks, credential harvesting, social engineering and other means to obtain unauthorized access to or disrupt the operation of our networks, systems and those of our suppliers, vendors and other service providers. In addition, we may face cyber threats from parties that seek to target us through our customers, suppliers, vendors and other stakeholders with whom we do business. Cybersecurity threats are constantly evolving and becoming increasingly sophisticated and complex, increasing the difficulty of detecting and successfully defending against them.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: The CIMT responds to potential cybersecurity incidents raised to its attention by making an assessment of the event to determine if a cybersecurity incident has, in fact, occurred, identifying any assets impacted by the incident, determining any information stored and processed by assets identified as compromised, assessing the nature and level of damage that has occurred (accessed, exfiltrated, released to the public, etc.) and revising the assessment throughout the incident response process when additional details are identified.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: We aim to be proactive in our approach to cybersecurity, with our practices informed by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This approach aids us in identifying and managing cyber risks in a manner that aligns with our business operations. While the NIST CSF serves as a guiding framework to help us identify, assess, and manage cybersecurity risks, this does not imply we adopt a blanket adherence to its standards and requirements in all respects. Our cybersecurity risk management program is further informed by the industry-recognized certifications we have obtained through comprehensive third-party evaluations, including ISO/IEC 27001:2022, ISO 27701, ISO 27799, ISO 22301, SOC 2 Type 2, and SOC 3.

companyName: KALTURA INC

ticker: KLTR


text: The Company places a high priority and focus on securing the confidential information it receives and stores about its borrowers, depositors and other customers and employees as well as sensitive information regarding financial transactions and the Company's information systems. This priority and focus starts at the Company's board of directors, which is ultimately responsible for risk oversight, establishing the Company's risk appetite, understanding the Bank's key risks and assuring the risk management strategy, processes and internal controls are appropriate to manage risk, in each case inclusive of cybersecurity risk. The Company's board of directors approves an information security policy and program (the "Information Security Policy and Program"), which contains a statement of the Company's risk appetite with respect to cybersecurity matters, on an annual basis. The Company's risk appetite includes specific information security risk tolerance thresholds and limits established with the approval of the Company's board of directors and executive management. Key risk indicators are monitored by the Risk Oversight Committee of the Company's board of directors (the "Risk Oversight Committee"), which receives quarterly reports from the Company's Chief Risk Officer, Information Security Officer and Enterprise Risk Management Committee regarding management's efforts to protect the Company from cybersecurity threats and the general threat landscape facing companies with operational characteristics similar to the Company's. The Risk Oversight Committee reports quarterly to the Company's board of directors regarding the Company's cybersecurity risk oversight processes as the board of directors seeks to ensure the Company is operating within its stated risk appetite.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments, vendor available software updates and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms and services established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to vetting, identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity and information technology threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested, evaluated and updated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. Cybersecurity incidents are assessed for materiality based on potential impacts to operations, financial condition or sensitive data. Material incidents are publicly disclosed within four business days of determining materiality, in compliance with SEC requirements. For the reporting period, no material cybersecurity incidents were identified that required disclosure. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's ERM function and the Company's Chief Information Security Officer.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of potential risks, both internal and external, that could affect our business operations, financial stability, and reputation, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Our risk assessment methodology considers historical data, control effectiveness, and expert analysis to quantify and prioritize risks accordingly.

companyName: Yext, Inc.

ticker: YEXT


text: Cyber threat actors and the types of threats posed are becoming more sophisticated and effective and are increasingly targeting commercial companies. In seeking to mitigate these cyber threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data, customers and other stakeholders entrusted to us, a top priority. The board of directors and our management are actively involved in the oversight of our risk management program, which includes cybersecurity. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. There may be instances where our policies and procedures are not properly followed or where such policies and procedures prove to be ineffective. As of the date hereof, we are not aware of any material risk from cybersecurity threats that has materially affected the Company, including our business strategy, results of operations or financial condition. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding risks related to system security risks, data protection breaches and cyber-attacks, see the risk factor entitled "System security risks, data protection breaches, and cyber-attacks could compromise our proprietary information, impair customer and vendor relationships, disrupt our internal operations, harm perception of our products and expose us to litigation and/or regulatory penalties, which could have a material adverse effect on our business and our reputation" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: CPI Card Group Inc.

