text: Internal Cybersecurity Team Our internal cybersecurity team is responsible for the development, implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company. Reporting to our IT Director are experienced personnel who assist with managing cybersecurity objectives and to implement related policies and tools. Also, the internal cybersecurity team conducts periodic security awareness training for employees. In addition to our internal cybersecurity capabilities, we also regularly engage consultants to assist with assessing, identifying, and managing cybersecurity risks and optimize infrastructure.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Periodic assessments of the Global Information Security Program are conducted to ensure it is well-positioned to meet its objective of reducing the threat of known and emerging cybersecurity risks, as well to confirm ongoing compliance with legal and industry best practices and standards. Assessments of the program are continuously conducted by management and by an independent third party at least annually or whenever there is a material change to a business practice that may implicate the security or integrity of records containing personal information, to ensure the continuing suitability, adequacy, and effectiveness of the organization's approach to managing information security. As part of the annual review process, the Company engages external auditors to assess compliance with SOC2/SOC1, SOX, PCI-DSS and HITRUST, in addition to engaging an independent third party to conduct penetration testing and an overall risk assessment. The results of these assessments are reviewed and discussed with senior members of Company management and the Technology and Cybersecurity Committee of the board of directors (the "Technology Committee"), which is comprised of individuals with cybersecurity experience from both a technical and governance perspective. In addition to the processes we have put in place to ensure our information systems and networks continue to evolve and adapt to the ongoing cybersecurity threat environment, we have designed an enterprise security architecture system that deploys layers of security controls to continuously monitor for potential cybersecurity vulnerabilities and threats in a situation when a potential incident does arise. Our systems are configured to generate alerts in the event of any potential breach or intrusion with a team in place to receive and act upon such alerts. Additionally, all WEX systems that store, process, transmit, or could affect the security of confidential data are logged and monitored, with our information security team conducting a daily review of any such systems. If an alert is triggered automatically by our system or as a result of our team's review and a potential cyber or information security incident is detected, the alert will be elevated within the information security incident response team and the CISO will become responsible for informing the crisis management team to facilitate the Company's assessment and response to the potential incident. The crisis management team along with the CISO will inform and coordinate with members of senior management and when appropriate, the Technology Committee, to evaluate the incident and consider potential response actions, including with respect to mitigation and containment actions. Furthermore, the crisis management team, in conjunction with members of senior management will determine whether to engage third parties, including outside counsel, consultants, law enforcement and external forensic firms, to provide support in the assessment of and response to the incident.

companyName: WEX Inc.

ticker: WEX

secItem: Item 1C


text: o Review after closure of each incident and conducting a post-mortem analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the CIRT evaluates competency and any additional training requirements needed.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Strategic engagements of consulting firms and legal advisors to advise the Board and our executive officers regarding the structure and oversight of our cybersecurity risk management program, cyber strategy framework evolution, risk-based assessments, incident response services, and cyber technology;

companyName: TopBuild Corp

ticker: BLD


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we endeavor to: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct annual cybersecurity management and incident training for employees that process sensitive data; • Conduct onboarding and cybersecurity training for all employees on an ongoing basis; • Conduct regular phishing email simulations for all employees; and • Carry cybersecurity risk insurance meant to provide protection against the potential losses arising from a cybersecurity incident.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: The Board of Directors has oversight of cybersecurity risk as part of the ERM program. The Board of Directors is assisted by the Sustainability and Technology Committee, which regularly reviews the cybersecurity program with management and reports to the Board of Directors and the Audit Committee, which assists the Board in its oversight of the Company's ERM program. Cybersecurity reviews by the Sustainability and Technology Committee or the Board of Directors generally occur quarterly, or more frequently as determined to be necessary or advisable. In recent years, the Board added a director who had served as Chief Information Officer for a large public company with sensitive information to assist the Board and Sustainability and Technology Committee in overseeing cybersecurity risks.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: Risk Management Framework Our security program is risk-driven and integrated into our overall enterprise risk management (ERM) process. We emphasize risk detection, which serves as the foundation for risk management-related business decisions. Our ISMS provides the structure for our overall security program and serves to assess, manage, monitor, and minimize our cybersecurity risks. The program includes: • Context of the organization • Leadership • Planning • Support • Operation • Performance evaluation • Improvement

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Our chief information security officer reports to our chief information officer. Our chief information security officer has more than 15 years of experience working in information technology-related roles, a degree in Information Technology, and Global Information Assurance Certifications in Security Essentials (GSEC) as an Intrusion Analyst (GCIA) and as a Penetration Tester (GPEN).

companyName: TEXAS INSTRUMENTS INC

ticker: TXN


text: In the absence of a functional Audit Committee at this time, the full Board of Directors will be responsible to oversight the cybersecurity risks for the Company.

companyName: Oncotelic Therapeutics, Inc.

ticker: OTLC


text: The Executive Vice President, Senior Operations Officer has 34 years of experience in operations and technology with an educational background in Business Administration. In the role of Senior Bank Operations Officer and Executive for the past 23 years, she oversees and works closely with Horizon's technology and security teams to develop and implement robust security measures to protect the Bank's systems, networks, and customer data. The Senior Bank Operations Officer stays current on the latest industry trends and emerging cyber threats through publications, webinars, seminars and banking association training around cyber security. She also collaborates with external agencies, such as law enforcement and regulatory bodies, to address cyber threats and ensure compliance with industry best practices.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer, as discussed below, quarterly to the Information Technology Committee and annually to our board of directors.

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: 2024, we became aware of a cybersecurity incident that involved unauthorized access of an employee's email account. Through this unauthorized access the threat actor was able to fraudulently divert Company funds to its bank account. We detected the incident in a timeframe management believes minimized any financial, operational or reputational risk to the Company. We believe this early detection ultimately resulted in an immaterial impact to our financial results and at no point was our ability to generate revenues disrupted.

companyName: HARROW, INC.

ticker: HROW


text: Our cybersecurity program includes robust risk assessment and identification processes that are aligned with our overall enterprise risk management (ERM) program. As part of the annual integrated risk assessment process, the cybersecurity team works with ERM, internal audit and our legal compliance function to assess and identify cybersecurity and related risks to our business. These risks are then included, as appropriate, in the updated ERM profile, and with top risks being addressed in the cybersecurity yearly plan. As part of that process, we utilize both internal and third-party resources to identify risks. In addition, Internal Audit regularly conducts operational audits of the cybersecurity processes.

