text: The Corporation considers cybersecurity a subset of information security, and as such, cybersecurity risks and controls are assessed in our information security risk assessment and managed in our Information Security Program (ISP). The ISP is developed and maintained utilizing the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook and represents the standards, policies, procedures, and guidelines defining the Corporation's security requirements and related activities, which includes risk management and risk assessment practices. Management has designated the Information Security Officer (ISO), along with the Systems and Information Technology (IT) Steering Committee, with implementing and monitoring the ISP. The Corporation's IT department consists of the Chief Information Officer (CIO), who has over 40 years of experience in the IT field, including 14 with the Corporation, and other key personnel who have years of experience and various certifications related to assessing and managing cybersecurity risk. Additionally, the Corporation has established a comprehensive enterprise risk management program to monitor risks related to its operations, including cybersecurity risk, and the Corporation's Chief Risk Officer has primary responsibility for the enterprise risk management program. Management also engages the services of third parties to assist the ISO with their tasks. The Corporation believes that risk management is a component of overall governance and that IT risk management is a component of overall risk management.

companyName: C & F FINANCIAL CORP

ticker: CFFI


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Semnur Pharmaceuticals, Inc.

ticker: SMNR

secItem: Item 1C


text: Despite our efforts with respect to information technology operations, cybersecurity and data privacy, we have been, and may continue to be, impacted by breaches in data security and lapses in data privacy, which occur from time to time. During fiscal year 2025, the Company did not experience any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, cash flow or financial condition.

companyName: RBC Bearings INC

ticker: RBC


text: We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates a layered portfolio of employee training programs, multiple resources to manage and monitor the evolving threat landscape, Board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.

companyName: W. P. Carey Inc.

ticker: WPC


text: As a provider of SaaS solutions and an extensive user of a variety of technology services, we are subject to numerous risks from cybersecurity threats that have and could adversely affect us; however, to date none have materially affected us or our business strategy, results of operation or financial condition. Cybersecurity threats are ever-present and continuously evolving and we have and will continue to expend considerable resources to deliver solutions that are designed to comply with the stringent security and technical regulations and practices applicable to financial institutions and financial services providers and to safeguard our solutions and information systems against cybersecurity threats. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors." We have implemented a risk-based approach to identify and assess the cybersecurity threats that have and could affect our business and information systems, which approach is incorporated into our overall enterprise risk management program. Our enterprise risk management program includes a formal, enterprise-wide inventory, categorization and assessment of risks, including risks associated with cybersecurity threats, overseen by the Risk and Compliance Committee, or RACC, of our Board of Directors. This program is managed by our Chief Risk Officer, or CRO, appointed by the RACC, and an Enterprise Risk Oversight Committee consisting of a cross-functional representation of senior leaders including our Chief Information Security Officer, or CISO. Our CRO has over nine years of senior risk management experience at large technology organizations, following a 20-year career in the U.S. Army. Our enterprise risk management team works in partnership with our security, information technology, compliance, internal audit, and third-party risk management functions, which collectively rely on a variety of internal resources and processes, as well as third-party consultants, auditors and applications, to identify, assess and manage cybersecurity risks, including cybersecurity threats related to third-party providers on which we rely. Our enterprise risk management function also extensively consults with senior management across our organization in identifying, assessing and managing risks.

companyName: Q2 Holdings, Inc.

ticker: QTWO


text: Arrow's senior management regularly considers the impact of cybersecurity risks when developing its business strategy and financial planning. Arrow has various policies and procedures in place to mitigate cybersecurity risks and maintains a layered, defensive program to manage and maintain cybersecurity controls.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Related to Cybersecurity Risks Our cybersecurity program and related operations and processes are directed by our Executive Director of Information Technology, whom we refer to as the IT Director. Currently, the IT Director role is held by an individual who has over 16 years of cybersecurity, information technology, and systems engineering experience. The Director of IT reports to our management – currently the Chief Business Officer.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: Our Information Security Officer is accountable for managing our enterprise information security processes and procedures and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the CSI Committee, provides guidance, oversight, monitoring, and challenge of the first line's activities. The Committee as a whole, consists of information security professionals with varying degrees of education and experience as well as Information Technology professionals, and audit and fraud professionals. Individuals within the Committee are generally subject to professional education and certification requirements. In particular, our Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Our Chief Operating Officer and other members of senior management are primarily responsible to assess and manage our material risks from cybersecurity threats. We have engaged a third party, who authored security manuals and holds multiple industry certifications, as our Virtual Chief Information Security Officer (VCISO) to support our Head of IT in Cyber related architecture and assessment.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and this evaluation and the management of material risks from cybersecurity threats is integrated into our overall risk management processes. This integration is designed to ensure that cybersecurity considerations are part of our decision-making processes. In addition, the Board's Technology and Social Responsibility Committee includes a member who has had extensive experience in cybersecurity, including in particular cybersecurity standards for smart city transportation systems.

companyName: Rekor Systems, Inc.

ticker: REKR


text: The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and employee training, education, and awareness initiatives. has implemented risk management structures, policies and procedures and is responsible for our day-to-day cybersecurity risk management.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: Our information technology general controls are established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our Board of Directors. We conduct cybersecurity penetration testing annually to identify and remediate cybersecurity gaps. We also perform cybersecurity assessments of all our third-party providers who have access to our information technology systems and data.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: Management and Strategy identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and conducting risk assessments.

companyName: EvoAir Holdings Inc.

ticker: EVOH


text: Cybersecurity Incident Response and Recovery Planning The Company has established and maintains incident response and data recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis by the Cybersecurity Committee and members of the IT department.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Our accounting and financial reporting platforms and related systems, and those that we, or our third-party service providers, offer to our tenants are necessary for the operation of our business. We use these platforms and systems, among others, to manage our tenant relationships, for accounting and financial reporting, and for other recordkeeping purposes. Our business operations and financial reporting rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and commercially sensitive or confidential information. Our business depends on the proper functioning and availability of our information technology platform, including communications and data processing systems. We are also required to effect electronic transmissions with third parties including clients, vendors and others with whom we do business, and with our Board. We also recognize that, as we continue to increase our dependence on information technologies to conduct our operations the risks associated with cyber security also increase.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: Our Director of IT, HR & Administration has been responsible for IT and cybersecurity for approximately 15 years across several organizations, and is currently responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO has had the overall IT and cybersecurity responsibility since inception of the Company in 2015 and is currently responsible for approving IT and cybersecurity related policies, processes, and procedures, approving related activities and budgets, helping prepare for cybersecurity incidents, and reviewing security assessments and other security-related reports.

