text: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's Chief Information Security Officer ("CISO") and other members of management.

companyName: LKQ CORP

ticker: LKQ


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, cybersecurity software providers and managed cybersecurity service providers.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO

secItem: Item 1C


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: • Training and education, to enable Goldman Sachs employees to recognize information and cybersecurity concerns and respond accordingly; • Identity and access management, including entitlement management and production access; • Application and software security, including software change management, open source software, and backup and restoration; • Infrastructure security, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems; • Mobile security, including mobile applications; • Data security, including cryptography and encryption, database security, data erasure and media disposal; • Cloud computing, including governance and security of cloud applications, and software-as-a-service data; • Onboarding; • Technology operations, including change management, incident management, capacity and resilience; and • Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency on vendor assessments.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: Oversee Third Party Risk Because we are aware of the risks associated with third party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Legal and Compliance Officer (CLCO) and our Chief Operating Officer (COO) and on an ongoing basis by our IT professionals. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: We also maintain cybersecurity awareness and training programs through our learning management platform as well as through our internal policies and certifications, which are subject to review and oversight by our management and our Board of Directors. All newly hired team members are required to take training courses with particular focus on the acceptable use of technology and related cybersecurity risks. E-mail phishing training and testing is performed routinely throughout the year.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading " The Company's failure to protect personal information adequately and breaches in cyber security and data protection could have an adverse effect on its business. " in Item 1A, " Description of Risk Factors" of Part I of this report.

companyName: Two Hands Corp

ticker: TWOH


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.

companyName: Veritex Holdings, Inc.


text: To manage material risks and enhance preparedness, we maintain a cyber insurance program integrated into our overall risk management framework. During insurance renewals, we collaborate with brokers and cyber experts to assess our program and align coverages with identified risks. In the event of a cybersecurity incident, our crisis management plan is triggered, mobilizing the Crisis Management Team to assess the situation and oversee critical decisions related to abatement, mitigation, and response. Responsive steps, each as deemed necessary or advisable and in addition to other elements of the plan, include engaging third-party forensic and other experts, coordinating communications with stakeholders, contacting law enforcement, and reporting incidents to the Board or Audit Committee. In a post-incident review, lessons learned are analyzed for incorporation into future protocols.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: While we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: Security Leadership and Function Team: Our Chief Technology Officer ("CTO") oversees our Security organization, which is a team of people dedicated to keeping company and personal information and systems safe from unauthorized alteration, disclosure, destruction and intrusion. Our Security Steering Committee is made up of our CTO, members of our Information Security Team, and key individuals depending on the risk being addressed. The Security Steering Committee meets quarterly to review security risks and discuss upcoming priorities. The CTO, in coordination with the Security Steering Committee, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats, lower risk of a cybersecurity incident, and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. We continue to invest in enterprise-grade certification of our practices. In the event of an incident, we intend to follow our detailed incident response protocol, which outlines the steps to be followed from incident detection, investigation, mitigation, recovery and communication including notifying functional areas, senior leadership and the Board, as appropriate.

companyName: Matterport, Inc./DE


text: Cybersecurity threats, if realized, could disrupt operations, compromise sensitive data, damage our reputation, subject us to regulatory investigations or penalties, and result in significant financial losses. While we maintain processes and controls designed to prevent or mitigate such risks, no system can provide absolute assurance.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: Our Chief Information Security Officer (CISO) oversees our information security program and is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, policy, architecture, and risk management processes. Our CISO has over 20 years of experience in cybersecurity, serving as a security consultant to Fortune 100 companies, and a subject matter expert in computer forensics to law firms and U.S. Government agencies.

companyName: GoPro, Inc.

ticker: GPRO


text: Risk Management and Strategy AVITA Medical has implemented an Information Security Management System ("ISMS"). The Company's ISMS is a continuous process designed to analyze the potential risks, vulnerabilities, the likeliness of occurrence and the related consequences of cybersecurity threats. The process is based on establishing the context, assessing the risks, and treating the risks. The key concept of the ISMS is to consistently maintain and improve confidentiality, integrity, and availability of information assets that should be protected by the organization on behalf of itself and its clients, and third parties. Once a risk, threat or vulnerability is identified, the Company establishes a risk treatment plan to take corrective action to prevent risks that can be avoided and minimize the ones that cannot. We engage an independent third-party cybersecurity services and consulting firm to continuously review our information security. We also conduct internal phishing campaigns and perform an independent penetration test on an annual basis. In addition, we conduct regular security awareness training and testing of our employees. The Company has not had any material cybersecurity incidents.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and senior IT leadership maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Company, at the direction of the Audit Committee, conducts periodic reviews of the Company's cybersecurity posture and the effectiveness of its risk management strategies. These reviews help in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties and Topper Group employees) and other data, confidential information or intellectual property. To date, these incidents have no t had a material impact on our service, systems or business and we do not believe cybersecurity risks from these prior incidents are reasonably likely to materially affect our operations. For further information on cybersecurity risks and potential related impacts on us, see "Risk Factors – Our business and our reputation could be adversely affected by the failure to protect sensitive customer, Topper Group employee or the Partnership's vendor data, whether as a result of cyber security attacks or otherwise, or to comply with applicable regulations relating to data security and privacy."

companyName: CrossAmerica Partners LP

ticker: CAPL


text: An Information Security Risk Assessment led by the Manager's Chief Information Officer ("CIO") is performed on an annual basis, and/or upon major changes of cybersecurity related processes and infrastructure, for evaluating the potential impacts to key technology, processes, and people upon known relevant threats. Either a mitigating action plan and/or risk acceptance with valid business reasons is required as a response to each identified risk. The results of the Information Security Risk Assessment are available to senior management for review and approval.

companyName: Ridgewood Energy O Fund LLC


text: We use advanced threat detection tools and technologies to identify potential cybersecurity risks. This includes continuous monitoring, intrusion detection systems, and anomaly detection mechanisms, to promptly identify any unusual activities or security breaches. Threat intelligence sharing with industry partners helps us stay informed about the latest cybersecurity threats.