companyName: Anywhere Real Estate Group LLC


text: We have a set of Company-wide policies and procedures concerning cybersecurity matters. The Company's Incident Management Policy provides a framework for reporting and managing security incidents affecting the Company's information and business computing devices and systems, losses of information, and information security concerns. All users, including employees, contractors, consultants, suppliers, customers, government, and all personnel affiliated with third parties that perform work for the Company, are obligated to report information security incidents in order to mitigate the consequences and reduce the risk of future breaches of security. Our incident response process consists of several principal steps, including 1) preparation for a cybersecurity incident, 2) detection of a security incident and assignment to the appropriate IT personnel, 3) identification and preservation of evidence, and 4) risk assessment. Depending on the nature and severity of an incident, notifications are escalated to our CEO and the Board of Directors and, if determined to be material, externally. The incident management process is overseen by the Director of IT. The Company maintains additional policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, mobile devices and data destruction. These policies go through an internal review process and are approved by appropriate members of management.

companyName: ASTRONICS CORP

ticker: ATRO


text: A security awareness program that educates our team members on an ongoing basis on internal security policies and secure behaviors.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: We use third-party service providers in various functions throughout our business. We have implemented stringent processes to oversee and manage cybersecurity risk with these third parties, which includes risk assessment activities, enforcement of policies to ensure compliance with current cybersecurity standards and monitoring activities, and periodic review of potential cyber breaches announcements made by the third-party service providers.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: While we have experienced and expect to continue to experience cybersecurity threats and incidents, there have been no material incidents incurred to-date at the Company. However, there can be no guarantee that our policies and procedures will be followed in every instance or that those policies and procedures will be effective. Cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in the risk factors in Part I, Item 1A of this report.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Our information technology function is overseen by our Chief Information Officer ("CIO"), with support from our Cybersecurity Steering Committee, and helps to identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, and conducting vulnerability assessments to identify vulnerabilities.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: We developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across other legal, strategic, operational, and financial risk areas.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: • Cybersecurity incident means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through the Company's information systems that jeopardizes the confidentiality, integrity, or availability of the Company's information systems or any information residing therein. • Cybersecurity threat means any potential unauthorized occurrence on or conducted through the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of the Company's information systems or any information residing therein. • Information systems means electronic information resources, owned, or used by the Company, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the Company's information to maintain or support the registrant's operations.

companyName: Arq, Inc.

ticker: ARQ


text: The Audit Committee regularly reports its activities, including those related to cybersecurity, to the full Board. The full Board also receives briefings from management on our cyber risk management. As part of the Board's continuing education on topics that impact public companies, Board members receive presentations on cybersecurity topics from our CISO or his designee.

companyName: Lemonade, Inc.

ticker: LMND


text: Members of the Board of Directors stay apprised of the rapidly evolving cyber threat landscape and provide guidance to management, as appropriate, to address the effectiveness of our overall data privacy and cybersecurity program. Recently, members of the Board of Directors and Executive Leadership Team participated in a Cybersecurity Exercise led by our CIO and CISO as training, and, to prepare for incident response. The Board of Directors and Audit Committee also receive regular cybersecurity posture reports from an external third-party, and outside counsel advises the Board of Directors on best practices for the Board's oversight of InfoSec and the evolution of that oversight over time. Additionally, two members of our Board of Directors and Audit Committee have experience in InfoSec matters.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: We have established an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. This plan requires the IT Security Manager to determine whether a cybersecurity incident has occurred and to communicate such findings to the Incident Response Team. The IT Security Manager is responsible for communicating incidents to the Vice President - IT and the other members of management as appropriate. If a cybersecurity incident is determined to be material by our management team, they would notify the Board.

companyName: TEAM INC

ticker: TISI


text: Our management and Board of Directors recognize the importance of maintaining the capacity, reliability, and security of our information technology environment and data security infrastructure. Both management and the Board of Directors are actively involved in our enterprise risk management process, which specifically identifies cybersecurity as a key risk to us. To address cybersecurity risk, we have instituted policies, processes, and internal controls aligned with the framework established by the Secure Controls Framework, a meta-framework that reflects the standards of multiple security frameworks including those of the National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO). The focus of our cybersecurity program is to preserve the confidentiality, security, and availability of our systems and data, mitigate cybersecurity threats, and effectively respond to and recover from cybersecurity incidents when they occur.

companyName: ACUITY INC. (DE)

ticker: AYI


text: The Board has delegated responsibility for more detailed oversight of the Company's cybersecurity and information security framework to the Risk Committee of the Board. The CISO and CIO provide updates on the cybersecurity threat environment and the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment to the Risk Committee quarterly and to the full Board at least annually and on an ad hoc basis. Additionally, the Risk Committee also reviews and approves the Cyber Risk Management Program Policy and Information Security Program Policy at least annually. Elevation to a full Board communication and/or interaction would occur upon the initiation of a cyber incident response, or a material compromise of business functionality, customer data or network integrity.

companyName: Bancorp, Inc.

ticker: TBBK


text: SLB faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. SLB has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on SLB’s business, financial condition, results of operations, or cash flows. See “Risk Factors – Business and Operational Risks – Our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, and cash flows.”

companyName: SLB LIMITED/NV

ticker: SLB


text: Cyber Risk Governance The Audit Committee is a sub-committee of our Board of Directors and is delegated to the role of cyber risk oversight for the Company.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: We have not identified material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business and financial condition." and "Technical problems or disruptions that affect either our customers' ability to access our services, or the software, internal applications, database and network systems underlying our services, could damage our reputation and lead to reduced demand for our information, analytics and online marketplace services, lower revenues and increased costs."

