text: The Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. The Company's cybersecurity organization is led by the CTO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to Usio's CEO, CAO, and Legal team, as well as to the Risk and Cybersecurity Committee. The CTO has served in this role for 16 years, and more than 20 years with the Company developing, maintaining, and securing our corporate network and information technology systems. The CTO holds a bachelor's degree in Information Technology from the University of Texas at San Antonio with over 11 years of previous software and hardware systems engineering experience.

companyName: Usio, Inc.

ticker: USIO


text: The Company's Chief Information Security Officer ("CISO") is responsible for assessing and managing the Cybersecurity risks with comprehensive oversight of information security functions with an emphasis on strategic leadership, governance, risk management and technical proficiency. Moreover, the Company's CISO provides cyber security updates to the entire board of directors and the board's Quality Compliance Management Risk Committee (the "Committee"). The purpose of the Committee is to assist the Board in fulfilling its oversight responsibilities relating to the Company's compliance with laws, regulations, and industry standards that, if breached, may cause significant business, regulatory, or reputational damage to the Company, including oversight of the Company's: • Compliance with good ("x" = manufacturing, clinical, laboratory, pharmacovigilance, storage, distribution etc.) (GxP) and medical device Quality Systems Regulations (QSR); • Healthcare compliance, anti-corruption, privacy and data security landscape, medical product safety, supply chain, employee health and safety, political expenditures and lobbying activities, and government contracting; • Enterprise Risk Management program; • Cyber and information security risks.

companyName: Emergent BioSolutions Inc.

ticker: EBS

secItem: Item 1C


text: If the incident is determined material, the company will file a Form 8-K within four business days of determining the event was material. The disclosure would include the material aspects of the incident's nature, scope, and timing as well as the material impact on the Company.

companyName: Woodbridge Liquidation Trust

ticker: WBQNL


text: We are an early stage biopharmaceutical company and we are focused on developing our patented DehydraTECH technology. We do not sell products and therefore do not maintain customer lists or similar personal information. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently. We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. To this end, we utilize an outsourced information technology consultant, who we believe has sufficient experience and expertise with regard to cybersecurity matters, to implement systems and procedures designed to reduce, respond to and monitor for cybersecurity threats and vulnerabilities. Our outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems monthly and has implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition.

companyName: Lexaria Bioscience Corp.

ticker: LEXX


text: governing internal communications regarding Cybersecurity risks; and making required public and regulatory disclosures regarding Cybersecurity threats and incidents. We oversee risks from Cybersecurity threats associated with our use of third-party service providers by requiring our vendors to agree that they have and will maintain appropriate Cybersecurity controls, such as through standard contractual provisions, and by coordinating with key vendors with respect to integration with our systems. Our Cybersecurity risk management program is based on the National Institute of Standards and Technology ("NIST") framework.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: We devote significant resources to our security program that we believe is reasonably designed to mitigate our cybersecurity and information technology risk. We believe our cybersecurity program is reasonably designed to protect our information systems, software, networks, and other assets against, and mitigate the effects of, cybersecurity incidents where unauthorized parties attempt, among other things, to disrupt or degrade service or our operations; misuse or abuse technology and information systems; make unauthorized disclosure of data; or otherwise cause harm to Ford and Ford Credit, our customers, suppliers, or dealers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are reasonably designed to reduce and mitigate these risks, and have requirements for our suppliers and service providers to do the same. Data safeguard practices of suppliers and service providers who process Personally Identifiable Information on our behalf are reviewed annually for compliance with our policies and applicable regulations. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers and service providers, there can be no assurance that we can prevent the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by those parties. When we become aware that a supplier or service provider's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems.

companyName: FORD MOTOR CREDIT CO LLC


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures, and evaluating guidelines and policies with respect to our cybersecurity risk assessment and risk management. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. From time to time, third-party subject matter experts present to the Audit Committee on contemporary cybersecurity topics of interest.

companyName: GRIFFON CORP

ticker: GFF


text: We believe that information security is a critical component of our business strategy. Therefore, we maintain and continuously assess and strengthen our cyber security program. We do not maintain a database of information other than for our products Management

companyName: Resonate Blends, Inc.

ticker: KOAN


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. The Audit Committee maintains delegated oversight of cybersecurity risks, bringing in third-party expertise as needed to advise on cybersecurity infrastructure, policies, and practices. Our CIO and CISO brief the Audit Committee quarterly, at a minimum, on Montrose's cybersecurity risks, business-impacting incidents, and ongoing and future cybersecurity project implementations. In addition, the Audit Committee's third-party cybersecurity advisor meets regularly with the CIO and CISO to review our cybersecurity strategy and our continued progress toward meeting our objectives. The full Board of Directors receives quarterly updates from the Audit Committee regarding its oversight of cybersecurity risks and is also periodically briefed on our cybersecurity risk management program directly by our CIO and CISO.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Our information security function is led by our Chief Financial Officer & Head of Corporate Strategy ("IT Lead"), who reports to our CEO and is supported by our third party security provider, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example analyzing report of threats and threat actors and conducting periodic vulnerability assessments for certain systems. Our assessment and management of material risks from cybersecurity threats are considered as part of our risk management processes. For example, our IT Lead and certain management, including our CEO, evaluate identified material risks from cybersecurity threats against our overall business objectives and our IT Lead periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and, we believe, are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional description of risks from cybersecurity threats and potential related impacts on the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "We are dependent upon information technology systems, which are subject to disruption, damage, failure and risks associated with implementation and integration."

companyName: Aircastle LTD

ticker: AYR


text: The Company and its business units engage third parties to assess various aspects of the information security program, provide threat intelligence, perform external audits, perform penetration testing, and provide other services as needed.

