text: The Company has also adopted a cyber-incident response plan which provides for controls and procedures in connection with cybersecurity events, including escalation procedures summarized below. The cyber-incident response plan is designed to address non-operational and operational cybersecurity events. Evaluation and response to cybersecurity events is led by our Cybersecurity Incident Response Team ("CIRT"), under the direction of our CISO. The CIRT is comprised of subject matter experts representing information security, information technology, operational technology and legal. The CIRT performs an impact assessment with respect to cybersecurity incidents, gathers facts and provides a chronology of events in connection therewith, and leads remediation and recovery activities. Our General Counsel, Senior Vice President, Chief People and Strategy Officer, Chief Ethics and Compliance Officer (or their respective designees), and CISO review and assess significant non-operational data breaches. Cybersecurity events that meet specified criteria for operational impact are escalated for further review to our Business Continuity Incident Command Team ("Incident Command Team"). The Incident Command Team performs an initial assessment that includes evaluation of the cybersecurity event's severity, response required, and estimated business cost, and leads the execution of business continuity plans to maintain Company operations. Cybersecurity events meeting certain criteria are escalated to our Disclosure Committee, General Counsel and Chief Financial Officer for further review, and, if appropriate, may be further elevated for the review of the Board of Directors. The Disclosure Committee, General Counsel and Chief Financial Officer assess and determine materiality using the facts gathered and chronology of events provided by the Incident Command Team.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: While the Company does not employ a Chief Information Officer or consider cybersecurity threats to be a material risk to the business strategy, results of operations or financial position of the Company, the Board of Directors discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: GREYSTONE LOGISTICS, INC.

ticker: GLGI

secItem: Item 1C


text: Monitoring Cybersecurity Incidents The Chief Experience Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The Chief Experience Officer implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Chief Experience Officer will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Strive, Inc.

ticker: ASST


text: The full Board of Directors is responsible for oversight of our key cybersecurity risks. The Board retains direct oversight of cybersecurity matters to best utilize the experiences and expertise of all Board members. Management, including the CIO, provides reports approximately quarterly to the Board regarding risks, threats, the threat landscape, assessments of and improvements to the cybersecurity program, and internal response preparedness.

companyName: WISCONSIN POWER & LIGHT CO


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in " Item 1A. Risk Factors " of this Annual Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for the Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in " Item 1A. Risk Factors " of this Annual Report.

companyName: BPGC Acquisition Corp.


text: Our Vice President of Information Technology meets with our IT Steering Committee on a routine basis. Regular topics for discussion with the IT Steering Committee include cybersecurity initiatives and strategies, cybersecurity events, emerging threats, regulatory requirements and industry standards.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: We maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems against operational risks related to cybersecurity.

companyName: Expion360 Inc.

ticker: XPON


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers. We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations. We assess and manage cybersecurity risks associated with our use of these providers by obtaining third party reporting relating to reputation and litigation screening for these vendors.

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: Risks from Cybersecurity Threats We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding whether any risks from cybersecurity threats, including as a result of any cybersecurity incidents that are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: The Senior Vice President, Senior Technology Officer has 27 years of experience in information technology, with the last 12 as the information technology leader for the Bank. He holds a Bachelor's Degree in Computer Science. He is an active member of FS–ISAC's Mergers an Acquisition Working Group, and a named author of their 2023 "Cybersecurity Best Practices in Mergers, Acquisitions and Divestiture Deals" publication. He also serves as an advisory member of the Indiana Governor's Executive Council on Cybersecurity. He attends numerous industry training sessions including those put on by the SANS Institute, PaloAlto, Cisco, Microsoft, the Cybersecurity and Infrastructure Security Agency (CISA), and FS–ISAC.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: The CISO is responsible for developing and deploying Montrose's overall cybersecurity and data privacy strategy, policies, procedures, and threat detection and response actions, with the support of Montrose's cybersecurity team. The cybersecurity team implements Montrose's cybersecurity and data privacy policies and procedures, including governance, compliance, and risk management practices, to safeguard Montrose's information systems and data. Collectively, the CISO and the cybersecurity team manage and evolve Montrose's cybersecurity posture with the objective of preventing cybersecurity incidents and increasing system resiliency to minimize business impact should an incident occur.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Enterprise Information Systems Security Policy, which, among other objectives, prescribes a comprehensive framework for creating a practice-based Information Security Management System; protecting the confidentiality, integrity, and availability of our data and systems; providing for the development, review, maintenance, and ability to ensure the effectiveness of minimum security controls required to protect our data and systems; and recognizing the highly-networked nature of the current computing environment to provide effective company-wide management and oversight of related cybersecurity risks;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Providing transparent cyber risk metrics and governance outcomes to the Board of Directors, ensuring alignment with strategic priorities and positioning cybersecurity as a business enabler.

companyName: Zedge, Inc.

ticker: ZDGE


text: The Company's board of directors ("Board") is responsible for overseeing and monitoring our risk management processes, including cybersecurity-related risks. The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board (" Audit Committee ") is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company's cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) any recent, high profile cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company's senior management, internal auditors and independent auditors.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: The SGC is comprised of members of our executive leadership team, including the CEO; CFO; Chief Operations Officer; Chief Legal Officer; Vice President, Information Technology; and CISO. The CISO reports to the SGC on a regular basis, and informs the committee of critical risks that could potentially affect our information security and cybersecurity posture, as well as regulatory compliance; the status of key projects designed to evolve our information security programs; and any significant cybersecurity issues, incidents and patterns of events. The SGC has the authority to (i) investigate any matter brought to its attention that may impact our ability to adequately protect our information assets and (ii) involve its members, the Board, other steering committees, government agencies and law enforcement, as it deems appropriate, to respond to and remediate such matters. The CISO provides updates to the SGC during the course of significant cybersecurity incidents and in parallel, response teams partner with our IT and legal teams, law enforcement and others as needed to triage and remediate such incidents. Following such events, we implement changes as appropriate to improve our risk mitigation and remediation capabilities as cyber threats evolve.

companyName: QuidelOrtho Corp

ticker: QDEL


text: The Audit Committee has oversight responsibility over our cybersecurity risk management process, including risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration.

companyName: Digital Turbine, Inc.

ticker: APPS


text: HCTI board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which assists the Board in fulfilling its oversight responsibilities regarding the Company's policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing the Company's information security policies and internal controls regarding information security; and reviewing the Company's annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the Company's cybersecurity program and receives quarterly updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends.