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: The Bancorp's CISO is responsible for information security policies and the coordination of information security efforts across the organization. The CISO has over 35 years of diverse experience in information technology management and cybersecurity leadership at Fifth Third and at other large, complex organizations. This prior experience includes leadership of functions for cybersecurity threat management, intelligence, risk mitigation and incident response. The CISO has a Bachelor of Science degree in Computer and Information Science and is a certified Six Sigma Black Belt. The Bancorp's CISO reports to the Chief Information Officer. The CISO also reports directly to the Technology Committee and participates in various management councils and committees. The Bancorp's IT CSRM team monitors that the CISO has appropriate authority to carry out the duties and responsibilities necessary of that position.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: We rely upon technology and information systems to support our mining and business operations globally. These systems may be susceptible to cybersecurity risks including, but not limited to, external attackers, malware, viruses, and unauthorized access to our IT systems. Cybersecurity and the secure adoption of emerging technologies, including artificial intelligence ("AI"), remain strategic priorities for Newmont. We continuously invest and develop our cybersecurity controls and processes to address these threats and reduce the risk of future breaches and cyber attacks. Risk associated with a cybersecurity incident, impacting our operations, has been integrated into our overall global risk management system and process. Our Board of Directors and management team oversee these risks as part of our enterprise risk management framework, ensuring alignment with our business objectives and regulatory obligations.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: Our GPO: • is supported by a network of data protection officers, attorneys and privacy specialists across Unisys; • manages privacy management software that is used across Unisys to facilitate privacy impact assessments, record data processing activities and map data flows; and • follows evolving privacy regulatory guidance for countries in which it operates and adjusts standards, as necessary.

companyName: UNISYS CORP

ticker: UIS


text: We also have processes to oversee and identify cybersecurity risks from cybersecurity threats associated with our use of suppliers, vendors, third-party service providers and IT support companies. These include the use of cybersecurity questionnaires, the performance of contract reviews to ensure IT-related compliance and the mitigation of identified information security risks and the sharing of our information security and acceptable use policy.

companyName: DORIAN LPG LTD.

ticker: LPG


text: Further, our information security program is designed to provide oversight of third parties who store, process or have access to sensitive Company or customer data, and we require similar levels of protection from third-party service providers as are required for the Company. We maintain supplier risk assessment processes to identify risks associated with third-party service providers.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, members of the ITC, along with other lines of business heads, report to the management Enterprise Risk Management Committee (the "ERMC"), which in turn reports to the Board Audit and Risk Committee quarterly. The ERMC consists of the Company's Chief Risk Officer, Chairman & CEO, President, Chief Financial Officer, Treasurer, Chief Compliance Officer, Chief Technology Officer, Chief Strategic Operations Officer and Chief Credit Officer. In addition, the Company's Chief Technology Officer attends Company Board of Directors meetings and provides an information technology ("IT") report at each meeting.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Our Senior Director of Technology boasts over ten years of experience spearheading technology operations for organizations with a keen emphasis on cybersecurity. His extensive background has been pivotal in shaping our cybersecurity policies, implementing our cybersecurity program, and supervising information governance and compliance measures.

companyName: Acreage Holdings, Inc.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including CFO/CEO. The CFO/CEO work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: Our Board of Directors has approved management committees including the TSC, which focuses on technology impact, and the CROC, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. The TSC is chaired by management within the Company and includes the Chief Risk Officer, Director of Information Security and Director of Technology Management as well as other key departmental managers throughout the entire company. These committees meet at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan to facilitate timely informing and monitoring efforts. The Director of Information Security reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the CROC on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: HOME BANCORP, INC.

ticker: HBCP


text: In cybersecurity or privacy incidents, the probable frequency and magnitude of loss are evaluated by the triage team. The incidents are categorized as either high- or low-level severity and communicated to the CIO and Chief Executive Officer and the Senior Vice President, General Counsel and Corporate Secretary ("Legal Counsel"), at which time a determination is made on any additional communication requirements. Our Board of Directors is notified of high-level severity incidents. Our approach to incidents generally includes a process of investigation, learning, and subsequent improvement. In addition, we believe cyber insurance is a key mechanism for supporting and managing critical cyber incidents. Aligning the policy involves a thorough review of our protection layers and processes.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Cybersecurity is a critical component of Synovus' business and the advancement of our strategies, including our growth initiatives. As a financial institution, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries that target the financial services industry specifically. Our clients, vendors, and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these stakeholders could materially adversely affect our operations, performance, and results of operations. As such, we maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to these cybersecurity threats and risks. Our program is fully integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and client-facing products and services.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: With Westlake's support, we maintain a comprehensive approach to cybersecurity and data protection, based on a risk-based, defense-in-depth strategy. Westlake follows industry standard cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework to design, assess and update our cybersecurity strategy, controls and processes. Westlake regularly assesses industry best practices and standards and endeavors to implement them in its efforts to manage cybersecurity risk for us. The focus is on protecting our highest-value information assets, which include manufacturing systems, financial systems, and confidential, personal, and private information.

companyName: Westlake Chemical Partners LP

ticker: WLKP


text: The cybersecurity subcommittee receives periodic reports from the Senior Director for IT or the CTO concerning the Company's risk profile, including significant cybersecurity threats and risk and the processes the Company has implemented to address them. The cybersecurity subcommittee of the audit committee also receives/has access to various reports, summaries and presentations related to cybersecurity threats, risk and mitigation.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers may be subject to security risk assessments at the time of onboarding, contract renewal, or upon detection of an increase in risk profile, according to our vendor security review process. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties.

companyName: Skillz Inc.

ticker: SKLZ


text: Separately and as previously disclosed, Umpqua Bank experienced an on-premises MOVEit security incident in May 2023. The on-premises instance was removed from the network immediately and decommissioned, and the unauthorized actor did not obtain any customer information or Umpqua Bank data. An independent forensics firm was engaged and confirmed our assessment of this on-premises MOVEit incident, which did not cause any interruption of business operations. We do not currently believe the on-premises incident will have a material adverse effect on our business, operations, or financial results.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including those associated with the use of third-party services and service providers. This framework includes steps for assessing a cybersecurity threat's severity and source, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and threat mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. To prevent and detect material cybersecurity incidents, our framework further includes, among other things, ongoing security awareness training for employees, regular cybersecurity risk and vulnerability assessments, and mechanisms to detect and monitor unusual network activity. We recognize the complex and evolving nature of cybersecurity threats and engage with various third-party service providers, including cybersecurity assessors and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size. Additionally, we maintain industry-standard cybersecurity insurance to provide further protection against cybersecurity risk.

companyName: EVOLUTION PETROLEUM CORP

ticker: EPM


text: Our CTO leads our global technology strategy and multiplatform operations and has over 15 years of experience working in technology positions at large media companies. The senior members of our information security team have extensive experience in technology and information security.

companyName: Paramount Global


text: We review cybersecurity risk as part of our overall enterprise risk management program with a goal of ensuring that cybersecurity risk management remains a top priority in our business strategy and operations.

