text: PGE considers cybersecurity to be a top enterprise risk in PGE's enterprise risk management program, and manages the risk by adhering to established security policies and governance, identifying risk through risk assessments, utilizing technology to provide a layered security approach, controlling access, robust security awareness training and conducting resiliency exercises. As a utility with critical infrastructure, both cyber and physical security will continue to be an important consideration for the Company's future strategy and operations. The Company maintains a cybersecurity program, overseen by a cross-functional executive committee, that uses a risk-based methodology to support the security of its systems. Additional information about cybersecurity risks and the potential impact to the Company can be found in Item 1A.—"Risk Factors." The Company has not experienced a material cybersecurity incident.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed. For more detailed information about our company's specific cybersecurity risks, please refer to the risk factor titled "Cybersecurity or other data security incidents could harm our business, expose us to liability and cause reputational damage" in Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: Nextpower Inc.

ticker: NXT

secItem: Item 1C


text: We have engaged third-party experts to assist us in monitoring and managing our cybersecurity process. Furthermore, we monitor cybersecurity threats at certain of our third-party vendors on a regular basis. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the company, including our business strategy, results of operations, or financial condition. We have discussed cybersecurity risks that may affect the company in Item 1A, "Risk Factors," under the headings, "The necessity for ongoing physical and technological security has resulted, and may continue to result, in increased operating costs," "Water Utility Services rely on information technology and systems that are key to business operations. A system malfunction, security breach, cyber-attacks or other disruption that compromises our information and expose us to liability and adversely affect business operations. In addition, noncompliance could expose us to liability and adversely affect business operations," and "We may not be able to maintain adequate insurance coverage at reasonable costs, or at all, to cover all losses incurred in our operations."

companyName: H2O AMERICA

ticker: HTO


text: Like many large, global companies, CommScope relies heavily on digital technology to conduct operations and engage with our customers and business partners. As our engagements become more complex and interdependent, threats from security incidents like ransomware and data breaches increase. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing our data and the data customers and other stakeholders entrust to us a top priority. Our Board of Directors (Board), through our Audit Committee, and our management team are actively involved in the oversight of our Enterprise Risk Management (ERM) program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. We have made investments in resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We believe that risks from prior cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that any such incidents will not materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding the risks associated with cybersecurity incidents, see Item 1A. "Risk Factors."

companyName: Vistance Networks, Inc.

ticker: VISN


text: We are ISO/IEC 27001:2022 certified and the ISO Information Security Risk Management Standard is used as a reference guide for our risk management approach. We have a designated Chief Information Security Officer (CISO) who has primary responsibility for managing our cybersecurity risks. Our CISO has more than 28 years of experience in Information Security and holds a master's degree in Information Technology. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO is assisted by a team of Information Security Officers (ISOs) and a third-party consultant who has expertise in cybersecurity, information security risk management, and information systems audit and holds various certifications including, CISA, CISM, HITRUST Certified Common Security Framework Practitioner, QSA, and CSP.

companyName: INNODATA INC

ticker: INOD


text: To protect against the risk of cybersecurity threats, we evaluate new and existing third-party service providers through a risk assessment process designed to assess their capabilities for maintaining appropriate safeguards over the information provided to them. Where applicable, we require our third-party service providers, by contract, to implement and maintain such safeguards and periodically evaluate these providers and the continued adequacy of their safeguards based on the risk they present. In addition, we may engage third-party service providers to perform functions associated with our information security program and the assessment of security threats. The third-party risk assessments and reports are shared with internal teams and IT leadership to assist with ongoing risk mitigation actions.

companyName: PRA GROUP INC

ticker: PRAA


text: Our third-party risk management program is integrated into our Information Security Program within our ERM Program. The policies, procedures and practices applicable to the cybersecurity components of the third-party risk management program were developed and are maintained consistent with the FFEIC IT Examination Handbook, as well as guidance from our prudential regulators. We perform a risk assessment, including cyber threats, associated with use of third-party vendors and exercise appropriate due diligence before entering into a vendor arrangement. We also engage a third party to actively monitor our cybersecurity risks and gather threat intelligence of select vendors and their products and services. Additionally, we conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. Our contracts governing third party engagements require certain security and privacy protections where applicable. All third parties with access to our information systems must review and acknowledge our Acceptable Use Policy before access is granted.

companyName: S&T BANCORP INC

ticker: STBA


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management team, including our executive staff, IT team, and Global Director of IT who reports to our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We offer cybersecurity training programs for employees at all levels and departments.

companyName: Identiv, Inc.

ticker: INVE


text: Our information security program is managed by a senior director who reports to the Chief Information Officer (CIO), providing routine security program updates and briefings. The current senior director has more than 25 years of experience in cybersecurity, federal law enforcement, and cyber investigations, while possessing the required subject matter expertise, skills, experience, and industry certifications expected of an individual assigned to these duties. Our information security team, which includes the CIO and senior director, as well as additional professionals, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. Our CIO provides regular updates to our Chief Executive Officer and other members of management. The Audit Committee of the Board of Directors is responsible for oversight of the Company's cybersecurity risk exposure and the CIO provides reports to the Audit Committee, as well as the full Board of Directors, at least annually. The reports to management and our Board include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. For the year ended December 31, 2023, we are not aware of any material cybersecurity incidents.

companyName: INSMED Inc

ticker: INSM


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Financial Officer, and the Vice President of Operational Engineering. Those members of management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes members of management reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: evidence related to system modifications; and with external specialists to aid in the ongoing evaluation of existing policies and procedures. Establishment of a dedicated cybersecurity governance committee; of cybersecurity incident response procedures and formats; Conducting penetration tests on a quarterly basis; Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system;

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As of the date of this Annual Report, the majority of the Company's IT systems are computed using leading secure cloud platforms.

companyName: Viewbix Inc.

