text: We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third-party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our Information Security Program team's protocols in partnership with the vendor management, enterprise risk management, and internal audit departments.

companyName: First Foundation Inc.

ticker: FFWM


text: The Board of Directors, committees of the Board of Directors and management coordinate risk oversight and management responsibilities, and cybersecurity represents an important component of our overall approach to enterprise risk management. In general, we seek to address cybersecurity risks through a cross-functional approach focused on protecting business operations and preserving the confidentiality, integrity and availability of information by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Walmart Inc.

ticker: WMT

secItem: Item 1C


text: Managing Material Risks & Overall Risk Management We have a cross-departmental approach to addressing cybersecurity risk, including input from our employees, senior management, and the Audit Committee of our Board of Directors (the "Board"). We devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats promptly and effectively.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate them for effectiveness of those plans. Our incident response and business recovery plans address — and guide our employees, management, Audit Committee, and the Board on — our response to a cybersecurity incident.

companyName: PGT Innovations, Inc.


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by Great Elm IT Management, with support from their third-party consultants. Great Elm IT Management alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing its severity and determining potential responses, as well as communicating with business leaders and senior management, and the Board, as appropriate.

companyName: Great Elm Group, Inc.

ticker: GEG


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: P3 Health Partners Inc.

ticker: PIII


text: In the ordinary course of business, our board of directors receives quarterly updates from the DIS regarding the Information Security Program and compliance with relevant regulations, as described above. Members of the Audit Committee of our board of directors receive presentations as well as minutes of the meetings of our information technology steering committee on a quarterly basis. Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or the Audit Committee sooner than its next quarterly update. See the section entitled "Part I, Item 1. Business—Risk Management" for additional information on the role of our board of directors and its committees in overseeing risk management.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: The CIO regularly informs the Company's Executive Vice President and Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") of material aspects related to cybersecurity risks and incidents regarding the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Risk Assessment: No less frequently than annually, we complete an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate our cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company. We complete internally managed weekly vulnerability testing. To supplement our internal assessment, we also engage third-party consultants to assess system configurations through configuration review and annual penetration testing.

companyName: VINEBROOK HOMES TRUST, INC.


text: The CDO is supported by two senior cybersecurity professionals — our external Chief Information Security Officer ("CISO") and our Director, IT Infrastructure & Security. The CISO brings over two decades of experience building and scaling cybersecurity programs in high-growth enterprise environments, including leading the security function for a publicly traded cloud technology company. This individual has previously served in cybersecurity leadership roles at global financial services and payment technology companies and currently advises Fortune 500 companies through virtual CISO services. In addition to operational leadership, this professional is also a cybersecurity educator, contributing to the development of future security talent at the collegiate level. Our Director, IT Infrastructure & Security holds an advanced degree in cybersecurity operations and leadership and has more than 20 years of experience managing IT infrastructure, enterprise security operations, and risk mitigation strategies. She has led initiatives to build and scale global Security Operations Centers (SOCs), implement zero trust architecture, and design infrastructure hardening practices across multiple sectors, including high-tech and financial institutions.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Neuphoria recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: The CSIRP includes a framework to timely report cybersecurity incidents to our Executive Leadership Team. The severity of an incident is based on perceived impacts that include the severity of damage, compromise, or loss, and probability of further exploitation or escalation. The Chief Information Officer (CIO) and CRO are notified of all incidents that are determined to be significant. based on perceived impacts of the incident or event. The Chief Executive Officer and Board of Directors are notified of these incidents by the CIO and CRO as necessary.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: The information technology department, led by the Senior Vice President of Technology and Planning, Chief Information Officer ("CIO"), is responsible for the Company's cybersecurity program. The CIO, along with the certified Information Security Officer and VP Information Technology have significant experience spanning over 20 years in information security, infrastructure, and compliance.

companyName: Seneca Foods Corp

ticker: SENEA


text: TIAA's cybersecurity team periodically reports to the Fund's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Fund, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.

companyName: Nuveen Churchill Private Capital Income Fund


text: As part of our cybersecurity risk management program, we perform the following: • Cybersecurity risk assessment is performed on all new products and product updates; • Employ internal staff with security certifications, and we work with third parties to perform security vulnerability testing; • Changes to data protection laws are closely monitored and necessary changes are implemented; • Provide routine security training to employees and communicate any emerging threats; • Review the security posture of all third parties that we engage; • Maintain a comprehensive incident response plan; • Carry cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.

companyName: Phunware, Inc.

ticker: PHUN


text: ITEM 2. Properties. Our corporate headquarters is located in Cleveland, Ohio, and, at June 30, 2024, the Company maintained approximately 335 manufacturing plants. We also maintain various sales and administrative offices and distribution centers throughout the world. None of these manufacturing plants, administrative offices or distribution centers are individually material to our operations. The facilities are situated in 36 states within the United States and in 42 other countries. We own the majority of our manufacturing plants. Our leased properties consist of sales and administrative offices and distribution centers as well as manufacturing plants.

companyName: Parker-Hannifin Corp

ticker: PH


text: In addition, LivaNova routinely engages with third-party service providers to conduct evaluations of its security controls, whether through penetration testing, security assessments, or consulting on best practices to address new challenges. The Company receives threat intelligence from industry peers, government agencies, industry-specific information sharing and analysis centers, and cybersecurity associations. The Company relies heavily on its supply chain to deliver products and services to its customers, and a cybersecurity incident at a supplier, subcontractor, or service provider could materially adversely impact the Company. The Company assesses third-party cybersecurity controls through its information security program and includes security and privacy addendums to its contracts where applicable.

companyName: LivaNova PLC

ticker: LIVN


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools from our Managed Security Services provider designed to monitor, detect, block, and alert us to suspicious and unauthorized activity, including suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, which integrate directly into our patch and vulnerability management tools.

companyName: BayCom Corp

ticker: BCML


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of the Company's cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including IPALCO and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2024.

companyName: IPALCO ENTERPRISES, INC.


text: We sometimes engage external cybersecurity experts, or applications, to enhance our cybersecurity program. These serve to assist our internal cybersecurity team in mitigating cyber threats, in addition to monitoring and responding to potential cyber incidents.