ticker: PMTS


text: Vendor security is maintained using programs that evaluate the risk associated with service providers and business partners, focusing on the nature of data accessed or retained. This risk-based approach guides our due diligence and security assessments for selected vendors, ensuring that our contracts reflect the necessary security commitments.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: Management is responsible for identifying and assessing material cybersecurity risks on an ongoing basis and for developing, managing and implementing our cybersecurity program to assure that our potential cybersecurity risk exposures are monitored and appropriate mitigation measures are implemented. Our cybersecurity program is overseen by our Vice President, Information Technology and our Director, Enterprise Security. Our Vice President, Information Technology has significant professional experience in leading the information technology function and our Director, Enterprise Security has held various roles in cybersecurity and is an ISC2 Certified Information Security Professional (CISSP). Each periodically participates in various industry cyber forums and communicates industry best practices to the appropriate internal information security professionals.

companyName: MASCO CORP /DE/

ticker: MAS


text: Our Board oversees cybersecurity risk as part of its overall risk oversight function. Our information technology department (the "IT Department"), which functions as our Information Security Advisory Team, is responsible for managing our information security program and implementing cybersecurity risk management practices. The IT Department is led by our Chief Information Officer, who oversees our cybersecurity strategy and ensure its alignment with business objectives.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: We believe that currently we have no t encountered a cybersecurity event that has had a material impact on our business. See Item 1A. "Risk Factors" for a discussion of our cybersecurity risk.

companyName: CXJ GROUP CO., Ltd

ticker: ECXJ


text: As is the case for most large global companies, we are regularly subject to cyberattacks and other cybersecurity incidents and, therefore, we incorporate cybersecurity into our overall risk management process. Our commitment to cybersecurity emphasizes using a risk-based, "defense in depth" approach to assess, educate, block, identify, respond to and recover from cybersecurity threats. Recognizing that no single technology, process or control can effectively prevent or mitigate all risks, we employ a strategy of technologies, processes and controls, all working independently but as part of a cohesive strategy to manage or reduce risk.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: The Company's CSO is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. Our CSO has held leadership positions in information security for over 30 years, including serving as Chief Security Officer of large public and private organizations, with a high focus on data security. Team members that support the CSO and our information security program have relevant educational and industry experience, including holding Certified Information Systems Security Professional certifications.

companyName: Upland Software, Inc.

ticker: UPLD


text: To better understand Viasat's threat landscape we partner with multiple U.S. government agencies to acquire and share cybersecurity threat intelligence related to threats, vulnerabilities, indicators of compromise, and current, relevant threat information that are expected as a cleared defense contractor and active Defense Industrial Base (DIB) member. Partner entities include the Defense Cyber Crime Center (DC3), Defense Cybersecurity Information Sharing Environment (DCISE), DCMA, National Security Agency Cybersecurity Collaboration Center (NSA CCC), and Defense Counterintelligence and Security Agency (DCSA). Viasat is also an active participant in several Information Sharing and Analysis Centers (ISACs), including the National Defense (ND-ISAC), Aviation (A-ISAC), and Space (Space ISAC).

companyName: VIASAT INC

ticker: VSAT


text: Technical safeguards and incident response and recovery efforts. As part of our information security program, we have implemented a number of tools and procedures designed to identify and remediate vulnerabilities and misconfigurations in our applications and infrastructure, as well as manage access and identities throughout their lifecycles. These tools and procedures are intended to be consistent with ISO and NIST frameworks, In addition, we have implemented an incident response policy that outlines established processes for addressing cybersecurity issues that leverages a cross-functional cybersecurity incident response team and outside advisors intended to allow the Company to take action in a timely and decisive manner in compliance with applicable laws, rules and regulations during the response, investigation and remediation of a given cybersecurity incident.

companyName: IAC Inc.