companyName: Graham Holdings Co

ticker: GHC


text: Our security incident response plan provides guidelines and requirements for reasonable and consistent responses to security incidents to limit damage while preserving the confidentiality, integrity and availability of Company systems and information, and reducing recovery time and cost, including but not limited to, escalation of security incidents to appropriate team members for investigation and response and documenting the required steps for investigation and remediation taken during the security incident response. We perform an annual tabletop exercise led by third-party security experts with participation from executive management and technical internal teams.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: The Technology Steering Committee meets on a regular basis and is tasked with providing oversight and guidance regarding both information technology and cybersecurity related issues of strategic importance to the Bank. The Technology Steering Committee is comprised of numerous members of the management team, Chief Technology Officer ("CTO") and ISA. The Technology Steering committee reports to the Board of Directors through Committee minutes.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Risk Management and Strategy Enterprise Risk Management. We utilize an enterprise risk management process undertaken on an ongoing basis pursuant to which we seek to identify various enterprise risks related to product safety and regulatory, global environmental exposure, site environmental matters, IT system interruption and cybersecurity, supply chain matters, business continuity, health and safety incidents, and other matters. We have an enterprise risk management group that manages this process, which includes our executive leadership team. Their activities include assessing the risks, prioritizing the risks, measuring the risks, implementing mitigation plans, and auditing the results.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: Our cybersecurity risks are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors, and our Internal Audit function, which is an objective, independent assurance and advisory organization that helps HP achieve business objectives and conducts regular assessments, audits, and testing of the cybersecurity program and its associated controls.

companyName: HP INC

ticker: HPQ


text: Our board of directors has delegated oversight of risk assessment and risk management activities, including oversight over cybersecurity risks, to the audit committee. The audit committee meets at least quarterly with our Vice President and Chief Information Security Officer ("CISO"), who oversees our overall information security risk management program. The CISO's updates to the audit committee include recent developments related to the threat landscape, security controls, results of vulnerability assessments, third-party reviews, technological trends and information security considerations arising with respect to peers and third parties.

companyName: Paylocity Holding Corp

ticker: PCTY


text: The Corporation's information technology risk management department consists of professionals with experience and expertise in cybersecurity, including specialists in identity and access management, cyber defense operations, security engineering, and information technology governance, risk, and compliance. This department is led by the Chief Information Officer ("CIO"), who has a bachelor of science in information technology and many certifications such as Certified Information Systems Security Professional, Certified Cloud Security Professional and Certified Information Privacy Professional, and the Information Security Officer ("ISO"), who has a bachelor of science in computer science and has over 19 years of experience in cybersecurity risk management. The ISO reports to the CIO, and the CIO reports directly to the President and Chief Executive Officer. Additionally, the Corporation engages third-party experts as needed to assess, manage, and respond to cybersecurity risks through various methods, including risk assessments, IT audits based on different frameworks, penetration and vulnerability testing, social engineering, incident response, threat intelligence, education, and managed security services.

companyName: PROVIDENT FINANCIAL HOLDINGS INC

ticker: PROV


text: Our Chief Information Officer ("CIO") is responsible for implementing our cybersecurity strategy, developing policies and procedures, and ensuring that appropriate resources are allocated to cybersecurity initiatives. Our CIO has over 25 years of experience in the information technology field, including consulting on cybersecurity risks and mitigation in a variety of industries. He is a member of the local Infragard chapter and a regular speaker on cybersecurity topics at the Chlorine Institute. Additionally, the senior security and network engineering team has decades of experience in network and application security. The CIO is continually informed about the latest threats and developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CIO implements and oversees processes based on the National Institute of Standards and Technology ("NIST") cybersecurity framework and is responsible for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. Management reports at least twice yearly to the audit committee on the status of our cybersecurity efforts, including assessments of significant risks identified and actions designed to mitigate such risks.

companyName: HAWKINS INC

ticker: HWKN


text: Risk Management and Strategy Match Group maintains an enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our information security teams, led by our Senior Vice President, Security Engineering, are responsible for assessing and managing our exposure to information security risks, including by: • Implementing and enforcing physical, operational and technical security policies, procedures and controls; • Conducting, and engaging independent third-party experts to conduct, regular internal and external security assessments and audits, including assessments of the security posture of third-party vendors and partners; • Collaborating with our development teams to engineer and integrate security throughout the product development lifecycle; • Implementing scalable and continuous data protection practices; and • Detecting, monitoring, investigating, and responding to potential security threats and incidents.

companyName: Match Group, Inc.

ticker: MTCH


text: Cybersecurity threats have not materially affected, and are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition while we are strategically focused on pursuing development of our Casamora property. The Company is not aware of any material security breach to date.

companyName: Awaysis Capital, Inc.

ticker: AWCA


text: The CISO and VP of Information Security have more than 25- and 30-years' experience, respectively, working directly in the cybersecurity industry, performing and coordinating red-teaming and blue-teaming exercises, conducting research and developing cybersecurity tools and products, as well as presenting at various international conferences.

companyName: Satellogic Inc.

ticker: SATL


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. We maintain security controls that are continuously reviewed to protect against emerging cyber threats. Our IT Department monitors these security controls and risks and regularly reports to senior management and the board of directors on material developments.

companyName: Corvex, Inc.

ticker: MOVE


text: We have established procedures to assess, identify, and manage material risks from cybersecurity threats and have integrated those procedures into our overall risk management systems and processes.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: Before engaging third-party service providers who may have access to the Company's, customer, employee or other sensitive data, or to the Company's systems, we perform due diligence in order to identify and evaluate their cyber risks, which includes self-attestation questionnaires (developed using Service Organization Controls (SOC) reports). This process is led by the Vendor Management team and includes participation of dedicated information security resources. Third-party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. After contract executions, third-party service providers deemed critical by our vendor management office undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information, or collectively Information Systems and Data.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: The cybersecurity councils, cybersecurity management teams and materiality assessment teams include members with decades of operational experience as cybersecurity professionals as well as management with decades of service in the areas of information and operational technology and legal, compliance, financial reporting and enterprise risk management. Some of these members hold degrees and certifications that we believe enhance our ability to manage and respond to cybersecurity risks, including, among others, bachelor's and/or master's degrees in cybersecurity and computer science as well as certified information systems security professional, certified incident handler, and certified information security manager certifications.