companyName: CarParts.com, Inc.

ticker: PRTS


text: Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including receiving notification of threats and incidents associated with the use of services provided by business associates. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, and implementing cybersecurity countermeasures and mitigation strategies. In addition, it provides steps for our cybersecurity team to report to management and our Board of Directors on information security and cybersecurity matters, including material cybersecurity threats and incidents.

companyName: Progyny, Inc.

ticker: PGNY


text: Our information technology networks, those of our operators and managers, and those of third parties on whom we rely, are important enablers to our ability to perform day-to-day operations of our business. Our business operations depend on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data.

companyName: WELLTOWER INC.

ticker: WELL


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, oversight of cybersecurity and other information security risks.

companyName: Vista Outdoor Inc.


text: Ongoing Efforts and Improvements We continue to enhance our cybersecurity posture by investing in the latest technologies and partnering with leading cybersecurity experts. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats. Our Information Security Officer has extensive bank operations experience, has attained Certified Information Security Manager certification with the Information Systems Audit and Control Association, and attends relevant cybersecurity training sessions on a regular basis. Our CIO brings over 25 years of extensive experience in the banking industry, encompassing a diverse range of expertise, including software development, managed services and support, independent consulting, penetration testing, and bank management. This multifaceted background equips them with a unique perspective and deep understanding of both the technical and operational aspects of the financial sector. We remain committed to continually improving our cybersecurity infrastructure and to monitoring for new and evolving threats.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: Oversight of Third-Party Risks We have sought to implement stringent processes to oversee and manage cybersecurity risks resulting from our day-to-day business interactions with third parties. Our third-party risk oversight is primarily handled internally at the Company and consists of four fundamental pillars. First, we require each third-party information technology vendor that we engage with to complete a cybersecurity questionnaire detailing their cybersecurity standards and practices. These questionnaires are completed at the beginning of the relationship and thereafter periodically throughout the relationship based upon our risk level assessment. Second, we use a third-party consultant to monitor and assess cybersecurity matters relating to our vendors based on publicly available information. This monitoring is ongoing and, if an issue is identified, we will proactively seek to engage with our vendors to remediate the issue. Third, we seek to strictly limit access to our internal infrastructure and, for those vendors that have a need to access to our infrastructure, we use methods and processes to limit their access. Finally, we require our contracts with third-party vendors to include contractual obligations with respect to cybersecurity matters that are applicable those vendors, including data breach notifications.

companyName: Integer Holdings Corp

ticker: ITGR


text: Our Board of Directors maintains ultimate oversight of the Company's enterprise risk management program, which includes material cyber security risks. Under the oversight of the audit committee and capital allocation and risk management committee of the Company's Board of Directors, and as directed by the Company's Chief Executive Officer, our CIO is primarily responsible for the assessment and management of material cybersecurity risks. Our CIO oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. These services include product penetration testing, third party partner due diligence audits, security controls assessment, incident response preparedness, and vendor security review. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, in connection with the services they provide to us, and to promptly report any suspected breach of its security measures that may affect us.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Arcosa's cybersecurity risk management program is overseen by management at multiple levels. The CIO and Director of Information Security play key roles in assessing, monitoring, and managing the Company's cybersecurity risks with support of dedicated information technology and security personnel. Both the CIO and Director of Information Security have been in their respective roles at Arcosa for 5 years. The CIO has over 40 years of leadership positions in the high tech and IT industries. He is experienced in detailed product and solution development as well as business process operations providing an understanding of how cybersecurity considerations intersect the business. The Director of Information Security and Compliance at Arcosa has more than 20 years of experience architecting, designing, and deploying security solutions based on industrial frameworks.

companyName: Arcosa, Inc.

ticker: ACA


text: The Company conducts internal risk assessments, with the assistance of independent third parties, against standards including the National Institute of Standards and Technology Cybersecurity Framework. The assessment results are used to develop responsive cybersecurity controls and risk mitigation strategies. The Company's cybersecurity risk management program provides the structure for managing the respective risks through the use of a combination of automated tools, technologies, and third-party monitoring, as well as ongoing employee education via cybersecurity training and security awareness communications.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to "Risk Factors" for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:

companyName: SPX Technologies, Inc.

ticker: SPXC


text: The Audit Committee is primarily responsible for oversight and review of guidelines and policies with respect to risk assessment and risk management. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: Blue Owl Capital Corp II


text: We rely on information technology systems across our business. As our reliance on data and information technology systems have increased, we have continued to evolve and modify our cybersecurity processes and strategy and related governance and oversight practices as well as enhance the expertise of our cybersecurity team.

companyName: Cyber App Solutions Corp.


text: In addition, we engage third-party consultants to conduct evaluations of the operational effectiveness of our security controls. These consultants perform penetration testing on our cybersecurity practices and procedures on an annual basis.

companyName: Regional Management Corp.

ticker: RM


text: Governance and Risk Management Our Technology Risk Program is designed to proactively identify, monitor, and mitigate technology-related risks across our digital operations and assess cybersecurity risks related to third-party vendors and suppliers. Our Cybersecurity Program and our Technology Risk Program are led by our Chief Information Security Officer ("CISO") a Certified Information Systems Security Professional with two decades of cybersecurity leadership. The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The Technology Risk Oversight Committee chaired by our CISO, with members representing leadership throughout our Company, provides oversight and guidance to technology risks, including cybersecurity. Our Company's Cybersecurity Program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leading industry practices, and our Cybersecurity Program is integrated into our Company's Enterprise Risk Management framework. Internal and external experts regularly evaluate our Cybersecurity Program, and the results of those reviews are reported to senior management and our Company's Board of Directors. Our Incident Response Committee, which is comprised of leaders in the areas of information security, digital, legal, finance, privacy, compliance and ethics, corporate security and communications, is responsible for leading our Company's response to cyber incidents. Our Cybersecurity Incident Response Plan outlines the processes by which management is informed about and monitors detection and mediation of cyber incidents. We actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We have a Data Protection Office that works closely with, and assists, our enterprise Privacy Program, overseen by the Chief Privacy Officer, along with advisory support from appointed Data Protection Officers in Europe and Quebec.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: Our board of directors is responsible for overseeing and advising our company so that it functions as effectively as possible. The audit committee consists of a subset of the board of directors. The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. The audit committee performs oversight functions and meets regularly with management to review the company's business and operations, including the oversight of risks from cybersecurity threats. Management is responsible for and regularly discusses identifying, assessing, and managing material cybersecurity risks on an ongoing basis through programs led by the Chief Information Security Officer, Chief Legal Officer, and the Chief Financial Officer.