companyName: T Stamp Inc

ticker: IDAI


text: Our Board of Directors (the "Board") has delegated responsibility for enterprise risk management, including cybersecurity risk oversight, to our Audit Committee (the "Committee"). The Committee receives quarterly information security updates from our Chief Financial Officer and Vice President of Information Technology ("VP of IT"). The Committee in turn reports to the full Board regarding its activities, including those related to cybersecurity, on at least a bi-annual basis.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: Overview of Cybersecurity Risk Management and Strategy Our cybersecurity risk identification, assessment and management process is a critical part of our overall enterprise risk management ("ERM") system. Within our ERM system, we adhere to our Information Security Management Policy ("ISM Policy") which is aimed at providing guidelines to monitor, review and continually improve our Information Security Management System ("ISMS"). Our ISMS is informed by ISO/IEC 27001:2022 standards and is operated based on an action model that identifies information security missions and objectives, including improvement measures to achieve continuous optimization. Our Cybersecurity Incident Response Plan ("CIRP") is a critical component of our cybersecurity incident identification and management process, which, along with our incident response team, is designed to guide our response to potential cybersecurity incidents effectively and efficiently. Our ISM Policy, ISMS and CIRP are all internal processes we use to assess, identify and manage material risks from cybersecurity threats.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: In addition, we engage in a broad range of activities to secure and protect the data that we obtain through our business operations including, but not limited to: • continued development and enhancement of our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access; • security and business controls to appropriately limit access to and use of personal information, including adaptive and multifactor authentication; • comprehensive data protections, including encryption, to facilitate the secure storage, use, and transmission of sensitive data; • annual privacy/data security training to all employees and contractors and regular awareness and testing activities year-round regarding social engineering threats, such as phishing, for employees; • background checks on our employees, as permitted; • due diligence requirements and controls for third parties (e.g., service providers) with access to sensitive data throughout the lifecycle of the relationship; and • a dedicated global information security team that partners with all technology groups to monitor, prioritize, and remediate risks to the enterprise.

companyName: H&R BLOCK INC

ticker: HRB


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Sprout Social, Inc.

ticker: SPT


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.

companyName: Blue Owl Real Estate Net Lease Trust


text: DECEMBER 31, 2023 As we are fully externally advised, we are reliant on our external advisor's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our advisor's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.

companyName: New York REIT Liquidating LLC


text: We rely on software, hardware, and network systems, including cloud-based technology, that are either developed by us or licensed from or maintained by third parties to maintain operations. In the ordinary course of our business, we collect and utilize proprietary and customer information and data. We utilize systems designed to protect customer information and prevent fraudulent transactions and other security breaches. We rely on third-party software products to secure our credit card transactions.

companyName: MEDIFAST INC

ticker: MED


text: We expect to utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We intend to utilize well-known cloud-based technologies and service providers, such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.

companyName: bowmo, Inc.


text: At UCT, cybersecurity risk management forms a critical component of UCT's overall enterprise risk management program. Led by our Chief Information Security Officer ("CISO"), who has over 20 years of experience in information security and technology leadership, and under the oversight of our Board of Directors, we have implemented processes to assess, identify, manage and report cybersecurity risks, which, together with our broader business continuity plans, aim to not only address immediate response to cybersecurity incidents but also ensure swift restoration of critical systems and the maintenance of core business functions in the face of digital threats. Our senior management and information technology ("IT") security teams devote considerable time and resources to conducting regular evaluations of our systems and implementing necessary enhancements to our security infrastructure to better guard against evolving cybersecurity threats.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: The cybersecurity program is managed by our CIO and our Senior Director of Cybersecurity and Network Operations and reviewed and monitored by executive management, with oversight from the Board. Our CIO has significant expertise and more than 30 years of experience in information technology and cybersecurity including cloud technologies and reports to our Executive Vice President & Chief Legal Officer. Our Senior Director of Cybersecurity and Network Operations has more than two decades of experience in the fields of information technology and cybersecurity and holds cybersecurity certifications, including the Certified Information Systems Security Professional, Certified Cloud Security Professional, and GIAC Information Security Professional certifications. The CIO and Senior Director of Cybersecurity and Network Operations meet regularly with each other and members of their team to discuss cybersecurity threats, capabilities and program strategy. We have built in incident workflows that automatically provide notifications and escalate cybersecurity incidents. During an incident, the CIO acts as the incident commander and the Senior Director of Cybersecurity and Network Operations acts as operations section chief, working together to provider supervision over incident response.

companyName: Midstream Co LLC


text: In order to drive continuous improvement, we have implemented an internal security and data protection maturity assessment for our client delivery teams. In addition, we commission an independent external assessment of our cybersecurity maturity annually. The results of these assessments are shared with the Board, key senior leadership, and the Infosec leadership team to develop and inform our strategy for the coming year. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. While we have experienced cybersecurity events, to date, we are not aware that we have experienced a material cybersecurity incident.

companyName: Thoughtworks Holding, Inc.


text: Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the interim CSO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews our cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. In addition to regular updates to the audit committee, we have protocols by which we escalate certain cybersecurity incidents and, where appropriate, report on them in a timely manner to the board and the audit committee.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: We utilize dedicated internal and external cybersecurity personnel to focus on assessing, detecting, identifying, managing, preventing and responding to cybersecurity threats and incidents. Our approach to cybersecurity incorporates a layered portfolio of technology controls, including strategic partnerships for our cybersecurity platforms, documented policies and procedures, periodic end user training, including cybersecurity awareness training for employees and certain contractors, and dedicated resources to manage and monitor the evolving threat landscape, including through the gathering of actionable threat intelligence. We maintain and periodically evaluate and, as needed, update our information security policy and an incident response plan, which describes the processes we use to prepare for, detect, respond to and recover from a cybersecurity incident, including processes to assess severity, escalate, contain, investigate and remediate an incident, as well as to comply with potentially applicable legal and disclosure obligations.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: e.we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; f.we conduct pre-engagement and targeted recurring reviews of the security controls and security-compliance posture of applicable third-party service providers; g.all employees are required to complete periodic trainings that cover security and privacy best practices and company policies;

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Our Information Security Program is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). Our CISO oversees the third-party consultants who help assess our security controls and penetration testing previously described. The CTO provides oversight, leadership and direction for data risks, technology risks and information security. Our CISO leads the Cybersecurity organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: Cybersecurity matters are overseen by our board of directors, which meets quarterly to review the measures implemented by the Company to identify and mitigate cybersecurity risks. Our Chief Information Security Officer ("CISO") reports to the board quarterly on cybersecurity matters. These reports and presentations are prepared with input from members of our senior management team responsible for overseeing the company's cybersecurity risk management, including the Chief Technology Officer, Chief Financial Officer, Chief Legal Officer, Chief People Officer, and SVP, Engineering. In addition, cybersecurity risks and associated mitigation efforts are assessed by senior management as part of the enterprise risk assessment process that includes reporting to and discussion with the audit committee and our board of directors. In addition, cybersecurity controls have been integrated into our disclosure controls and procedures.