companyName: SEMPRA

ticker: SREA


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including because of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: XBiotech Inc.

ticker: XBIT


text: Although the risks from cyber threats have not materially affected FirstEnergy's business strategy, results of operations, or financial condition to date, FirstEnergy continues to closely monitor cyber risk. Overall, FirstEnergy has implemented tactical processes for assessing, identifying, and managing material risks from cyber security threats to FirstEnergy including governance at the executive and board level of FirstEnergy's Cyber Security Program, including FE's risk management strategy and the controls designed to protect its operations. Additionally, FirstEnergy, through its Disclosure Committee, has updated its disclosure controls and procedures to ensure appropriate disclosure of any material cyber security incidents. See Item 1A. Risk Factors for additional information regarding FirstEnergy's cyber security risks. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.

companyName: FIRSTENERGY CORP

ticker: FE


text: As a part of its oversight of the key risks facing the Company, our Board of Directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. While the Audit Committee of the Company's Board of Directors (the "Audit Committee") reviews any significant legal, compliance or regulatory matters that may have a material impact on the Company's business, financial statements or compliance policies generally, it does so in consultation with our ERC Committee with respect to any such matters that involve cybersecurity, data privacy or information technology. The Chair of our ERC Committee is also a member of our Audit Committee, which facilitates close coordination between the two committees on cybersecurity, data privacy and information technology matters.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: We have implemented a comprehensive cybersecurity program guided by recognized industry practices and frameworks and we continue to evolve the program in order to be able to assess, identify and manage risks from the continually evolving cybersecurity threat landscape. Our cybersecurity program encompasses our enterprise information technology, including operational technology and technology of third parties on which we rely, and connected products and services. Although we maintain a cybersecurity program that we believe is reasonably designed to protect the Company, cybersecurity threats may result in adverse effects on the confidentiality, integrity, and availability of our information systems or those of third parties on which we rely, and our connected products and services.

companyName: Xylem Inc.

ticker: XYL


text: We face a number of cybersecurity risks in connection with our business. As of the date of this report, we are not aware of any cybersecurity incidents that materially impacted the Company in the last three years. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition to date, we have, from time to time, experienced threats to and unauthorized persons gaining unapproved access to, including breaches of, our data and systems, including insider threats and phishing attacks. For more information about the cybersecurity risks we face, see " Risk Factors – We rely on the efficient, uninterrupted, and secure operation of complex information technology systems and networks to operate our business. Any significant system or network disruption due to a breach in the security of our information technology systems could have a negative impact on our reputation, regulatory compliance status, operations, sales, and operating results " included elsewhere in this Annual Report

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each of our associates is required to complete information security and data privacy training on an annual basis to reinforce awareness of cybersecurity risks to the organization.

companyName: Playa Hotels & Resorts N.V.


text: The Sponsor, Fidelity Management & Research Company LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists. These assessments include regular penetration testing and periodic third-party audits to validate the effectiveness of our controls.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: There can be no assurance that the Company's third-party vendors' and service providers' cybersecurity risk management processes, including their policies, controls or procedures, will be effective in protecting the Company's systems and information.

companyName: SUNHYDROGEN, INC.

ticker: HYSR


text: In the ordinary course of our business, we collect and store sensitive data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of policies, standards, architecture, and processes. The cyber risk management program falls under the purview of our Controller, who serves as our head of the Information Technology ("IT") systems and processes, and has cross-functional expertise in IT, cyber security, and more than 10 years of experience. Under the guidance of our Controller and Chief Financial Officer, we work with various third party consultants to help develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements and to evaluate/adopt cybersecurity software from reputable vendors in cybersecurity.

companyName: Inrad Optics, Inc.


text: The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company's business depends on the communications and information technology systems that it shares with Man Group, which has a majority interest in Varagon, the parent company of the Adviser. The Company also relies on the cybersecurity policies and procedures implemented by Man Group. Man Group has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to Man Group's Information Security Policy (the "Information Security Policy") and Man Group Cybersecurity Policy ("the "Cybersecurity Policy"), the Man Group's Information Security team and the Chief Information Security Officer ('the "CISO") are responsible for the ongoing and regular monitoring of the Information Security Policy and the Cybersecurity Policy to ensure that they are operating in a manner reasonably calculated to prevent unauthorized access to, or unauthorized use of, non-public information. Man Group has engaged and may engage, from time to time, assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks, subject to the continued oversight of Man Group.

companyName: Varagon Capital Corp


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face cybersecurity risks, threats and attacks that could materially affect our operations, business strategy, results of operations, or financial condition. For further details on the exposures related to these risks, see the section titled "Risk Factors" within this Annual Report on Form 10-K.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level and by reviewing our operational policies and procedures. We review our operational policies and procedures with third party experts on an annual basis as part of our annual audit process. We also maintain cyber insurance coverage. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Vendor Management Team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: We evaluate cybersecurity risk as part of our overall enterprise risk management program, using systematic methodologies, reporting channels and governance processes that apply across the broader enterprise risk management program.

companyName: bluebird bio, Inc.