ticker: VBIX


text: Head of IT reviews Cyber Security risk on a regular basis as identified by our external IT service provider based on the current threat landscape and threat intelligence publicly available. These are with a background and understanding of ISO 27002 controls and IASME Cyber Essentials.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: The CISO provides periodic reports to the executive risk management committee and the board-level risk committees of the Company and the Bank, as well as the cross-functional management steering committee that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation and remediation of cybersecurity incidents. Our CISO also provides reports to our Chief Executive Officer and other members of our senior management, as appropriate. The Chief Risk Officer and the board-level risk committees of the Company and the Bank report to the full board of directors on key cybersecurity risk management topics, as appropriate.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: In the event that a cybersecurity threat or incident is identified, the Chief Technology Officer and the security team would work closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provide information to senior management, with the goal of timely assessing such incidents, determining applicable disclosure requirements and communicating with the Chair of the Audit Committee regarding any significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, associates and stakeholders, and continues to provide regular reports until such incidents are concluded. The above framework is designed to track and allow team members to monitor each incident throughout its lifecycle to ensure the Company is informed about and following cybersecurity incidents as they are mitigated and remediated. Post-incident reviews would also be performed to determine if there are any additional controls that may feasibly be implemented to prevent recurrence.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: Our IT Security team is led by our CISO. Our CISO reports to our CIO who, in turn, reports to our Executive Chairman and Chief Executive Officer. Our CISO has 40 years of IT experience, with over 20 of those focused on IT security functions and strategies. Collectively, the other members of our IT Security Team have decades of relevant education and experience and maintain a wide range of industry certifications. We provide cybersecurity training for our IT Security Team upon joining the IT Security Team, on an annual basis and more frequently when necessary.

companyName: EASTMAN KODAK CO

ticker: KODK


text: In the normal course of business, we may collect and store customer information, and certain sensitive company information, including proprietary and confidential business information.

companyName: NYIAX, INC.


text: We will develop and implement a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program will be integrated into our overall enterprise risk management program and includes a cybersecurity incident response plan.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: We conduct regular technical risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We also conduct periodic programmatic risk assessments including identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: ESS Tech, Inc.

ticker: GWH


text: We also recognize that third-parties that provide information systems we use can be subject to cybersecurity incidents that could impact us. To mitigate third party risk, we maintain a Vendor Integrity Code, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors determined to present a higher risk are also subject to additional diligence such as questionnaires, inquiries, and review of System and Organization Controls (SOC) 1 and 2 reports, when relevant.

companyName: American Homes 4 Rent

ticker: AMH


text: Leadership for our cybersecurity program is provided by our Chief Information Officer, or CIO, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO is a seasoned executive with over 25 years of experience in Information Technology, including 18 years in cybersecurity leadership roles specifically within the energy industry. The CIO's expertise is further underscored by prior service on the American Gas Association's Distribution Natural Gas Information Sharing and Analysis Center and as a former President of Oregon's InfraGard chapter, a partnership between the FBI and the private sector. Notably, the CIO also serves as our Chief Information Security Officer and is supported by a cybersecurity team with many years of experience led by a Vice President of Cybersecurity.

companyName: Venture Global, Inc.

ticker: VG


text: Prevention and Preparation We identify and address information security risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements, which provides multiple, redundant defensive measures and prescribes actions to take in case a security control fails or a vulnerability is exploited. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for security operations center (SOC) services, penetration testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our information technology environment.

companyName: Public Storage

ticker: PSA


text: We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their estimated impact on the Company's risk environment.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we have experienced, and we may in the future experience, threats to and breaches of our data and systems, including ransomware attacks and phishing attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "We are dependent on information technology in our operations, and the failure of such technology may adversely affect our business. Security breaches of our information technology systems, including cyber-attacks, ransomware attacks, or use of malware or phishing or other malicious techniques by threat actors, have in the past and could in the future lead to liability, impact our operations, or damage our reputation and financial results" in Item 1A, "Risk Factors".

companyName: PLUG POWER INC

ticker: PLUG


text: Before engaging third-party service providers to whom we grant access to our information technology systems, we may review their information security programs, depending on the feasibility of such review and our assessment of the level of risk the third-party service provider poses to our business operations and our information technology and financial reporting systems. We determine risk level based on a set of internally developed criteria. We do not, however, review the information security programs of all third-party vendors. Where feasible, we also conduct periodic reviews (typically annual) of certain third-party service providers, particularly service providers of financial, financial reporting and accounting systems, depending on our assessment of the level of risk to our business operations and our information technology and financial reporting systems.

companyName: Cronos Group Inc.

ticker: CRON


text: Identifying and assessing cybersecurity risks is integrated into our enterprise risk management. As part of our risk management program, we continuously assess risks from third parties, including vendors, suppliers, and other business partners associated with our use of third-party service providers. We have implemented incident response and breach management processes that include the following steps: mobilizing the right stakeholders and containing the attack, maintaining trust with all affected stakeholders and understanding the attack, recovering the most critical business operations, and learning from the attack. We also conduct tabletop exercises to, among other things, align activities and expectations in connection with our incident response processes, discuss strategic questions, and review third party recommendations.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: The Board, as part of its general oversight function, participate in discussions with senior management and amongst themselves regarding cybersecurity risks. With the assistance of the Company's most senior IT manager, we review annually the cyber and data security risks of our overall IT environment. We assess cybersecurity risk and the overall environment which includes devices, IT systems, websites, social media accounts, manufacturing technology/systems and suppliers/vendors. The oversight from the Board includes material changes to policies, procedures, employee training and elements of the overall environment, as necessary, senior management provides an update on emerging cyber threats. The Board has access, as requested, to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical service providers, suppliers, and vendors.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: Our Board of Directors has overall oversight responsibility for our cybersecurity model. Our overarching cybersecurity programs are under the direction of the Eos leadership team, and directly supported by the efforts of the ITD. The ITD, led by the Director of ITD, reports to the Chief Financial Officer ("CFO") of the Company. With over 7 years of experience leading cybersecurity teams and programs, our Director of ITD leverages a combination of internal and external systems and security experts to keep our CFO informed of potential risks to the organization. The Director of ITD is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs and systems. Management reports material cybersecurity risks to our Board of Directors on an annual basis. In addition, our management follows a risk-based escalation process to notify the Board of Directors outside of the regular reporting cycle when they identify an emerging risk or material issue.

companyName: Eos Energy Enterprises, Inc.

ticker: EOSE


text: Our Head of IT is primarily responsible to assess and manage our material risks from cybersecurity threats and has prior work experience in cybersecurity, holds relevant degrees, and has current industry recognized cybersecurity certifications.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: In anticipation and in response to such risks, we have a comprehensive information security/cybersecurity program, including controls and procedures designed to safeguard and maintain the integrity of our IT systems, and prevent and detect unauthorized access to our IT systems by threats or bad actors, both internally and externally. Due to the ever-changing nature of cyber threats, we seek to proactively mitigate risks through prevention and preparation. We take a risk-based approach and identify new and continuing threats to our information systems that could potentially compromise their secure and efficient operation. Our cybersecurity program is fully integrated into our overall risk management framework and is regularly evaluated by internal and external experts.