companyName: Y-mAbs Therapeutics, Inc.


text: Implements stringent oversight of third-party service providers, including conducting security reviews before engagement and ongoing monitoring to ensure compliance with the Company's cybersecurity standards.

companyName: Energy Services of America CORP

ticker: ESOA


text: We closely monitor privacy and cybersecurity laws and regulations and conduct related reviews of our policies. We have implemented incident response plans that provide for the response, containment, eradication, reporting, and disclosure of security incidents. We also carry customary cybersecurity risk insurance and have a retainer in place for third-party incident response and forensics resources.

companyName: Compass, Inc.

ticker: COMP


text: Previously, our information security program was led by our Vice President of Compliance and Information Technology, who has since left the Company. As of February 25, 2025, the responsibilities of this role are being performed on an interim basis by our IT Manager, whose experience includes two years supporting the cybersecurity function under the Vice President of Compliance and Information Technology. We are currently seeking a replacement to oversee our information security program.

companyName: SES AI Corp

ticker: SES


text: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management and post-incident analysis designed to safeguard the confidentiality, availability and integrity of our platform and assets. A cross-functional incident response team, comprised of representatives from our internal security committee including information technology, information security, engineering, cloud operations, compliance, privacy, legal and members of our executive leadership team, is responsible for the monitoring and disposition of potential incidents, such as data breaches, intrusions and other security events, and implementing our detailed incident response plan. Our approach includes procedures to appropriately inform management, the audit committee of the board of directors and the full board of directors, as applicable, about cybersecurity threats and incidents. In fiscal 2025, we did not identify any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, our business, results of operations or financial condition. For more information about these risks, please see "Risk Factors – Risks Related to Our Business" in this Annual Report on Form 10-K.

companyName: Zscaler, Inc.

ticker: ZS


text: Lessons learned —no later than two weeks from the end of the incident, perform a retrospective of the incident. Prepare complete documentation of the incident, investigate the incident further, understand what was done to contain it, and determine whether anything in the incident response process could be improved.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: He receives support from our operational team which comprises cybersecurity, IT, controllership, and legal professionals who regularly review cybersecurity matters and evaluate emerging threats, as well as act as first responders to triage any cybersecurity incidents. In the event of a cybersecurity incident, the Committee and Board receive updates from this team on an ad-hoc basis, if appropriate, under our tiered escalation support framework.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: The Audit Committee of our Board ("Audit Committee") oversees risks pertaining to cybersecurity. A member of our IT and Information Security teams regularly reports to the Audit Committee, and directly to the Board, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters. In addition, our Vice President of Software Engineering typically conducts an annual cybersecurity review with our Board. We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our websites and systems. Specifically, we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection. In addition, we utilize a firewall, a virtual private network, multi-factor authentication and single sign-on and conduct regular phishing testing. We also regularly evaluate and assess our systems and the controls, processes and practices to protect those systems, including recently completing the migration of our public-facing websites and applications and our back-end business intelligence systems to the cloud. We also retain personnel that have in-depth experience in penetration testing and conduct penetration testing against our own systems. Further, we utilize third party partners to help us monitor issues that are internally discovered or externally reported that may affect our websites and mobile applications, and we have processes to assess the potential cybersecurity impact or risk of these issues. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.

companyName: Groupon, Inc.

ticker: GRPN


text: Our cybersecurity risk management and strategy processes are overseen by our CISO along with leaders from our Information Security, Compliance, Legal and Internal Auditing teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: The Company conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk mitigation strategies. This review helps in identifying areas for improvement and aligning cybersecurity efforts with the overall risk management framework.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Employee Awareness and Training Weatherford offers multilingual training sessions and awareness campaigns to better equip our employees with knowledge and tools to safeguard our information systems. Cybersecurity training is an integral part of our employee development program, beginning with comprehensive onboarding sessions to establish foundational knowledge. To ensure ongoing awareness and preparedness, employees complete annual refresher courses, which reinforce best practices and address emerging cybersecurity threats. Additionally, Weatherford performs periodic phishing simulations and training to enhance employee vigilance against social engineering attacks. We also provide industry-specific cybersecurity training to relevant employees to address sector-specific risks and strengthen our organization's overall security posture. Employees are encouraged to report on cybersecurity threats, data privacy incidents, or any other concerns.

companyName: Weatherford International plc

ticker: WFRD


text: The Company has an IT Team and Cyber Incident Response Team made up of senior managers of the bank and led by the Chief Operating Officer (COO), the Information Security Officer (ISO) and the Security Officer (SO).The COO, ISO and SO are primarily responsible for assessing and managing material risks from cybersecurity threats and are responsible for designing, implementing and maintaining our cybersecurity environment and incident response procedures. The IT Team is responsible for ensuring the Board of Directors and employees are trained annually on cybersecurity and information security awareness and apprised of any emerging threats. Additionally, the IT Team ensures employees are adequately trained on our incident response procedures.