text: As of December 31, 2023, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have invested in the protection of our data and information systems and the monitoring of our systems on an ongoing basis, such efforts may not in the future prevent material compromises to our information systems, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and practices.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: For information security and technology risks, our first line of defense includes the following: • Chief Information Security Officer: The CISO establishes and manages the enterprise-wide information security program. • Chief Information Officer: The CIO oversees the establishment of appropriate governance, processes, and accountabilities within each business area to comply with our internal policies.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Ongoing Activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: All corporate machines are protected by anti-virus software and enterprise network protection; We require two-factor authentication on all corporate machines; We require two-factor authentication for all corporate email accounts; We require all corporate employees to complete quarterly cybersecurity training provided by a third-party; Our CIO and other members of our technology team, proactively monitor all potential risks and immediately respond to threats; Our data is backed up in multiple offline air-gapped devices; We test all backups quarterly; We monitor regulations to ensure our policies and procedures are up-to-date and compliant.

companyName: HireQuest, Inc.

ticker: HQI


text: To aide in identifying and assessing material risks from cybersecurity threats, our Enterprise Risk Management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring and vulnerability assessments to inform our professionals' risk identification and assessment.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: We maintain a comprehensive information security policy that is intended to maintain the security and confidentiality of client information, protect against threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. We have a written information security program that is aligned to our information security policy and designed to assess, identify and manage risks that result from cybersecurity threats. Our information security program is centered on preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and cyber incidents while ensuring our processes continue to operate effectively. On an annual basis, the Board of Directors reviews and approves our information security program and information security policy.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: Monitoring Controls. In addition to our cybersecurity policies and procedures, we place significant emphasis on monitoring controls as a critical component of our cybersecurity strategy. These controls are designed to enable us to consistently oversee and evaluate the effectiveness of our cybersecurity measures to help ensure prompt detection of and response to potential threats or anomalies.

companyName: EVgo Inc.

ticker: EVGO


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with data breach or other similar incidents. Cyber liability insurance also provides coverage in the event of a ransomware attack. Our cyber risk coverage includes assistance in the timely remediation of material cyberattacks and incidents.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: Cybersecurity threats on our information systems are included as a topic considered by our risk committee working group. This group identifies, assesses and makes related recommendations for managing a number of risks, including cybersecurity threats. Management has also formed an enterprise risk management committee which is charged with addressing the full spectrum of its risks and managing the potential individual as well as combined impact of those risks as an interrelated risk portfolio. Moreover, this group engages subject matter experts from various departments within the Company to engage in a bi-annual exercise designed to identify potential worse case scenarios, the estimated likelihood of each, and the potential financial impact of each risk, as well as to prioritize such risks, including the risk of a cybersecurity threat.

companyName: GRAYBAR ELECTRIC CO INC


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, tabletop exercises, and other areas of importance. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. Our Chief Compliance Officer also regularly reports to the Audit Committee regarding the Company's compliance with applicable regulations relating to cybersecurity.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures. Management participates in cybersecurity incident response by anticipating and directing the Company's response to cybersecurity incidents. Our cybersecurity incident response processes are designed to identify and escalate certain cybersecurity incidents and vulnerabilities to members of management. Depending on the circumstances, management may work with third party experts and escalate to the Board as necessary.

companyName: GTJ REIT, INC.


text: The board of directors of the Company (the "Board") has oversight responsibility for our risk management framework, including technology and cybersecurity risks facing the Company. The ERM program enables the board to establish a mutual understanding with the management of the effectiveness of its information security risk management practices and capabilities including the division of responsibilities for reviewing its information security risk exposure and risk tolerance, tracking emerging information risks, and reviewing for proper escalation of certain key risks for periodic review by the Board.

companyName: Clever Leaves Holdings Inc.

ticker: CLVR


text: The Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, and cybersecurity represents a component of the Corporation's overall approach to enterprise-wide risk management. The ERC reviews and approves the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Corporation's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Corporation's approach to cybersecurity risk management with the Corporation's CISO.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: The Board has oversight of cybersecurity risks and, specifically, the Audit Committee of the Board is charged with the oversight of the Company's guidelines and policies to govern the process by which risk assessment and risk management are undertaken by management, including with respect to cybersecurity risks. Our Board is composed of members with diverse expertise, including risk management, technology and finance, which experience provides them with the skills needed to oversee cybersecurity risks effectively.

companyName: Matador Resources Co

ticker: MTDR


text: People. Recognizing that technology alone cannot mitigate all security threats, we focus on developing our most critical resource: our people. Our corporate cybersecurity awareness activities are combined with enterprise-wide and department-specific tools and mandatory employee training, providing our employees with knowledge and resources to support our efforts to mitigate security threats.

companyName: PTC INC.

ticker: PTC


text: Management's Role in Managing Risks IT Department is responsible for conducting a risk assessment as well as prioritizing, implementing, and maintaining the appropriate risk-reduction measures defined in the risk assessment process.

companyName: CXApp Inc.

ticker: CXAI


text: The CISO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Audit Committee and Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.

companyName: FAIR ISAAC CORP

ticker: FICO


text: The Plans promote the Company's cybersecurity infrastructure through policies and procedures relating to, among others, employee responsibilities, data loss prevention, access controls, cyber risk assessments and management, reporting requirements, and electronic communications. Pursuant to the Plans, Diameter also engage s external parties as it deems appropriate, including cybersecurity consultants to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the expertise of legal, information technology and compliance personnel of Diameter and external cybersecurity consultants when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.

companyName: Diameter Credit Co


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. We work with third parties, including cybersecurity software providers and managed cybersecurity service providers, to identify and assess cybersecurity risks and conduct penetration testing.

companyName: OPAL Fuels Inc.

ticker: OPAL


text: Our Chief Executive Officer and General Counsel are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from our internal information technology team.

companyName: IMMUNIC, INC.