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: The Internal Cybersecurity Team has robust processes and redundancies in place designed with the objective of deterring, detecting, mitigating, and responding to potential cybersecurity threats, which includes a vulnerability assessment, prioritization, and remediation program. The Internal Cybersecurity Team also performs regular system penetration testing to validate our security controls and assess our infrastructure and applications. All management employees take mandatory periodic security awareness training on the Company's data security policies and procedures, which is supplemented by Company-wide testing initiatives, including periodic phishing tests. Additionally, in 2023, our Board of Directors and certain management employees participated in a tabletop exercise to simulate a response to a cybersecurity incident, and our Internal Cybersecurity Team incorporated the findings from this exercise into our processes.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Security Updates and Backups. We monitor security bulletins, software updates/patches, and functional software updates/patches and apply them in accordance with the timeline prescribed in our policies and based upon recommendations from third-party vendors, as applicable. Systems that no longer provide security updates/patches are discontinued. We research, test, and verify functional software updates/patches before installation. We perform data backups periodically based on business requirements to maximize data availability and prevent information loss, including before any system upgrade or maintenance. Encrypted data remains encrypted throughout our backup processes. We review backup schedules at least annually, and changes may only be made by authorized personnel after formal documentation and approval. Data backups are stored in geographically separate facilities.

companyName: Clene Inc.

ticker: CLNN


text: The ERM Program is a proactive and ongoing process led by our legal and risk professionals and senior management, to identify, assess and manage risks and to build out and track mitigation and reduction efforts. The Board has tasked the Audit Committee with overseeing, reviewing and discussing with management, the internal audit team and the independent auditors, our ERM Program, policies and procedures with respect to, among other things, the assessment and management of risks related to our cybersecurity and information security and the steps management has taken to monitor and control such risks.

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: Management and strategy The Company currently manages its cybersecurity risk through a variety of practices that are applicable to all users of our information technology and information assets, including our officers and directors, contractors, and vendors. The Company uses a combination of technology and monitoring to promote security awareness and prevent security incidents, including network and passwords protocols, third party firewalls, and antivirus protections.

companyName: OKMIN RESOURCES, INC.

ticker: OKMN


text: Members of our security operations team are responsible for notifying the information security management team about cybersecurity incidents. The information security management team is responsible for assessing cybersecurity incidents; managing the analysis, mitigation, and remediation of incidents; and conferring with other members of management about incidents, including the Chief Information Security Officer and other members of our senior executive management team.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: We use third-party service providers for a variety of services throughout our business, ranging from infrastructure support and maintenance, cybersecurity incident response, data protection and privacy compliance. In addition, we engage with contract research organizations, contract manufacturing organizations, distributors, and other supply chain resources.

companyName: Celcuity Inc.

ticker: CELC


text: To manage the information security processes related to relationships with third parties and contractors, we maintain a policy which requires all third parties and contractors to implement controls and abide by a non-disclosure agreement, and we regularly evaluate existing critical third-party service providers to ensure they continue to meet our minimum information security practices. Proposed relationships with new third-party service providers are evaluated to ensure the technology provided is in alignment with our standards and guidelines.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: We also maintain a formal Vendor Management Program that provides oversight of cybersecurity risks related to our vendor and supplier relationships. During vendor onboarding, we perform risk-based due diligence on these third-parties, with heightened requirements for vendors that have access to confidential enterprise information, personal data, or that require access to our information systems. This Vendor Management Program includes specific cybersecurity requirements for our vendors, as well as ongoing monitoring, assessment, and contract review. Members of the CCDC are involved in and review the Vendor Management Program annually.

companyName: Gold.com, Inc.

ticker: GOLD


text: We recognize that security is an enterprise concern and requires stakeholders from across the enterprise to understand and manage this risk. Our security management structure reflects a centralized security program that coordinates security functions across the enterprise. The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters. One AERC member holds the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University, and a second has significant work experience related to technology and data security.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, overseen by the Audit Committee and the Board of Directors. The Company has developed an information security program to address material risks from cybersecurity threats. The program includes processes identifying how security measures and controls are developed, implemented, and maintained.

companyName: WK Kellogg Co


text: The foundation of the information security program is based on risk management principles. The Bank has established a risk management framework that identifies, assesses, and manages risks, including cybersecurity risks, that could have a material impact on its business, operations, or financial condition. The Bank identifies new risks to the confidentiality, integrity, and availability of its sensitive information and services during the assessment of new processes, services, vendors, or changes in the banking industry. The mitigating controls of identified risks collectively create the information security program.

companyName: VWF Bancorp, Inc.

ticker: VWFB


text: We have also adopted a cybersecurity incident response plan that is designed to effectively identify, analyze, contain, remediate and eradicate, escalate, report, and appropriately document cybersecurity incidents. The plan also includes a materiality assessment framework that sets forth procedures and escalation protocols to support our assessment of whether a cybersecurity incident is material and subject to SEC reporting requirements. Such escalation protocols include the involvement of the CISO and other senior leaders across various functions, including finance, legal, privacy and global communications, as appropriate. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cybersecurity incidents.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, using common methodologies, reporting channels and governance processes that apply to other risks managed by our organization, including operational, financial and strategic risks, as well as applicable legal and regulatory risks.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: Our cybersecurity program takes a cyberthreat and risk-based approach and was developed to align with ISO 27001, an international standard for information security, and we also assess ourselves against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition, our cybersecurity risk management program aligns with ISO 31000, the international standard for risk management. The foregoing does not imply that we meet all technical standards, specifications or requirements, or that we have been certified on these requirements in any respect, only that we have used these industry standards as guides when designing our cybersecurity and risk management programs.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Cybersecurity risk management is part of the Company's global enterprise risk management program. In order to manage the risks associated with cybersecurity threats, the Company has implemented a risk-based cybersecurity program consisting of processes, technologies, and controls to assess, identify and manage material risks from cybersecurity threats.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Pathward has established a Crisis Management Team ("CMT"), which is comprised of executive leadership and key senior stakeholders and is engaged immediately following a cybersecurity incident. The CMT provides leadership and maintains ultimate executive level oversight during each phase of the incident.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, internal audits of our program, independent external expert evaluations of our program's maturity and operational readiness and the results of penetration testing. Our Board of Directors also receives cybersecurity updates and education on a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident report and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.