companyName: LITHIA MOTORS INC

ticker: LAD


text: Our Vice President of Information Technology and Security monitors our processes for preventing, detecting, mitigating, and remediating cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of our incident response plans, which include escalation to our Chief Executive Officer and Chief Financial Officer, as appropriate.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: The Company's Vice President of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology, Security and Business Intelligence works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. The Company's Vice President of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest. The Vice President of Information Technology, Security and Business Intelligence holds a master's degree in business administration from Boston University, a master's degree in electrical and computer engineering from Utah State University, and a bachelor's degree in electronics engineering from Mumbai University. The Company's Information Technology team has specific professional certifications and has over 10 years of experience with managing risks arising from cybersecurity threats.

companyName: Axogen, Inc.

ticker: AXGN


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Our systems are continually subject to sophisticated and evolving cyber threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that have materially impacted our operations or financial condition. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification, escalation, and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to evolve our security controls, incident response capabilities, and third-party vendor management protocols.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: We are a blank check company with no business operations except the proposed business combination transaction. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for an initial business combination. Therefore, we do not believe that we face significant cybersecurity risks and have not adopted any cybersecurity risk management programs or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Oak Woods Acquisition Corp

ticker: OAKU


text: Risks from cybersecurity threats are monitored on an ongoing basis by the Information Security team, engaging the Cyber Incident Response Team, Cyber Crisis Team, the Core Team, and Extended Core Team, as needed, and escalated to the extent that incidents rise to the level of notification to the relevant risk or board committee or on an ad hoc basis.

companyName: Independent Bank Group, Inc.


text: Cybersecurity incidents meeting a certain criteria are escalated to our Disclosure Committee for SEC disclosure consideration. The materiality of any cybersecurity incident is ultimately evaluated and determined by our Disclosure Committee in collaboration with our CIO. Our Disclosure Committee is comprised of our executive officers, our CIO, our Chief Ethics and Compliance Officer, and relevant business leaders from our finance and legal departments. The Disclosure Committee is presented with a detailed overview of the cybersecurity incident by the CIO. The Disclosure Committee then evaluates the cybersecurity incident and its potential materiality based on SEC guidance and by considering relevant quantitative and qualitative factors.

companyName: CoreCivic, Inc.

ticker: CXW


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems or those third parties with whom we work or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: GENELUX Corp

ticker: GNLX


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and contract research organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes conducting a risk assessment for certain vendors.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: Buckle is committed to earning and maintaining the trust of its guests, teammates, vendors, and shareholders. This commitment, as it relates to technology and data, requires a focus on protecting business operations and preserving the confidentiality, integrity, and availability of information by preventing, identifying, and mitigating cybersecurity threats and effectively responding to any security incidents when they occur. The Company's commitment to cybersecurity is integral to its business strategy, operational integrity, and brand reputation.

companyName: BUCKLE INC

ticker: BKE


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: the review of the security procedures used by third parties that may host or otherwise have access to our systems;

companyName: MedWellAI, Inc.

ticker: MWAI


text: As a financial services company entrusted with the safeguarding of sensitive information, including sensitive personal information, we believe that a strong enterprise cybersecurity program is a vital component of effectively managing risks related to the confidentiality, integrity and availability of our data. While no organization can eliminate cybersecurity and technology risk entirely, we devote significant resources to a cybersecurity program designed to mitigate such risks. For further discussion of cybersecurity and technology risk, and related risks for our business, see "Item 1A. Risk Factors. "

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Incident Response Policy The Board of Directors is responsible for overseeing the risks from cybersecurity threats. Each month, the Board is presented with the executive overview of the Cybersecurity Continuous Monitoring Review Report (" Report ") prepared by the Company's third-party chief information security officer. The Board of Directors reviews the Report each month and, if warranted, directs senior management of the Company to take necessary and appropriate actions in accordance with the IR Policy (as defined below).

companyName: NORWOOD FINANCIAL CORP

ticker: NWFL


text: We have not identified cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Security breaches, cybersecurity incidents, or our inability to effectively integrate, manage and keep our information systems secure and operational could violate security laws, disrupt our operations, and subject us to significant liability."

companyName: PACS Group, Inc.

ticker: PACS


text: Our cybersecurity program is managed and directed by our Vice President, Information Technology, or IT, who has approximately 20 years of experience in information technology and information systems management. Our Vice President, IT reports to our Chief Financial Officer.

companyName: enGene Holdings Inc.

ticker: ENGN


text: Muhammad Afnan, Director of Software Development, who brings extensive knowledge in software security practices and the implementation of secure development life cycles.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: The Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, for the period covered by this annual report. For a discussion regarding risks associated with cybersecurity threats, see "Risk Factors – Risks Relating to Our Business – If our information technology, telecommunications or other computer systems become unavailable or unreliable, our ability to conduct our business could be negatively or severely impacted" and "Failure to maintain the security of information technology systems and confidential data may expose us to liability"; and "Use of artificial intelligence technologies, by us or third-parties on whom we rely, could expose us to technological, security, legal, and other risks."

companyName: BERKLEY W R CORP

ticker: WRB


text: The Company uses a Disaster Recovery Plan (the "Plan"), along with incident response policies, to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Company and with our Board of Directors, notify law enforcement, regulatory bodies, and other government agencies, and notify customers and employees. The Plan provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team ("CMT"). The CMT facilitates coordination across key stakeholders of the Company. The Company's CIO and key members of management are members of the CMT. The Company provides the CIO and the information security team the latest tools and techniques to protect the confidentiality, integrity and availability of the Company's data for the benefit of our customers, employees and shareholders. We regularly engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities specifically include internal audits, vulnerability assessments and penetration testing. The Company's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives. The CIO and other members of the information technology team receive ongoing training related to developing threats, proactive solutions and industry best practices in order to effectively protect the Company and its stakeholders.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: Terex has experienced cyber incidents in the normal course of business; however, no prior cybersecurity incident has had a material adverse effect on Terex's business, strategy, results of operations, financial condition or reputation. For more information on the cybersecurity threats and risks we face, see Part I, Item 1A. – Risk Factors.