ticker: IMUX


text: The information security team undertakes or engages in these practices and activities, among others, as part of the Company's risk management system: • updating of software and hardware (including firmware) for vulnerabilities and required patches; • regular employee training and education to identify and avoid cybersecurity risks and threats; • developing, implementing and testing incident response and information recovery plans to assess and respond to cybersecurity threats and incidents; • collaborating with our internal audit function and other internal teams for testing cybersecurity controls and procedures; • identifying and managing cybersecurity risks presented by third parties, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to our systems and data; and the systems of third parties that could adversely affect our operations or business in the event of a cybersecurity incident affecting those third-party systems; • overseeing threat intelligence systems and notification procedures; and • maintaining technology solutions for cybersecurity prevention and defense, including outside firewalls, multi-factor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls.

companyName: Simply Good Foods Co

ticker: SMPL


text: Cyber Security Program Overview The Adviser's cyber security program is reliant on the Investcorp Group's information security team, which is responsible for assessing, identifying, and managing material cyber risks, including those applicable to the Company. The cyber security program involves a periodic risk assessment, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investcorp Group's information security team actively monitors the current threat landscape to identify material risks arising from new and evolving cyber security threats, including material risks faced by the Company, and advises the Adviser of such risks during periodic reviews.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: We utilize our third-party risk management program to evaluate the cybersecurity posture of our third-party service providers based on risk, including data and systems access. These processes assist us in identifying and mitigating risks from cybersecurity threats associated with our use of third-party service providers. Where appropriate, we contractually require third-party service providers to implement and maintain appropriate and reasonable security measures in connection with their work with us and consistent with applicable laws, and to promptly report any breach of their security measures or systems that may affect our company.

companyName: AppLovin Corp

ticker: APP


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially and adversely affected the Company (including our business strategy, results of operations or financial condition), nor, in our view, are such threats currently reasonably likely to materially and adversely affect the same.

companyName: STAG Industrial, Inc.

ticker: STAG


text: We have incurred expenses, and may incur in the future expenses and losses related to this incident. See also the risks included below the heading " Cybersecurity, Information Technology and Outsourced Services Related Risks " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to cybersecurity.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: We have implemented and maintain policies and processes designed to assess, identify, and manage material risk from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data"). We have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: biote Corp.

ticker: BTMD


text: As part of our cybersecurity risk management system, our IT management team tracks and logs privacy and security incidents across our OEM partners, Microsoft and Oracle and other IT system providers, our vendors, and other third-party service providers to remediate and resolve any such incidents. Any significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We would consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosures and other compliance decisions. Our management is tasked with apprising TSS's independent public accounting firm of matters and any relevant developments.

companyName: TSS, Inc.

ticker: TSSI


text: Management's Role in Cybersecurity Risk Management and Governance Our executive management team is responsible for assessing and managing material risks from cybersecurity threats and possess relevant experience and expertise in various disciplines that are key to effectively managing such risks. The experience and expertise of our executive management team is also supplemented by our external IT service providers that collectively have extensive, broad experience and expertise in these areas. Our executive management team reports information about such risks to the Audit Committee of the Board on at least a quarterly basis.

companyName: CervoMed Inc.

ticker: CRVO


text: Annually, employees receive cybersecurity training, and we provide additional targeted cybersecurity awareness and education activities throughout the year. In partnership with external consultants, we periodically conduct "tabletop" exercises with management and members of our Information Security, Information Technology and Privacy teams during which we simulate real-life cybersecurity incident scenarios to assess our preparedness, test our incident response plans and highlight potential areas for improvement. Audits of our cybersecurity risk management processes are conducted periodically in order to test the effectiveness of controls designed to prevent and respond to cyberattacks at different levels within Gap Inc. In addition, we maintain cybersecurity risk insurance.

companyName: GAP INC

ticker: GAP


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers. For certain vendors, these processes include vendor risk assessments, security questionnaires, review of vendors' written security program, and imposition of contractual obligations related to information security on certain vendors.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Identified Cybersecurity Risks Federal and state regulators have issued guidance requiring financial institutions to implement layered security controls, strengthen client authentication for online services, and address risks from compromised credentials. Institutions must also maintain business continuity plans to ensure timely recovery of operations and data following a cyber-attack. Failure to comply with these regulations may result in sanctions, including financial penalties.

companyName: BayCom Corp

ticker: BCML


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Kandi Technologies Group, Inc.


text: There can be no assurance that our cybersecurity program will prevent all incidents. In the event of a cybersecurity incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our capabilities to address evolving threats. We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our Company or our stakeholders.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: Our management team works with our digital transformation team in an effort to identify, assess and manage the Company's cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage, mitigate and remediate material risk from cybersecurity threats to our Information Systems and Data. These measures include but are not limited to firewalls, endpoint detection and response, antivirus programs, email security measures, backups and recovery procedures, privileged access management, multi-factor authentication schemes, data encryption, automatic patching, and security system information event monitoring to detect and respond to any emerging threats. Our information security and privacy policy framework includes standards for incident response, vulnerability management, data protection and logical access controls.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: The Audit Committee receives periodic reports from our cybersecurity function concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: Company management maintains primary responsibility for the risk management of the Company, including cybersecurity risks. The Board's Audit Committee is responsible for the oversight of risks associated with cybersecurity threats. The Audit Committee Charter provides that the Committee is responsible for reviewing management's assessment of the Company's information technology process framework and practices and the controls implemented to monitor and mitigate information technology risks. In addition, as part of the Audit Committee's quarterly meetings and as provided for in its Charter, the Committee receives reports and briefings from the Company's Chief Information Officer (CIO), Director of Cybersecurity, and management's cybersecurity team. Those reports and briefings include management's review of emerging cybersecurity developments and threats, the Company's risk relating to cybersecurity, and the Company's strategy to mitigate data protection and cybersecurity risks. The Audit Committee has the authority to obtain advice and input from external cybersecurity resources to assist in its oversight functions.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: The Board of Directors actively collaborates with management to supervise cybersecurity risks. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: High Roller Technologies, Inc.