companyName: BIOGEN INC.

ticker: BIIB


text: Although the Company employs measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personally identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. Any such incidents could compromise the Company's networks, or those of our vendors, or disrupt the Company's or our vendors' critical systems, and the information stored there, such as personally identifiable information or funds, could be accessed, publicly disclosed, lost, corrupted or stolen. Third parties may have the technology and know-how to breach the security of this information, and the Company's security measures and those of the Company's banks, merchant card processing and other technology suppliers may not effectively prohibit others from obtaining improper access to this information. The techniques used by criminals to obtain unauthorized access to sensitive data change frequently and often are not recognized until launched against a target; accordingly, the Company may be unable to anticipate these techniques or implement adequate preventative measures.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the employees, customers and other individuals who are authorized to use them, and threat actors use a sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See section "Risks Relation to our Operations".

companyName: LAKELAND FINANCIAL CORP

ticker: LKFN


text: Foundationally, we seek to manage cyber risk through a structure of controls that includes cybersecurity standards, policies and cyber solutions that protect the availability, integrity, and confidentiality of our critical IT and mining systems. We monitor for emergent cyber threats and assess any actions required to reduce those risks. Our cybersecurity program is aligned to globally recognized security frameworks including the Mitre Att&ck Framework, NIST and ISO 27001. We are currently certified compliant against ISO 27001 and engage a certified audit firm to conduct annual control testing and reaffirm our certification. We further test our cybersecurity controls by engaging leading third-party cybersecurity service providers to perform external and internal penetration tests of critical business applications and mining system. Additionally, we review and tabletop test our incident response plan. We leverage continuous monitoring of our internet facing presence, as well as, known internet based criminal communities for mentions of Newmont, our executives, and employees. Our Security Operations Center ("SOC") continuously monitors for security events and threats, responding and escalating when appropriate. We also hold employee trainings on privacy and current cybersecurity topics, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: The Company is in the process of establishing a cybersecurity policy which will implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy encompasses the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.

companyName: DIH HOLDING US, INC.


text: We also maintain an Incident Response Plan that provides a structured framework for addressing potential or actual cybersecurity incidents. The Incident Response procedures and detections/prevention mechanisms are continuously refined to address evolving threats and alerts. This Plan includes the timely notification, escalation, and reporting of cybersecurity incidents to the Bank's Operational Risk Management Committee, Enterprise Risk Management Committee, and the Board of Directors and/or the duly designated ERM Committee of the Board of Directors. It also includes for the timely notification to regulatory agencies, including but not limited to the FDIC, DFS, FRB and SEC as required or deemed appropriate. We also undertake periodic simulations and tabletop exercises to test our Incident Response Plan and ensure business resiliency and proper incident response management.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: We have established and test our disaster recovery plan, and we protect against business interruption by backing up our major systems. Our cybersecurity team engages third-party security experts for risk assessments and system enhancements, including a third-party security consultant that conducts regular network security reviews, scans and audits. In addition, we have implemented various preventive measures, such as protections designed to safeguard against cyberattacks, including employee training, multifactor authentication, firewalls and virus detection software, periodic scans of our environment for any vulnerabilities and penetration testing.

companyName: Progyny, Inc.

ticker: PGNY


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring our information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, engaging third party experts and implementing cybersecurity training for our employees. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation.

companyName: LendingTree, Inc.

ticker: TREE


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: CORETEC GROUP INC.

ticker: CRTG


text: Oversight of Third-Party Service Providers. The Company also uses third-party service providers to support its operations and many of its technology initiatives. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture and/or a recommendation of specific mitigation activities. Following an evaluation, the Company determines and prioritizes service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: To further improve the effectiveness of our information security processes, we engage third -party service organizations to monitor the Company's information technology (IT) environment, conduct evaluations of the effectiveness of our security controls and provide aggregate monthly reports to our corporate IT Security Team regarding the results of such third -party assessments, training and vulnerability testing, data security posture, material cybersecurity risks and areas of improvement.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: The Company has established and maintains a comprehensive incident response plan, designed to address the Company's response to a cybersecurity incident. Cross-functional members of the Company comprise the Incident response team to respond and disclose material incidents. The incident response plan defines pre-incident activities and preparation, classification of incidents, response team internal and external contacts, process flow of the response team, escalation of incidents to outside entities and law enforcement and frequency of review of the incident response plan. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.

companyName: Xencor Inc

ticker: XNCR


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including risks to our customer, vendor, and employee data and our systems. We conduct due diligence of third parties' information security programs, and cybersecurity considerations may inform our selection of third-party service providers. In certain circumstances, including in those where we believe a third party could introduce cybersecurity risk to us, we generally contractually require such third parties to manage their cybersecurity risks. We also receive the results of cybersecurity and data privacy audits conducted on certain vendors to determine if those vendors meet our cybersecurity standards.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Item 1A. Risk Factors of this Form 10-K, including " Cybersecurity risks and the failure to maintain the confidentiality, integrity, and availability of our computer hardware, software and internet applications and related tools and functions could result in dam age to the Company's reputation and/or subject the Company to costs, fines, or lawsuits", and " We rely on network and information systems and other technology whose failure or misuse could cause, and has caused, a disruption of services or loss or improper disclosure of personal data, business information, including intellectual property, or other confidential information, resulting in increased costs, loss of revenue or other harm to our business."

companyName: ENZO BIOCHEM INC


text: Our business depends on the continuous functioning of our OA System, which tracks order status and monitors business workflows. The secure handling of information is crucial, particularly for tracking automobile orders. We have implemented various measures, such as access controls, data encryption, and vulnerability assessments, to prevent and mitigate cybersecurity risks and incidents. In particular, we have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, which is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. We have developed a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also developing tools and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including Squarespace and Google Workspace, which assist us with information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. We engage in the assessment and testing of our cybersecurity risk management program, policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate. However, cybersecurity incidents, if they occur, depending on their nature, could lead to the loss, destruction, or unavailability of critical and confidential data, impacting our operations and potentially harming our reputation. This could result in customer distrust, termination of partnerships, significant remediation costs, and legal liabilities.

companyName: CHEETAH NET SUPPLY CHAIN SERVICE INC.