companyName: TEREX CORP

ticker: TEX


text: Cybersecurity Incident Response Plan We have established a Cybersecurity Incident Response Plan ("CIRP"), which details the steps to be followed to properly respond to, contain, and remediate a cybersecurity incident. Within this plan, there are also engagement processes for our external cybersecurity incident response firm, which also assists Wyndham's cybersecurity team by annually testing the CIRP through custom tabletop exercises. The CIRP provides a process for escalating certain cybersecurity incidents to the IRC and to other members of management to facilitate management-level consideration as to whether a cybersecurity incident may be material to the Company and whether public disclosure of the incident is required.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: We have developed and implemented a cybersecurity risk management program intended to materially protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes policies and processes for assessing, identifying, and managing risk from cybersecurity threats as well as a cybersecurity incident response plan. Our cybersecurity risk management program is integrated into our overall risk management system and processes, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other strategic, operational, legal, compliance, and financial risk areas.

companyName: VERU INC.

ticker: VERU


text: The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our patients, customers, operations, partners, employees and third parties, consistent with our legal obligations. Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact us or our operations to date. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. See Item 1A. Risk Factors "Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position" for a discussion of cybersecurity-related risks.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: We believe we are appropriately staffed (as supported by our outsourced IT provider) to support a healthy cybersecurity posture given our size and scope.

companyName: Vocodia Holdings Corp

ticker: VHAI


text: We understand the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Cybersecurity processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated into our operations as a part of our overall risk assessment process.

companyName: Ocugen, Inc.

ticker: OCGN


text: The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's CISO, who reports to the Company's CIO. The CISO and CIO (collectively, the Company's "Cybersecurity Leaders") are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department. The CIO holds an undergraduate degree from Cornell and has served in various roles in information technology for over 20 years, including Vice President, Senior Director, Manager and Consultant. • The CISO is responsible for all aspects of cybersecurity across the Company's facilities, airports, and aircraft fleet, which includes security engineering, security operations, incident response, threat intelligence, risk and compliance, and vulnerability management. The CISO has served in various roles in information technology for nearly 40 years at numerous technology companies and consulting firms. The CISO earned a Bachelor of Science in Industrial Engineering from Louisiana State University, a Master of Science in Management Information Systems from The University of Texas at Dallas, and a Master of Business Administration from Southern Methodist University.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: The Company requires authorization of all personnel, including contractors, before being granted access to facilities, systems, and data. The Company's identity and access management systems are integrated with human resource applications and processes to facilitate provisioning and de-provisioning of badges and logical system access.

companyName: CINCINNATI BELL INC


text: The Company tests and evaluates its cybersecurity risk management processes on a regular basis. As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, financial condition or results of operations.

companyName: WillScot Holdings Corp

ticker: WSC


text: Our Board of Directors' Role in Oversight of Cybersecurity Threats Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board of Directors oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee.

companyName: FIRST BANCSHARES INC /MS/


text: Our Global Director of Cybersecurity leads a quarterly cybersecurity governance meeting, comprising of all IT teams from our subsidiaries. This meeting serves as a platform to review and discuss ongoing and upcoming security projects, compliance, and regulations.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: • Governance: Our BOD's oversight of cybersecurity risk management is led by the Audit Committee, which oversees our ERM program. Cybersecurity threats, risks and mitigation are periodically reviewed by the Audit Committee and such reviews include both internal and independent assessment of risks, controls and effectiveness.

companyName: PFIZER INC

ticker: PFE


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, application providers, and information technology support. We prioritize the use of known vendors with experience specific to our industry needs and, depending on the nature of the services to be provided, our contracts with certain vendors include certain contractual provisions related to security.

companyName: Landos Biopharma, Inc.


text: Management ' s Role. Our IT Security Team addresses and responds to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The team oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The IT Security Team also assists with the review and approval of policies, completes benchmarking against applicable standards, and oversees the security awareness program.

companyName: EASTMAN KODAK CO

ticker: KODK


text: Management continually re-assesses the Company's cybersecurity risk environment based on changing circumstances and new information identified by its monitoring, scanning and testing as well as third party resources. processes for assessing, identifying, and managing cybersecurity threats have been integrated into our overall risk management processes.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: Our cybersecurity programs are under the direction of our CISO, who receives reports from our security teams and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and key security leaders are certified and experienced information systems security professionals, security engineers, and information security managers each with well over a decade of experience. Our CISO and security teams, along with our management, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity programs.

companyName: MongoDB, Inc.

ticker: MDB


text: We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: Over 98% of our restaurants are owned and operated by franchisees who themselves are at risk of cyber-attacks or security incidents. There is limited direct connectivity between the Company's network and the networks on which our franchisees operate. We have established minimum information security standards for our franchisees, which are in process of being adopted.

companyName: YUM BRANDS INC

ticker: YUM


text: We have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion on the Company's cybersecurity related risks, see "Risk Factors - We rely significantly on information technology and any inadequacy, interruption, theft or loss of data, malicious attack, integration failure, failure to maintain the security, confidentiality or privacy of sensitive data residing on our systems or other security failure of that technology could harm our ability to effectively operate our business and damage the reputation of our brands" and "Risk Factors - Our business is subject to increasing government regulations in both the U.S. and abroad that could impose material costs" and other risk factors contained in Part 1, Item 1A of this Annual Report on Form 10-K. Cybersecurity Governance The Audit Committee of our Board of Directors is tasked with providing oversight of cybersecurity risk.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity. Our Audit Committee will report from time to time, as necessary, to the Board on these matters. At the management level, our cybersecurity program is managed by our Chief Executive Officer, who reports to the Board, with the assistance of a third-party vendor.

companyName: Finch Therapeutics Group, Inc.

ticker: FNCH


text: We also have invested in tools and technologies to protect our and our patients', customers' and business partners' data and information technology, and we regularly monitor our information technology systems and infrastructure to identify and assess cybersecurity risks. We have designed a Threat Intelligence function that actively looks for risks that target the pharmaceutical industry generally or AbbVie specifically. We rely in part on third parties (including assessors, consultants, advisors and others) in connection with our processes for assessing, identifying, managing and reducing cyber risks.

companyName: AbbVie Inc.