ticker: ROLR


text: The Company's cybersecurity program, identified events, current and future strategies are presented to the Audit Committee for periodic review. The Audit Committee may choose to present relevant information to our board of directors (the "Board") as deemed necessary.

companyName: Southland Holdings, Inc.

ticker: SLND


text: We use third-party service providers to perform a variety of functions throughout our business, such as Amazon Web Services, Expedient (Columbus, OH), and Corespace (Dallas, TX). Depending on the nature of the services provided, certain providers are subject to cybersecurity risk assessments at the time of onboarding. We also use various inputs to assess the risk of our third-party service providers, including information supplied by them.

companyName: INTELLINETICS, INC.

ticker: INLX


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature, including information regarding our product architecture, software, algorithms, and applications ("Information Systems and Data").

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: management and strategy recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats.

companyName: Ainos, Inc.

ticker: AIMD


text: We engage third-party security experts to support our risk assessment activities and to provide system security enhancements. Our program includes regular vulnerability and penetration testing (internal and external) of our enterprise systems by independent external security experts.

companyName: STERIS plc

ticker: STE


text: The Company utilizes a risk-based, multi-layered information security strategy based on the U.S. National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage risks from cybersecurity threats. This approach includes: (i) dedicated security operations center monitoring; (ii) network-based and host-based protections; (iii) a Privacy Council focused on privacy regulation adherence; (iv) privileged access management controls; (v) annual and ongoing information security training for all employees and targeted tabletop and other exercises; (vi) encryption of data, backup, recovery, and testing; (vii) regular internal and external audits against information security best practices; and (viii) benchmarking using external third parties. The Company employs these, and other measures, to protect its information assets and operations from internal and external cyber threats while ensuring business resiliency. It also aims to protect employee, customer and supplier information from unauthorized access or attack, as well as secure the Company's networks, systems, devices, products, and services.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: The CISO or other designated person(s) conducts periodic monitoring of the networks affecting the Trust to detect potential cybersecurity events;

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: HPS Corporate Lending Fund


text: We also maintain a business continuity program designed to ensure that resources and plans are in place to protect us from potential loss during a disruption, which includes the unavailability of our information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. These business continuity resources and plans include maintaining business continuity sites to ensure continued operations, regular backing up of data and systems on offsite facilities, testing our ability to operate on disaster recovery systems, and annually reviewing department level business continuity procedures.

companyName: Federal Home Loan Bank of Cincinnati


text: Security Measures and Monitoring We deploy a layered defense model using widely adopted technologies and internal solutions for threat monitoring, detection, and response. Our efforts include: • Regular system scans, vulnerability assessments, and penetration testing • Ongoing compliance with the Payment Card Industry Data Security Standard (PCI DSS) • Deployment of endpoint detection and response (EDR) tools and real-time monitoring solutions • Secure development practices and controls embedded within our digital transformation initiatives As we modernize our digital platforms and phase out legacy systems, we are embedding advanced security practices into our infrastructure. This includes improving controls around identity management, access, encryption, and software development life cycles.

companyName: PETMED EXPRESS INC

ticker: PETS


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our initial public offering. In addition to our own cybersecurity risks, any proposed Business Combination target, such as Youlife, may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Distoken Acquisition Corp


text: The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as of the Company's Chief Financial Officer who serves as the Chief Information Security Officer of Muzinich. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: Muzinich BDC, Inc.


text: Education and awareness training on information security and data protection is conducted regularly for employees. Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.


text: InfuSystem is committed to continuous improvement in our cybersecurity risk management practices. In the coming fiscal year, we will focus on: 1.Enhancing our threat detection and monitoring capabilities. 2.Conducting regular tabletop exercises to improve incident response readiness. 3.Staying abreast of emerging threats and adjusting our cybersecurity posture accordingly. 4.Collaborating with industry partners and regulatory authorities to enhance overall cybersecurity resilience in the medical device industry.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: Juniata's risk management program is designed to identify, assess and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Juniata's Information Security Officer ("ISO") and SVP/IT Manager are primarily responsible for the cybersecurity component of the risk management program and are key members of the organization, both of which have a clear line of reporting directly to the Board of Directors and are involved with management's Information Technology ("IT") Steering Committee. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: The Company adheres to cybersecurity practices shaped by relevant laws and industry benchmarks. We proactively manage cyber risks through a multidisciplinary framework designed to safeguard the integrity, confidentiality, and availability of our data and systems. This framework includes several key initiatives: Enterprise Risk Management—We identify primary cybersecurity threats to our operations. Vulnerability Management—We scrutinize software and computing infrastructure for potential vulnerabilities.

companyName: Crypto Co

ticker: CRCW


text: Such threats and breach attempts have not materially affected our business, strategy, results of operations or financial condition. At any given time, however, we may face known or unknown cybersecurity risks and threats that cannot be fully prevented or mitigated, and we may discover vulnerabilities in our cybersecurity programs. Therefore, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on the cybersecurity risks we face, please refer to "A failure of one or more key information technology systems, networks or processes may materially adversely affect our ability to conduct our business." in Item 1A. "Risk Factors."

companyName: SRx Health Solutions, Inc.