ticker: CTNT


text: IT staff is tasked with assessing, identifying, and managing cybersecurity threats and is responsible for: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, and services and to our broader enterprise IT environment; of risk-based action plans to manage identified vulnerabilities and implementation of new protocols and infrastructure improvements; incident investigations; threats to sensitive data and unauthorized access to our systems;

companyName: AIRWA INC.

ticker: YYAI


text: We are executing on a multi-year roadmap to, among other things, further improve our ability to defend against, respond to, and recover from ransomware and other cyber events; enhance application cybersecurity capabilities, including defenses against fraud attacks; and to ensure security capabilities are built into new cloud-based platforms that we adopt. A number of states where our insurance companies are domiciled, including Connecticut, have adopted the NAIC Insurance Data Security Model Law. Our legal team monitors the status of new cybersecurity regulations, including notification requirements.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: We have 24x7 security cybersecurity monitoring, which utilizes both third-party cybersecurity experts and leading tools to monitor activity in our information systems. We also maintain an incident response plan and playbooks that define our response to a cybersecurity incident, including a cross-functional incident response process that includes key stakeholders such as senior leaders and legal, and leverages our technological resources and third-party service providers. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to leadership when appropriate pursuant to internal guidelines governing the reporting of such events.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Management assesses and considers cybersecurity risks through its enterprise risk management program, consultation with external advisors, as well as through discussions with our CIO and CISO. We have an experienced and dedicated CISO with over 25 years of Information Technology experience in retail for several globally recognized brands, with the majority of their career focused on all aspects of cybersecurity from delivery to operations including incident response. The CISO holds a Master's Degree in Information Technology, has attained the professional certifications of Chief Information Security Manager and National Association of Corporate Directors, and actively participates in the cybersecurity industry through advisory boards and forums that promote peer to peer collaboration.

companyName: FIVE BELOW, INC

ticker: FIVE


text: To date, the Company is not aware of risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional information regarding cybersecurity risks and potential related impacts on our Company.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: Role of our Board of Directors The Nominating and Corporate Governance Committee of the Board of Directors is primarily responsible for the oversight of our information security programs and cybersecurity incident response plans. We established a cyber subcommittee comprised of our senior management team that reports directly to the Board and its Committees regarding our cyber risks and threats, the status of initiatives strengthen our information security systems, assessments of our cybersecurity program and incident response plan, and our views of the emerging threat landscape. Our Executive Vice President – Business Intelligence and our head of Internal Audit report directly to the Nominating and Corporate Governance Committee as well as the Audit Committee regarding these matters and are responsible for reporting to the Committees on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Nominating and Corporate Governance Committee regularly reports to the Board of Director on cybersecurity risks and other matters reviewed by the Nominating and Corporate Governance Committee in conjunction with the management team. All materials or presentations on cybersecurity provided to the Nominating and Corporate Governance Committee are provided to all Board members.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: The Company's cybersecurity program is overseen by the Risk Committee of the Board, which is responsible for ensuring the program is well resourced and able to protect the security and confidentiality of our data and that of our clients. The program is managed by the CISO who reports to the chief risk officer and is reviewed by regulators, as well as internal auditors. The CISO provides quarterly information security updates to the Risk Committee as well as the Company's executive-level Risk Council on cybersecurity programs, policies and controls, efforts to improve security, and responses to cybersecurity events. Annually, the CISO meets with the Risk Committee of the Board of Directors to communicate the Board's responsibilities for cybersecurity and privacy, as well as the cybersecurity program's strategy for addressing emerging risks and regulatory requirements.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Engagement of Third Parties. As part of its Cyber Program, Manhattan engages outside independent auditors, consultants, and professional advisors. We also engage industry-leading cybersecurity service and systems providers to assist with protection from and detection of cybersecurity threats and incidents and our responses to them.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: As part of our cybersecurity risk management system, our incident management process tracks and logs privacy and cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) across Weave, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Weave's independent public accounting firm of matters and any relevant developments and also provides regular updates on cybersecurity to our A udit Committee and Board of Directors.

companyName: Weave Communications, Inc.

ticker: WEAV


text: We regularly assess cybersecurity risks to our systems, applications, and infrastructure; have established capabilities and corresponding processes to monitor our information systems for potential vulnerabilities and threats; and implement controls pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools and services that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. In addition, we have a dedicated security operations center that performs 24x7 threat monitoring of our systems and environment. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

companyName: NET Power Inc.

ticker: NPWR


text: Our designated IT team members monitor cybersecurity threats in real time for the Company at the enterprise level, with the assistance of third-party threat detection and monitoring software. Cybersecurity threats at the subsidiary level are also monitored in real time by experienced IT professionals at those subsidiaries, including our Vice President of Digital and Technology at JM Bullion. These individuals report cybersecurity incidents immediately to our Chief Information Officer (CIO), who in turn follows approved reporting protocols, as more fully described below.

companyName: Gold.com, Inc.

ticker: GOLD


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and certain other applicable industry standards.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: We use independent service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: The Cybersecurity and Technology Committee of our board of directors provides oversight of the Company's cybersecurity threat landscape, risks and data security programs, and the Company's management and mitigation of cybersecurity risks and potential breach incidents. The Audit and Risk Committee of our board of directors provides an additional layer of cybersecurity oversight, as it provides oversight of the Company's enterprise risk management program, which includes management of cybersecurity risks and the potential fraud and privacy risks that could arise from a cybersecurity incident.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: Our IT team is led by the Vice President of Administration and the Director of Information Technology. The latter is responsible for regular assessment and management of cybersecurity risks. The Director of Information Technology has constant access to the Audit Committee to provide regular updates as necessary regarding any new developments.

companyName: ENNIS, INC.