ticker: ABBV


text: Cybersecurity Incident Response Plan ("CIRP"): Our CIRP ensures we are prepared to respond to, report, and remediate any cybersecurity incidents effectively. Led by the Chief Information Officer ("CIO"), our corporate compliance and risk management team manages all aspects of incident response. For significant incidents, additional third-party resources would be mobilized to mitigate impact on the business.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our Cyber Oversight Group utilizes the IRP to: (1) prepare for and protect against cybersecurity incidents; (2) identify and analyze cybersecurity incidents; and (3) contain, eradicate, and help ensure appropriate reporting of cybersecurity events in accordance with our regulatory obligations. In the event of a cybersecurity incident, the IRP provides a framework to coordinate the response. The IRP also addresses escalation protocols to senior management responsibility with respect to disclosure determinations and provides for Audit Committee and Board briefings as appropriate. We also manage threats to our systems originating or associated with third party service providers by integrating cybersecurity requirements and other related obligations into various contracts. We also utilize vendor intake evaluations, ongoing cyber risk monitoring of our critical technology vendors, and and other risk management strategies to evaluate and help mitigate risk associated with our third party service providers. Vulnerabilities and risks identified for our third-party vendors are handled through ongoing scanning and reviews.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: Roper has also established a Cyber Disclosure Committee chaired by the Vice President of Cybersecurity to track and evaluate potentially material cybersecurity incidents and to assess their potential impact on the organization. This process builds upon the CSIRP and provides a framework for Roper management to monitor potentially material cybersecurity incidents. The Cyber Disclosure Committee reports its activities and findings, as appropriate, to the Chief Executive Officer, Chief Financial Officer, Principal Accounting Officer, and General Counsel, and, if appropriate, to the Board of Directors.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). Our cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: U.S. SILICA HOLDINGS, INC.


text: NEE, including FPL, operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats which is led by a cybersecurity incident response team. NEE, including FPL, uses these resources to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on their systems, and monitors for impacts to external vendors or suppliers. Assessment of an incident includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE, including FPL, invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents as appropriate to oversight committees charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and NEE's Board of Directors.

companyName: FLORIDA POWER & LIGHT CO


text: The processes overseen by our information security team are integrated with our enterprise risk management ("ERM") program, including routine reporting to our executive team on cyber risk through the different levels of our ERM governance structure including our risk management frameworks and processes. We undergo routine testing of both the design and operational effectiveness of our security controls, consult with industry leaders on best practices, and ensure alignment with relevant industry frameworks and laws, as well as auditing by our internal audit team. Our cybersecurity program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments. In addition to our policies and procedures designed to manage and identify cybersecurity risks, we maintain an incident response plan designed to contain, analyze, remediate, and communicate cybersecurity matters to help ensure a timely and appropriate response to cybersecurity incidents.

companyName: EPLUS INC

ticker: PLUS


text: The Risk Management Committee of the Board of Directors (the "Committee") is responsible for overseeing the risks from cybersecurity threats. The Committee receives reports from, and oversees, IT Risk Assessment, Cybersecurity Risk Assessment, Annual IT Program Status Report, Vendor Management Risk Assessment, and Quarterly Internal Vulnerability Reports and current Cyber Events briefings. The Committee also makes budgeting, procedure, and policy decisions designed and intended to improve the Company's residual risk.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: Our cybersecurity materiality assessment teams, which include chief information security officers, chief information officers, chief risk officers, chief accounting officers or chief financial officers, and general counsels, help assess the materiality of certain cybersecurity incidents.

companyName: SEMPRA

ticker: SREA


text: During the year ended December 31, 2024, the Company did not experience any risks from cybersecurity threats that materially affected or were reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: Cybersecurity is among our Board's oversight priorities. Through their oversight role, the Board has allocated oversight of cybersecurity risk to our Audit Review Committee of the Board. Our Audit Review Committee plays a vital role in our cybersecurity risk management process and regularly reviews the Company's cybersecurity and other information technology risks, controls and procedures. Throughout the year, management provides the Audit Review Committee with updates to our cybersecurity risk management process and our security monitoring and protection systems. The Audit Review Committee is kept informed of new security solutions planned for deployment. As part of their regular review of reports from management, the Audit Review Committee regularly reports cybersecurity risk updates to the Board, which enables the Board to incorporate the insights of such reports into its overall risk oversight analysis.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: Our Head of IT, twice a year, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. He also reports on a quarterly basis to the executive committee on cybersecurity and information technology matters. The chair of the audit committee provides periodic reports on cybersecurity risk management to the full board of directors. Our General Counsel, on an annual basis, discusses the results of our enterprise risk assessment processes, including risks related to cybersecurity, with the full board of directors.

companyName: Disc Medicine, Inc.

ticker: IRON


text: Our Chief Information Security Officer ("CISO"), who reports directly to the Chief Financial Officer, oversees the Company's approach to managing cybersecurity and digital risk. Our CISO also regularly engages with cross-functional teams at the Company and partners with our dedicated technology risk management and privacy teams, and collaborates with our internal audit department to review information technology-related internal controls as part of the overall internal controls process. Our information security strategic plan includes the development of a single detection and response team across both the corporate and product information and technology environments.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: The Company's cybersecurity program fundamentally aligns with the COBIT framework. This is reflected in our related policies, practices and procedures. We have multiple layers of security controls as well as a third -party SOC that helps identify, avoid and mitigate cybersecurity threats. The evaluation of risks includes consideration of cybersecurity and privacy risk, including ( 1) potential impact on the Company's employees, customers, and other stakeholders, ( 2) intelligence briefings on notable cyber events impacting the industry and ( 3) evaluation of external threats. The Company utilizes internal and third -party assessment tools and tests to evaluate its cyber risk policies, practices and procedures as well as to challenge how its defenses are built and deployed. These assessments provide opportunities for critical self-analysis, constructive feedback from third parties, and learnings from industry experts to enhance cyber resilience. Both formal and informal cybersecurity awareness trainings are provided to employees to help identify and avoid cybersecurity threats and to ensure employees understand the Company's cyber risk management policies along with the key role they play to ensure cyber hygiene. The Company has established a cybersecurity incident response team that includes the CEO, CFO, VP of HR, IT Director and other personnel. The Company has also retained counsel to advise on cybersecurity matters. The Company periodically undertakes table top exercises facilitated by a third party whereby the incident response team reacts to, evaluates and updates, if necessary, its policies and processes to a simulated cyberattack.