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: We devote resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Information Officer ("CIO") who in turn reports to our Chief Executive Officer, to manage cybersecurity risk. Our CISO and information security team also develop and implement policies and best practices related to product security. We received ISO 27001 certification for our cybersecurity function and functionality for streaming media through Dolby OptiView in 2024 and are subject to annual ISO 27001 standard compliance monitoring audits in connection with that certification. In fiscal 2025, Dolby Atmos for cars achieved TISAX certification, a global information security standard for the automotive industry. We also take part in periodic security audits by our clients and partners.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: Our cybersecurity risk management program includes: • Identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise IT environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats; • Performing a cybersecurity risk assessment to evaluate our readiness if the risks were to materialize; and • Ensuring risk is addressed and tracking any necessary remediation through an action plan.

companyName: MARA Holdings, Inc.

ticker: MARA


text: To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity risk management program that includes the identification, prioritization, and management of technical and non-technical risk to the confidentiality, integrity, or availability of patient, employee, clinical trial participant, payor, business partner, and company information. This program considers the risks associated with our industry and the technical and regulatory requirements related to the information systems and data involved. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.

companyName: BriaCell Therapeutics Corp.

ticker: BCTX


text: • Risk Committee – The Risk Committee of our Board of Directors is responsible for overseeing our enterprise-wide risk management program and corporate risk function, including cyber risk. The Risk Committee assesses whether the risk-management programs are capable of managing our significant risks and monitors whether our most significant enterprise-wide risk exposures are in alignment with our appetite for risk. • Enterprise Risk Management Committee ("ERMC") – The ERMC is a management committee of the Bank. The Risk Committee delegates oversight responsibility of the Company's cybersecurity programs to the ERMC. The ERMC presents summary reporting to the Risk Committee pertaining to the status of such programs. • Chief Risk Officer ("CRO") – Karlyn M. Knieriem has served as our Executive Vice President and CRO since 2022. As CRO, Ms. Knieriem is responsible for reporting serious incidents to external authorities pursuant to advice from internal or external legal counsel, unless otherwise delegated. Ms. Knieriem has over 25 years of experience in financial services across a variety of roles including finance, treasury, retail, credit, and risk management. • Chief Information Officer ("CIO") – Lori Meyer has served as our CIO since June 30, 2023, after serving in several leadership roles in the Company, including Director of Enterprise Program Management, Director of IT Business Management, Director of IT Business Relations, and Business Process Improvement Lead. As CIO, Ms. Meyer is responsible for oversight of the Company's cybersecurity policies and informing the ERMC on current computer security readiness, information security standards, procedures, regulatory compliance, data security and privacy concerns, and the remediation plans annually, or as needed. • Chief Information Security Officer ("CISO") – Dale Daugherty has served as our CISO since 2021. As CISO, Mr. Daugherty is responsible for establishing and monitoring the effectiveness of the Company's cybersecurity policies and reporting the status and a summary of cybersecurity incidents to the CRO, CIO, ERMC, and Risk Committee. In this role, Mr. Daugherty serves as an intermediary between the CRO and the CIRT. Since 2002, Mr. Daugherty has served in the roles of Information Security Officer, AVP – IT Audit Manager, and Director of IT Compliance, Risk, and Security for the Bank and holds the CISSP, CISA, GCIH, GCIA, and GSEC certifications. • Chief Human Resources Officer ("CHRO") – Rachel B. Turitto has served as our CHRO since 2019. As CHRO, Ms. Turitto is responsible for appropriate administration of the Company's cybersecurity policies with respect to employee-related cybersecurity incidents. Ms. Turitto joined us with over 15 years of diverse experience across multiple human resource disciplines, including human resource information systems.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: The Bank's vendors are subject to a formal vendor management process which includes an assessment of vendor risks (including cybersecurity risks) and ongoing monitoring. When warranted, the Bank seeks independent third-party reports related to the performance of its vendors, such as System and Organization Controls ("SOC") reports that are issued in accordance with Statement on Standards for Attestation Engagements No. 18.

companyName: Federal Home Loan Bank of Dallas


text: Our systems periodically experience directed attacks that may be intended to lead to financial loss, interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and other stakeholders) and other data, confidential information or intellectual property. These attacks are increasing in frequency, uniqueness and sophistication to evade detection and remove forensic evidence of the incident, including due to emerging technologies such as artificial intelligence and machine learning, which may cause cybersecurity incidents to be more difficult to detect for periods of time or at all. However, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional discussion about cybersecurity-related risks.

companyName: Gentherm Inc

ticker: THRM


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of New Mountain Capital's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.

companyName: New Mountain Finance Corp

ticker: NMFC


text: Valley maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by vendors, service providers and other third parties, as well as the systems of third parties that could adversely impact its business in the event of a cybersecurity incident affecting those third-party systems. We have integrated security reviews into the third-party vendor management program. We assess third-party cybersecurity controls and include security and privacy provisions in our contracts where applicable. However, ultimately, we rely on the third parties we use to implement information security programs commensurate with the relevant risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: The Company integrates cybersecurity into its enterprise risk management (ERM) framework to ensure cyber threats are regularly evaluated as part of its business strategy and operational resilience efforts.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: We routinely manage cybersecurity risks through a defined framework that includes activities aimed at the identification, assessment, treatment and monitoring of risks. Cybersecurity risk assessment results are used by senior management to make informed decisions about where to allocate resources to reduce cybersecurity risks and improve overall security posture. We examine our entire program annually with third parties and measure the program against generally accepted industry standards and frameworks, such as an internationally recognized security control framework established by the NIST and used by companies to assess and improve their ability to prevent, detect and respond to cyberattacks. Our cybersecurity policies and standards are reviewed annually and are mainly guided by the NIST 800-53 Cybersecurity Framework. In addition to the NIST framework, we leverage the International Organization for Standardization 27001 and 27002 standards. Our information protection policies and standards are informed by NIST 800-53b, moderate-level security control baseline requirements.

companyName: Cigna Group

ticker: CI


text: Our cybersecurity program is designed to promote actions that protect our computer systems and networks, delivering safe, secure, and reliable operations. Our digital technology group is led by a dedicated Chief Information Security Officer ("CISO"). Our CISO has 15 years of experience as a chief information security officer, over four decades of experience in the energy industry, a degree in computer science, and manages a team at WES that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, governance, and risk management. The CISO also leads WES's Cybersecurity Council, which is a cross-functional internal team including members of WES senior management, that meets regularly to review current information-technology and cybersecurity issues and initiatives and to collaborate on key decisions. Additionally, the CISO provides quarterly reports to the Audit Committee of the Board of Directors. These reports include updates on WES's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. In addition, in our continuing commitment to cybersecurity education and preparedness, we also engage with industry peers, vendors, intelligence organizations, and law enforcement communities to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Western Midstream Operating, LP


text: The Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Board of Directors for remediation and future prevention and detection.

companyName: Charging Robotics Inc.