companyName: MAGNITE, INC.

ticker: MGNI


text: The Company has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data (Information Systems and Data).

companyName: MACROGENICS INC

ticker: MGNX


text: Our cybersecurity risk assessment and management processes are implemented by certain Company management, including our Compliance Officer and Vice President of Engineering and Operations, both of whom have previously served in management roles at other public biotechnology companies.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Operating System and Application Security: We have a vulnerability scanning tool in place that scans all information assets monthly to report any vulnerabilities. Those reports are analyzed by system administrators for appropriate mitigating actions. We have implemented an email security tool that sanitizes all incoming emails for malicious content, attachments, or links.

companyName: International Seaways, Inc.

ticker: INSW


text: The Head of IT meets with the Chief Legal Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from the Company's third-party technology providers, as appropriate. In addition, the Head of IT has regular meetings with our managed security service provider to inform our cyber risk management processes and reporting to management. The Head of IT, working with the Chief Legal Officer, provides periodic reports on cybersecurity and information technology matters to the audit committee, which is responsible for reviewing and overseeing the Company's risk management process, including cybersecurity risks.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: Our Board of Directors does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Our Audit Committee provides direct oversight over cybersecurity risk, and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives updates from management twice a year regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Cybersecurity incidents have increased in number and severity and it is expected that these trends will continue. Techniques used in cyber-attacks evolve frequently, are increasingly sophisticated, and may not be recognized until launched. Cyber-attacks can originate from a wide variety of sources, including both internal and external sources, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to broadly disrupt the operations of financial institutions. We may be unable to fully prevent cyber-attacks due to the inability to anticipate, detect, or recognize threats to our systems, or to implement effective preventative measures against all breaches. In addition, we do not have control over the cybersecurity of the systems of our customers, counterparty, and third-party service providers.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Audit Committee of the Board of Directors (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include the Company's risk assessment and risk management policies.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: Impacts from Cybersecurity Threats As of the date of this report, though we and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity risk management program and governance structure, we cannot guarantee that a significant cyberattack will not occur. A successful attack on our operational and information technology or other business systems could have significant consequences to the business. See "Part I, Item 1A, Risk Factors," for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Because of the size and scope of Prudential's business, Prudential, the Manager, their affiliates and the Company are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Risks Related to Market Events and Regulatory Developments— Cybersecurity and data protection risks could result in the loss of data, exposure of confidential information, interruptions in our business, and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations." for a discussion of such risks.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: Yubo Beijing uses third-party service providers to assist it from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. Yubo Beijing also uses third-party service providers to perform a variety of functions throughout its business, such as application providers and hosting companies. Yubo Beijing manages cybersecurity risks associated with its use of these providers by reviewing their security assessments and applicable reports.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: Our Board is actively engaged in the oversight of our information security program. In 2025 the Board created an Information Security Committee, which is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material information security issues and risks. Our CTIO provides reports, at least quarterly, to the Information Security Committee regarding information security programs, key enterprise information security initiatives, and significant cybersecurity and privacy incidents. Our CTIO is part of the risk management function, reporting directly to our Chief Executive Officer ("CEO").

companyName: Kearny Financial Corp.

ticker: KRNY


text: We routinely undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents, including an annual risk review, policy reviews and revisions. In addition, we maintain business continuity, contingency, and recovery plans for use in the event of a cybersecurity incident by the administering of local and cloud based back up of files. and emails.

companyName: ENvue Medical, Inc.

ticker: FEED


text: We continue to evaluate internal systems, processes, and controls to identify potential cybersecurity vulnerabilities and mitigate potential loss from cyber-attacks. We have implemented a monitoring and detection system to help identify cybersecurity incidents. All incidents are escalated to our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management. We also require our employees to receive annual cybersecurity awareness training. We perform cybersecurity tabletop exercises and implement post-incident "lessons learned" to enhance our response. We provide our system users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: The Sponsor recognizes the importance of managing cybersecurity risks to protect its business operations, clients, and stakeholders. The Sponsor has implemented a comprehensive Cybersecurity Policies and Procedures Plan applicable to the Funds, which outlines the Sponsor's approach to identifying, assessing, and mitigating cybersecurity threats and vulnerabilities in alignment with industry standards and best practices.

companyName: Amplify Commodity Trust

ticker: BDRY


text: Our operations are highly dependent on the information systems and technology of Blue Owl, the indirect affiliate of our Adviser, which has implemented a cybersecurity management program. Below are details Blue Owl has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blue Owl Real Estate Net Lease Trust


text: Further, our assessment and management of material risks from cybersecurity threats are an important element of our overall enterprise risk management program and included in our annual enterprise risk assessment which we provide to senior management and the Board.

companyName: Zoom Communications, Inc.

ticker: ZM


text: The Board of Directors is ultimately responsible for our Information Security Program, and it has delegated to the Audit Committee primary oversight responsibility for this information security and technology (including cybersecurity) risk management program. The Audit Committee periodically reviews the program and information security, cybersecurity, and technology risks. At least quarterly, the Audit Committee reviews and discusses with management and our senior information officers the Information Security Program, including the structure and function of the program and any enhancements made to the program as a result of third-party reviews or an identified security risk. The Audit Committee regularly briefs the Board on these discussions. In addition, our Incident Response Policy outlines procedures pursuant to which cybersecurity incidents or risks are escalated within the Company, and, as applicable, timely reported to the Audit Committee and Board.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at technical and executive levels and incorporate external resources and advisors, as needed. In an effort to detect and defend against cyber threats, the Company provides its employee-partners with various cybersecurity and data protection training programs and requires annual security awareness training participation. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and these programs educate employee-partners on the importance of reporting all incidents promptly to the IT Security team. We also require employee-partners in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: CINTAS CORP

ticker: CTAS


text: Our board of directors, in coordination with the Audit Committee, oversees Holley's enterprise risk management activities, including the management of risks from cybersecurity threats. Our Audit Committee directly oversees our cybersecurity program. The Audit Committee receives updates, biannually or more frequently, as needed, from management on the Company's cyber risk management processes, including reports on risk trends related to cybersecurity. If a cybersecurity incident is identified, the information technology team, in conjunction with management, will take appropriate actions to mitigate and remediate the incident in a timely manner. Management will determine the materiality of the incident and inform the Audit Committee, as appropriate.

companyName: Holley Inc.