companyName: RGC RESOURCES INC

ticker: RGCO


text: Our Senior Director of Cybersecurity Infrastructure and Threat Hunting, Corporate Cybersecurity leads our information security organization responsible for overseeing our information security program. This individual has over 20 years of experience in various roles involving security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").

companyName: Hughes Satellite Systems Corp


text: The Audit Committee will coordinate these activities through regular interactions with the Company's management including but not limited to: presentations regarding recent developments, potential risks associated with third parties, emerging trends, any relevant findings or any incident that rises to the level of established thresholds.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: As part of the above processes, we engage with subject matter expert consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: As discussed under the "Risk Factors" heading in this Annual Report, our business has been and may again in the future be impacted by disruptions to our IT infrastructure or our third-party providers' IT infrastructures from (among other causes) cybersecurity-based risks, including attacks (i) on our IT infrastructure (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into third-party products); and (iv) on facilities or similar infrastructure. Risk Management and strategy.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: We work with third-party service providers from time to time that assist us to identify, assess and manage cybersecurity risks, including professional SEIM SOC and other services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is assessed as a component of the Company's enterprise risk management program. In addition, we have developed a process whereby our senior management will evaluate material risks from cybersecurity threats against our overall business objectives and will report certain cybersecurity incidents to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management and compliance programs.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Our Board and the Board's Audit Committee oversee the Company's enterprise risk management ("ERM") program, including the Company's assessments of cybersecurity risks and exposures and the Company's processes to safeguard assets and manage material cybersecurity risks. On an annual basis, the Board reviews the Company's principal current and future risk exposures, including cybersecurity risks and exposures. The Audit Committee bears principal responsibility for overseeing the Company's major financial risk and enterprise exposures and the steps management has taken to monitor and control such exposures, including an annual session with our CIO on the Company's procedures and policies for assessing and managing cybersecurity risks and disclosing any material cybersecurity incidents. In performing these oversight functions, the Board and Audit Committee rely on advice, reports and opinions of management, counsel and our internal and external auditors, including mid-year and year-end cyber inquiries by our external auditors on various aspects of the Company's cybersecurity program, processes and training.

companyName: Sotera Health Co

ticker: SHC


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our current IT consultants and IT MSP, who report to our interim Chief Financial Officer, to manage the risk assessment and mitigation process. Our interim Chief Financial Officer has served in various capacities in enterprise risk management and cybersecurity over five years, including serving as our Data Security Coordinator for the past two years, during which he has overseen our risk management process.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, account takeover, fraudulent order, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition, and we do not believe such risks are reasonably likely to have such an effect over the long term. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - Our reputation and business may be harmed if our or our vendors' computer network security or any of the databases containing customer, employee, or other personal information maintained by us or our third-party providers is compromised, which could materially adversely affect our results of operations."

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Our board of directors and the Risk Committee of the board of directors oversee an enterprise-wide approach to risk management, including cybersecurity risks, intended to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. The Risk Committee is central to the board of directors' oversight of cybersecurity risks and bears the primary responsibility for this function. The Risk Committee is composed of board members with diverse expertise including, risk management assisting them to oversee cybersecurity risks. The Risk Committee receives regular reports from our Chief Information Security Officer ("CISO") and provides updates to the full board of directors at each regular meeting of the board of directors. The Risk Committee also reviews all information security plans and policies, which are then recommended to the full board of directors for its review and approval.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Post-Incident Activity After recovery, the Company performs a review of the incident to identify and implement enhancements to the cybersecurity program that can mitigate the risk or severity of future incidents. The CISO generally oversees the implementation of enhancements identified through these reviews with oversight by senior management and the Audit Committee as appropriate.

companyName: American Homes 4 Rent

ticker: AMH


text: To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: Protecting the information maintained by the Company about its patients, customers, colleagues, and partners against external and internal threats is a priority for the Company. Accordingly, the Company invests in the development and implementation of cybersecurity policies, control standards, and control procedures, including a risk management and assessment program, security and event monitoring capabilities, an incident response plan, and other detection, prevention, and protection capabilities, including practices and tools to monitor and mitigate external and insider threats. The Company engages in a risk monitoring process through its Office of Information Security (OIS) within the Information Technology organization that seeks to identify the likelihood and impact of threats to its systems and data, and assesses the effectiveness of the controls in place.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: Our Director, IT Infrastructure & Cybersecurity monitors cybersecurity incidents and does so by working closely with expert technology and security partners. We and our partners deploy a variety of technologies and processes, including but not limited to intrusion monitoring, detection and response, patch management, threat hunting, identity and access management, assessments, audits and tests.

companyName: Third Harmonic Bio, Inc.


text: Key elements of our cybersecurity risk management program and strategy include but are not limited to the following: • Adhering to principles of Security by Design and Security by Default • Conducting third-party vulnerability scans, and penetration testing • Access controls enforcing principles of Least Privilege, Zero Trust, and Role-Based Access Controls with MFA requirements for critical systems and accounts • Cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents • A third-party risk management evaluation process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors with access to our information systems or data • An employee cybersecurity awareness training program including awareness training and simulated attacks • A dedicated team responsible for incident identification, management, and remediation • Implementation of cybersecurity controls with ongoing monitoring and improvement internally, with assistance from external auditors • Third-party security vendors and auditors, where appropriate, to assess, test otherwise assist with aspects of our security processes.

companyName: PACS Group, Inc.

ticker: PACS


text: Our cybersecurity risk management processes also address risks associated with our use of third-party service providers, including those who have access to our employee data or our systems that support customers and our network of independent commission sales agents and third party capacity providers. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threats identified through such diligence. Additionally, we may require certain third parties to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: Our processes also include assessing cybersecurity threat risks associated with the use of third-party service providers in the normal course of business use. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house our critical systems and data.

companyName: GPODS, INC.


text: We describe how risks from cybersecurity threats, could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A of this Annual Report on Form 10-K.