ticker: CHEV


text: The VP of IT is also responsible for apprising the Audit Committee of cybersecurity incidents promptly for more significant incidents and in the aggregate for less significant incidents.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: As part of our enterprise risk management process, we have adopted a cybersecurity risk management program designed to assess, identify, and mitigate risks from cybersecurity threats. Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity risk management program is supported by third parties, including a managed services provider that assists the Company with, among other things, threat monitoring and incident response.

companyName: Fusion Pharmaceuticals Inc.


text: Cybersecurity is integrated into our enterprise risk management ("ERM") process. Cybersecurity-related risks are included in our ERM risk register, which are reviewed by internal stakeholders who designate the relative level of severity of identified risks. The ERM risk register, which includes any identified cybersecurity-related risks, is reviewed by our Executive Management Committee and is reported quarterly to the board of directors, who then reviews the identified risks, mitigation plans and monitoring reports and provides oversight as appropriate.

companyName: Valaris Ltd

ticker: VAL


text: At the EQRT level, oversight of cybersecurity is the responsibility of our board of directors, receiving at least annual updates on EQT's cybersecurity program and receiving prompt notice regarding any material cybersecurity incidents that are relevant to EQRT, as well as ongoing updates regarding such incidents. EQT's cybersecurity program and processes also provide incident escalation to our Chief Financial Officer for any security incidents that meet pre-established reporting thresholds. EQRT's Chief Financial Officer determines if any cybersecurity events have taken place at the EQRT level and assesses whether those events are material to EQRT based on quantitative and qualitative criteria determined by EQRT's management, supported by external advisors. When determining the materiality of a cybersecurity event, EQRT considers the actual and potential impact on the EQRT operations, strategy, performance, cash flows and financial condition. EQRT adheres to EQT's Incident Handling Playbook and employee awareness training requirements.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response policies, disaster recovery/business continuity policies, a vulnerability management policy, a vendor risk management program, risk assessments, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: We are aware of the risks associated with engaging third-party service providers and other third parties. We have implemented risk-based processes to oversee and manage these risks, including, where appropriate, contractual requirements to implement technical, administrative, cybersecurity, and physical measures to protect the security and confidentiality of OneStream information (including customer information), and to notify the Company promptly of relevant security incidents. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: OneStream, Inc.

ticker: OS


text: Our management formed an interdepartmental Information Security Council ("ISC"), comprised of senior executives from multiple disciplines, including our CIO and Vice President of Infrastructure Services, to assess and manage our material risks from cybersecurity threats. The ISC has primary responsibility for our overall cybersecurity risk management program. Our CIO, Vice President of Infrastructure Services, and others within our Information Technology department supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and Vice President of Infrastructure Services have a combined 50+ years of experience in information technology, with increasing oversight of cybersecurity responsibilities over the past 20+ years.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We have developed an information security policy ensuring that our cybersecurity objectives are established and compatible with our strategic direction. The goal of this policy is to protect our informational assets against reasonably foreseeable internal, external, and accidental threats. Identifying and assessing cybersecurity risk is integrated into our overall risk management processes. Cybersecurity risks related to our business, operations, privacy, and compliance are identified and managed through third party assessments, internal IT audits, governance, risk and compliance reviews.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: We use a third-party information technology consultant to help identify, assess and manage the Company's cybersecurity threats and risks. This consultant reports to and works with our management team, including our Chief Scientific Officer and President and Chief Operating Officer to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools including for example by subscribing to reports and services that identify cybersecurity threats, leveraging certain system monitoring tools, and leveraging tools provided through Microsoft Office 365.

companyName: CalciMedica, Inc.

ticker: CALC


text: Our board of directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO (or designee) regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our company's enterprise risk management committee, which in turn provides quarterly updates to our board of directors, and members of our management team are included in our Adviser's incident response process in the event a cyber security incident occurs that could materially impact us.

companyName: Invesco Real Estate Income Trust Inc.


text: The CTO and VPCS are informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: Education and Awareness Our employees and contractors receive regular cybersecurity awareness training, including specific topics related to social engineering and email fraud, to communicate the Company's evolving information security policies, procedures, and standards. Employee training includes periodic phishing exercises to provide Company employees with a heightened level of awareness to cybersecurity threats, and to equip them with relevant information to prevent cybersecurity incidents.

companyName: Telesis Bio Inc.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to executive management and/or the Board of Directors. The Incident Response Plan is coordinated through the Chief Information Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: TC Bancshares, Inc.

ticker: TCBC


text: Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Datacentrex, Inc.

ticker: DTCX


text: Everest outsources certain business, technological and administrative functions and relies on third-party vendors to perform certain functions or provide certain services on its behalf. The Company negotiates contractual provisions to address identified cybersecurity risk(s) with third-party vendors. Third party security assessments of these vendors are also performed as part of the Company's third-party vendor management processes. The Company also maintains processes to oversee and manage material risks from cybersecurity threats associated with its use of third-party service providers.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: The management of IT Provider is responsible for directing and controlling operations and for establishing, communicating, and monitoring policies and procedures. The key members of management are the President, (who has over 20 years' experience in his current position) and is responsible for overseeing delivery of the services, and the Chief Information Officer ("CIO") (who has over 10 years' experience in his current position) and is responsible for overseeing the IT environment that supports the services. Importance is placed on maintaining sound internal controls and promoting integrity and the ethical values of the Affiliated Group in all personnel. Organizational values and behavioral standards are communicated to all personnel through policy statements and the Employee Handbook. Additionally, the President and CIO are in daily contact with personnel at all levels and reinforce the Affiliated Group's policies, procedures, and organizational values.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our senior management works with our information technology consultant to evaluate material risks from cybersecurity threats against our overall business objectives.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial conditions. Our internal systems, processes, and controls are designed to mitigate and minimize potential losses resulting from cyber attacks, however, there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. For further discussion of risks from cybersecurity threats, see Item 1A. Risk Factors in the section titled "We are subject to certain risks in connection with our use of technology."