ticker: HLLY


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee receives timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the Audit Committee discusses our approach to cybersecurity risk management with our Chief Information Officer ("CIO"). The Audit Committee makes regular reports to the full Board regarding our information technology risks. Each member of our Audit Committee is experienced in the area of information security, either as a result of their professional history, current responsibilities in overseeing processes and controls in this area at the Company, or both. The Audit Committee may discuss such processes and controls with our internal accounting and security teams and independent registered public accounting firm.

companyName: POTBELLY CORP

ticker: PBPB


text: We have robust logging systems in place to monitor our systems, and our response plan includes promptly identifying the executives and parties affected Governance: Our governance includes routing all production changes through approval processes and testing in the test environment before implementation in production.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: The Company's cybersecurity program is designed to protect and preserve the confidentiality, integrity, and availability of our networks and systems, as well as information that we own or is in our care, through a risk-based approach. The Company's program may leverage aspects of U.S. National Institute for Standards and Technology standards and other applicable industry frameworks. Our cybersecurity program identifies, assesses, and manages material risks from cybersecurity threats by implementing robust practices, processes, and technologies designed to protect our data digital assets and data.

companyName: Strategic Education, Inc.

ticker: STRA


text: The Company has embraced the NIST-CSF as a blueprint for its cybersecurity program since 2018. This framework's key domains guide the establishment and continuous improvement of processes to identify, assess, and manage cyber risks and threats. The Company's controls are routinely monitored by its Security Operations Center. Its cybersecurity program, security posture, incident response, and security awareness training are tested by an external party to evaluate their effectiveness and maturity rating.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: The Company maintains an enterprise-wide risk management ("ERM") process to identify, assess and monitor risks that are or may become material to our business. Our ERM process includes participation by senior management, other leaders, and employees across the business in surveys and discussions about the risk environment with certain members of senior management and management level leaders meeting quarterly to discuss the Company's top risks as identified through our ERM process.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the section titled " Risk Factors—If our security measures are compromised, or if our platform is subject to attacks that degrade or deny the ability of users to access our content, users may curtail or stop use of our platform. "

companyName: YELP INC

ticker: YELP


text: As of December 31, 2024, cybersecurity risks have not materially affected our business, strategy, results of operations, or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents. For additional information about our cybersecurity risks, see Item 1A, "Risk Factors - AbbVie depends on information technology and a failure of, or significant disruption to, those systems could have a material adverse effect on AbbVie's business."

companyName: AbbVie Inc.

ticker: ABBV


text: In December 2022, the Company learned of a cybersecurity threat to its information technology system ("IT System"), and that certain data, including personal data of employees, had been extracted from the Company's IT System. Upon learning of the cybersecurity threat, the Company launched an investigation and undertook prompt action, including employing containment protocols to mitigate the impact of the threat, engaging third-party information technology cyber security and forensics experts and special legal counsel, and utilizing additional security measures to help safeguard the integrity of its IT System's infrastructure and the data contained therein. The Company has not identified any material damage suffered from the incident.

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: The Audit Committee receives presentations at least annually regarding our enterprise risk management program, including reports from our Vice President of Internal Audit and our head of Information Technology, on information security matters (such as cybersecurity risk and developments), as well as the steps management takes to monitor and control such exposures.

companyName: Vista Outdoor Inc.


text: Our Board of Directors provides oversight of our cybersecurity program through quarterly and annual risk review and cybersecurity reporting. On a quarterly basis, cybersecurity risk and mitigation strategies are reviewed as part of our business risk management group's reporting to the Board of Directors, which includes the reporting of significant business risks, including cybersecurity mitigation strategies employed to manage these risks, and a review of any emerging risks. Annually, our Vice President of IT provides an overview of our cybersecurity program to the Board of Directors, including a review of key strategies, emerging risks and a summary of key performance indicators. In addition, annually the Board of Directors reviews the results of our penetration and vulnerability testing.

companyName: Otter Tail Corp

ticker: OTTR


text: Our cybersecurity risk management strategy relies on input from management, including our Chief Operating Officer, Mr. Stephen Hill, to help us understand cybersecurity risks, establish priorities and determine the scope and details of our cybersecurity program and to implement it. Mr. Hill has held senior management positions at numerous pharmaceutical companies for over a decade. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy and for communicating key priorities to employees and other stakeholders. Our cybersecurity incident response and vulnerability management processes involve management, who participate in our disclosure controls and procedures.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: We maintain and continue to expand our investment in the development of our information security management system ("ISMS"). Our ISMS leverages a risk-based approach and is informed by industry standard guidance, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. A material cyber-attack on Company systems, distribution partners and their key operating systems, or any other third-party partners or vendors and their key operating systems may interrupt the ability to operate the Company's business, damage the Company's reputation, or result in monetary damages. The development of the ISMS is focused on the protections of the confidentiality, integrity, and availability of the Company's information system infrastructure as well as the data in the Company's care, custody and control. The Company engages third parties to evaluate certain aspects of the ISMS, provide threat intelligence, and perform vulnerability assessments and other services as needed.

companyName: TUCOWS INC /PA/

ticker: TCX


text: At least quarterly, the Audit Committee, Chief Executive Officer and senior finance and legal management, evaluate, review and discuss with the COO our cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, recent cybersecurity incidents at other companies and the emerging threat landscape. Significant cybersecurity incidents are reviewed and discussed with the Audit Committee and senior finance and legal management as required by our cybersecurity incident response plan.

companyName: Torrid Holdings Inc.

ticker: CURV


text: • Employee training: Information security is an integral component of our employee training program. Training includes efforts to maintain security awareness among employees at all times by means of company-wide communications of cybersecurity risks or incidents affecting third parties, internal testing and similar efforts.

companyName: RENASANT CORP

ticker: RNST


text: The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate and monitor the risks faced by the Company, including cybersecurity risk.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Our CIO has 20 years of experience in the information technology industry, including engagement with cybersecurity strategy and oversight. Our CIO reports directly to our Chief Executive Officer.

companyName: Owens Corning

ticker: OC


text: Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends, including those related to the use of AI as both a threat and a defense mechanism. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.