companyName: Gitlab Inc.

ticker: GTLB


text: Our board of directors ("Board"), in coordination with each of our committees of our Board, is responsible for oversight of our enterprise risk management activities. The Board oversees risks from cybersecurity threats through periodic reports from the audit committee of the Board ("Audit Committee"), which monitors cybersecurity incidents and management's response to such incidents.

companyName: Symbotic Inc.

ticker: SYM


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks. The Board of Directors receives briefings from management periodically on our cyber risk management program and presentations on cybersecurity topics as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: Thermon's cybersecurity risk management system is a comprehensive framework that helps the Company identify, assess, and mitigate known cybersecurity risks. The system is designed to protect the confidentiality, integrity, and availability of the Company's information assets.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: reporting of the scope, objectives and results of internal audits on the procedures performed on the control environment related to our information security systems and security controls to the Audit Committee at least two times a year;

companyName: AMPHENOL CORP /DE/

ticker: APH


text: As a result of our global business, we must comply with domestic and international laws and regulations. Our privacy and cybersecurity policies encompass incident response procedures, information security and vendor management. In order to help develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business. In order to comply with the variety of domestic and international legal requirements, Infosec aligns the company's program with common industry frameworks (such as the National Institute of Standards and Technology (NIST), the International Organization for Standardization (ISO), Cyber Essentials +, and the Trusted Information Security Assessment Exchange (TISAX)).

companyName: Thoughtworks Holding, Inc.


text: The RLI Corp. Board of Directors provides oversight for cybersecurity risks primarily through its audit committee. The Company's chief information officer (CIO), who also serves as the Company's chief information security officer (CISO), along with the head of the Company's IT security department, present quarterly to the audit committee on cybersecurity risks and the Company's strategies and actions to assess and manage those risks. Additionally, the board receives periodic updates on emerging cybersecurity issues and developments through director education provided by the Company and third-party experts, detailed reviews provided by the CIO/CISO and the Company's head of IT security on select cyber security topics, and "table top" simulations of a cybersecurity event.

companyName: RLI CORP

ticker: RLI


text: The management IT Steering Committee provides oversight and governance of the Information Security Program. This committee includes members of information security, compliance, audit, human resources, legal, operations, banking, and wealth. The committee generally meets monthly to review and provide oversight of our risk management strategy; audit reports related to our cyber and information security processes; third-party risk assessments; periodic testing of systems and infrastructure; status of employee and customer training; and updates on security incidents. More frequent meetings may occur in accordance with the incident response plan to facilitate timely assessment, monitoring, and reporting.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: We rely on both internal information technology systems and networks, and those of third-party vendors and contractors, to acquire, transmit, store and otherwise process information in connection with our business activities. Our ability to effectively manage our business depends on the security, reliability and adequacy of our and our third-party contractors' and vendors' technology systems. As such, we have implemented an information security program designed to assess, identify, and manage risks from cybersecurity threats.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: To encourage alignment on risk identification, assessment, and management objectives throughout all levels of the company, we have implemented a security education and awareness program that is designed to reinforce key behaviors that facilitate risk reduction and inform team members about the material cybersecurity risks facing our organization. We also include periodic training on information security to the board of directors.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") framework, and shares common methodologies, reporting channels, and governance processes that apply across the ERM framework to other areas, including legal, compliance, strategic, operational, and financial risk. We assess and identify cybersecurity risk to the organization by: • Employing a cybersecurity policy that sets forth a protocol for assessing, testing, identifying and preventing security risks; • Conducting assessments of risk likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of IT systems and the related information processes, stored, or transmitted; • Training personnel on security risks and how to identify and prevent such risks; • Performing risk analysis and security assessments that document the results of the assessment for use and review; • Overseeing and identifying any risk from cyber threats associated with any third-party service provider. • Ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended; and • Continuously scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Seer, Inc.

ticker: SEER


text: Review and provide oversight on the policies and procedures of the Company in preparation for responding to any material information security or privacy incidents;

companyName: Cohen & Co Inc.

ticker: COHN


text: We have instituted a company-wide security awareness training program to educate employees about cybersecurity risks and their role in maintaining our security posture. Continuous education and testing support our workforce in remaining knowledgeable and vigilant to cybersecurity threats. Employees are instructed to report all cybersecurity concerns directly to our internal information technology ("IT") team for immediate assessment and response.

companyName: Axe Compute Inc.

ticker: AGPU


text: Although the Board has determined that enterprise risk management should be the responsibility of the Board as a whole, it has delegated responsibility to oversee specific areas of risk management to its committees. Our Audit Committee oversees and reviews the Company's cybersecurity, data privacy, and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and respond to data breaches. At periodic meetings of the Board and its committees and in other meetings and discussions, management reports to the Board and its committees with respect to the most significant risks that could affect our business, including cybersecurity-related risks. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident to meet reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Risk Management and Strategy Assessing, Identifying and Managing Material Risks Our cybersecurity program is focused on assessing, identifying, and managing risks arising out of our use of information technology including the risk of cybersecurity incidents and threats. Our program is informed by recognized frameworks (such as the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework) and leverages external and internal expertise. Our program is integrated into our operations and is widely communicated to employees through annual employee and contractor cybersecurity awareness training, regular awareness exercises, and employee outreach activities including cybersecurity tech talks, on-site digital signage, intranet resources, CEO cybersecurity champion recognition at quarterly town hall meetings, and other targeted communications. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment, investigation, and remediation by our internal cybersecurity team.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: HammerPay's vendor-management program governs all third parties that handle or access sensitive data, including banking partners, cloud providers, and API vendors. Each provider undergoes due diligence, contractual data-protection obligations, and ongoing certification reviews (SOC 2, PCI-DSS).