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: Management's Role in Cybersecurity Risk Management Given the important role of technology in the Company's operations and customer service, the Company has established an Information Technology Steering Committee, which consists of our IT Manager, President, Chief Financial Officer, Chief Experience Officer, Director of Risk Management and Information Security Officer. The Information Technology Steering Committee reviews, monitors, aligns, and prioritizes all significant strategic information technology initiatives and security risks. The Information Technology Steering Committee reports to the Operational Risk Committee and minutes of the committee's meetings are subsequently reported by the Operational Risk Committee to the Company's Board of Directors. Our IT Manager, in collaboration with our Information Security Officer, makes quarterly reports to the Information Technology Steering Committee. Such reports include updates related to key metrics, key risk indicators, key performance indicators, penetration test results, risk assessment results, project updates, incident reports, compliance matters, and operational issues.

companyName: F&M BANK CORP

ticker: FMBM


text: Management offers cybersecurity updates to the Audit Committee on at least an annual basis, and more frequently if circumstances warrant. These briefings include assessments of risks, the threat landscape, and updates on any incidents.

companyName: CEA Industries Inc.

ticker: BNC


text: The IT team provides quarterly reports to the Company's senior management. Such reports typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans, and the evolving cybersecurity threat landscape.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: The Company's Board of Directors takes seriously both the responsibility to guard against cybersecurity threats and its compliance with the SEC Cybersecurity regulations adopted on July 26, 2023. Our Board of Directors has standing agenda to review and discuss on cybersecurity matters with management during each meeting. Management is updated on cybersecurity matters by the IT Senior Systems Administrator ("ITSSA").

companyName: UNIVERSAL BIOSENSORS INC


text: We maintain cybersecurity policies and procedures as part of our overall risk management process. We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments which are designed to identify, assess, and manage cybersecurity risks. We perform cybersecurity risk analyses of select third-party service providers and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. We did not experience any material cybersecurity threats or incidents for the year ended December 31, 2023.

companyName: AVADEL PHARMACEUTICALS PLC

ticker: AVDL


text: The Adviser's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help the Company prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact the Company. The Adviser's cybersecurity risk management processes seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat, and mitigate such threats. The Company relies on the Adviser to engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity program and risk management processes and responding to incidents.

companyName: HPS Corporate Lending Fund


text: 2023, we did not identify any cybersecurity incidents or threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred.

companyName: Investview, Inc.

ticker: INVU


text: In particular, the Vice President of Network Services leads a team of IT professionals that includes individuals with significant cybersecurity expertise. The Vice President of Network Services has over 26 years of experience in various roles with the Company as well as with the U.S. Army involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. The team of IT professionals led by the Vice President of Network Services includes individuals with relevant degrees and certifications, including Certified Information Security Systems Professional (CISSP), Certified Cyber Security Architect (CCSA), EC-Council Certified Ethical Hacker (CEH), GIAC Certified Forensic Examiner (GCFE), SANS Digital Forensics And Incident Response (FOR408), CompTIA Certified PenTest+, Cisco Certified Network Associate (CCNA), and CompTIA Certified Security+.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We continuously monitor threats and unauthorized access to our information security network.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: Cybersecurity oversight is embedded in our ERM Steering Committee, chaired by the Chief Operating Officer and including senior executives such as the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"). This committee is responsible for: • Identifying, assessing, and managing cybersecurity risks within the broader ERM framework; • Aligning cybersecurity risk management priorities and strategies with business objectives; • Monitoring periodic internal and third-party assessments, threat simulations, and security exercises to evaluate cybersecurity defenses; and • Addressing identified vulnerabilities through mitigation efforts and risk response strategies. See "Item 1C. Cybersecurity—Governance—Management's Responsibilities" below for additional information regarding our cybersecurity risk management program.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Reporting to Board The VP of Technology regularly informs the Chief Executive Officer regarding cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. In addition to briefings on an as-needed basis, any significant cybersecurity matters and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: maintain multiple layers of controls, including embedding security into our technology investments, multi-factor authentication tools, apply policy of least privilege to data and systems access, monitor logins both at network perimeter and within, segment and firewall system access within the network perimeter not solely at network edge or perimeter;

companyName: ALPHA PRO TECH LTD

ticker: APT


text: We take a proactive approach to managing cybersecurity risks. This includes regular updates to our systems, access controls, and training programs to help employees recognize and avoid phishing, spam, and other common cyber threats.

companyName: Paramount Gold Nevada Corp.

ticker: PZG


text: The Custodians hold a majority of SOL in cold storage and provides a user interface for the Company to manage the allocation of SOL between cold and hot storage for the wallets. The Company maintains more than 98% of its SOL treasury in cold wallets.

companyName: UPEXI, INC.

ticker: UPXI


text: We are working to continue to improve our overall cybersecurity approach and plan to take any necessary steps to protect our information assets and operations from internal and external cyber threats in the event any such steps are recommended by Mission Cloud or other 3 rd parties that we may engage to assist.

companyName: Freeze Tag, Inc.

ticker: FRZT


text: Management plays an integral role in assessing and managing the Company's material risk from cybersecurity risks. The assessment and management of those risks is led by the Company's CISO, who has over 20 years of experience working in information technology, including over 10 years specifically focused on information security, infrastructure, and strategy, and the Company's CIO, who has over 25 years of experience in Retail, Consumer Products, Merchandising, Supply Chain and IT, of which 15 years have been in leadership roles, and implemented by the CISO's team, who are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, processes and operations. The CISO and CIO lead quarterly meetings of the Company's Security Executive Steering Committee (the "Steering Committee"), which is composed of the Company's CFO, General Counsel, and CIO. The Steering Committee drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.

companyName: CARTERS INC

ticker: CRI


text: We have developed and integrated into our overall risk management program an information security program that is designed to address material risks from cybersecurity threats. Our program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. A cybersecurity risk assessment, based on an internationally recognized methodology, is conducted annually.

companyName: GUESS INC

ticker: GES


text: Risk Management and Strategy have developed and maintain processes designed to assess, identify, and manage cybersecurity risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The scope of these processes includes risks that may be associated with both our internally managed information technology ("IT") systems and key business functions and sensitive data operated or managed by or maintained at third-party service providers. These processes are managed and monitored by a dedicated information technology team, which is led by our head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment.