companyName: NMI Holdings, Inc.

ticker: NMIH


text: The risk management framework includes guidelines for identifying and estimating the cost of protective measures to eliminate or reduce the security risks to an acceptable level.

companyName: CXApp Inc.

ticker: CXAI


text: The board of directors of our general partner and executive leadership team at the Partnership are committed to investing the attention and resources necessary to maintain the privacy, security and integrity of our information, systems and networks and enhance the Partnership's resiliency against cyber threats. To assist in these efforts, the board of directors of our general partner has assigned a number of cybersecurity related responsibilities to its standing committees while retaining overall responsibility for the oversight of Delek's cybersecurity activities.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Our policies and approach to cybersecurity include several key elements: • Continuous Monitoring and Defense: We work to protect our environments and products from threats through multi-layered defenses. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Operations Center provides comprehensive, around the clock, cyber threat detection and response capabilities. • Third-Party Software Risk Assessment: W e complete security audits on all third-party platforms prior to selection. • Incident Response Plan: Our Incident Response Plan includes the investigation steps and notifications required on all actual and suspected information security incidences • Cybersecurity Training Programs: Our training program is multi-faceted and focused on awareness of new techniques that threat actors utilize both in the corporate environment, as well as their personal lives. Employees undergo regular training on information security best practices, including interactive training to confirm understanding and test employee skills. • Compliance Policy: Mandatory compliance with all cybersecurity programs, including applicable legislative and regulatory requirements. • Third-Party Cybersecurity Plan Assessment: We regularly engage with cybersecurity professionals in reviewing our cybersecurity plan.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: Our cybersecurity team, which includes both our employees and those of our managed services providers, is comprised of people with various functional areas of responsibility, including personnel from our information technology, operations, legal, compliance, risk management, communications, incident command center, security, human resources, finance and internal audit teams. We have contracted with a Security Operations Center service provider and a Managed Detect and Response service provider; both of which are staffed 24 hours a day to provide monitoring and active protection support for our cybersecurity risk management program. Our senior security leadership team has significant experience with data security, and members have served in various roles within our security program.

companyName: Ardent Health, Inc.

ticker: ARDT


text: Magnolia engages third party consultants to benchmark its internal cybersecurity posture against the NIST CSF, perform external penetration tests, and facilitate simulated cyberattacks and incident responses. Additionally, third party service providers perform continuous managed detection and response activities. Security due diligence is performed when considering purchasing third party software and utilizing third party hosted providers. This evaluation considers the security architecture, confidentiality and criticality of data, as well as methods and practices used by third party vendors to encrypt, transmit, store, back up, and recover data.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: Management's Role in Risk Oversight Our information security team includes our Executive Vice President, Chief Digital & Technology Officer and our Head of Technology Risk, Compliance and Chief Information Security Officer. Our Executive Vice President, Chief Digital and Technology Officer has over 20 years of information technology experience. Prior to Zoetis, he was the VP, Information Technology at Biogen, overseeing all aspects of Infrastructure, IT Operations, and Enterprise Architecture globally and held various corporate leadership roles at Eli Lilly and Company, including Head of IT Infrastructure and Enabling Functions. He holds a bachelor's degree in information systems and a master of business administration degree. Our Head of Technology Risk, Compliance and Chief Information Security Officer has 37 years of experience in Life Sciences Information Technology, including over 20 years of experience in information security and holds bachelor's degrees in computer science and biology.

companyName: Zoetis Inc.

ticker: ZTS


text: Finally, as disclosed above, our incident management procedures are designed to notify and actively involve our Audit Committee and Board of Directors whenever there is a reasonable risk of a material cybersecurity incident.

companyName: ZUORA INC


text: Role of the Board Our Board of Directors provides oversight with respect to our risk assessment and risk management activities, including our cybersecurity risk management strategy. While our Board has primary responsibility for risk oversight, the Board's standing committees support the Board by addressing various risks within their respective areas of responsibility.

companyName: Wendy's Co

ticker: WEN


text: Management's Role and Expertise The CTO and the Cybersecurity Steering Committee are responsible for overseeing and executing our cybersecurity strategy, including the assessment and management of cybersecurity risks. The CTO reports directly to the CFO and maintains communication with the Audit Committee, the Board of Directors and the Cybersecurity Steering Committee with respect to information security and cybersecurity matters.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: The Program is evaluated on an ongoing basis to address the evolving cyber threat landscape and to comply with applicable legal and regulatory obligations. See "Business—Regulation—U.S. Regulation—Privacy and Cybersecurity" and Business—Regulation—International Regulation—Privacy and Cybersecurity for further discussion. Control adequacy and design are reviewed periodically, and periodic audits assist in identifying areas for continued focus, improvement and/or inclusion, and are designed to provide assurance that controls are appropriately designed and operating effectively. Additionally, our Internal Audit group performs testing of Corebridge's control environment, including the Program.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: The Board has designated that the Risk Management Committee is responsible for overseeing cybersecurity risks, and our Senior Vice President of Information Technology and Supply Chain Management ("SVP of IT & SCM") reports to the Risk Management Committee on cybersecurity matters. The SVP of IT & SCM has over 20 years of experience in IT systems, IT infrastructure, fab and manufacturing environments, and site disaster recovery and compliance. Our IT administration team supports the SVP of IT & SCM and has deep working knowledge of the NIST cybersecurity framework, the Cybersecurity Maturity Model Certification (CMMC) program, ISO 27001, and extensive experience in systems and technology infrastructure management. In addition, our Director of Corporate Security reports to our Chief Risk and Compliance Officer and is involved in the ongoing compliance with relevant cybersecurity regulations, including with regard to cybersecurity monitoring and incident response (as noted below). The Director of Corporate Security has over 20 years of experience in quality systems, semiconductor manufacturing, and industrial security.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: We engage consultants in connection with our risk assessment processes to help us design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We manage third party service providers using a risk-based approach intended to determine if the relevant third parties have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our business.

companyName: Marqeta, Inc.