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: Our Vice President, Information Technology is primarily responsible for leading our cybersecurity program through our information technology team. Our Vice President, Information Technology has over 20 years of experience in information technology, and regularly reports on cybersecurity matters to our Audit Committee. Our Vice President, Information Technology reports directly to our Chief Financial Officer, who is a member of our executive leadership team and reports directly to our Chief Executive Officer. As of December 31, 2023, our Information Technology team consisted of team members and contractors, many of whom have advanced degrees and cybersecurity-related industry certifications. Under the direction of our Vice President, Information Technology, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to continually enhance our cybersecurity program in response to such developments.

companyName: Acorda Therapeutics, Inc.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To date, we have not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, financial condition, results of operations, or cash flows.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: Cybersecurity risk is initially overseen at ConnectOne by the management IT Committee (the "ITC"). The members of this committee include, as co-chairs, the Chief Compliance Officer and the Chief Technology Officer. Additional members are our Information Security Officer, Information Technology ("IT") Manager, Chief Risk Officer, Chairman & Chief Executive Officer, Chief Digital Officer and Chief Brand and Innovation Officer.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: To certify our policies and processes to International Standards Organization (ISO)/ International Electrotechnical Commission (IEC) 27001, we are engaging a third-party consulting firm to conduct a gap analysis on our cybersecurity compliance. After achieving compliance, we expect to engage a third-party auditor to ensure we are compliant on an annual basis. Achieving compliance with any cybersecurity standard does not guarantee that controls cannot be broken, bypassed, or circumvented by zero-day vulnerabilities, or malicious threat actors.

companyName: Allegiant Travel CO

ticker: ALGT


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data.

companyName: YORK WATER CO

ticker: YORW


text: Although we have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in our "Operational Risk Factors" in Item 1A, Risk Factors, of this report. Our business is highly dependent on our ability to collect, use, store and manage organizational and client data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our businesses, liability to clients, loss of client or other sensitive data, loss of employee data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy one or more of our office locations. As we outsource significant portions of our information technology functions to third-party providers, such as cloud computing, we bear the risk of having less direct control over the security and performance of those systems.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Impact of Cybersecurity Risks on Strategy and Results Based on the information available as of the date of this Annual Report, we have not been materially affected by any previous cybersecurity incidents. However, we continue to experience cyber-attacks, including phishing, and other attempts to break or gain unauthorized access to our systems that could materially affect us in the future. For further information, see "Risks related to information security and technology" included in Item 1A. Risk Factors of this Annual Report.

companyName: lululemon athletica inc.

ticker: LULU


text: We have a dedicated Information Security team within the IBT team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including Legal and Finance, in identifying, analyzing, and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements.

companyName: Twist Bioscience Corp

ticker: TWST


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, and the Company's full Board and management is actively involved in overseeing the risk management process. These processes include response to, and an assessment of, internal and external threats to the security, confidentiality, integrity and availability of Company data and systems, along with other material risks to Company operations. We recognize the critical importance of maintaining the trust and confidence of our customers, business partners and employees.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: Our CISO has twenty years of professional experience, with eleven years specifically in information security roles. He has been with Pega for four years and has a Master of Science degree from Northwestern University.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: A key component of our cybersecurity risk management program is our incident response policy, which provides for evaluation, response, and reporting procedures in connection with a cybersecurity incident. Under this policy, we have established an incident response team (IRT), a multi-disciplinary management-level team led by the Company's Chief Technology Officer (CTO) and comprised of the Company's Chief Executive Officer (CEO), General Counsel/Compliance Officer, Chief Financial Officer, and EVP, Corporate Strategy. The policy provides that the IRT will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of the IRT. In such event, the policy provides that the IRT will assess whether a cybersecurity incident has the potential to materially impact the Company and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit Committee and/or the Board of Directors.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: Role of Management Our DISO is responsible for developing and implementing our cybersecurity program and holds certifications including ISO/IEC 27001:2002 Certified Information Security Executive, Cyber Security Executive Certification from Cornell University, Risk & Compliance Executive Certification from William & Mary University, and Healthcare Risk & Compliance Certification from American College of Medical Practice Executives (ACMPE). Our DISO's responsibilities include managing cybersecurity risk, leading the cybersecurity team, staying informed about threats, reporting on cybersecurity performance, promoting a culture of security, and compliance and audit support. Our DISO regularly updates senior management and the Board of Directors on the performance of the cybersecurity program and the state of cybersecurity risk. Our DISO reports directly to our CTO who provides executive leadership and support for the overall technology and cybersecurity strategy.

companyName: Waystar Holding Corp.

ticker: WAY


text: Elite's management team, in conjunction with cybersecurity service providers, is responsible for oversight and administration of Elite's cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and also relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Elite for strategic cyber risk management, advisory and decision making.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: There is no single required operating system (although most coworkers use MacBook) nor single software required for all coworkers, except Microsoft Word, Excel and PowerPoint, however, different employees operate different versions of these software. Employees are expected, but not required to keep their software up to date.

companyName: NEXT-ChemX Corporation.

ticker: CHMX


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: Cybersecurity requires ongoing investment and diligence against evolving threats and in the context of new or developing technologies. For further information regarding the risks we face from cybersecurity threats and how our business strategy, results of operations, and financial condition could be materially affected by such risks, see Item I.A. Risk Factors under the heading, "Privacy and information security laws are complex ".

companyName: DAVITA INC.