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's Risk Management program and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the Board has delegated primary oversight responsibility over the Company's risk management program, including oversight of cybersecurity risk management, to the Audit & Risk Committee of the Board.

companyName: National Bank Holdings Corp

ticker: NBHC


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, penetration testing firms, and cybersecurity consultants.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Our policies encourage each of our employees to contribute to our data security efforts. We provide comprehensive training resources, ensuring that each team member is equipped with the knowledge to protect our organization against cyber threats. However, the completion and understanding of this training is not mandatory for all employees. We regularly remind employees of the importance of handling and protecting data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. In this regard, the Company has implemented policies and procedures for all employees including: (i) information security/cybersecurity policies, which are internally available for all employees, (ii) information security/cybersecurity awareness training; (iii) a clear escalation process which employees can follow in the event an employee notices something suspicious; and (iv) ensuring that information security/cybersecurity is part of the employee performance evaluation and/or disciplinary process.

companyName: Vado Corp.


text: To facilitate the success of our risk management framework, multidisciplinary teams throughout the Company, including members of the legal department, operations, and senior management, are deployed to support risk mitigation and our response to threats and potential cybersecurity incidents. We also regularly conduct training and education to upgrade our game-changers' knowledge of security risks and vulnerabilities. In fiscal year 2024, our game-changers completed mandatory security awareness training, resulting in a company-wide pass percentage of 95%. In August 2024, we held a Cyber and Fraud Awareness Month, which promoted best practices and vigilance in protecting information and data to prevent cyber-attacks, and educated game-changers on how to report phishing or suspicious messages through a dedicated reporting channel.

companyName: Concentrix Corp

ticker: CNXC


text: We review and evaluate material cybersecurity risks related to the use of third parties, including vendors, service providers and other external users of our systems.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: The Managing Owner has written procedures and policies that govern the Trust's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: GLOBAL MACRO TRUST


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Apollo Realty Income Solutions, Inc.


text: The Company's risk management program includes governance through the Board of Directors and regular reporting by management to the Board. Our Chief Technology Officer is tasked with integrating any cybersecurity risk considerations into overall risk management strategy. Risk management includes regular risk assessments to identify internal and external risks and to evaluate the magnitude of harm that could arise out of such risks. Further, risk management may utilize third party service providers where complementary and supplementary to the Company's overall business strategy. Lastly, risk management includes training and education over the continuously evolving landscape of cybersecurity threats.

companyName: Mondee Holdings, Inc.

ticker: MOND


text: obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs.

companyName: ACM Research, Inc.

ticker: ACMR


text: Our cybersecurity risk assessment and management efforts are led by our chief operations officer, who is responsible for implementing and overseeing processes for the monitoring of our information systems, and the ITSP Group. Included in this responsibility is the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our chief operations officer reports directly to our chief executive officer and board of managers.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. However, we and our customers have experienced cybersecurity incidents and routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for additional information about the risks to our business associated with a cybersecurity incident affecting our information technology systems.

companyName: Guardant Health, Inc.

ticker: GH


text: Genworth's CISO and CRO, both members of management, support the cybersecurity risk oversight responsibilities of the Board and the risk committee and involve applicable management personnel in cybersecurity risk management. The risk committee receives periodic reports from the CISO and CRO on the Company's technology and cybersecurity risk profiles, information security program and key cybersecurity initiatives. Additionally, the CISO and CRO follow a risk-based escalation process to notify the risk committee outside of the regular reporting cycle when they identify actual or potential substantive cybersecurity risks or issues.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: While we continuously invest in cybersecurity controls, we acknowledge the possibility of cybersecurity incidents despite our efforts. These incidents may include unauthorized access, data breaches, ransomware attacks, and service disruptions. We have contracted with a cyber insurance provider, Incident Response provider, and a Managed Security Services Provider to minimize the impact of such events and support prompt detection, containment, and recovery measures.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers.

companyName: Turnstone Biologics Corp.


text: Risks Related to Third-party Service Providers Garmin operates a third-party risk management program, which is aligned to NIST principles, to oversee and identify material risks from cybersecurity threats, undertake appropriate remediation, and establish and maintain compensating controls when appropriate. We conduct cybersecurity assessments of third-party service providers that will process personal, confidential, or proprietary information. Before proceeding with any such third-party service provider, we require them to remediate or mitigate any material findings from our cybersecurity assessment and to agree contractually to maintain acceptable cybersecurity practices throughout the duration of their service to Garmin and after for so long as they retain any personal, confidential, or proprietary information, and to promptly notify Garmin of any cybersecurity incidents that impact Garmin.

companyName: GARMIN LTD

ticker: GRMN


text: The Audit Committee of the Board of Directors has oversight of management's efforts with respect to IT systems and cybersecurity. As part of this oversight, the company's IT leader meets on a quarterly basis with the Audit Committee and on an annual basis with the company's Board of Directors. During these update meetings, IT provides the Audit Committee and Board of Directors updates regarding any changes around our cyber defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively counter these threats.

companyName: Green Plains Inc.

ticker: GPRE


text: While we have experienced cybersecurity incidents in the past, to date, none have materially impacted the Company or our financial position, results of operations and/or cash flows. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, under the heading "Security breaches and other disruptions could compromise our information systems and expose us to liability, which would cause our business and reputation to suffer."

companyName: Titan Machinery Inc.

ticker: TITN


text: We have implemented a third-party service provider risk assessment program to assess material cyber threats associated with using third party providers. This program is designed to assess risk prior to the onboarding of new providers as well as to review high risk and medium risk providers on an annual basis.

companyName: FIVE BELOW, INC

ticker: FIVE


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.

companyName: Blue Owl Technology Finance Corp.