ticker: EBF


text: Because the techniques used by computer programmers who may attempt to penetrate and sabotage our proprietary internal and customer data change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques. Unauthorized access to our proprietary internal and customer data may also be obtained through inadequate use of security controls. Any of such incidents may harm our reputation and adversely affect our business and results of operations. In addition, we may be subject to negative publicity about our security and privacy policies, systems, or measurements from time to time.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Management of Cybersecurity Risks The senior executives work to protect our information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with our cybersecurity incident response and recovery plans. Our Chief Executive Officer is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for preparing budgets, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Both executives have experience overseeing the information technology function and implementing and overseeing internal controls frameworks in our industry. We have engaged an IT Managed Service Provider who assists in the oversight of our corporate-wide data security, including developing, implementing and enforcing security policies to manage our overall cybersecurity risks. The senior executives regularly meet with our IT Managed Service Provider during the course of the year to review and discuss cybersecurity issues.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: As delegated by our Board, the Audit and Risk Committee of the Board is responsible for oversight of our risk management process and framework which is designed to monitor and manage strategic and operational risks, including cybersecurity risk. Our senior management, including our Chief Technology Officer, is responsible for the oversight of our information systems and Cybersecurity Program. Our Cybersecurity Program is supported by our cybersecurity governance, risk and compliance team, which is led by our Head of Cybersecurity, who reports to our Chief Technology Officer, and is composed of experienced and skilled personnel who are responsible for our security assurance, risk and operational management. Our Head of Cybersecurity maintains responsibility for the regular assessment and management of cybersecurity risks, including by direct work implementing the Cybersecurity Program and by supervising our cybersecurity team. Our Chief Technology Officer has over 20 years of experience in information technology and systems infrastructure and holds an advanced degree in computer engineering, and our Head of Cybersecurity has over 12 years of experience in cybersecurity, investigations, compliance, and cyber-risk management, within the high-tech and financial services industries.

companyName: Oportun Financial Corp

ticker: OPRT


text: We have not had cyber incidents that have materially affected our business or financial condition. For details about our risks associated with cybersecurity threats, see "— Computer system interruptions or security breaches of our information systems could significantly disrupt our product development programs and our ability to operate our business." in the section titled "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K.

companyName: Nkarta, Inc.

ticker: NKTX


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management from time to time on our cyber risk management program. Board members receive presentations and training on cybersecurity topics from our Chief Information Officer (CIO), Vice President of Security, or external experts as part of the Board's continuing education on topics that impact public companies. Our CTIO is an experienced information technology professional with just under 30 years of experience in the networking and communications industries. His extensive experience extends to all facets of information technology, including enterprise applications, cloud and SaaS systems, network infrastructure, and network management. For the past decade, he has been at the forefront of cloud systems development and security. Our VP of Security has over 30 years of experience in IT and Security and has the Certified Information System Security Professional (CISSP) certification as well as various technology vendor certifications.

companyName: ATN International, Inc.

ticker: ATNI


text: If the information technology systems, or that of third parties on which the Company relies, are affected by a significant cyber breach, this could result in, among other things, a significant disruption to operations; costly investigations and remediation; misappropriation of confidential information of the Company or that of customers, employees, business partners or others; litigation and potential liability; enforcement actions and investigations by regulatory authorities; loss of customers and contracts; harm to reputation; and a loss of management time, attention and resources from regular business operations, any of which could have a negative impact on business, results of operations, and cash flows. As previously discussed, the Company is subject to laws and rules issued by multiple government and private agencies concerning safeguarding and maintaining the confidentiality of our security, customer, and business information. The increasing promulgation of rules and standards will increase our compliance costs and our exposure to the potential risk of violations of the standards.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: As of the date of this Report, we have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incident, that has materially affected us, or is reasonably likely to affect us, including our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that we face, see our risk factors under Part 1. Item 1A. Risks Related to our Business and Properties - Security breaches and other technology disruptions could disrupt our operations, compromise our confidential information or information systems and expose us to liability, which could materially and adversely affect us.

companyName: FrontView REIT, Inc.

ticker: FVR


text: Encryption and Data Protection Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data.

companyName: Enviva, LLC


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment. internal and third-party security tools to monitor our systems, identify cybersecurity risks, and test our IT environment.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Our board recognizes the critical importance of maintaining the trust and confidence of our patients, business partners and employees. Our board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management, or ERM. Through our ERM program, risks are identified, assessed and managed at the organization level, mission and business process level, and information system level. Our cybersecurity program, policies and procedures are fully integrated into our ERM program and are maintained in accordance with industry good standards. We also have an Information Security program that more specifically addresses cybersecurity risks and is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Our Board of Directors has overall oversight responsibility for our cybersecurity model. Our overarching cybersecurity programs are under the direction of the Eos leadership team and directly supported by the efforts of the ITD. The ITD, led by the Director of ITD, reports to the Chief Financial Officer ("CFO") of the Company. With over 8 years of experience leading cybersecurity teams and programs, our Director of ITD leverages a combination of internal and external systems and security experts to keep our CFO informed of potential risks to the organization. The Director of ITD is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs and systems. Management reports material cybersecurity risks to our Board of Directors on an annual basis. In addition, our management follows a risk-based escalation process to notify the Board of Directors outside of the regular reporting cycle when they identify an emerging risk or material issue.

companyName: Eos Energy Enterprises, Inc.

ticker: EOSE


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: Deployment of endpoint detection and response (EDR) solutions; and Utilization of threat intelligence platforms to stay abreast of emerging threats.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: We have faced and continue to face cybersecurity risks in connection with the conduct of our business. Although we do not believe such risks have materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.

companyName: Cadrenal Therapeutics, Inc.

ticker: CVKD


text: Once a cybersecurity incident is contained the focus shifts to remediation. Where appropriate, third-party forensic providers and other managed service providers may be brought in to assist with the investigation and remediation process.

companyName: Playa Hotels & Resorts N.V.


text: Our Audit Committee is responsible for overseeing our major financial, legal, and regulatory risk exposures, which span a variety of areas, including cybersecurity.

companyName: Outset Medical, Inc.

ticker: OM


text: The program is designed to identify, assess, manage, mitigate, and respond to cyber threats with the goal of preventing cybersecurity incidents to the extent feasible, while also increasing our system resilience to minimize business disruption in the event we experience a cyber event. Our program is structured to be nimble and adaptable to changes in cybersecurity threats over time and to respond to emerging threats in a timely and efficient manner.

companyName: UNION BANKSHARES INC

ticker: UNB


text: As an externally-managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our Adviser and our Adviser is a subsidiary of J.P. Morgan. As such, we are reliant on J.P. Morgan for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: The Board's Roles and Responsibilities The Board of Directors, as a whole and at the subcommittee level, oversees and monitors cybersecurity risk at the Company, receiving regular updates from management on the status of the Company's current cybersecurity risks, a prioritization of key risk areas to be mitigated, and any significant cyber incidents that have occurred or are reasonably likely to occur.