ticker: IAC


text: If the Company's IT department identifies a cybersecurity incident, the IT department assesses such incident and its materiality. If the IT department makes a preliminary determination that a cybersecurity incident may be material, the IT department brings the incident to the attention of the Risk Committee. The Risk Committee then continues its assessment and makes the final determination whether the cybersecurity incident is material. The IT department, the Risk Committee, and any necessary third parties, including managed security service providers, forensic investigators, and internal and external auditors, collaborate in the response and management with respect to cyber incidents.

companyName: Orion Properties Inc.

ticker: ONL


text: In addition, our management team has established an internal Cyber Steering Committee (the "Cyber SteerCo"), which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks facing us, including cybersecurity risks. Each of the CDIO/CISO and CTO/CISO sit on the Cyber SteerCo along with our General Counsel and former CISO.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the IS Audit Committee oversight of cybersecurity, data privacy and other information technology risks. The IS Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: Management and Board of Trustees Oversight Our Board of Trustees oversees risk management for the Company, including through its approval of the investment policy and other policies of the Company and its oversight of the Advisor. For certain risks, our Board of Trustees has delegated oversight responsibilities to committees of our Board of Trustees. For example, the Nominating Committee assists our Board of Trustees with assessing risks associated with conflicts of interest. Cybersecurity risk management is integrated into this broader risk management framework. Our Board of Trustees has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Real Estate Debt BDC


text: We rely heavily on information systems to meet the operational and financial needs of our business. Therefore, we seek to continuously improve our approach to cybersecurity with the goal of ensuring the confidentiality, integrity and availability of our information resources and to reduce the risk of information loss by accidental or intentional modification, disclosure or destruction. We believe we devote appropriate resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: Overall Risk Management The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats. The cyber risk management program is maintained as part of the Company's overall governance, ERM program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company has and may continue to face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: Our CISO manages the Company's information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cyber threat detection and incident response. Our CISO promptly informs and updates the Board about any information security incidents that may pose a significant risk to the Company.

companyName: CORPAY, INC.

ticker: CPAY


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Responsibility for assessing, monitoring and managing our cybersecurity risks rests with third party expert consultants in conjunction with our IT Director, both reporting to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: CHICAGO RIVET & MACHINE CO

ticker: CVR


text: Board of Directors Oversight of Risks The Board is directly responsible for overseeing risks related to cybersecurity and is composed of board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: PROSPER MARKETPLACE, INC


text: The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions and our information systems, the Company has implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program. Key components of the cybersecurity risk management program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate these risks; and reports results to executive management and the Board; • A third-party MDR service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting; • A dedicated cybersecurity team covering critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence; • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks; • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online; • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: Veritex Holdings, Inc.


text: Our enterprise risk management process is overseen by our Chief Legal Officer and Chief Financial Officer. In collecting information on enterprise risk, cyber security is specifically included as a risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the audit committee and among senior management on a periodic basis. Further, in accordance with the committee's charter, the chair of the audit committee provides periodic updates on committee activities to the full board of directors, which may include discussion of any cyber risks.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. Our executive management team informs our Audit Committee on cybersecurity risks on a regular basis, at least once per year.

companyName: Rocky Mountains Group Ltd


text: Management considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. The cybersecurity governance committee will oversee the management's implementation of the cybersecurity risk management program.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Our cybersecurity risk management framework is based on the National Institute of Standards and Technology's Guide for Conducting Risk Assessments. For example, cybersecurity risks are assessed upon pre-defined matrices of probability and potential impact. Such risks are then recorded within an enterprise risk register along with risk treatment plans for approval from the Enterprise Risk Management Committee.

companyName: Poseida Therapeutics, Inc.