ticker: OTF


text: The Audit and Risk Committee receives quarterly reports from our Chief Information Security Officer ("CISO") and our Chief Information Officer on our cybersecurity risks and meets in executive session with our CISO following such reports. In addition, management updates the Audit and Risk Committee, as necessary, regarding significant cybersecurity incidents.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: To implement our cybersecurity strategy, we maintain various safeguards to secure the data we hold, including encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system, regularly assessing product features for security vulnerabilities, conducting continuous internal penetration tests, and leveraging multi-factor authentication to help effectively protect sensitive information and appropriate access rights. We also have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to preserve the availability of critical data and systems. We have processes in place to assess and manage vendor cybersecurity risks, which include initial and periodic security program reviews through the use of third party vendors who specialize in this subject matter. We have engaged our independent, internal audit team that reports directly to the Chair of the Audit Committee of our board of directors to audit our adherence to our cybersecurity policies. These audits help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: The Company conducts quarterly meetings of the IT and financial leadership of the Company's segments, including the CIO, and information from those meetings is provided to the Company's Audit Committee, which typically meets on a quarterly basis. At each Audit Committee meeting, the CIO and Chief Financial Officer provide an update to the Audit Committee on any relevant current and new IT risks and the general health of the IT risk management program, including cybersecurity risks. They also provide the Audit Committee with a quarterly written cybersecurity brief from IT leadership, including an incident reporting log, a review of emerging cybersecurity risks and developments, an assessment of the overall effectiveness of our cybersecurity programs and recommended updates to our cybersecurity risk assessment program. Management, along with our CIO, is responsible for developing the cybersecurity strategy and supervising our cybersecurity risk management program. Our IT team supports these efforts by managing day-to-day operations, including threat detection, incident response and system monitoring. Our cybersecurity incident reporting and escalation plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior Company management and our Audit Committee and/or Board of Directors, as applicable.

companyName: JANEL CORP

ticker: JANL


text: TIAA's cybersecurity team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Company and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: The governance of our cybersecurity risks involves active and informed participation from our management team, our IT team and our board of directors. This oversight includes briefings by our IT team on the nature of the risks we face and the steps we are taking to mitigate these risks, as well as immediately reporting any significant cybersecurity incident that occurs to management and the board of directors.

companyName: Kaya Holdings, Inc.

ticker: KAYS


text: The Sponsor engages a selection of third-party experts ("Experts") to assist its internal legal, compliance and engineering personnel in developing, implementing and testing its cybersecurity policies and procedures. The Experts assist in performing assessments, penetration tests and reviewed areas of potential vulnerability. In addition, the Experts work with the Sponsor to conduct cybersecurity training, exercises and quarterly internal phishing tests. The Sponsor uses the findings of such exercises and campaigns to improve its practices, procedures, and technologies. The Sponsor also engages the Experts to support its cybersecurity threat and incident response management and maintains information security risk insurance coverage.

companyName: Bitwise Bitcoin ETF

ticker: BITB


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, CTO, Chief Financial Officer, and General Counsel, who works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.

companyName: Xometry, Inc.

ticker: XMTR


text: We have a security policy which outlines mandatory security requirements for all of our employees, contractors or other agents. This policy is supported by internal standards, directives and procedures. The security program includes implementation of software security throughout the development life cycle, vulnerability and configuration management software across certain data infrastructure, products and services. Our risk management process includes employee education and annual analysis of risks from across the company, which are then prioritized for remediation. Our approach to cybersecurity is integrated into our overall company-wide approach to risk management. Our management team, including our Deputy Chief Security Officer and our Data Privacy Officer, evaluates risks from cybersecurity threats against our overall business objectives and regularly reports to both the Audit Committee of our board of directors and to our internal audit function which evaluates our overall enterprise risk.

companyName: Unity Software Inc.

ticker: U


text: Within CDRM, our Cybersecurity Defense Center ("CDC") has established policies, processes, and controls that are designed to monitor, detect, investigate, respond to, and escalate management of cybersecurity threats and incidents. If we experience a cybersecurity incident, the CDC activates an incident response plan, which includes processes to enable us to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate brand and reputational harm. Based on initial investigation into such incident's impact to the Company, the actor(s) involved, and other factors, the CDC assigns a severity level to an incident, which dictates the escalation path for a given incident. For incidents rising to higher levels of severity, the Cyber Governance and Incident Disclosure Committee, a cross-functional committee spanning cybersecurity, IT, legal, finance, enterprise risk management, and compliance teams, assesses the severity and potential materiality of such incidents and, as appropriate, escalates to designated members of our senior management for further assessment, response, and remediation. Additionally, we have established a Cyber Crisis Management Team, responsible for addressing and responding to the most severe cyber incidents. If warranted, senior management notifies the Audit Committee and/or the full Board of Directors, as appropriate. Throughout this process, the CDC continues to investigate the incident and, as its understanding of the incident evolves, updates its severity assessment, as necessary.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: The Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024, and the Company is not currently aware of any cyber security attacks or breaches that are reasonably likely to materially affect the Company's business, business strategy, operating results or financial condition. However, as discussed under Item 1A "Risk Factors," specifically the risks titled "Risk of operational interruptions relating to computer software or hardware failures, including cyber-attacks," a cybersecurity incident could negatively impact sales and profits. The sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well controls are designed and implemented, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: We view security awareness as a continuous program. All Company employees receive cybersecurity and fraud training at the required new employee orientation and subsequently receive information security tips via email. Employees also receive annual security awareness training.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions including contract research organizations, or CROs, for managing clinical trials, professional services, SaaS platforms, managed services, property management, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions. We generally engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. As discussed below, members of management advise the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks with financial statement or financial statement reporting implications. The Audit Committee routinely interacts and reports to the entire Board of Directors on these matters.

companyName: Energy Services of America CORP

ticker: ESOA


text: d.provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: Inhibrx, Inc.


text: Risk Management Strategy Given the increasing reliance on technology and potential of cyber threats, we have integrated a cybersecurity component into our risk management program, which is designed to identify, assess and mitigate risks across various aspects of the Company. We have a dedicated Information Security Department, which is led by our Chief Information Security Officer. The Information Security Department serves to protect the security and confidentiality of customer information, protect against any threats or hazards to the security or integrity of Company information and protect against unauthorized access to, or use of, such information that could result in substantial harm or inconvenience to our customers.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: Our Board receives periodical reports from Yubo Beijing's management on cybersecurity risks. In addition, Yubo Beijing's management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, or Information Systems and Data.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Refer to "Item 1A. Risk Factors— Risks Associated with Business and Industry — Unauthorized disclosure, destruction or modification of data, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted and costly litigation and damage our reputation".

companyName: EvoAir Holdings Inc.