ticker: DVA


text: The Audit Committee receives periodic reports from our cybersecurity function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: The CIO is a member of the Company's Risk Management and Compliance Committee (RMCC). The RMCC is comprised of members from the senior leadership team and is responsible for overseeing enterprise-wide risk management across all categories, including cybersecurity. The RMCC is overseen by the Company's Management Committee, which is comprised of the President and Chief Executive Officer, Senior Vice President and Chief Financial Officer, Senior Vice President, Utility Operations, Senior Vice President, General Counsel & Corporate Secretary and Senior Vice President, Human Resources. The CIO provides regular cybersecurity updates to the Audit Committee of the Board of Directors and the Management Committee. These updates address prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as risks, threats, and the threat landscape.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: As a blank check company, we have no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Annual Report, any sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure, or the systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Due to our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Annual Report. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Cartesian Growth Corp II

ticker: RENEF


text: We recognize the critical importance of cybersecurity in protecting our business and our stakeholders' information. We are committed to maintaining a robust cybersecurity risk management program and implementing a comprehensive strategy to mitigate cyber threats and vulnerabilities. Our cybersecurity policies, standards, processes and practices are fully integrated into our overall enterprise risk management program, as described below. This disclosure outlines our cybersecurity risk management approach, strategy, and governance structure.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: For purposes of Item 106 of Regulation S-K, "cybersecurity threat" means any potential unauthorized occurrence on or conducted through a company's information systems that may result in adverse effects on the confidentiality, integrity or availability of a company's information systems or any information residing therein.

companyName: Emeren Group Ltd


text: The KKR CISO is a member of the firm's Operational Risk Committee. The Operational Risk Committee is comprised of senior employees from across our asset management business and operating functions. The committee focuses on significant operating and business risks, which includes among others, regulatory, cybersecurity, operational, geopolitical, and reputational risks, and is responsible for ensuring risks are identified, assessed, managed and mitigated effectively. The cybersecurity risk environment for KKR's asset management business, which includes identifying and monitoring KKR's technology risks, including those related to information security, business disruption, fraud and privacy related risks, and also promoting cybersecurity awareness at the firm. The Operational Risk Committee reports to KKR's Risk and Operations Committee, which is comprised of senior employees from across our asset management and insurance businesses and operating functions. KKR's Risk and Operations Committee includes our Chief Financial Officer, Chief Operating Officer, Chief Legal Officer and General Counsel, Chief Compliance Officer. At least annually, management will present to the Audit Committee and the Risk Committee of our Board of Directors on various topics relating to KKR's technology risks, including KKR's cybersecurity program, the current cybersecurity threat landscape, and risk management.

companyName: KKR & Co. Inc.

ticker: KKR


text: Cybersecurity threats, including those resulting from previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. condition. The cybersecurity threat environment is increasingly challenging. While we employ various measures to improve our cybersecurity posture and protect against evolving threats, we cannot guarantee that these measures will always be successful. For more information, please refer to Part I - Item 1A - Risk Factors – Risks Relating to the Legal and Regulatory Environment – "Our operations are highly dependent on information technology infrastructure, and failures, attacks or breaches could significantly affect our business" in this Annual Report on Form 10-K.

companyName: REGAL REXNORD CORP

ticker: RRX


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: The Board of Directors has oversight of cybersecurity risk, which it manages as part of the ERM program. The Board of Directors is assisted by the Audit Committee, which regularly reviews the cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur quarterly, or more frequently as determined to be necessary or advisable. In recent years, the Board added a director who had served as Chief Information Officer for a large public company with sensitive information to assist the Board and Audit Committee in overseeing cybersecurity risks.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, which leverages a "three lines of defense" model to manage risk within the organization. Technology risk (including cybersecurity risk) is identified as a key risk area for the Company, and Management measures inherent risk, mitigating controls, and residual risk on a quarterly basis.

companyName: BANNER CORP

ticker: BANR


text: As part of our overall risk management, we have implemented a Data Security and Cybersecurity Program (the "DSCP") which sets policy expectations, ensures broad coverage over information technology risks, integrates the Information Security and Information Technology Risk Management Framework into our broader risk management systems, establishes clear roles and governance, and aligns control expectations to the National Institute of Standards and Technology ("NIST"). Under the DSCP, we have processes for identifying, assessing, escalating and managing technology and cybersecurity risk. The DSCP employs various controls and policies to secure our operations and information, which include monitoring, reporting, managing and remediating cybersecurity threats and incidents.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: Monitoring and Incident Response The CSRI division of our Information Security team is responsible for the operation of our internal Security Operations Center ("SOC"), which performs monitoring and alerting for security events 24 hours a day, 7 days a week, 365 days a year. The CSRI division also actively seeks out cybersecurity threats that might affect the organization and/or our customers. The CSRI team is a component of Lincoln's formal security incident response team ("SIRT") and process. In addition to the Information Security team, the SIRT also includes representatives from the Company's legal and compliance teams (including Privacy), office of business resiliency, chief risk office, corporate communications, as well as the information technology team. While the CSRI division is responsible for cybersecurity responses generally, should a critical event arise, such an event would be raised to and addressed by the SIRT.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: Our cybersecurity risk management program is designed to be adaptable in order to respond to an evolving landscape of emerging threats and available technology. Our security controls and cybersecurity risk management program are evaluated through data gathering and analysis of emerging threats from internal and external incidents and technology investments. See the Part I, Item 1A. "Risk Factors" for a more comprehensive description of risks related to cybersecurity.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: Our board of directors has overall responsibility for evaluating key business risks faced by us, including cyber security and information technology. The audit committee of our board of directors assists the board of directors in the oversight and assessment of risks relating to data privacy, technology and information security, including cybersecurity. Our audit committee holds regular meetings to discuss issues including our cybersecurity threats and has a dedicated agenda during such meetings that are designed to assist our board of directors and our audit committee in exercising their oversight function. The meetings involve presentations and reports from our management and specifically includes updates of current cybersecurity threats faced by us and steps we are taking to address them.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: BioCrude utilizes the specialized services of an IT professional, to protect its internet-connected systems, such as hardware, software and data from unauthorized access to its data centers and other computerized systems. We deploy collective methods, technologies, and processes to help protect the confidentiality, integrity, and availability of computer systems, networks and data. Part and parcel of our cybersecurity is, continuously updating our licensed/purchased software, running up-to-date antivirus software, having firewalls (Secure for BioCrude's website provided by its website hosting agent, and Watchguard systems as a gatekeeper to the internet), as well as being prudent on continuously changing usernames and passwords and being cognizant and suspicious of unexpected emails (Phishing emails are currently one of the most prevalent risks to the average user).

companyName: BioCrude Technologies USA, Inc.