ticker: SRXH


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our program to best practices, as well as by engaging experts to attempt to infiltrate our information systems (as such term is defined in Item 106(a) of Regulation S-K). We test and review the result on a semi-annual basis.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Among other matters, our Board delegates to our Audit and Finance Committee the oversight of our programs, policies, and procedures related to cybersecurity, information asset security, and network security. Broad oversight is maintained by our full Board, which receives regular reports from the Audit and Finance Committee as well as management, as appropriate. The Audit and Finance Committee and the full Board actively participate in discussions with management and among themselves regarding cybersecurity risk. Our CIO and CISO present to the Audit and Finance Committee at least a bi-annual review of our strategies, policies and internal controls relating to information technology and cybersecurity (including network security, cloud security and physical security), with respect to corporate goals, industry trends and competitive advantages. To aid the Board with its cybersecurity oversight responsibilities, the Board also receives regular presentations on these topics. Our incident response plan is designed to escalate certain cybersecurity incidents, from our information security team and CISO, through our Chief Legal Officer and CIO, to our Audit and Finance Committee, depending on the impact of the incident.

companyName: PATTERSON COMPANIES, INC.


text: ITW's Board of Directors is responsible for providing oversight and strategic guidance to management to support the long-term interests of the Company's stakeholders. As part of this responsibility, the Board of Directors annually reviews and evaluates the Company's cybersecurity policies and practices with respect to risk management as well as steps taken by management to monitor and control such exposures. In addition to oversight by the Board of Directors, several cross-functional management teams focus on cybersecurity risk and report any identified cybersecurity incidents. Each of the Company's divisions has a Division Cyber Incident Response Team and protocols in place to communicate cybersecurity incidents to a central Cyber Incident Response Team. The Cyber Incident Response Team is led by the Chief Information Security Officer and is responsible for the initial assessment of cybersecurity incidents and oversight of any incident response.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition, and although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to Cybersecurity and Business Disruptions" in "Risk Factors" on page 14 of this Form 10-K.

companyName: BOEING CO

ticker: BA


text: [Cybersecurity is an important aspect of our business operations, and we are committed to protecting our systems, data, and the information of our clients and stakeholders. We recognize that cybersecurity threats are constantly evolving and that maintaining robust security measures is an ongoing process. Below is an overview of our cybersecurity risk management and the measures we have in place:

companyName: GT Biopharma, Inc.

ticker: GTBP


text: With oversight from our Board of Directors, the Company has formally adopted and annually updates a Security Incident Response Plan which coordinates the activities we undertake to prepare for, detect, respond to and recover from cybersecurity incidents. These activities include processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our incident response plan establishes a framework for measuring the severity of security incidents and provides for a post-market response program including protocols for coordination and communication between security response teams, designated leaders within the Company, internal and outside legal counsel, and the Audit and Finance Committee ("AFC") of the Company's Board of Directors in responding to any such incidents.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: We partner with third parties to support and evaluate our cybersecurity program. Provided third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing and consulting on best practices. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our data or our systems. Third-party risks are included within our risk assessment of vendors, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Mr. Gharib is responsible for hiring information security personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Mr. Gharib is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: As an externally managed company, we rely on our Manager and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our Manager's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer, who periodically reports, among others, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually. The Chief Information Security Officer leads TPG's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact the organization, including the Company, and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields. The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties. This includes external third parties that may have permission to access Coherent IT systems and assets, such as consultants, and review of the systems of third parties that could adversely impact Coherent's infrastructure in the event of a cybersecurity incident affecting those third-party systems, such as through vendors and other service providers.

companyName: COHERENT CORP.

ticker: COHR


text: The global data protection landscape is rapidly evolving, and we may be impacted by or subject to new, amended, or existing laws and regulations in the future, including as our operations continue to expand or if we begin to operate in foreign jurisdictions. The risk of a security breach or disruption or data loss, particularly through social engineering attacks, cyber-attacks, or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Our Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management, including our head of information technology, regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have material affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: CURIS INC

ticker: CRIS


text: Our chief architect and the cybersecurity committee are responsible for our cybersecurity rules and methods, like those described in the "Risk Management and Strategy" section. They stay updated and track how we prevent, identify, lessen and address cybersecurity issues. This is done through regular checks of our systems, tests to find security weaknesses and having a plan ready to respond to any incidents. In addition to regular meetings and participation on the cybersecurity committee, the chief architect and co-chief executive officer regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update our board of directors or the audit committee about these changes as well as our cybersecurity risks, so that our board of directors can administer its oversight function as part of its broader oversight and risk management.

companyName: Revolve Group, Inc.

ticker: RVLV


text: As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology (IT) environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for managing the risk inherent to engaging with external service providers, suppliers, and vendors.

companyName: Seer, Inc.

ticker: SEER


text: The CISO, Senior Vice President – Enterprise Information Security, and Vice President – Cyber Risk Governance regularly inform the Chief Executive Officer, the Chief Operating Officer, the Chief Risk Officer, the Chief Information Officer, the Chief Technology Officer, and the Chief Audit Officer of all concerns related to cybersecurity risks and incidents, including the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. This aims to ensure that senior management is kept up to date on the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Company's Board of Directors, ensuring that they have comprehensive information and can provide oversight with respect to critical cybersecurity issues.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: A profile is maintained of the most likely threats, their intent, and the impact the threat may have on the confidentiality, integrity, and availability of Company assets. Evaluation of relevant risk-based scenarios or vulnerability of an asset and how a threat may exploit the asset. Implemented security controls or "mitigating factors" are considered for each scenario.