companyName: NORTHWEST PIPELINE LLC


text: risk assessment; risk management; and risk monitoring. CISS operates a security operations center for monitoring, identifying, and mitigating potential cybersecurity events or incidents.

companyName: EXELON CORP

ticker: EXC


text: Third Party Service Provider Monitoring The Bank maintains a robust Vendor Management Program to appropriately measure, monitor and control risks associated with outsourcing products and services, including cybersecurity risks. Under the program, vendors are assigned a risk rating based on an assessment of the vendor and its access to network, systems and confidential information. Critical and high-risk vendors are reassessed at least annually, and remediation plans are implemented for identified deficiencies. The Bank's Information Security Officer ("ISO")conducts regular periodic reviews of the adequacy of its oversight of controls over third party relationships.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: The Company's cybersecurity program is integrated within the Company's enterprise risk management program, which provides oversight and governance of cybersecurity risk through risk assessment, risk monitoring, and follow-through on stated objectives and investments to actively manage and remediate related risks.

companyName: Strategic Education, Inc.

ticker: STRA


text: We have a cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity incidents that is designed to protect the confidentiality, integrity, and availability of our information technology assets and data. Cybersecurity risk management is part of our enterprise risk management program. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition. Those processes include the development, approval and implementation of our Enterprise Information Security Policy ("EISP"), Information Security Standards, Information Security Incident Response Plan ("ISIRP") and Business Continuity Management Policy.

companyName: Federal Home Loan Bank of Indianapolis


text: C. Management's Role and Expertise Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the VP of Security, who has over 16 years of dedicated experience in the field of cybersecurity across multiple industries. Their background includes extensive experience in cybersecurity program development, leadership, and risk management, which is instrumental in the execution of our cybersecurity strategies. Some specific responsibilities include overseeing our governance and compliance, risk management (identification, assessments, and treatment), and security and privacy awareness programs.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: The Company's cybersecurity program also includes employee training and education. Frequent employee training topics include social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. Training emphasizes the importance of reporting incidents promptly to the Company's security operations team. The Company also conducts periodic phishing tests with employees and provides employees with easy-to-use tools to report potential phishing emails.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: We have adopted a cybersecurity and privacy incident reporting framework to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident, assessment of public disclosure considerations and reporting to the Audit Committee and the Board.

companyName: SANMINA CORP

ticker: SANM


text: We regularly engage third parties and leverage their expertise to improve our cybersecurity environment and defenses against third party threats. Such third parties assist us in the assessment and testing of our cybersecurity environment and help us identify any potential gaps in our cybersecurity defenses. We also regularly discuss evolving cybersecurity threats with third parties and interface with software and hardware providers to manage our cybersecurity environment.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Arrow has not experienced, nor does it believe it is reasonably likely to experience, a material effect on the Company's business strategy, results of operations or financial condition as a result of a significant compromise, significant data loss or any material financial losses related to cybersecurity incidents or other security problems.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Cyber attacks and data security breaches could harm our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.

companyName: IPALCO ENTERPRISES, INC.


text: Our board of directors addresses the Company's risk management and strategy, including the management of cybersecurity threats, as part of its general oversight function, and our management is responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the Audit Committee.

companyName: Viracta Therapeutics, Inc.

ticker: VIRX


text: Murphy engages cybersecurity assessors, consultants, our internal auditors, and other third parties both periodically and as appropriate when cyber threats are identified. Murphy utilizes these consultants to perform forensic analysis of data published by threat actors, to monitor and scan Murphy's systems for threat vectors, and to consult on emerging cybersecurity environment topics.

companyName: MURPHY OIL CORP

ticker: MUR


text: Technical Safeguards. We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which we evaluate and improve through vulnerability assessments and cybersecurity threat intelligence.

companyName: PROS Holdings, Inc.


text: Our cybersecurity incident response and communication plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The cybersecurity risk committee works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our cybersecurity incident response and communication plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: MANNKIND CORP

ticker: MNKD


text: Role of the Board of Directors and Management The Audit Committee of the Board of Directors oversees our enterprise risk management, which includes cybersecurity. The Chair of the ISC reports on our cybersecurity program to our Board at least annually.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Fund believes have materially affected, or are reasonably likely to materially affect, the Fund, including its business strategy, operational results, and financial condition.

companyName: John Hancock Comvest Private Income Fund


text: Pursuant to the terms of the Fund's LLC Agreement, the Manager renders management, advisory and administrative services to the Fund, which includes the assessing, identifying, and managing of material risks from cybersecurity threats through its Corporate IT Security Governance program. Ridgewood Energy's Corporate IT Security Governance program consists of an information security framework and organizational structure with senior management oversight that are designed to safeguard critical information assets. Cybersecurity risk is evaluated based upon risk-based approach.

companyName: RIDGEWOOD ENERGY T FUND LLC


text: We employe an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employe a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts, penetration testers, and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We have optimized our vulnerability management program that scans devices every four hours, and we have strict key performance metrics to ensure vulnerabilities are remediated quickly. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Our Board of Directors has specific oversight responsibility for cybersecurity, which also oversees our general risk management. The Board of Directors reviews and discusses with management our policies, practices and risks related to information security and cybersecurity. Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. Our chief financial officer provides an update to the Board of Directors on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.

companyName: Maison Solutions Inc.

ticker: MSS


text: Primary responsibility for assessing any cybersecurity risks rests with our chief executive officer, who would report any threat to our board of directors.

companyName: TOKEN COMMUNITIES LTD.

ticker: TKCM


text: The Company is susceptible to a variety of risks as an inherent part of serving our clients' needs, including risks related to cybersecurity, data privacy and technology. The Company maintains a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program, which balances serving the interest of our clients, their policyholders and customers, regulatory bodies, our investors, our employees and other relevant constituencies, is integrated within the Company's Enterprise Risk Management ("ERM") program.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including, confidential information that is proprietary, strategic or competitive in nature, and data related to financial and customer data ("Information Systems and Data").