text: The Company engages third-party service providers to be able to perform 24/7 proactive monitoring, correlation and triage of logs and activity throughout our systems, networks and infrastructures. These processes are performed by cybersecurity service providers as well as automated detection. These processes include detection and response, as well as vulnerability management and remediation. The Company also has a vendor risk management process to assess risks related to technology third-party service providers where we initially assess their cybersecurity posture upon engaging their services. We annually review these vendors to update our risk assessment and to monitor for any changes that could present additional risks.

companyName: HELEN OF TROY LTD

ticker: HELE


text: We engage third-parties to conduct information security testing, including penetration testing, on our systems including our credit card payments infrastructure. In addition, our information security program is subject to periodic self-assessments that measure the maturity of our program in a manner aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ETSY INC

ticker: ETSY


text: A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive, or business harm, loss of intellectual property rights, significant costs, or the Company being subject to government investigations, litigation, fines, or damages. As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. For more information, see "Risk factors - Risks related to our business operations, employee matters, taxes, litigation, and managing growth - Information system failures or unauthorized or inappropriate use of or access to our information systems risk disclosure of confidential or proprietary information, including personal data, and could damage our reputation, and subject us to significant financial and legal exposure."

companyName: iTeos Therapeutics, Inc.


text: RCSC meetings include discussions of specific risk areas throughout the year including, among others, those relating to cybersecurity. The CISO provides quarterly updates each year to RCSC on cybersecurity matters. These reports include an overview of the cybersecurity threat landscape, key cybersecurity initiatives to improve the Company's risk posture, changes in the legal and regulatory landscape relative to cybersecurity, and overviews of certain cybersecurity incidents that have occurred within the Company and within the industry.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: We regularly review the effectiveness of our cybersecurity controls, promptly addressing any identified risk areas and subject our information technology systems to testing performed by external parties on an annual basis. Our employees are required to successfully complete training on topics relating to our cybersecurity, data privacy and information security policies and procedures. Training is administered and tracked through online training modules. In addition, we perform periodic testing to evaluate the effectiveness of our training programs and to help prevent loss associated with the disclosure of electronic information. We also leverage third-party service providers and solutions across our operations to review, test, and assess our security systems and controls, as well as assist in the mitigation of any potential cyber risks. We recently obtained the ISO 27001 certification.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: We have integrated our assessment and management of material risks from cybersecurity threats into our overall risk management systems and processes. For example, the results of such third-party cybersecurity assessments are shared with our senior management and the board's audit committee for review, both of which evaluate our overall enterprise risk.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: To date, such cybersecurity risks have not materially affected us. We do, from time to time, experience threats to our data and systems that have been halted by the policies and systems in place. For more information about the cybersecurity risks we face, see "Risk Factors - Operational Risks" in Part I, Item 1A of this Annual Report.

companyName: UNION BANKSHARES INC

ticker: UNB


text: The Company has processes in place to assess the effectiveness of its information technology security program. The Company applies cybersecurity assessment tools that analyze the Company's ability to identify, protect from, detect, respond to, and recover from cybersecurity threats and that analyze the various controls put into place by the Company's information security program. The Company also conducts an annual cybersecurity assessment to identify risks and issues and may conduct more frequent assessments as required by a material change to the Company's cybersecurity risk. Further, the Company engages third parties to conduct penetration tests to assess the performance of the information technology security program. The results of these assessments and tests are reviewed by the Company's enterprise security team and senior management and are used to identify areas of vulnerability, which the Company then works to address.

companyName: Finance of America Companies Inc.

ticker: FOA


text: The Bank relies heavily on its information systems and other technology to conduct and manage its business and, as a result, it is subject to cybersecurity threat risk. Cybersecurity threats include potential unauthorized occurrences on or conducted through the Bank's information systems that may result in adverse effects on the confidentiality, integrity, or availability of its information systems or any information residing therein. Cybersecurity threat risks include, but are not limited to, malicious software or the exploitation of vulnerabilities, social engineering (e.g., phishing), denial-of-service attacks, viruses, and/or malware. As further described below, the Bank has implemented processes for assessing, identifying, and managing material risks from cybersecurity threats that are designed to protect the confidentiality, integrity, and availability of its information technology assets and data.

companyName: Federal Home Loan Bank of Dallas


text: The Company's Chief Risk Management Officer reports directly to the CEO and chairs the Company's management-level Enterprise Risk Management Committee, through which the Company's executive team manages and oversees the Company's entire risk management program, including cybersecurity risk management. In addition, the Company's Chief Information Security Officer ("CISO") reports directly to the Chief Risk Management Officer and works in tandem with the Company's Enterprise Technology Department. The Enterprise Technology department is responsible for the Company's information systems and for building and maintaining cybersecurity defenses within the Company's technology systems. The Company's Chief Technology Officer ("CTO") reports directly to the CEO and leads the Enterprise Technology Department. Collectively, the Enterprise Technology and Enterprise Risk Management Departments work together to oversee the day-to-day management and implementation of the Company's cybersecurity risk management program.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our SVP Engineering and Chief Information Security Officer, General Counsel and Head of Global Affairs, and Chief Privacy Officer, as appropriate. In addition, our incident response plan includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: Grindr Inc.

ticker: GRND


text: Aptiv is also exposed to cybersecurity risks at third-parties, such as suppliers, customers, service providers and consultants. Third-party risk to the Company is identified through an internal third-party risk management process, which involves analyzing third parties for cybersecurity risk at onboarding and throughout the duration of their relationship with the Company. For third-parties with a high cyber risk, we also utilize external firms to monitor such third-parties for threats and to provide remediation support as needed.