ticker: MQ


text: We place high importance on conducting tabletop exercises to test and enhance our readiness for cybersecurity incidents. These exercises involve our Crisis Management Team, which includes representatives from executive management, legal, information technology, finance, operations, and marketing. The Crisis Management Team focuses on analyzing the scope, impact, and root cause of simulated incidents, while the marketing and legal departments, along with a team of executives, plan the messaging to customers, employees and other stakeholders deemed necessary or advisable in the circumstances. For compliance readiness, we monitor the legal and regulatory landscape associated with cybersecurity incidents. These exercises and activities provide valuable insights to improve transparency, messaging, response protocols, stakeholder confidence and organizational resilience in the event of a cyber crisis.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes. For example, we regularly engage independent third parties for penetration testing and evaluation of our various security compliance standards. We also conduct internal assessments of our cybersecurity risk management program. We review and update our cybersecurity policies, standards and procedures as needed, to account for changes in the threat and operational landscapes, as well as in response to legal and regulatory developments. Further, we require mandatory training for all employees and contractors on our cybersecurity and privacy policies. We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.

companyName: SentinelOne, Inc.

ticker: S


text: Our Chief Technology Officer and members of the Engineering Security team typically meet twice annually with the Audit Committee to review the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them. The Chair of the Audit Committee, in turn, reports to the full Board.

companyName: YELP INC

ticker: YELP


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced cybersecurity incidents that have materially affected us, our business strategy, our results of operations or our financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding risks from cybersecurity threats, please refer to "Item 1A. Risk Factors" of this annual report on Form 10-K.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: Our Board considers cybersecurity risk as part of its risk oversight function. In connection with the Audit Committee's oversight of the Company's risk management, the Audit Committee reviews with management, as appropriate, the Company's cybersecurity risk exposure and the steps management has taken to monitor or mitigate such exposure, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes. In addition, management will update the Audit Committee and the full Board, as necessary, regarding cybersecurity incidents that we may experience.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: Our cybersecurity program is designed based on the concepts of control maturity and control efficacy. For control maturity, our cybersecurity program is aligned to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and is assessed annually by an independent third party against our yearly control maturity targets in the context of current cyber threat and industry trends. The NIST CSF assessment results are used to validate the progress made against the current year maturity targets, inform the program's strategic priorities and establish maturity targets for the following year. These assessment results are provided to our Board of Directors on an annual basis.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Westwood's Board is responsible for overseeing the effective execution of our overall cybersecurity programs. Along with management, our Board reviews our cybersecurity efforts and programs and is informed of cybersecurity risks primarily through discussions with management, educational sessions and exercises.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: In the event of a cybersecurity incident, these leaders engage the Incident Response Team (IRT), a team comprised of senior- and executive-level leaders from various business units, legal and finance departments, and the corporate communications team, to help manage and maintain business operations throughout the incident and any recovery period. The IRT is responsible for reporting details of the incident and its impact on the business to the Executive Leadership Team (ELT) and making key recommendations for managing operations. The ELT is responsible for advising the Board of any material cybersecurity incidents. Both the ELT and the IRT have participated in formal cybersecurity response training.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: The Company has in the past experienced cybersecurity incidents of varying degrees involving our technology infrastructure and information systems. While these incidents have at times resulted in some disruptions to our business operations, as of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "The compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents, data security breaches, other security problems, design defects, information system failures or other events could have a material negative impact on our business" in Part I, Item 1A., Risk Factors of this Annual Report on Form 10-K.

companyName: Sandisk Corp

ticker: SNDK


text: The Company has implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We regularly communicate these and other pertinent security issues or compliance across our organization. Additionally, Exela has mandatory security awareness training addressing cybersecurity, privacy and confidential information.

companyName: Exela Technologies, Inc.

ticker: XELA


text: We have strategically integrated cybersecurity risk management into our broader ERM program to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. Our strategy includes regular employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: TENNANT CO

ticker: TNC


text: The Compliance Committee receives periodic reports from management regarding cybersecurity and privacy risks, any material updates thereto and a summary of any cybersecurity and/or privacy events or incidents that have occurred, in each case, since the most recent update provided to the Compliance Committee. The Compliance Committee reports to the full Board regarding its activities, including those related to cybersecurity and privacy. In addition, at least once every twelve months and promptly after the occurrence of certain specified cybersecurity/data privacy incidents, the Board and our Interim Chief Executive Officer receive the written Cybersecurity and Privacy Program materials, which include the results of the most recent cybersecurity and privacy risk assessment and any evaluations thereof or updates thereto (collectively, the "Reporting Materials"). On an annual basis, management also leads the Board through a comprehensive review of the Reporting Materials, including, among other things, a review of the identified material cybersecurity and privacy risk exposures and the safeguards implemented to control such risk exposures.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Executive Officer. The CISO has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, counterparts at third-party vendors and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 20 years of experience in the fields of information technology and cybersecurity and maintains multiple professional cybersecurity certifications.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer ("CIO"). The CIO has been responsible for cybersecurity for over ten years across multiple organizations, leading enterprise security programs, business continuity planning, cybersecurity response planning, and the implementation of the National Institute of Standards and Technology (NIST) cybersecurity framework. In the CIO's most recent role, the CIO established and led a dedicated Cybersecurity Department, developing comprehensive security strategies, implementing cutting-edge cybersecurity tools, and designing response plans to support the entire company. At our Company, the CIO continues to drive proactive risk management, regulatory compliance, and a culture of cybersecurity awareness.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Our Board is ultimately responsible for the risk oversight of the Company, including cybersecurity and privacy risks. Our Board has delegated day-to-day responsibility for oversight of cybersecurity risks to the Cyber Committee. The Cyber Committee is composed of members of our Board who have diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Pursuant to its charter, our Cyber Committee: • assists our Board in fulfilling its risk oversight responsibilities with respect to the protection of the Company's assets, including confidential, proprietary and personal information, reputation and goodwill in all forms; • supervises and monitors the soundness of our cybersecurity and data protection strategies and practices; • oversees and monitors our material compliance with applicable information security, privacy and data protection laws, industry standards and contractual requirements; • promotes and furthers the integrity, adoption and coordination of our data security processes across the Company to help ensure that data and system security is a Company-wide business objective and priority; and • oversees our cybersecurity and data protection performance and the overall implementation of our cybersecurity and data protection strategy.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: The Company mitigates risks from cybersecurity incidents using a multifaceted approach which includes, but is not limited to: establishing information security policies, implementing information protection processes and technologies, assessing cybersecurity risk, implementing cybersecurity training, monitoring our information technology systems, and collaborating with public and private organizations on best practices. The Company is currently in material compliance with relevant information privacy and cybersecurity governmental standards with which it is required to comply.

companyName: DT Midstream, Inc.