companyName: EPLUS INC

ticker: PLUS


text: Our CISO leads the strategy, engineering, and operations of cybersecurity across the company, and reports to the EVP of Cloud + AI. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Before joining Microsoft, our CISO served in a prior Chief Technology Officer role as well as in senior leadership, engineering, and operational roles within multiple organizations. In addition to the Board's oversight of cybersecurity risk, to support the CISO, we have established a Cybersecurity Governance Council ("CGC") charged with overseeing initiatives that safeguard Microsoft's computing environments, products, and services. The CGC is comprised of an executive-level team of Deputy CISOs with cybersecurity backgrounds and expertise relevant to their roles. The CGC responsibilities include approving our enterprise security risk assessment process and results, determining the appropriate cybersecurity risk level and mitigations, reviewing the NIST CSF alignment, and supporting compliance with cybersecurity regulations. Our cybersecurity efforts are supported directly by Microsoft's security and threat intelligence experts and our employees across the company, all of whom receive cybersecurity awareness training and education and are expected to support our efforts.

companyName: MICROSOFT CORP

ticker: MSFT


text: The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence prior to engagement on and ongoing risk-based periodic audits of our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: PINTEREST, INC.

ticker: PINS


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including an incident response policy, vulnerability management policy, disaster recovery and business continuity plan, vendor risk management program, programs for incident detection and response, encrypting certain data, network security controls, data segregation, asset management tracking and disposal, penetration testing, employee training, access controls, physical security controls, systems monitoring, a dedicated cybersecurity officer; and cybersecurity insurance.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The underlying processes and controls of our program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). The program is subject to annual risk assessment by a third-party consultant to ensure compliance with the standards of the NIST CSF and to identify, quantify and categorize material cyber risks. In addition, with the assistance of the consultant we have developed a risk mitigation plan to address cyber risks, and where necessary, remediate potential vulnerabilities.

companyName: Sachem Capital Corp.

ticker: SACH


text: The Company's Disclosure Committee, with the assistance of its Cybersecurity Subcommittee, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Interim CFO and CAO, General Counsel, Vice President of Investor Relations and Communications, Corporate Controller, and Financial Reporting Manager. The Cybersecurity Subcommittee of the Company's Disclosure Committee is comprised of, among others, the Company's Interim CFO and CAO, SVP IT, General Counsel, Corporate Controller, and IRT Security Officer.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: To date, the Company has not experienced a cybersecurity incident that has materially impacted its business strategy, results of operations, or financial condition. Despite the Company's efforts, there can be no assurance that its cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting its systems and information. The Company faces risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" in this document for further discussion of the risks associated with an interruption or breach in the Company's information systems or infrastructure.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and third-party manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider (such as by reviewing certain vendor's security assessments or reports) and impose contractual obligations related to cybersecurity on the provider.

companyName: Xometry, Inc.

ticker: XMTR


text: Jeffrey Klein. Mr. Klein, age 49, was appointed President of Popeyes U.S. & Canada in March 2024. From June 2022 to March 2024, Mr. Klein held the position of Chief Marketing Officer of Popeyes U.S. & Canada. Prior to joining RBI, he served as Chief Marketing Officer of Little Caesars Pizza from April 2019 to June 2022. Prior to that, Mr. Klein spent 15 years leading CPG brand marketing for various brands at PepsiCo where he held several roles during his tenure, including Senior Vice President and Chief Marketing Officer of PepsiCo Foodservice.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We maintain collection, storage, and access controls of personal, proprietary, and confidential information, focusing on protecting trade secrets, intellectual property, clinical trial data, third-party information, and employee data.

companyName: Ingevity Corp

ticker: NGVT


text: To support management's role in assessing and managing cybersecurity threats, our cybersecurity team conducts periodic security review meetings designed to identify vulnerabilities and review remediation efforts. In addition, we maintain a comprehensive Security Response Policy, which sets forth various actions to be taken in the event of a suspected security breach, including incident verification by our cybersecurity team, notification of our ERM committee, and mitigation and remediation actions. We also have a range of controls designed to identify, assess, mitigate, manage, and thereby seek to minimize the cybersecurity risks associated with the engagement of third-party service providers.

companyName: Hamilton Lane INC

ticker: HLNE


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; offsite backup storage of critical systems and information; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training;

companyName: CADIZ INC

ticker: CDZI


text: The Company has also established processes to oversee and identify cybersecurity risks from third-party service providers. Third-party service providers (including suppliers and business partners) are required to have security policies, standards and procedures that meet or exceed the information security guidelines as specified in the Security Program. The Company has an established third-party due diligence program to ensure vendors meet the Company's expectations as agreed to in their contract. Roles, responsibilities and expectations for service providers and other third parties are communicated and documented through contracts (and other associated agreements) and monitored through oversight as part of the Company's Third-Party Risk Management Program.

companyName: M&T BANK CORP

ticker: MTB


text: Monitoring Cybersecurity Incidents The ISO and other information security staff utilizes vendor relationships and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The ISO provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Our management team meets with our information technology service provider periodically to discuss then-current cybersecurity issues, which may include efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including threat intelligence and other information obtained from governmental, public or private sources, and external service providers engaged by us; and alerts and reports produced by security tools deployed in the information technology environment including a spear-phishing report.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: Our cybersecurity risk management processes have been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. We identify our enterprise risks through each member of our management team, along with counsel from our internal auditors and attorneys and we present an assessment of our enterprise risks to our board of directors on an annual basis. Our information technology management plays an integral part in the identification and communication of cybersecurity risks to our management team.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: eHealth maintains an Office of the Chief Information Security Officer ("CISO"), who reports to our Chief Digital Officer ("CDO"). Our CISO focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure. eHealth also has a Privacy Officer who advises the company on privacy-related laws and regulations, provides guidance on privacy compliance, drives privacy policy, creates, and oversees the privacy program.

companyName: eHealth, Inc.

ticker: EHTH


text: The audit committee receives periodic reports from our CIO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: Considering the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and testing our risk management systems. These engagements allow us to leverage specialized knowledge and insights, including leading industry practices, to better inform our cybersecurity strategies and processes. Our collaboration with these third parties includes audits, threat assessments, and consultations to enhance our security measures.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: To help identify and manage cybersecurity risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts us and our technology systems. We conduct diligence of significant third-party service providers who will have access to our data or information technology systems and incorporate certain cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.

companyName: CoreCivic, Inc.

ticker: CXW


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cybersecurity incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.

companyName: StepStone Group Inc.

ticker: STEP


text: The Company maintains arrangements with third party information infrastructure (IT) vendors—including "cloud computing" vendors. The Company has processes designed to manage cybersecurity risks arising from our use of such vendors, including conducting risk assessments prior to integration into the Company's networks and additional assessments prior to contract renewals or extensions. Cybersecurity measures employed by significant third-party service providers are also assessed prior to introduction into our environment. The Company also commissions third-party risk assessments of certain IT vendors to identify and evaluate risks associated with each third party and to minimize potential disruptions and liabilities that may arise from external partnerships. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.