text: Our global information technology organization, led by our CIO, is responsible for our overall information security strategy, policies, operations and threat detection and response. Our current CIO has more than two decades of experience in positions of increasing authority at the Company. The global information technology organization manages and maintains the cybersecurity program with the goal of preventing, detecting and remediating incidents, and works to increase our system resilience to minimize the business impact should an incident occur. Our cybersecurity program is informed by the National Institute of Standards and Technology Cyber Security Framework (NIST-CSF). Consistent with that framework, our cybersecurity program addresses the need to identify, protect, detect, respond and recover from cyber risks. The process includes notification of potentially significant incidents to the Cybersecurity Disclosure Committee and the Audit Committee of the Board, as appropriate. Our Cybersecurity Disclosure Committee is comprised of senior leadership across multiple functional areas and is responsible for reviewing and evaluating potentially significant cybersecurity incidents and for determining whether any notification or disclosure is required under applicable laws.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: We utilize a variety of methods performed both internally and by third-parties to assess the Company's cyber risk management program including penetration tests, risk assessments and evaluation against the NIST CSF. The effectiveness of controls and safeguards are evaluated on an on-going basis to address current and emerging cyber-risks. We engage an external auditor to conduct an annual payment card industry data security standard review of our security controls protecting payment information. Our Internal Audit function also regularly reviews various elements of our program utilizing third-party subject matter experts in IT and cyber issues to ensure we are complying with our internal controls and staying abreast of best practices in the industry. We incorporate many resources and tools on both an ad hoc and planned cadence to maintain readiness to withstand and respond to a cyber incident including incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training throughout the organization.

companyName: Murphy USA Inc.

ticker: MUSA


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented.

companyName: CSI Compressco LP


text: The Company's CISO is certified in Risk and Information Systems Control (CRISC) and Certified Information Privacy Professional/United States (CIPP/US). The CISO reports to the Quality Compliance Management Risk Committee twice per year and also reports to the Board twice per year.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: The Company's Incident Response Team, which is comprised of members of the finance, legal, information technology and operations teams conduct annual tabletop exercises in which various levels of management participate in simulated data security/privacy scenarios that the Company, its customers, vendors and/or its personnel may face in the future. The Company engages external resources to refresh the subject matter of these exercises and to continually challenge the Company's management in these exercises. Annual formal training using an online platform is required for all employees. Topics include how to identify suspicious activities and occurrences related to social engineering, phishing, viruses, and insider threats.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: The Company routinely engages third-party industry experts to work in conjunction with our internal audit team in performing risk assessments of the Program and the Plan and of the Company's execution of the Program and the Plan.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: Our President and COO, with guidance from our third-party MSP, manages our cybersecurity risk management and strategy process. Collectively, our consultants have 50+ years' experience in the cybersecurity industry in various roles.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Our CCO and our Chief Financial Officer, or our CFO, work collaboratively with senior members of our outsourced technology firm to comprise our Cybersecurity Team. Our Cybersecurity Team has primary responsibility for overseeing, implementing and managing our processes and controls to assess, identify and manage material risks from cybersecurity threats, including those described above in Risk Management and Strategy.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: We assess Chipotle's Information Security program using an industry cybersecurity framework from the National Institute of Standards and Technology. This program includes policies, processes and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: Under this program, we employ additional key practices including, but not limited to, maintenance of an information technology ("IT") assets inventory, quarterly vulnerability testing, identity access management controls including restricted access of privileged accounts, physical security measures at our offices, maintenance of firewalls and anti-malware tools, ongoing cybersecurity user awareness training, industry-standard encryption protocols, and critical data backups.

companyName: Sachem Capital Corp.

ticker: SACH


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer. Members of the audit committee regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: The Company's Board of Directors (the "Board"), as a whole, has oversight responsibility for our strategic and operational risks. The Board regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including updates on the internal and external cybersecurity threat landscape, incident response, assessment and training activities, and relevant legislative, regulatory, and technical developments. Our Vice President of Information Technology presents, at least annually, to the Board, an overview of our cybersecurity threat risk management and strategy as well as provides reports regarding the evolving cybersecurity landscape, including emerging risk. Our Vice President of Information Technology and other members of his team remain informed about cybersecurity threats through the reporting framework as described above under Cybersecurity Risk Management and Security – Cybersecurity incident response plan and testing.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business. For more information about the cybersecurity risks we face, refer to "Item 1A. Risk Factors."

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL


text: Our Board of Directors has delegated oversight of our cybersecurity program, which includes oversight of cybersecurity threats, to the Risk and Governance Committee. Throughout the year, at each quarterly Risk and Governance Committee meeting, or as needed, the committee is updated on IT security by senior management, including industry IT breaches, cybersecurity incidents and employee cybersecurity training. Our SVP, IT Operations & Security, is a Certified Information Systems Security Professional who has provided technology-related infrastructure and application management services for over 25 years and is responsible for day-to-day assessment and management of our information systems and cybersecurity program. Our SVP, IT Operations and Security, reports directly to our Chief Financial Officer.

companyName: Aircastle LTD

ticker: AYR


text: Ongoing risk assessments of third-party service providers designed to ensure they meet the Company's standards for reliability, security, compliance, and performance.

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: Impact of Cybersecurity Risks on Strategy and Results As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. However, we and our third-party service providers continue to experience cyberattacks, including phishing, ransomware and other attempts to gain unauthorized access to our and their systems, that could materially affect us in the future. For additional information regarding the threats we face, see "Risk Factors—Business and Operational Risks—If we encounter problems with our distribution system, our ability to deliver our products to the market could be adversely affected"; "—We rely significantly on information technology and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business"; and "—Legal, Regulatory and Compliance Risks—Data security or privacy breaches could damage our reputation, cause us to incur additional expense, expose us to litigation and adversely affect our business and results of operations" included in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Under Armour, Inc.

ticker: UAA


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. The Audit Committee assists the Board in meeting its responsibility to oversee cybersecurity and data privacy strategies and practices. On a quarterly basis, the Audit Committee receives updates on (a) our progress meeting objectives established in our cybersecurity maturity roadmap, (b) relevant reported cybersecurity events in the overall market (and for Kforce, if any) and evolving risks, (c) results of work performed by our information security organization (ex. penetration tests, cybersecurity program maturity assessments) and (d) detailed reports of cybersecurity trends within the Firm. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests and other tests and assessments.

companyName: KFORCE INC

ticker: KFRC