ticker: DTM


text: Our Vice President of Information Technology leads an IT Security Team and has overall responsibility for the security program. The IT Security Team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes. The IT Security Team works across the enterprise to assess and prepare our employees and third parties to manage cybersecurity risks and detect, investigate and respond to cybersecurity incidents. Our Vice President of Information Technology has 25 years of information technology experience, including 22 years of leadership responsibility, and has substantial operational experience with cybersecurity policy, protection, incident response, and governance. We also utilize a third-party cybersecurity advisor to act as our CISO, supporting the Vice President of Information Technology. This fractional executive has extensive experience as a CISO and cybersecurity executive with over 25 years of expertise in designing, building, and operating transformational information security programs, is a Certified Information Systems Security Professional, and holds a Master of Science in Strategic Intelligence.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: Reporting to the Audit Committee: Management provides an annual comprehensive report to the Audit Committee on the Company's cybersecurity posture, incident response activities and risk mitigation efforts.

companyName: DallasNews Corp


text: We use a third-party sub-contractor to manage all Information Technology (IT) issues, including protection against, detection, and response to cyberattacks.

companyName: Microbot Medical Inc.

ticker: MBOT


text: The Bank retains external consultants to assist in the development and monitoring of those processes for identifying, assessing, and managing cybersecurity incidents and threat risks. The Bank's Cybersecurity Incident Response Plan also facilitates management of third-party cybersecurity incidents. As part of the Bank's vendor management process, the Bank undertakes due diligence of third-party systems that the Bank will interact with, including risk profiling and classification, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of all service providers in accordance with a risk profile classification. The Bank reviews performance, technologies utilized by vendors, and promotes escalation of any unsatisfactory reviews as part of Bank's continuous assessment of its vendors.

companyName: Federal Home Loan Bank of San Francisco


text: The Company has an incident response program in place that is designed to enable a coordinated response to mitigate the impact of cyber-attacks, recover from the attack and provide for the prompt escalation of certain cybersecurity incidents to management, including for decisions regarding timely reporting of material incidents in accordance with SEC rules.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: There have been no material cybersecurity threats and incidents incurred to-date at the Company. However, there can be no guarantee that our policies and procedures will be followed in every instance or that those policies and procedures will be effective. Cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in the risk factors in Part I, Item 1A of this report.

companyName: DecisionPoint Systems, Inc.


text: The Company relies on our IT systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. The Company has implemented processes to manage the cybersecurity risks associated with its use of third-party service providers, including processes during the contract review phase by both Information Security and Legal teams providing contractual safeguards as well as ongoing monitoring of third-party service providers for incidents that may affect the Company. To date, no cybersecurity incidents have had such a material adverse effect on us, and we are not presently aware of any cybersecurity threats that are reasonably likely to materially affect us.

companyName: ModivCare Inc

ticker: MODVQ


text: Our management team, including our CDIO, CISO, Vice President and Deputy General Counsel – Chief Privacy and Data Protection Officer and additional members of the ECRG are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, our management team has extensive information technology experience, as well as cybersecurity incident response, compliance, oversight, and program management experience. Additionally, certain leaders and personnel within the cybersecurity organization hold industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.

companyName: AMERICAN AIRLINES, INC.


text: The Audit Committee of the Board is responsible for oversight of cybersecurity risks. The Audit Committee and Board periodically and as necessary receive updates from the Cybersecurity team or external experts regarding the activities and performance of the cybersecurity risk management program, current and potential risks and threats, and other relevant cybersecurity topics.

companyName: Canoo Inc.

ticker: GOEVQ


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A – Risk Factors, which should be read in conjunction with the foregoing information.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: Blue Owl Capital Corp II


text: Our management team, including the Vice President of IT and the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of IT, Randy Jepsen, oversees infrastructure, procurement, development, and IT support, with over 25 years of experience in the IT industry and 19 years at Smith Douglas and The SMART Builder Solutions designing and enhancing internal enterprise applications. Our Chief Financial Officer, Russell Devendorf, previously oversaw the information technology and risk management functions of a publicly traded homebuilder from 2008 to 2017, overseeing the company's cybersecurity program and the implementation of an incident response plan and cybersecurity insurance. As a result, our management team's cybersecurity experience includes previous combined experience of almost 50 years managing and otherwise engaged with IT and internal audit functions at public companies overseeing the development and strengthening of cybersecurity programs inclusive of training, risk assessments, and formal policies and procedures.

companyName: Smith Douglas Homes Corp.

ticker: SDHC


text: The identification of risks is a multifaceted process that involves a range of activities. This includes monitoring of guidance issued by regulatory authorities, participating in professional forums, conducting both internal and external audits, collaborating with third-party services, reviewing policies, and adhering to best practice frameworks including Federal Financial Institutions Examination Council ("FFIEC") guidance and information security requirements established in the Gramm-Leach Bliley Act, along with other relevant state laws and agency regulations. For instance, as part of our risk management framework, we regularly assess phishing threats targeting employees, conduct simulated attack exercises, and implement enhanced endpoint detection solutions. Furthermore, we emphasize the importance of maintaining a collaborative relationship with third-party service providers/vendors. This collaborative approach enhances our risk management capabilities and ensures a shared commitment to maintaining a secure information environment.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: Management and the Board are evaluating and intend to implement further cybersecurity-related measures, including, without limitation, developing a more robust internal policy framework, incident response plan, crisis management planning, third-party vendor assessments, and contractual obligations for third parties that the Company engages with.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Based on our board of directors' and management's review of risks associated with cybersecurity threats, we have concluded that, to date, there have been no cybersecurity threats which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the risk factor titled "Cybersecurity risks, including those involving network security breaches, services interruptions and other incidents affecting the confidentiality, integrity or availability of our data and systems, could result in the compromise of confidential data or critical data systems and give rise to potential harm to our patients, remediation and other expenses, expose us to liability under HIPAA, breach notification laws, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations."