text: Vital aspects of our cybersecurity governance that are currently in process or have been implemented include the following: • Governance and Strategy: Management, the Audit & Risk Committee and the board ensure that our cybersecurity strategy is aligned with our business strategy. • Risk Management and Oversight: Our Audit & Risk Committee and the board, as part of the board's enterprise risk management oversight, actively oversee our cybersecurity risk management framework, ensuring that material risks are identified, assessed, and mitigated. • Resource Allocation: o Budget Approval: The board reviews and approves cybersecurity budgets and resource allocations to ensure we have adequate resources to implement and maintain effective cybersecurity measures.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: In the normal course of business, we also collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, customer information including bank account information and invoice and payment information, sensitive third-party information and employee information, and certain personal information. To protect this information and our systems, our existing cybersecurity protections include monitoring and detection programs and technical security measures. Additionally, we have processes in place that are designed to assess and manage cybersecurity risks associated with our use of higher-risk third-party service providers.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with the Company's information security team in an effort to continuously improve our cyber risk posture. Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, risk assessments and security certifications. The Company also receives independent audits on our global cybersecurity program from industry leading vendors at least annually.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: The standards set in our cybersecurity program include the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. These standards are guided, in part, by the relevant National Institute of Standards and Technology (NIST) and American Water Works Association (AWWA) frameworks and guidance. We use various tools, security measures and technologies to aid in seeking to protect our network perimeter and internal systems from unauthorized access, intrusion, or disruption. Assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: Our information security program is designed to continuously adapt to an evolving landscape of emerging threats and available technology. Through data gathering and evaluation of emerging threats from internal and external incidents and technology investments, security controls are regularly monitored and adjusted on an as needed basis. We have developed a data security strategy that is integrated within our overall risk management strategy and implemented through layers of controls embedded throughout our technology environment that establish multiple control points between threats and our assets. We test the effectiveness of our controls and data protection processes through internal and independent external audits and assessments, including regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate hacker attacks. Our information security program is supported by regular training of information technology employees and awareness training and activities for executives, directors, and employees companywide through which we communicate our information security policies, standards, processes and practices.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: Third-party vendors can present cybersecurity risks to the Company's technology resources. The Company has a vendor management team that provides oversight of third-party vendors and engages with the enterprise security team to assess potential cybersecurity risks related to a third-party vendor's services, both at the time of initial engagement and as part of an annual review process. The enterprise security team considers a number of factors in assessing such risks, including the types of services provided by the third-party vendor, the data and systems the third-party vendor needs to access to provide the services and the policies and controls the third-party vendor has in place to mitigate cybersecurity risks. Some third-party vendors present a higher risk and require additional approval before a contract is signed or renewed. This ensures leadership is aware of risks posed by third-party vendors and can consider this information when evaluating contracts.

companyName: Finance of America Companies Inc.

ticker: FOA


text: Engagement with Third Parties Our engagement with third-party service providers incorporates a thorough consideration of cybersecurity risks. Through our diligent evaluation process, we ensure that our partners adhere to stringent cybersecurity standards, safeguarding our data and systems against potential threats. This collaborative approach towards cybersecurity underscores our commitment to maintaining a secure operational environment for our stakeholders.

companyName: PAID INC

ticker: PAYD


text: The Board has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to the Board.

companyName: Worthington Steel, Inc.

ticker: WS


text: At least quarterly, management provides our Board and the Technology and Information Security Committee with updates about our cybersecurity and related risk exposures, our policies and procedures to mitigate such exposures and the status of projects to strengthen our information security infrastructure and program maturity and defend against and respond to cybersecurity threats. In addition, we use a risk-based escalation process to notify the Board and the Technology and Information Security Committee outside of the regular reporting cycle should we identify a significant emerging risk or potentially material issue that should be brought to their attention.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or reported by our third-party monitoring service that may affect our information services and have processes to assess those issues for potential cybersecurity impact or risk. We impose security requirements upon our suppliers and CROs, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.

companyName: MetaVia Inc.

ticker: MTVA


text: We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks. On an annual basis, we work with credible, third-party cybersecurity experts to assess our ability to prevent, identify, and respond to cybersecurity threats through internal and external penetration tests and monthly vulnerability scans. We also test our organizational cybersecurity capabilities through facilitated tabletop exercises which simulate real life scenarios. Together with the findings of the SOC 1 and 2 assessments, and our threat intelligence and monitoring activities, these exercises, tests and scans help us identify potential cybersecurity risks. When practical and necessary, we patch vulnerabilities that are identified.

companyName: JBG SMITH Properties

ticker: JBGS