companyName: Aptiv PLC

ticker: APTV


text: We have implemented policies, programs and controls and invested in cybersecurity technologies that focus on assessing, monitoring, and managing our cybersecurity risks. These include, but are not limited to: maintaining comprehensive cybersecurity policies and practices; augmenting our organization with a global cybersecurity operation center that monitors cyber threats 24-hours a day on a year-round basis; new surveillance technologies to proactively identify threats and improve the Company's cyber defense capabilities; implementing enterprise-wide cybersecurity training, anti-phishing and awareness programs for our employees and crew members; and conducting cyber simulations with various teams across the Company as well as with management to evaluate our response approach. We have also implemented comprehensive processes designed to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which include security assessments on our suppliers and vendors and continuous monitoring of cyber threats. Our cybersecurity program is based on recognized best practices and standards for cybersecurity, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We conduct regular third-party assessments of our cyber risk management program.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: Impacts of Cybersecurity Incidents To date, the Company has no knowledge that we have experienced a cybersecurity incident that has or is reasonably likely to have a material impact on our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" in this document for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: We manage access controls to restrict data acquisition and system entry to authorized personnel only and enforce compliance with pre-set permission levels via Microsoft systems. We work with a third-party IT resource with an endpoint management system to monitor and secure all endpoints within the Company's cloud-based network and invest in continuous threat intelligence resources and technologies to detect, analyze, and respond to emerging cyber threats.

companyName: Guardion Health Sciences, Inc.


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by maintaining quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from qualified third-party experts, we periodically conduct penetration testing and tabletop exercises to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we regularly educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: Our CDO directs, coordinates, plans, and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy.

companyName: REGIS CORP

ticker: RGS


text: The Company did not experience a material cybersecurity incident in 2024. It did, however, experience the previously-disclosed impacts from the Change Healthcare cybersecurity incident in the first and second quarters of 2024. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – "Significant disruptions of information technology systems or breaches of information security could materially and adversely affect our business, financial condition and operating results." which is incorporated by reference into this Item 1C.

companyName: Veradigm Inc.


text: Risks from Cybersecurity Threats We have not experienced any material cybersecurity incidents. As a result, we do not believe that risks from cybersecurity threats, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. See also "Risk Factors — Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business strategy and operating results." As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks Governance Board of Directors Oversight Our board of directors oversees the management of risks associated with cybersecurity threats.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: The Company's Board of Directors (the "Board") takes an active role in risk oversight related to cybersecurity matters, primarily through the Audit Committee (the "AC"), which covers enterprise cybersecurity risk, and the Innovation and Technology Committee (the "ITC"), which covers product cybersecurity risk. The Board, individually and through the AC and ITC, regularly reviews relevant information technology and cybersecurity matters and receives periodic updates from information technology and cybersecurity subject matter experts as part of its risk assessment procedures, including analysis of existing and emerging risks, as well as plans and strategies to address those risks. In connection with the Board's risk management oversight responsibility, the entire Board receives a full briefing from management annually on cybersecurity matters, as well as periodic briefings based on specific requests or current events. On a regular basis, the Board also reviews the Company's enterprise risk management program, within which the Company's cybersecurity processes have been integrated, as described above.


text: We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The CRO/CISO coordinates the Company's response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information. The CRO/CISO informs senior management and the Board Risk Chair and Board Audit Committee Chair as soon as practical if a significant security incident occurs. Formal incident reports, if/when applicable, are reviewed by ITSC, ERMC, and the Board Risk Committee.

companyName: Capital Bancorp Inc

ticker: CBNK


text: On April 1, 2022, a final rule issued by federal financial regulatory agencies became effective – that rule imposes upon banking organizations and their service providers notification requirements for significant cybersecurity incidents. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident" as those terms are defined in the rule. Banks' service providers are required under that rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: The Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience at the Company and elsewhere, leads our global information security organization responsible for overseeing the Coupang information security program. The CISO regularly reviews our cyber strategy with technology leadership in order to integrate the cyber strategy across the organization. The CISO is updated on cybersecurity threats from experienced information security officers in our security organization on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Supporting the CISO, is the dedicated information security team, which comprises almost 200 individuals. In addition to full-time employees, external consultancy services provide us with certain information security services and specialized advice.

companyName: Coupang, Inc.

ticker: CPNG


text: Our CISO leads an internal cybersecurity team comprised of individuals with varying experience and skillsets. This team covers a variety of cybersecurity-related functions, including security operations, strategy and governance risk and compliance, program management, security architecture and engineering, vulnerability management, and product security. We also have a dedicated security operations center that is responsible for detection and monitoring of cybersecurity incidents. Our CISO takes steps to stay informed about and monitor the identification, prevention, detection, protection, mitigation, and remediation of key cybersecurity risks and incidents through various means. In the case of a security event, the security incident response plan is activated to respond to the security event. We also assess and manage our cyber risks through our internal Information Security and Privacy Governance Committee, which is composed of a cross-organizational leadership team and was formed to oversee the management, operation, and overall effectiveness of the information security management system.

companyName: SailPoint, Inc.

ticker: SAIL


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to senior management and the Information Technology Committee of our board of directors, as well as the full board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: The Company's Global Chief Information Officer ("Global CIO") leads all aspects of the Company's IT strategy, including digital capabilities and information systems. The Company's Global Chief Information Security Officer ("Global CISO"), who reports to the Global CIO, is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including the Brink's GIS Program. The Global CIO, with support from the Global CISO, provides periodic reports to the Board, the Chief Executive Officer, the Chief Financial Officer ("CFO") (to whom the Global CIO reports) and other members of our senior management. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. The GIS Program is regularly evaluated internally and externally, including by third-party experts, and the results of those evaluations are reported to senior management and the Board. The Company also actively engages with key vendors, industry participants and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security program, policies and procedures.

companyName: BRINKS CO

ticker: BCO


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, penetration testing firms, threat intelligence service providers, dark web monitoring services, cybersecurity consultants.

companyName: CS Disco, Inc.

ticker: LAW


text: The Cybersecurity Committee bears the primary responsibility for oversight of the management of risks related to the Company's information technology use and protection, cybersecurity, and product security. The Cybersecurity Committee consists of directors with cybersecurity and other expertise including risk management, technology and finance. The Cybersecurity Committee assists the Audit Committee and the Board in overseeing Tenable's overall process of risk assessment and enterprise risk management.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Our Information Security Officer and our cybersecurity team (which consists of our security policy manager, security operations manager, and red team lead) are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Information Security Officer has over 20 years of expertise within the cybersecurity field, and manages an experienced team with expertise in relevant security practices such as penetration testing, security operations, policy, etc.