companyName: Third Harmonic Bio, Inc.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. At December 31, 2024, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate.

companyName: S&T BANCORP INC

ticker: STBA


text: Our Board considers cybersecurity risk as a part of its overall risk oversight function. Our Board receives reports from our VP of IT at least bi-annually, and on an as-needed basis, on cybersecurity risks and actions taken to mitigate those risks. These reports include updates on our cybersecurity risks and the emerging threat environment, and the status of projects designed to enhance our information security systems and programs.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats and to remind them of the importance of handling and protecting our information. We engage third parties to conduct evaluations of our security controls, including testing both the design and operational effectiveness of our controls. We conduct regular vulnerability testing and tabletop exercises to test our readiness for a variety of potential incidents. We also participate in cybersecurity information-sharing with our peers, industry groups and government agencies.

companyName: Qorvo, Inc.

ticker: QRVO


text: We engage in active oversight of cybersecurity, a cornerstone of our comprehensive enterprise risk management (ERM) program. Our cybersecurity framework is rooted in the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, as well as the International Organization for Standardization (ISO/IEC 27001), reflecting our commitment to uphold the highest cybersecurity standards. We align our policies, standards and practices with these benchmarks and dynamically refine them to address evolving cybersecurity threats.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Our management team, including our Vice President of Technology, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises our internal cybersecurity and IT personnel and our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: The Company's cybersecurity program is supported by engagement of third-party service providers who help identify, assess and respond to cybersecurity risks. For example, the Company regularly engages third parties to perform and facilitate assessments on our cybersecurity measures, including information security maturity assessments, audits, tabletop exercises, threat modeling and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to leadership, the Audit Committee, and/or the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes and practices as appropriate based on the information provided by the assessments, audits and reviews.

companyName: Phreesia, Inc.

ticker: PHR


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: STAAR SURGICAL CO

ticker: STAA


text: Trinseo's business and production operations rely on secure access, processing, storage, and transmission of company confidential and personal identifiable information within various technology platforms. The Company has processes in place to monitor, identify, assess and respond to material risks from cybersecurity threats. Cybersecurity is incorporated into the Company's enterprise risk management ("ERM") program that is reviewed by the Board of Directors ("the Board"). Our Audit Committee has authority to oversee cybersecurity matters as part of its review of ERM. We maintain a cyber risk management program to identify, protect, detect, respond and recover from cyber threats and incidents. Our cybersecurity risk management and internal controls programs are aligned to ISO 27001 Standards and the National Institute of Standards and Technology (NIST) framework.

companyName: Trinseo PLC

ticker: TSEOF


text: We have not experienced cyber-attacks or other malicious activities that materially disrupted our business. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations, could harm our business. We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cyber-security incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Hughes Satellite Systems Corp


text: We employ a wide range of tools, policies, and services, including but not limited to penetration testing, network and endpoint monitoring, vulnerability assessments, information segregation, and tabletop exercises to inform our risk identification and assessment. We routinely review and upgrade our information technology and cybersecurity systems in order to better manage, report, and protect the information related to our formulas and processes, research and development, trade secrets, products, customers and suppliers, employees, and other sensitive information. We also have a cybersecurity specific risk assessment process that helps us identify our cybersecurity threat risks and maturity level by comparing our processes to standards set by the International Organization for Standardization.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: Our chief architect, who has over 15 years of experience in software engineering, has served as our chief architect for seven years, works with our cybersecurity management committee to manage our cybersecurity policies and processes, including those described in the "Risk Management and Strategy" section above. They stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. This is done through regular checks of our systems, tests to identify security weaknesses and maintaining our incident response plan.

companyName: Revolve Group, Inc.

ticker: RVLV


text: We also identify our cybersecurity threat risks by comparing our processes to standards established by the HITRUST and SOC2 frameworks and any findings resulting from penetration testing and threat modeling conducted by third party service providers. To provide for the confidentiality, integrity, and availability of critical data and information systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following internal security measures: • maintain a cybersecurity program through formally-defined documented policies, standards, processes, and procedures to ensure internal security measures are implemented to protect against cybersecurity threats, to assess emerging cybersecurity and data privacy laws, and to implement changes to our processes that are designed to comply with laws applicable to our organization; • implement policies and procedures to identity organizational assets, data and critical IT systems, assess (and periodically re-assess) those assets, data, and systems for cybersecurity risks, and to develop management plans for identifying and remediating identified risks; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to handle confidential data and systems in a legally compliant and acceptable manner; • employ technical security tools that are designed to protect our critical data and information systems from cybersecurity threats, including network firewalls and access controls, vulnerability scanners, intrusion prevention and detection systems, anti-malware/endpoint protection systems, and identity and access management systems which are evaluated for effectiveness and improved through vulnerability assessments and cybersecurity threat intelligence; • provide quarterly, mandatory training for our employees regarding cybersecurity threats to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • implement administrative processes and procedures to define acceptable security parameters and baselines of IT assets and information systems, and utilize access controls to prevent unauthorized alterations to system parameters and to maintain oversight over configuration changes and modifications to those systems; • conduct third party security reviews of critical and high-risk third-party suppliers and vendors; • conduct quarterly phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • implement a formal Incident Response Plan, based upon NIST, HITRUST, and SOC2 frameworks, to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident, which Incident Response Plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation; and • carry information security risk insurance to insure against potential losses arising from a cybersecurity incident.

companyName: Hyperfine, Inc.

ticker: HYPR


text: Our President, Product and Technology ("President of P&T"), Chief Data Officer ("CDO"), Chief Security Officer ("CSO"), and others in our cybersecurity and audit functions, help identify, assess, and manage cybersecurity threats and risks that may impact us or our business and operations. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating threats reported to us, coordinating with law enforcement, conducting audits and threat and vulnerability assessments, using external intelligence feeds, conducting table top exercises, and operating a bug bounty program.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We perform regular vulnerability scanning of our systems in order to confirm appropriate security controls are in place and function in accordance with established policies. We also have ongoing engagements with security consultants and other third parties as required to assist with assessing, identifying, and managing cybersecurity risks. These vendors help us with annual penetration testing and other items as needed. We have a robust internal controls framework and process and issue annual SOC 1 Type 2 reports covering our DV+, Streaming, and SpringServe platforms. In addition to our internal audit team, we have a dedicated compliance manager within the engineering department who helps promote compliance with our control framework.