companyName: BOSTON OMAHA Corp

ticker: BOC


text: In the event of a detected cyber incident by 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment of the incident, identifies the source of the problem, and resolves the issue as appropriate. If they are unable to resolve the issue, the problem is escalated to our cybersecurity monitoring and detection software provider for resolution. Events which are not routinely resolved by our IT and cybersecurity provider are brought to the attention of the board.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: Our Audit Committee is regularly involved in reviewing cybersecurity risk management. At least quarterly, the Vice President of Operations presents and reviews key security metrics with the Audit Committee including a review of cyber-security events, cybersecurity initiatives and new or developing cybersecurity risks relevant to the business. The Audit Committee, which comprises at least two individuals with experience in cybersecurity and related matters, meets with these members of senior management to review our information technology and data security policies and practices, and to assess current and projected threats, cybersecurity incidents, and related risks. Our Vice President of Operations reports directly to our executive management team and advises the company on cybersecurity risks and assesses the effectiveness of information technology and information security processes and business policies impacting our overall cybersecurity risk.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our CISO, Jim Higgins, has over 30 years of experience in the technology sector, including senior leadership roles in product security, information security engineering, and cloud enterprise. Mr. Higgins assisted the Linux Foundation in starting the Open Source Security Foundation to help increase awareness and promote technical solutions to address validation of Open Source software. Mr. Higgins has worked in information security at Chevron, Eastman Kodak, and Google, and, mostly recently, spent two years as the CISO of Block, Inc. (formerly Square).

companyName: Snap Inc

ticker: SNAP


text: Given the small size of our organization, we leverage a third-party information technology ("IT") service provider for management of our information systems needs. Our IT service provider works closely with executive management in the assessment, identification and management of cybersecurity threats. Cybersecurity threats are prevented and detected by multiple approaches, including perimeter defense, vulnerability management, intrusion testing, multifactor authentication and data protection. We are in the process of developing a formal cybersecurity awareness program that will include cybersecurity training for all employees and relevant contractors and will be integrated with our overall risk management process. Material risks from cybersecurity threats, including those associated with the use of third-party service providers, are assessed during our annual review of our enterprise risks and related controls.

companyName: PARKERVISION INC

ticker: PRKR


text: Training and Awareness We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including privacy and security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats. We have also developed a program for staging incident response drills to prepare support teams in the event of a significant incident.

companyName: Holley Inc.

ticker: HLLY


text: Our management team is actively involved in the assessment and management of cybersecurity risks. We have a CIO overseeing the Company's technology infrastructure and a designated a CISO responsible for cybersecurity program oversight. The CISO possesses over two decades of comprehensive experience in the information technology landscape, augmented by a robust background in program management. With a portfolio enriched by industry certifications and advanced academic degrees, including an MBA, the CISO stands as a seasoned leader within our corporate information security domain. The CISO collaborates with cross-functional teams to implement and uphold our cybersecurity policies and practices. Our executive leadership team is aligned with our cybersecurity objectives and regularly reviews our cybersecurity-related initiatives.

companyName: URBAN ONE, INC.

ticker: UONE


text: The Corporate Information Technology Director receives reports on information security and cybersecurity threats and, in conjunction with management, regularly reviews risk management measures we implement to identify and mitigate information security and cybersecurity risks. In addition to our internal cybersecurity capabilities, we also regularly engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: Management's Role Managing Risk Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process. Cybersecurity related risks are included in the population that the ERM function evaluates to assess the top risks to the enterprise on a quarterly basis. To the extent the ERM process identifies a heightened cybersecurity related risk, management develops risk mitigation plans to minimize the risk. The ERM annual risk assessment is presented to the Audit Committee of the Board.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: The security and integrity of our information systems, communication networks, IT infrastructure, and data centers are critical to the successful operation of our business.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: For further discussion of cybersecurity risks, please see our Risk Factors discussion under the heading, "Risks Related to Our Intellectual Property, Technology and Cybersecurity. "

companyName: indie Semiconductor, Inc.

ticker: INDI


text: From time to time, Griffon engages external experts, including cybersecurity assessors, consultants, and/or auditors to evaluate cybersecurity measures and risk management processes.

companyName: GRIFFON CORP

ticker: GFF


text: At the employee level, we maintain an experienced information technology team who are tasked with implementing our privacy and cybersecurity program and support the CISO in carrying out reporting, security and mitigation functions. We also hold annual employee trainings on privacy and cybersecurity, records and information management, and generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.

companyName: Shutterstock, Inc.

ticker: SSTK


text: Risk Management Strategy The Company has implemented a cybersecurity program intended to assess, identify, manage and reduce cybersecurity risk. Through our partnership with Harley-Davidson we maintain an IT incident response plan that is designed to protect against, identify, evaluate, respond to, and recover from an incident. The plan is designed to be flexible so it may be adapted to an array of potential scenarios and includes a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that is composed of both Company and Harley-Davidson personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. Currently the Company contracts for such cybersecurity services through the Master Services Agreement with Harley-Davidson, in addition to leveraging its own information technology and security tools and teams.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees the implementation of the cybersecurity risk management program.

companyName: ALEXANDERS INC

ticker: ALX


text: Our CISO is responsible for assessing and managing our material risks from cybersecurity threats and has the primary responsibility for leading our overall cybersecurity risk management program, supervising both our internal cybersecurity personnel and external cybersecurity service providers. Our CISO has over 20 years global large-scale cybersecurity experience in managing and leading IT and cybersecurity teams. Members of the cybersecurity team hold various credentials and certificates with respect to information systems and they participate in continuing education.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process.

companyName: TMC the metals Co Inc.

ticker: TMC


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity technologies, and controls and processes to aid in our efforts to assess, identify, and manage such risks.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: Processes and Risk Assessment Our cybersecurity policies and processes are overseen by the Audit Committee of our Board. Our cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that we store or process; (ii) maintaining the security and availability of our systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and our responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: Our CISO and CIO are also members of our information and security governance group, led by our CIO, which is comprised of executive and senior leadership from a variety of functions, including information security, corporate security, legal, finance, human resources, internal audit and compliance, as well as members of Teva's global situation room ("GSR"). Additionally, our CISO, CIO and other members of our information security office may, from time to time, consult and coordinate with other Teva departments and members of management to manage cybersecurity risks and implement cybersecurity incident responses.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Risk Management and Strategy systems, and third-party service providers to operate its digital media platform, which is focused on engaging Gen Z audiences through casual gaming, college sports, and social experiences. As a technology-enabled media company, we recognize the importance of cybersecurity in protecting our digital assets, user engagement data, and strategic operations.