companyName: Strategic Education, Inc.

ticker: STRA


text: We use a combination of people, processes, and technologies to monitor and mitigate cybersecurity threats, which include end-point monitoring, vulnerability assessments and penetration testing. We leverage a variety of cybersecurity services, tools and techniques designed to identify and assess cybersecurity threats and take preemptive action to reduce and, where possible, eliminate the potential impacts.

companyName: STEELCASE INC


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities, and we investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: We have experienced, and may in the future experience, whether directly or through our supply chain partners, cybersecurity incidents. While prior cybersecurity incidents have not had a material impact on the Company, future cybersecurity incidents, including breaches, could have a material impact on our business, operations and reputation. For additional information about the Company's cybersecurity risks, please refer to "Technology Risks" in Item 1A of this Annual Report on Form 10-K.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: As of December 31, 2024, and 2023, GlobalX remains proud to report that it has no t encountered any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, the Company.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: Any disruption, compromise, or breach of our network systems or infrastructure due to a cybersecurity threat or incident could adversely affect our operations, services, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our customers' and partners' proprietary information, which may include personally identifiable information. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction and harm to our relationships with corporate partners.

companyName: Hoth Therapeutics, Inc.

ticker: HOTH


text: We use third-party service providers to perform a variety of functions throughout our business, such as email and hosting providers, CROs and CMOs. We have certain vendor management processes that we may use as appropriate to manage cybersecurity risks associated with our use of these providers. These processes may include the imposition of information security contractual obligations on vendors, as well as quality control elements for certain vendors. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: ACELYRIN, Inc.


text: As of the date of this report, we are not aware of any material risks resulting from any previously reported cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. We discuss the risks relating to cybersecurity threats and their potential impact on our business more fully in "Risk Factors" in Part I, Item 1A herein. Continuously enhancing our information security controls to meet the evolving cybersecurity threat landscape remains a top priority.

companyName: Vimeo, Inc.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. On a quarterly basis, our Audit Committee receives updates from our CIO with respect to the status of our cybersecurity initiatives to strengthen our cybersecurity risk management. In addition, our CISO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Our Audit Committee discusses the potential impact of cybersecurity risks on our financial condition, results of operations or our reputation. Our Audit Committee periodically reports to the Board regarding its activities, including those related to cybersecurity. The Board also periodically receives briefings from management on our cyber risk management program. Board members receive periodic presentations on cybersecurity topics from our CISO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: The Chief Information Security Officer ("CISO") is the Chemours executive principally responsible for managing and maintaining the Program, is accountable for managing risk, ensuring that the organization's security posture is aligned with its business objectives, and providing timely updates to senior management on such efforts. The CISO reports to the Chief Information Officer. The current CISO has more than seven years with Chemours and over 25 years of total cyber and information security experience with multiple companies across both the private and public sector in CISO and other information security roles.

companyName: Chemours Co

ticker: CC


text: Markel Group Board Oversight The Markel Group Board of Directors oversees Markel Group's risk management framework on an enterprise-wide basis, which includes cybersecurity risks. Periodic reports are provided to the Markel Group Board of Directors by members of management which, among other things, seek to systematically identify the principal risks facing our businesses and the manner in which such risks are addressed. For cybersecurity, this includes a review of the cybersecurity program and its governance, active and planned initiatives, protection and prevention matters, detection and response measures, and the threat landscape.

companyName: MARKEL GROUP INC.

ticker: MKL


text: Board's Role in Oversight Our full Board oversees our cyber risk management program, and includes cybersecurity as part of the assessment of the Company's overall Enterprise Risk Management program. At least twice per year, and more frequently, if necessary, our CIO updates our Board on the Company's cyber risk profile and the steps taken by management to mitigate those risks. In the event of a material cybersecurity incident, the Board would receive prompt and timely information regarding the incident, as well as ongoing updates regarding such incident until it has been addressed. Cybersecurity-related risks are included in the Enterprise Risk Management committee's evaluation of top risks to the enterprise, which are also presented to the Board and executive management twice per year.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.

companyName: T Series Middle Market Loan Fund LLC


text: The Chief Administrative Officer is responsible for the appointment of the Information Security Officer. The Information Security Officer serves as the focal point for the information security program and is responsible and accountable for its implementation and monitoring, and management of the Information Security team. The current Information Security Officer has over a decade of experience in the cyber security field, including critical roles in security operations, security governance, risk, and compliance, and cyber threat intelligence. They have multiple industry leading certifications, including nine Global Information Assurance Certifications ("GIAC"), Certified Information Systems Security Professional ("CISSP") from the International Information System Security Certification Consortium ("ISC2") and a Master of Engineering in Cybersecurity Policy and Compliance.

companyName: Merchants Bancorp

ticker: MBIN


text: The Company is a shell company with no business operations. Our sole business activity has been to seek a merger with a suitable operating company.

companyName: Signature Holdings Corp


text: As a global company, we are also committed to respecting individual privacy and complying with applicable data privacy laws throughout the world, such as the European Union's General Data Protection Regulation ("GDPR"), UK Data Protection Act and the California Consumer Privacy Act ("CCPA"). To that end, to protect our data, including personal data, we maintain comprehensive information security and data privacy programs, with a balanced portfolio of defenses designed to prevent, detect and respond to cybersecurity threats.

companyName: WORLD KINECT CORP

ticker: WKC


text: GLDM does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of GLDM. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. GLDM also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor detailing the Sponsor's cybersecurity review processes, any potential risks and any incidents which could impact GLDM. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.

companyName: World Gold Trust

ticker: GLDM


text: All employees are required to take annual cybersecurity awareness training. The Company conducts monthly phishing campaigns in which employees are expected to report suspicious emails. If employees click on the training phishing email, they are provided immediate feedback on how to avoid phishing, in addition to being required to complete additional training. Quarterly security awareness is provided to all employees and focuses on cyber and physical security best practices.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: The CSIRT maintains overall responsibility for addressing and resolving incidents that occur at Monroe Capital. The CSIRT: (i) coordinates efforts in response to incidents; (ii) manages the assessment, recovery, and remediation efforts related to incidents; (iii) manages communication, both internal and external, regarding incidents; and (iv) manages notification of regulatory bodies as required by law in response to incidents.

companyName: MONROE CAPITAL Corp

ticker: MRCC