companyName: MAGNITE, INC.

ticker: MGNI


text: The Company's Board of Directors and Board Risk and Finance Committee oversee our integrated enterprise risk management and cybersecurity programs. The Board Risk and Finance Committee receive regular reports from the Chief Risk Officer and Chief Security Officer on key company risks and emerging threats. These reports also include cybersecurity monitoring and threat response metrics, industry trends and educational materials, risk mitigation strategies, regulatory requirements, corporate policies, third-party risk metrics, cybersecurity tools and resources, incident response plans, and other areas of importance.

companyName: NELNET INC

ticker: NNI


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Cybersecurity Management Team will trigger our incidence response plan, including notifying our CEO, CFO, and other relevant business executives. Our Cybersecurity Management Team, along with our CISO, will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps. If executive management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit Committee, who will escalate the risk to our full BOD, depending on an assessment of the risk.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: The Company has an information security program designed to identify, mitigate, respond to and manage reasonably foreseeable cybersecurity risks and threats. The program is overseen by the Chief Financial Officer. The CFO in conjunction with senior management conducts periodic reviews of cybersecurity control, policies, and procedures to ensure relevance and effectiveness for the Company's needs and operating environment. The CFO has previously led IT/cyber strategy and programs in his past work experiences and is able to apply those experiences to the Company. The audit and finance committee of the board has discussions with management on an annual basis about the Company's risk assessment and risk management policies, particularly in the areas of financial reporting, internal controls, and compliance with legal and regulatory requirements.

companyName: SUNation Energy, Inc.

ticker: SUNE


text: Our cybersecurity program leverages various industry standards like the National Institute of Standards and Technology ("NIST") and Center for Internet Security ("CIS") Program framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, mitigation and continuous process improvements. Our enterprise risk management team reviews cybersecurity risks, and key cybersecurity risks are incorporated into the enterprise risk management ("ERM") reports reviewed and discussed internally and with the Board. In addition, we have several avenues to gather risk intelligence, and potential threats identified by various services, internal and external assessments, and capabilities to adjust our security strategy. We also have a set of Company-wide policies and procedures concerning cybersecurity and technology standards, which include a Technology Use policy, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to endpoint and network protection, encryption standards, malware/ransomware protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: HASBRO, INC.

ticker: HAS


text: Reporting to Board of Directors The CISO provides management, the Risk Committee and the Board of Directors with information regarding the Company's cybersecurity program and potential cybersecurity threats or incidents. In addition, the CISO is empowered to escalate material cybersecurity threats or incidents and strategic risk management decisions to the Board of Directors so that they can provide appropriate oversight and guidance on these critical cybersecurity issues within the context of the Company's overall strategic objectives and business operations. Management, the Company's Chief Digital Officer (the "CDO"), the CRO, and the Incident Management Team (the "IMT") are also required to report cybersecurity threats and incidents to the Risk Committee and/or the Board of Directors, as applicable.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates.

companyName: BlueRiver Acquisition Corp.


text: The Environmental, Technology and Operations Committee of the Board of Directors oversees our management of cybersecurity risks. This Committee is briefed on security policy, programs and incidents on at least a quarterly basis. The Audit Committee of the Board of Directors provides oversight of required disclosures relating to cybersecurity.

companyName: AVISTA CORP

ticker: AVA


text: Our Chief Executive Officer and Chief Financial Officer are principally responsible for overseeing the cybersecurity risk management program, in partnership with outside consultants, as well as managing and responding to material cyber incidents if any occur. Our CFO also serves as a board member at a cybersecurity and mobile IT solutions company. Although our CEO and CFO do not otherwise have cybersecurity expertise, their many years in Company management and risk oversight more generally position them well to oversee the cybersecurity risk management program, which they do in partnership with outside consultants. They provide periodic briefings to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. Our cybersecurity risk management strategy and infrastructure includes maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Quoin Pharmaceuticals, Ltd.

ticker: QNRX


text: The company describes whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect the company under the heading "Cybersecurity incidents may hurt the company's business, damage its reputation, increase its costs, and cause losses," included as part of the company's risk factor disclosures in Item 1A of this Annual Report on Form 10-K. To date, the company is not aware of any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, the company, including its financial condition, results of operations, or business strategies.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: Assessing, identifying, managing, and mitigating risks from cybersecurity threats that may affect Idaho Power's systems and service are essential to its business. IDACORP's and Idaho Power's board of directors oversees risks from cybersecurity threats through the audit committee and the executive committee. The audit committee assists the board in the oversight of Idaho Power's major cybersecurity risk exposures, including oversight of management's information security activities. Those activities include briefing the audit committee and the board on information security matters several times a year in their regular meetings and on an ad hoc basis, conducting an annual security training program, and arranging for external security assessments. Together with the audit committee, the board's executive committee assists the board in monitoring management's risk management framework for cybersecurity on a regular basis.

companyName: IDACORP INC

ticker: IDA


text: The Board receives regular reports from the CIO concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. These reports also include materials related to certain cybersecurity trends we have identified, potential cybersecurity threats and risk, and proposed mitigation measures.

companyName: TerrAscend Corp.

ticker: TSNDF


text: Cybersecurity risks are incorporated into our overall enterprise risk management program. Our Chief Trust Officer ("CTrO") reports to our Chief Technology Officer and oversees our trust and overarching security strategy.

companyName: Atlassian Corp

ticker: TEAM


text: We have adopted several measures aimed to protect against cybersecurity breaches and to minimize disruption if a data breach were to occur. Such measures include documenting, among other things: (i) incident response plans; (ii) procedures for identifying and reporting an incident; and (iii) procedures for containing and eradicating known threats and restoring service to the impacted systems. Upon identification of a cybersecurity event, our policies guide how to handle the incident based on the incident severity and includes information about the required response times, communication protocols and preparation and dissemination of reporting to management. The severity of an incident is classified as "high", "medium" or "low" based on the sensitivity and type of data compromised, the criticality of the system to the Company's operations and its ability to function for users, and the anticipated recovery time and remediation resources required. Incidents classified as "high" must be communicated immediately along with regular progress updates to the CEO, the President, Chief Financial Officer (CFO), General Counsel, CIO and various members of the Information Technology team. High severity events require a sustained response effort using all available resources, which may include engaging third parties to assist in the resolution process as necessary, until resolved.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: We currently manage our cybersecurity risk through our IT consultants in a variety of practices that are applicable to all users of our information technology and information assets, including our officers, directors, employees, vendors and contractors. Our cyber risk management programs are designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: The Company's board of directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Nuveen Global Cities REIT, Inc.