companyName: Brag House Holdings, Inc.

ticker: TBH


text: The Chief Administrative Officer and General Counsel has primary oversight of the IT Department and the cybersecurity program, with a direct reporting relationship to the President and Chief Executive Officer. The Chief Administrative Officer and General Counsel also reports to the Audit Committee at least two times per calendar year and presents a report to the Board at least once per calendar year. These briefings include both educational and program status information, including: Current cybersecurity risks, including qualitative rating based upon underlying objective measures; Status of ongoing cybersecurity initiatives and strategies;

companyName: YORK WATER CO

ticker: YORW


text: Both the Risk and Audit Committees have oversight of the management of our cybersecurity risk. The Audit Committee is responsible for overseeing the CSP under its risk oversight responsibilities as it relates to financial controls. The Risk Committee is responsible for oversight of the management of cybersecurity risk consistent with the Framework.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: The Company has not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations, or financial condition. However, cybersecurity attacks and other threats to the systems, networks, products and services of the Company, its customers and vendors, and other third parties could materially affect the Company in the future. See Item 1A. Risk Factors – Unauthorized disclosure of sensitive or confidential client or customer information, whether through a cyber-attack, other breach of our computer systems or otherwise, could harm our business.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC


text: We rely on technology in all aspects of our business, including information systems of our third -party service providers. The information systems upon which we depend have been, and likely continue to be, subject to cybersecurity threats such as unauthorized access attempts, business email compromise, phishing, malware, ransomware, hacking and other cyberattacks attempting to disrupt operations. Our dependence on these information systems exposes us to cyberattacks, both directly and through cyberattacks impacting our service providers. A significant cybersecurity incident could result in service interruptions, security events, regulatory compliance failures, the inability to protect employee or corporate information or assets against unauthorized access or use, or other operational difficulties. As described above, we continuously monitor our cybersecurity threats, including risks associated with our use of service providers. We are not aware of any risks from cybersecurity threats, or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: PARKERVISION INC

ticker: PRKR


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: QVC INC

ticker: QVCD


text: We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management system and processes. Our cybersecurity risk management processes include the following: a. We leverage the National Institute of Standards and Technology ("NIST") framework to help ensure the Company's risk posture remains in alignment with the Company's overall risk appetite.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Cyber Risk Management and Strategy We have implemented and maintain various information security processes designed to manage cybersecurity risks relating to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and products (Information Systems and Data).

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: Our IT Services Team has a comprehensive incident response plan to address cybersecurity incidents. Our incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to regular review and assessment to ensure that it is effective in protecting our information technology. To date, we believe that our cybersecurity program has been effective in protecting the confidentiality, integrity, and availability of the Company's information. We cannot guarantee that our cybersecurity program will be successful in preventing all cybersecurity incidents. We currently maintain a cyber insurance policy that provides coverage against losses due to cybersecurity events, however, such insurance may not be sufficient in type or amount to cover us against all claims related to security breaches, cyber-attacks and other related breaches.

companyName: YIELD10 BIOSCIENCE, INC.


text: Our cybersecurity risk management process includes assessment of third-party service providers, suppliers and other business partners' ability to maintain compliance with our cybersecurity requirements, including review of Service Organization Control Type 2 ("SOC 2") reports and security controls. Our onboarding process for any third-party service provider includes execution of a business associate agreement that defines the service provider's responsibility to notify us in the event of any known or suspected cyber incident.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: All dollar amounts expressed in thousands, except per share amounts The Head of IT oversees the Company's cybersecurity incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The Head of IT also coordinates with the Company's General Counsel and interim Chief Financial Officer (the "Interim CFO") to assess and manage material risks from cybersecurity threats. The Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: Our CDO has primary responsibility for, and works collaboratively across the Company to implement and maintain, our cybersecurity risk management program designed to protect our information systems from cybersecurity threats and to respond to any cybersecurity incidents in accordance with our incident response plans. Our CDO leads a team, including a number of cybersecurity professionals, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with senior leadership and other teams across the Company. In addition to our extensive in-house cybersecurity capabilities, at times we also engage consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. Our CDO leads the core elements of e.l.f. Beauty's IT and digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology. Our CDO has served in various roles in information technology and cybersecurity leadership for over 25 years, has completed the Harvard Cybersecurity Program and is an active participant in industry consortia focused on data privacy and AI security. Her background includes developing and deploying enterprise risk management frameworks and leading initiatives that integrate AI into cybersecurity and compliance. As a thought leader in the intersection of artificial intelligence and cybersecurity, her expertise aligns with the critical needs of the constantly changing cybersecurity landscape and managing digital risk.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. As further discussed in Item 1A, Risk Factors, if we are unable to protect our information systems against service interruption, misappropriation of data, breaches of security, or other cyber-related attacks, our operations could be disrupted, we may suffer financial losses and our reputation may be damaged.

companyName: Burlington Stores, Inc.

ticker: BURL


text: We and certain of our vendors have experienced cyber-attacks in the past and may experience cyber-attacks in the future. For example, as previously disclosed, we became aware in January 2021 that certain of our information technology systems hosted by a third-party cloud provider were improperly accessed and certain of our source code and the credentials used to access the information technology systems themselves had been compromised. We received a threat to publicly release these materials unless we made a payment, which we have not done. As a result, it is possible that the source code and other information could be publicly disclosed or made available to our competitors. Due to the nature of the source code and the other information that we believe was improperly accessed, we at this time do not believe that any public disclosure will have a material adverse effect on our business or operations, but it is impossible to gauge the precise impact of any such disclosure.

companyName: Ubiquiti Inc.

ticker: UI


text: We engage multiple third-party consultants to advise us on our cybersecurity processes. We conduct external, third-party assessments of our cybersecurity program against specified industry frameworks, as well as annual re-assessments designed to help us understand program changes and the impact that they have had on overall program maturity. Additionally, we engage an external third-party penetration testing entity to measure the effectiveness of our cybersecurity strategy against cybersecurity threats.

companyName: ANSYS INC