companyName: Blend Labs, Inc.

ticker: BLND


text: The CIO, in coordination with the Information Security Governance Committee, is responsible for leading the assessment and management of cybersecurity risks. The current CIO has over 25 years of experience in information security. The CIO reports to the Board of Directors as part of the Information Security Governance Committee's updates discussed above and regularly communicates with the other members of the Information Security Governance Committee and senior management regarding cybersecurity risks.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: continuous monitoring for internal and external threats; regular evaluations of our cybersecurity program, including periodic external reviews; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees, as well as cybersecurity awareness training for our employees. Our program leverages standard industry frameworks to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: Cybersecurity Risk Management and Oversight The Board is responsible for overseeing the Company's cybersecurity program and ensuring that it is aligned with our strategic goals and risk appetite. The Board has diverse expertise on topics including accounting and financial management, corporate governance, global business, technology and innovation, human capital management, ESG and cybersecurity. The Board also reviews the strategic direction of the Company's cybersecurity program and ensures that adequate resources and budget are allocated to address cybersecurity threats.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: Our Board, with assistance from its Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Audit Committee receives reports on significant cybersecurity developments from the management team responsible for overseeing the Company's risk and cybersecurity management processes, including our Chief Compliance Officer and VP of Infrastructure & Security. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to our Board in a timely manner.

companyName: Exodus Movement, Inc.

ticker: EXOD


text: Although we continue to invest in cybersecurity and to enhance our internal controls and processes, we cannot guarantee these measures will be sufficient to protect us from a network security incident. For further information regarding the risks we face from cybersecurity threats refer to the "Risk Factors" within this Form 10-K.

companyName: OOMA INC

ticker: OOMA


text: To help protect client information and Tyler data, Tyler leverages both internal and external resources, including third-party assessments, to work to identify and respond to information security risks. For example:

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: We have implemented various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including sensitive and confidential information (including intellectual property and tenant and property-related information) that is proprietary, strategic, or competitive in nature ("Information Systems and Data"). Our information security processes are overseen by an outsourced IT Manager, with oversight from our Chief Operating Officer, who works to help identify, assess, and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using various methods. We have implemented and maintain technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including with respect to incident response, network security controls, access controls, periodic back-ups of data, and employee training addressing awareness of cybersecurity risks and how to detect certain cyberattacks. Some of these measures and processes involve the assistance of additional third-party service providers. For example, we rely on third-party service providers to assist us with our employee phishing testing and cybersecurity awareness training.

companyName: FrontView REIT, Inc.

ticker: FVR


text: Our board of directors administers its cybersecurity risk oversight function through its audit committee. The audit committee is responsible for overseeing our policies, practices and assessments with respect to cybersecurity, and provides periodic updates to our board of directors.

companyName: Protagenic Therapeutics, Inc.\new

ticker: PTIX


text: Cybersecurity risk oversight continues to remain a top priority for our Board. The audit committee of our Board maintains primary responsibility related to overseeing our cybersecurity risk as part of its program of regular risk management oversight. This includes, but is not limited to, the overall maturity and strategy of our cybersecurity program.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: Our Director of IT has over 15 years of experience in the field of information technology. He oversees and tests our compliance with standards, remediates known risks, and leads our employee training program and has extensive experience in cybersecurity and possesses the necessary knowledge, skills, background, and experience.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of Charles River subject-matter experts and leaders to assess and refine Charles River's cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our IT systems were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises. We also perform threat hunting and red team exercises.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: We, Kronos and CompX continually enhance our security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We, Kronos and CompX engage third-party services to conduct evaluations of our security controls through penetration testing, red team testing, consulting on best practices and to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: VALHI INC /DE/

ticker: VHI


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Operations Officer ("COO"), to manage the risk assessment and mitigation process.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Commencing in 2024, our Audit Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior professionals of the Adviser and Onex Corp. and each of the Adviser and Administrator is a subsidiary of Onex Corp. As such, we are reliant on Onex Corp. for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Onex Corp. has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Onex Direct Lending BDC Fund


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional discussion of cybersecurity risks or the impact of previous cybersecurity incidents, see Item 1A. Risk Factors "Risks Related to Our Business" in this Annual Report on Form 10-K.

companyName: Westrock Coffee Co

ticker: WEST


text: The Company relies on information systems and the data stored on them to conduct its operations. Our cybersecurity risk management program is designed to allow us to identify, assess, and manage cybersecurity risks. Our Chief Technology Officer, with the support of our IT Manager, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Technology Officer has 30+ years of experience leading and managing consumer facing services at scale. He has a Bachelor of Science in Computer Science and has led and managed both engineering and Enterprise IT teams across large scale organizations focused on delivering secure and performant consumer products. Our Chief Technology Officer also works closely with other management positions to ensure that the Company understands its cybersecurity risk management responsibilities.

companyName: Interactive Strength, Inc.

ticker: TRNR


text: The Company has experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on its business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on the Company's business strategy, results of operations, or financial condition to date, any actual or perceived breach of its security could cause operational disruption and result in delays or inability to produce, print and deliver its publications and other third-party print publications, damage the Company's reputation, cause the Company to lose existing customers, prevent the Company from attracting new customers, or subject the Company to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect the Company's business strategy, results of operations, or financial condition. In addition, more resources may be needed for the security of the Company's information technology systems in the future, which could increase the cost of doing business or otherwise materially adversely affect the Company's business strategy, results of operations, or financial condition.

companyName: DallasNews Corp


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.

companyName: INNO HOLDINGS INC.

ticker: INHD


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate an initial business combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the Board of Directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: TortoiseEcofin Acquisition Corp. III


text: The Company's acting CISO reports directly to the CIO, who in turn reports to the Chief Executive Officer. The CISO maintains the certified information systems security professional certification and has more than 23 years of experience in cybersecurity. Under the direction of the CISO, the Company's information technology department continuously analyzes cybersecurity risks to its business, considers industry trends and implements controls, as appropriate, to mitigate these risks. This analysis drives the Company's long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the Board of Directors regularly.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting confidentiality of business, client, investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Technology Finance Corp.

ticker: OTF