text: Our Chief Information Security Officer and other members of our cybersecurity leadership team regularly participate in threat intelligence briefings provided through various government and industry entities. Both our Chief Information Officer and our Chief Information Security Officer are members of the Delta Risk Council, which is the management group that oversees all areas of our business risk. Cybersecurity threat risks are a regular subject addressed by this group. In addition, our Chief Information Officer is a member of the Delta Leadership Committee and provides updates to this group as needed about cybersecurity matters. Our cybersecurity incident response plan includes processes for communication about cybersecurity incidents to appropriate levels of management, including to the Risk Council and Leadership Committee, as well as the Audit Committee and the Board, as merited.

companyName: DELTA AIR LINES, INC.

ticker: DAL


text: The Company recognizes the importance of identifying and managing material cybersecurity risks associated with our use of third-party service providers. To address these third-party risks, the Company has developed a program to assess both new and existing vendors and suppliers that are expected to have access to or otherwise influence Belden's internal network or internal data. Components of this program include customed vendor security assessments, security architecture review, and third-party rating services. We perform cybersecurity due diligence through this program as appropriate in connection with the on-boarding of a third-party relationship and conduct periodic reviews based on the inherent risk profile of the particular provider.

companyName: BELDEN INC.

ticker: BDC


text: Our teams also rely on third-party diagnostic tools and periodic audits to ensure that our program is performing as designed and in-line with applicable standards. Our Chief Information Officer oversees a security committee made up of professionals on our corporate security and other information technology teams to review the results of these audits and recommend improvements. Prior to engaging a third party to provide services, our information technology team performs a risk assessment to determine the level of review of the vendor needed based on the nature of the services to be provided and type of information that may be shared. The resulting vendor review may include requiring the vendor to provide the results of external audits. We continue to monitor our vendors throughout their engagements with us to ensure they have complied with their contractual obligations, including service level agreements and other contractual standards.

companyName: National CineMedia, Inc.

ticker: NCMI


text: The Director – Information Systems, in coordination with management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. Management is actively involved in the incident response and risk management process (mitigation, transference, and acceptance).

companyName: BADGER METER INC

ticker: BMI


text: Cybersecurity threats continue to evolve with the use of emerging technologies, such as AI. These threats can disrupt operations, compromise sensitive data, and erode trust. We strive to make sure that employees and contractors are up to date with their responsibility and understand the importance of their contributions to staying cyber secure through a robust training and education program. Employees and contractors are responsible for taking mandated cyber training on an annual basis. We also run phishing exercises on a routine basis to help ensure employees and contractors can recognize and report inappropriate activity and social engineering attempts.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: The Company's Vice President, Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Vice President, Information Technology has served in various roles in information technology and information security for over 33 years, including serving as Vice President, Information Technology of two large public companies. The Vice President, Information Technology holds an undergraduate degree in computer science, a Master of Business Administration in information systems, and the professional certification of Certified Chief Information Security Officer.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Overseeing Risks Associated with Third-Party Service Providers. We have established a third-party risk management program to evaluate new and existing third-party service providers for their security controls and processes; identify cyber risks associated to the third-party service providers requiring remediation tracking; and continuously monitor the cyber risk posture of third-party service providers. Where appropriate, our contracts with third-party service providers require agreement and adherence to security and privacy requirements, including: the proper access, use, retention and deletion of data; security awareness training; security incident response and breach notification; our rights to security assessment, testing and audits; compliance with laws and industry standards; and system and services requirements. For example, we require our business process outsourcers, which are providers that support certain customer services operations and other services, to complete security awareness training and payment card industry data security standards training.

companyName: Frontdoor, Inc.

ticker: FTDR


text: The Board of Directors receives periodic training related to cybersecurity and annually reviews comprehensive risk assessments of the Company's information technology, privacy and cybersecurity programs. The Board of Directors formally approves the Company's cybersecurity policies and program annually, and more frequently if material changes are adopted. Oversight of the Company's Information Security Program has been delegated to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee receives quarterly reports on the effectiveness and overall performance of the cybersecurity program and provides a report of the same to the full Board of Directors.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled "Risk Factors — Security breaches, including improper access to or disclosure of our data or our neighbors' data, or other hacking and phishing attacks on our or third-party systems, could harm our reputation and adversely affect our business."

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: Employees outside of our information security team as well as third-party cybersecurity experts have an important role in our cybersecurity defenses. We require employees to participate in annual cybersecurity training and provide them with additional optional training and awareness materials, and we regularly engage our employees in phishing exercises, reporting results to the Information Technology Committee. In addition, we regularly engage assessors, consultants, auditors and other third parties in our management of cybersecurity risk. For example, third parties are engaged to conduct evaluations of the maturity and effectiveness of our security program, including testing the design and operational effectiveness of security controls, penetration testing, engaging in independent audits, reviewing our policies and standards, and consulting on best practices to address new challenges. We also receive threat intelligence from government agencies, information sharing and analysis centers, and cybersecurity associations.

companyName: ASSURANT, INC.

ticker: AIZ


text: Increased global cybersecurity vulnerabilities and threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. We regularly experience cyberattacks aimed at our information systems and networks, including those that store sensitive data about third parties. We have established a Global Information Security Program, which is administered and overseen by the Company's Chief Information Security Officer ("CISO"), that establishes minimum requirements we adhere to in order to provide a secure environment for developing, implementing, and supporting our information technology and systems. Our Global Information Security Program is designed to maintain compliance with various regulatory requirements and certification standards, including those under HIPAA, HITECH, PCI, ISO, SOC and SOX, as we aim to have world-wide, generally accepted, best practices.

companyName: WEX Inc.

ticker: WEX


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these members of management report to the ERMC about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: In addition, assessment and management of material risks from cybersecurity threats are integrated into the Company's risk management strategy. For example, our cybersecurity team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Willdan Group, Inc.

ticker: WLDN