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: CRH also maintains a Company-wide incident response function centered in our Group Information Security (GIS) team, led by the CISO. GIS responds to potential incidents across CRH in accordance with predetermined severity classifications. In line with CRH's Cybersecurity Incident Escalation Standard and supporting guidelines and procedural documentation, incidents that are deemed potentially material to the Company and/or which may lead to the exposure of confidential or sensitive data are immediately escalated to GIS for review and, as necessary, mitigation and remediation actions are taken. GIS and the CISO also review regular attestation reports that are required to be prepared by CRH's operating companies and business units regarding cybersecurity incidents that did not meet the threshold for immediate escalation.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Risk and Compliance Protocols Annually, our Compliance Department conducts risk assessments to determine the effectiveness of controls outlined in the Information Systems Security Program. This is in alignment with the requirements of the Gramm-Leach Bliley Act ("GLBA") and the Federal Financial Institutions Examination Council ("FFIEC") guidance on securing customer information. Key focus areas include: Evaluating technology systems used for the collection, processing, and storage of information. Assessing both internal and external cybersecurity threats and vulnerabilities. Ensuring that penetration and controls testing are conducted regularly. Gauging the potential impact of compromised information or systems. Assessing the effectiveness of governance structures in managing information security risks.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data. Our security controls include: Network traffic monitoring and filtering Usage of Sentinelone Proofpoint to protect against phishing attacks OS/Hardware hardening OS/Software hardening Physical barriers to hardware access

companyName: Dalrada Technology Group, Inc.

ticker: DHTI


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, which to date have not had a material impact on our financial condition or results of operations. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors "Our internal computer systems, or those used by any CROs or other third -party contractors or consultants we may engage, may fail or suffer security breaches."

companyName: Clene Inc.

ticker: CLNN


text: The ISO is responsible for reporting, at least annually, to the Board of Directors on the status of the ISP, including overall compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.


text: We anticipate that we will continue to evaluate and address as needed our cybersecurity risk management, policies, structure, strategies and governance to meet our needs.

companyName: EchoStar CORP

ticker: SATS


text: The Audit Committee will receive regular updates from management on the state of cybersecurity risks facing the company. This will include briefings on any significant cyber incidents and ongoing risk management efforts. These updates will enable the Audit Committee to provide informed reports on cybersecurity matters to the full Board.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: To serve as an additional protection from outside threats, we also seek to prepare our employees and contractors about cybersecurity risks through training, simulated phishing exercises and awareness campaigns. We have implemented software and processes to help identify and evaluate risks from cybersecurity threats associated with third-party service vendors. In the event of a cybersecurity incident deemed to have a moderate or higher business impact, we have an incident response plan to notify senior leadership and to address how to contain the incident, mitigate the impact, and restore normal operations efficiently.

companyName: TALOS ENERGY INC.

ticker: TALO


text: Ms. Schmidt and other members of Company management provide an annual cybersecurity report to our Board of Directors and quarterly reports to our Audit Committee, which reports include a review of potential threats and vulnerabilities.

companyName: US Foods Holding Corp.

ticker: USFD


text: Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: The firm's senior executive team, inclusive of the CEO, CFO, COOs, CAO and Legal, are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: A management team, including the Chief Financial Officer (CFO), head of information technology (Head of IT), General Counsel/Chief Compliance Officer, and Deputy General Counsel (together, the Cybersecurity Management Team) responsible for managing and communicating priorities related to (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: Arteris, Inc.

ticker: AIP


text: Our CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has served in this role for the past five years, has more than 25 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations and developing cybersecurity strategy, and is a Certified Information Systems Security Professional ("CISSP").

companyName: Evolent Health, Inc.

ticker: EVH


text: In addition, the cybersecurity team, managed by the SVP of Enterprise Strategy and Execution, receives oversight and executive support through engagement with our ERC. The ERC is responsible for the holistic evaluation, management, and supervision of our aggregate risk profile. Similarly, the team works with our ERM function on business alignment and procuring cybersecurity insurance.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: The CISO and VPAA meet with our IT Executive Committee, comprised of all of our executive officers, on at least a quarterly basis to oversee our cybersecurity and IT framework and more frequently in the event of significant cybersecurity developments. Our management team, including our CISO, updates the Audit Committee and Board of Directors at least twice a year with respect to key developments and updates relating to our cybersecurity and IT infrastructure and the overall threat environment, including recent and emerging trends. With respect to any significant cybersecurity events or incidents, the VPAA, along with the IT Executive Committee, reports to the Board of Directors promptly in accordance with our escalation protocols, as appropriate, depending on the nature of the events.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: Our Chief Financial Officer reviews the efficacy of our cybersecurity program from time to time as circumstances make appropriate and annually in connection with the annual audit of the Company's financial statements.

companyName: Maitong Sunshine Cultural Development Co., Ltd

ticker: MGSD


text: Corporate Security Posture We periodically conduct independent security assessments to assess its security posture and to inform where cyber security investments should be made. For systems in our corporate environment on which our cloud certifications have an operational dependency, we also maintain ISO/IEC 27001 certifications relating to overall IT processes and controls and ISO 22301 certification relating to business continuity.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: 2. Employee Awareness and Training: PyraMax Bank recognizes that employees are a critical line of defense against cyber threats. Therefore, the Bank invests in comprehensive cybersecurity awareness training programs to educate employees about potential risks and best practices for safeguarding sensitive information.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: The Audit Committee oversees risks pertaining to cybersecurity. A member of our IT and Information Security teams regularly reports to the Audit Committee, and directly to the Board, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters. In addition, our Vice President of Software Engineering typically conducts an annual cybersecurity review with our Board. We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our websites and systems. Specifically, we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection. In addition, we utilize a firewall, a virtual private network, multi-factor authentication and single sign-on and conduct regular phishing testing. We also regularly evaluate and assess our systems and the controls, processes and practices to protect those systems, including recently completing the migration of our public-facing websites and applications and our back-end business intelligence systems to the cloud. We also retain personnel that have in-depth experience in penetration testing and conduct penetration testing against our own systems. Further, we utilize third party partners to help us monitor issues that are internally discovered or externally reported that may affect our websites and mobile applications, and we have processes to assess the potential cybersecurity impact or risk of these issues. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.

companyName: Groupon, Inc.

ticker: GRPN


text: Xerox Holdings' Cybersecurity organization is a global organization and is dedicated to protecting its infrastructure, information, and digital assets. It is responsible for establishing appropriate security policies, safeguards and controls to prevent, detect and respond to cyber threats, meet regulatory and compliance requirements, securing Xerox Holdings' intellectual property, products and services, and supply chain in collaboration with business, product, and IT partners. The information security organization is led by the Chief Information Security Officer (CISO) who reports to the Chief Transformation and Administrative Officer. In his over 18-year career as a Cybersecurity professional, the CISO has served in various roles with Fortune 500 companies, including as Deputy CISO, Head of Cyber Defense & Security Architecture, Distinguished Technologist Security, and Specialist Master. The CISO holds a bachelor's degree in Electrical and Electronics Engineering, is a Certified Information Systems Security Professional (CISSP), and has extensive experience in multiple security domains, including security operations, security architecture, identity and access management, cloud security, vulnerability management, and application/product security, policy, and compliance.