ticker: EVOH


text: We have a documented incident response plan for identifying and responding to cybersecurity incidents that focuses on isolating, containing, mitigating, and eradicating the threat as quickly as possible. In the event of a cybersecurity incident, we will follow a documented incident escalation procedure.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against portions of the NIST Cybersecurity Framework. We also have achieved PCI SAQ-A Compliance every year since 2019. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments.

companyName: Skillz Inc.

ticker: SKLZ


text: Our information security program is audited annually against a well-known security framework, by an accredited third-party. In 2024, we allowed our HITRUST certification to lapse and we replaced it with System and Organization Controls (SOC) 2 assessment, which has more general applicability and covers the trust services criteria of security, confidentiality, privacy, and accessibility.

companyName: OptimizeRx Corp

ticker: OPRX


text: Natural or man-made disasters: Data can be threatened by natural or human disasters. Lightning strikes, fire, floods, hurricanes, bombings, etc. Without proper data backup, all company data could be compromised in one incident. Backups, co-location of servers and data is regularly monitored and adjusted as needed with a goal of insulating the Company from this type of risk.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: He addresses cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. He is informed regarding the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: Namliong SkyCosmos, Inc.

ticker: NLSC


text: Management and Strategy have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on ISO 27002 standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27002 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We engage external resources that contribute to, and provide independent evaluation of, our existing cybersecurity practices and organizational risk assessment systems. We use established processes designed to identify, assess, and manage third-party service provider risks when third parties handle, possess, process, and store the Company's material information. Our cybersecurity risk management program includes (i) a policy designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; (ii) the use of external service providers to manage, assess, test and otherwise assist with aspects of our security controls; and (iii) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity prevention and mitigation efforts will always be successful, and it is possible that cybersecurity threats could have a material adverse effect on our business, operations, or financial condition in the future.

companyName: Protagenic Therapeutics, Inc.\new

ticker: PTIX


text: Cybersecurity is a top priority for Okta, Inc. Our cybersecurity strategy is to develop a consistent framework of security controls that can apply to all business functions. To execute on this strategy, we integrate cybersecurity risk management into our broader enterprise risk management program. We also take a cross-functional approach to cybersecurity risk management by engaging teams across the business, including security, technical operations, engineering, IT, customer support, legal and communications, to implement shared processes for identifying, assessing, and managing key cybersecurity risks.

companyName: Okta, Inc.

ticker: OKTA


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our cybersecurity program maintains assessment protocols for proactively evaluating potential cybersecurity impacts and risks, supported by incident response procedures. We employ systematic processes to manage cybersecurity risks, including through cybersecurity audits, network interconnectivity reviews, system access controls and monitoring, and data backup and recovery. Our cloud environments undergo continuous assessment, with firewall and backup systems designed to support operational resilience. We employ a Zero Trust Security framework that requires identity verification for network access, complemented by regular system assessments and monitoring. Our security controls include identity management programs, data loss prevention protocols, and threat detection capabilities. Our controls undergo regular review and updates based on threat intelligence, ensuring adaptability to emerging threats. Similarly, our incident response program is regularly tested and updated to address emerging threat landscapes. To ensure organization-wide security awareness, cybersecurity training is mandatory and provided to all employees annually. Cybersecurity awareness is also included across other training programs, including our annual "Living our Values" training modules and our privacy training programs.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: We have several committees and individual management positions responsible for assessing, identifying, and managing the material cybersecurity risks that we face. Enterprise Risk Management Committee.

companyName: Informatica Inc.

ticker: INFA


text: We do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected us. However, the sophistication of cyber threats continues to increase, and the preventative actions that we have taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: Greenland Technologies Holding Corp.

ticker: GTEC


text: Depending on the nature and severity of an incident, this process provides for evaluation by an executive management group to determine if the incident is material to us by evaluating the impact on our financial condition, reputation and potential litigation risk and regulatory impact. The management group is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, General Counsel, Chief Accounting Officer and the SVP Technology to determine if escalation is necessary by the Chief Executive Officer to the Board (specifically our Lead Independent Director and the Audit Committee Chair).

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third parties that may lead to a service disruption or an adverse cybersecurity incident. This includes processes for performing third-party risk ratings and data classification mapping of current and ongoing vendors. The program promotes good cybersecurity practices with our third-party vendors and helps to ensure their adherence to our cybersecurity standards.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our critical systems and information, including, for example: multi-factor authentication, encryption, anti-malware functionality, access controls and systems monitoring.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our personnel, including our Senior Director of IT, who has 20 years of experience in IT and cybersecurity and is a member of the Information Systems Audit and Control Association (ISACA).

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: We engage in a periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents at least annually. We evaluate our cybersecurity program's capabilities and processes, and we aim to continuously enhance our program according to our internal and external risk assessments. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: In 2024, ASGN has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.

companyName: ASGN Inc

ticker: ASGN


text: Chief Executive Officer ("CEO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; of ongoing cybersecurity initiatives and strategies;

companyName: Clubhouse Media Group, Inc.


text: Program and Strategy We understand the importance of maintaining a robust cybersecurity risk management program to assess, identify, and manage the material risks associated with cybersecurity threats.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: iv. Post-Incident, which includes issuing a report summarizing the threat or incident, and the steps taken in assessing and eliminating the threat, as well as steps to implement to attempt to prevent similar future incidents.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: We have implemented controls that align information security standards with the nature of our operations and strategic direction. When possible, we implement layered control systems by deploying different controls at different points of business processes and throughout an IT system so that the strength of one control can compensate for weaknesses in or possible failure of another control. We have also developed an enterprise-wide vendor management and third-party risk management program designed to identify, assess, and manage information security, operational and technology risks associated with third-party vendors. Our Enterprise-wide Vendor Management Program is in alignment with the FFIEC Guidelines for Third Party Service Providers and is designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. Our Information Security Program also continuously promotes cybersecurity awareness and culture across the organization, including regular education and training, that requires team members to complete training and certification on an annual basis and phishing simulations (attempts of attacks) monthly. New hires are also provided with information security awareness training during the orientation process. A customer security awareness and communication program has also been developed and implemented to keep customers abreast of security and fraud risks.

companyName: Amerant Bancorp Inc.

ticker: AMTB