companyName: XEROX CORP


text: The Audit Committee receives regular reports from various individuals that are part of the Cybersecurity Function concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee and the full Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: CS Disco, Inc.

ticker: LAW


text: With respect to cybersecurity, the audit committee engages in discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. In addition, employees of our Manager and/or the IT Consultant will brief the audit committee on the Manager's information security program and cybersecurity risks at least annually, and will brief the audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Annual briefings of the audit committee by employees of the Manager and/or the IT Consultant may include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: Cybersecurity risk management is an important part of the Company's overall risk management efforts. We maintain a comprehensive enterprise-wide information security program that comprises policies and controls designed to identify, safeguard against, detect, respond to, mitigate and manage reasonably foreseeable cybersecurity risks and threats. Our approach utilizes diverse security tools to prevent, identify, investigate, resolve and recover from vulnerabilities and security incidents. These include, but are not limited to, internal reporting, monitoring and detection tools. We use a collaborative, enterprise-wide strategy to address cybersecurity risks and allocate significant resources to our cybersecurity and risk management processes, which efforts are intended to adapt to the evolving cybersecurity landscape and promptly address emerging threats.

companyName: Dalrada Technology Group, Inc.

ticker: DHTI


text: Management and Strategy recognize the importance of assessing, identifying, and managing cybersecurity risks. These include operational vulnerabilities, intellectual property theft, fraud, extortion, potential harm to stakeholders, regulatory compliance issues, and associated legal, financial, and partnership with external consultants, we maintain comprehensive information security processes to identify and mitigate material cybersecurity risks. Our protective measures include: Technical,

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: f. Review information security examination reports and other significant communications from regulatory agencies and the status of any outstanding information security related regulatory findings. g. Monitor and discuss emerging industry information security risk issues including applicable frameworks, rules and regulations.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: The Company faces cybersecurity threats such as ransomware and denial-of-service. The Company's customers, vendors and business partners face similar cybersecurity threats, and a cybersecurity incident impacting the Company or any of these third-party entities could materially adversely affect our operations, performance and results of operations. In particular, the Company emphasizes the importance of cybersecurity as it may receive, store and transmit personal medical and other information relating to its customers, and believes it is imperative to protect this information from potential threats.

companyName: Verano Holdings Corp.

ticker: VRNO


text: In the ordinary course of its business, the Bank relies on electronic communications and information systems to conduct its operations and to store sensitive data, and employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding these defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While the Bank has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, the Bank's systems and those of its customers and third-party service providers are under constant threat and it is possible that we could experience a future significant event. The Bank expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. For further discussion of risks related to cybersecurity, see "Item 1A Risk Factors."

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: We provide periodic mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind.

companyName: ALIMERA SCIENCES INC


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cybersecurity risks as part of our larger risk management program. While all of our personnel play a part in managing cybersecurity risks, one of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Pelthos Therapeutics Inc.

ticker: PTHS


text: We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity procedures, which are informed by the National Institute of Standards and Technology cybersecurity framework, are supported by a third-party managed services provider that assists us in managing our IT systems. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: enGene Holdings Inc.

ticker: ENGN


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program. Advanced security infrastructure with state-of-the-art firewalls and intrusion detection systems. Regular cybersecurity training for employees. Strict data access controls and authentication protocols. Continuous monitoring of our networks and systems for signs of unauthorized activity. Partnerships with leading cybersecurity software and hardware providers for real-time systems monitoring and threat intelligence. Immediate containment and assessment of the incident.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: Our audit committee and members of our executive leadership team meet with our Head of Global Information Technology on a quarterly basis, along with other members of our IT security team from time to time, to discuss cybersecurity matters, such as the emerging cybersecurity threat landscape, significant developments to our cybersecurity processes, and our cybersecurity risk assessments.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Nominating and Governance Committee has been designated by our Board to oversee cybersecurity risks. The Nominating and Governance Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures from our Chief Information Officer. The Board also receives updates from management and the ESG Committee on cybersecurity risks on at least an annual basis.

companyName: EXPRO GROUP HOLDINGS N.V.

ticker: XPRO


text: Personnel and managing our cybersecurity risks rests with our third-party provider, the Company's Director of Information Technology and Director of Software Engineering (referred to as "IT"). Their knowledge, experience and relationship with our third-party vendor instrumental in developing and executing our cybersecurity strategies.

companyName: AppTech Payments Corp.

ticker: APCX


text: Also, as part of our cybersecurity program, we partner with a third-party information technology firm to support and evaluate our cybersecurity and informational security program. This third-party service includes product and software security for data protection and cyber defense, to monitor, detect, prevent, and protect our Company against potential cybersecurity threats.

companyName: MIND TECHNOLOGY, INC

ticker: MIND


text: Management's information technology steering committee, which is led by the chief information officer and includes all of our executive officers, is responsible for assessing and managing material risks from cybersecurity threats from our own information technology networks and systems we use that are owned by third party service providers. Ryan Hunt has served as our chief information officer since June 2021. Mr. Hunt joined us in 1997 and quickly transitioned his focus to technology. He began his technology career on the IT help desk, served in various other roles within the technology department and most recently served in the role of senior director of application development. Mr. Hunt earned his Bachelor of Science degree in Management Information Systems from North Carolina State University.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.

companyName: FUSE GROUP HOLDING INC.

ticker: FUST


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring - We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24 hour, seven day per week monitoring system which complements the technology, processes, and threat detection techniques we use to monitor, manage, and mitigate cybersecurity threats. From time to time, we engage third party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our internal audit function to conduct additional reviews and assessments. • Insider Threats - We maintain an insider threat program designed to identify, assess, and address potential risks from within our company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Information Sharing and Collaboration - We work with government and local law enforcement, customers, industry and/or supplier partners to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information. • Third Party Risk Assessments - We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections. • Training and Awareness - We provide on at least an annual basis awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate quarterly in required training, including spear phishing, social engineering and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement - We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided.

companyName: RingCentral, Inc.

ticker: RNG


text: The Company faces a range of cybersecurity threats including threats common to many industries, such as ransomware and denial of service, as well as more advanced threats specific to critical infrastructure industries such as mining. The Company's customers, equipment suppliers, transportation facility providers and joint venture partners face similar cybersecurity threats, and a cybersecurity incident affecting the Company or any of these entities could materially affect our operations, performance and results of operations. The Company continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity, please see the section titled "Risk Factors - Terrorist attacks or cyber incidents could result in information theft, data corruption, operational disruption and/or financial loss."

companyName: Core Natural Resources, Inc.

ticker: CNR


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor emerging data protection laws in conjunction with our advisors and implement changes to our processes to comply; Maintain firewall and virus protection software; and Maintain a cybersecurity insurance policy.

companyName: Corvex, Inc.

ticker: MOVE


text: We have a Cybersecurity Incident Response Plan that is integrated into our crisis management program. The plan provides protocols for evaluating and responding to cybersecurity incidents, including incident disclosure and reporting, notification to senior management and relevant committees, and meeting external reporting obligations. The plan is reviewed and updated regularly by our CISO and Chief Legal Officer to ensure its continued effectiveness. We recently performed tabletop exercises where we performed walkthroughs of cyber incident situations to test our response plan. We plan to continue testing on a periodic basis going forward.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: The same cybersecurity threats that predominate across most industries challenge Tyler and our clients as well. These threats range from crude phishing attempts to distributed denial-of-service disruptions to sophisticated malware and ransomware, among others. We are acutely aware that these same threats exist for our acquisition targets, our suppliers, and our third-party business partners, and a cybersecurity incident or vulnerability experienced by any of these entities could also materially and/or adversely impact our business operations and/or performance, both operational and financial, and could harm our reputation and/or competitive position. Given the criticality of a strong cybersecurity posture, we continuously and conscientiously invest in our security infrastructure, tooling, and related resources.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Risk Management and Strategy Albany International Corp. views cybersecurity risk management as a cornerstone of our Enterprise Risk Management ("ERM") strategy, and we are committed to protecting our digital assets and sustaining investor confidence. Cybersecurity risks we face include data breaches, operational disruptions, reputational harm, and regulatory fines. Such incidents could lead to shutdowns or disruptions of or damage to our systems and those of our customers and suppliers, and unauthorized disclosure of sensitive or confidential information, potentially including personal data and proprietary business information. Unauthorized disclosure of, denial of access to, or other incidents involving sensitive or confidential Company, employee, customer or supplier data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our or our customer's business, cause us to lose customers and result in significant financial exposure and legal liability.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Our business and operations would suffer in the event of system failures, security breaches or cyber-attacks."

companyName: LUMOS PHARMA, INC.


text: We employ a risk-based approach to cybersecurity which aligns with our corporate strategy, risk management and governance, and adaptable information technology ("IT") infrastructure. Our cybersecurity program consists of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity framework.

companyName: Texas Pacific Land Corp

ticker: TPL


text: We regularly engage third-party consulting services to conduct audits and assessments of the effectiveness of our cybersecurity controls and processes and identify areas for improvement based on developments in industry best practices. We typically engage these services annually, though the cadence can differ based on the results of the audits and assessments. We also leverage third parties to evaluate our cybersecurity and risk management strategy, review policies and procedures to address new risks and maintain ongoing compliance with evolving legal and regulatory requirements. For example, we partner with leading global security providers to leverage various threat intelligence channels as input to monitor and tune our cybersecurity controls.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: We engage third-party security experts, as appropriate, to support our processes for assessing, identifying, and managing cybersecurity risks, including, for example, periodic evaluations of our cybersecurity program from a design and effectiveness perspective, penetration testing, vulnerability scanning, employee awareness training, phishing simulations, and incident monitoring and response.

companyName: STARBUCKS CORP

ticker: SBUX


text: We conduct continuous assessments of our cybersecurity standards, perform regular tests of our ability to respond and recover, and monitor for potential threats. To further mitigate threats, we collaborate with governments and regulatory agencies and take part in external events to learn and share. Our workforce participates in regular security awareness training, including exercises to build capabilities to identify and report suspect phishing emails to our SOC. In the last year, we continued to expand the cybersecurity training and simulated testing we administer to high-risk groups within the organization. A tailored cybersecurity training course has been implemented for team members in operational technology roles, and we have increased the frequency of phishing simulation tests.

companyName: ENBRIDGE INC

ticker: ENB


text: The Company maintains processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks and data, including its intellectual property and confidential information. The Company also uses the services of a third-party managed information technology company to provide cybersecurity software, monitor certain of our endpoints, infrastructure, and networks for irregular activities, to assist in identifying, assessing, and managing material risks and to provide incident response services.

companyName: 4Front Ventures Corp.


text: Our Board considers cybersecurity risk as part of its risk oversight function and management expects to keep the Board informed of any material cybersecurity threats and expects to provide a report to the Board on a periodic basis and the Board will consider and oversee.

companyName: Cardio Diagnostics Holdings, Inc.

ticker: CDIO


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the security organization works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: CS Disco, Inc.

ticker: LAW


text: As part of our overall ERM approach, our third-party risk management program is designed to ensure proper risk identification and oversight of Atleos' vendors and includes the following objectives: • Perform risk-based segmentation and prioritization of all existing and new Atleos vendors; • Perform sanctions screenings on all vendors and anti-bribery, anti-corruption screenings on applicable vendors; • Perform extended due diligence on identified high risk vendors to include responsible sourcing, business continuity, information security, data privacy, and other reviews as applicable; and • Perform a financial risk assessment on identified high risk vendors The Company also employs advanced screening and due diligence processes and tools, including data privacy and cybersecurity specific evaluations as applicable, as part of our standard third-party onboarding and continuous monitoring processes.

companyName: NCR Atleos Corp

ticker: NATL


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including, through the Audit Committee, cybersecurity and information security risk management and controls. As part of its oversight function, the Board, directly and through its Audit Committee, oversees the Company's risk assessment and risk management policies, including related to cybersecurity. At least quarterly (with respect to the Audit Committee) and annually (with respect to the Board), our CTO and CISO report to the Audit Committee or the Board, respectively, addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Our cybersecurity risk assessment and management efforts are led by our Chief Operations Officer, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our Chief Operations Officer reports directly to our CEO and Board of Managers.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Although such risks have not materially affected us, including our business strategy, results of operations, and financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks. See "Item 1A. Risk Factors" for additional information regarding our organization's cybersecurity risks, which should be read together with this "Item 1C. Cybersecurity".

companyName: Healthcare Triangle, Inc.

ticker: HCTI