text: Our Audit Committee oversees the application of our ICT systems and all risks relating to cybersecurity. Cybersecurity is a standing agenda item at each of the Audit Committee's regularly scheduled meetings and the committee may engage any external advisor as needed to advise on cybersecurity matters. The Audit Committee periodically reports on such matters to the Board of Directors as part of our overall risk management and oversight framework. We have also established a management-level disclosure committee (the "Disclosure Committee"). The Disclosure Committee is responsible for overseeing the preparation of our public disclosure materials and assessing the materiality of events within the Company. The Disclosure Committee is also responsible for conducting our cybersecurity risk assessment and ensures constituencies from across the Company are represented in such assessment. The Disclosure Committee monitors cybersecurity incidents and risk on an ongoing basis and may engage outside consultants as needed to assess and respond to cybersecurity incidents. The Disclosure Committee reports to the Audit Committee on a variety of matters, including cybersecurity risks. The Disclosure Committee consists of employees representing our legal, finance, regulatory and clinical departments. We have also engaged a third party to provide technical information technology experience to the Disclosure Committee, Audit Committee and Board of Directors.

companyName: NewAmsterdam Pharma Co N.V.

ticker: NAMS


text: The risks from cybersecurity threats have not to date materially affected us or are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies in the healthcare industry that handle protected health information and companies in all industries that rely on technology to run their operations, a material cybersecurity incident could potentially impact our results of operations and financial condition. Refer to the risk factor titled "Security breaches, cybersecurity attacks, loss of data and other disruptions to our information systems could compromise sensitive information related to our business and expose us to liability, which could adversely affect our operations, financial condition, cash flows and results of operation" in Item 1A of this Report for additional information about the risks associated with cybersecurity threats.

companyName: agilon health, inc.

ticker: AGL

secItem: Item 1C


text: The Company's Board of Directors has a mix of experiences, skills, qualifications and backgrounds to support strategy and risk oversight, including expertise in cybersecurity and oversight of cybersecurity matters. This oversight is achieved through the Company's Finance and Risk Management ("F&RM") Committee, which is comprised of five members of our Board of Directors, and one Board member who serves in an ex-officio capacity. The F&RM Committee is responsible for reviewing key enterprise risks identified through our Enterprise Risk Management and Resiliency process, which includes information security strategies and risks, as well as data privacy and protection risks and mitigation strategies (collectively, "Information Security"). At each regularly scheduled F&RM Committee meeting, management, through the Company's Chief Information Security Officer ("CISO"), reports on Information Security controls, audits, guidelines and developments and the F&RM Committee is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: HERSHEY CO

ticker: HSY


text: Overview and Leadership Our enterprise risk management framework considers cybersecurity risk alongside other risks as part of our overall enterprise risk assessment process. As part of our enterprise risk management, we maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology, to support the effectiveness of our information technology systems and identify, prevent and mitigate information technology and data security risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to evolve and maintain our cybersecurity program's maturity across the elements of NIST CSF.

companyName: Simply Good Foods Co

ticker: SMPL


text: We depend on information systems and technology in many aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, and inadvertent release of information. We have a risk-based cybersecurity program and a dedicated team of cybersecurity professionals focused on protecting our data and information systems. These cybersecurity threats and related risks make it necessary for us to stay apprised of developments in the information security field, and dedicate resources on cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.

companyName: Varex Imaging Corp

ticker: VREX


text: We conduct regular risk assessments to identify potential cybersecurity threats. These assessments involve evaluating our systems, networks and data for vulnerabilities that could be exploited by cyber threats through, among other things, vulnerability scanning and penetration testing. Once risks are identified, we implement measures to manage and mitigate these risks. This includes updating and patching our systems, implementing security controls and monitoring our networks for suspicious activity. We have a process in place to respond to any identified threats, which includes containment, eradication and recovery measures. We also monitor and update our cybersecurity risk management strategy to respond to the evolving cyber threat landscape. This includes staying abreast of the latest cybersecurity threats and trends and updating our systems and processes accordingly.

companyName: Frontdoor, Inc.

ticker: FTDR


text: For additional information on certain risks associated with cybersecurity, including with respect to prior cybersecurity incidents, please refer to "We may be subject to disruptions or failures in our information technology systems and network infrastructures that could have a material adverse effect on us" in Item 1A: Risk Factors.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years. We and our Advisor routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. See "Item 1A–Risk Factors–Our business could suffer in the event our Advisor or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards, and practices are integrated into our enterprise risk management approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). We generally approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, suppliers and other third parties; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Krystal Biotech, Inc.

ticker: KRYS


text: There have been no cybersecurity events in the past that have materially affected the Company's business strategy, results of operations, or financial condition. Although we believe our defenses against cyber-intrusions are sufficient, we continue to update our prevention programs to respond to sophisticated and rapidly evolving attempts to overcome our security measures. Such continuing threats could have a variety of adverse business impacts. See Item 1A – "Risk Factors" under the heading "Security and fraud risks" above for additional information on risks to our business from cybersecurity incidents and related matters.

companyName: HCI Group, Inc.

ticker: HCI


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings: "Any significant technology disruption or failure, cyberattack or data security incident could adversely affect our business, financial condition and operations. " and "Our business relies on third-party cloud infrastructures, and any disruption of, or interference with, our use of cloud infrastructures could adversely affect our business, financial condition or results of operations." included as part of our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Rent the Runway, Inc.

ticker: RENT


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks. The Committee oversees management of our cybersecurity risks, including reviewing and discussing with management our major cybersecurity risk exposures and the steps management has taken to monitor and control such exposures.

companyName: Oscar Health, Inc.

ticker: OSCR


text: As previously disclosed, in fiscal year 2023, Fortra, LLC, the third-party vendor that provides the GoAnywhere managed file transfer as a service system (MFTaaS), experienced a data security incident that affected many of Fortra's customers, including us. We use GoAnywhere as a means by which our customers electronically share certain data regarding their employees and other third parties with us. Our understanding is that this activity was the result of the threat actor's exploit of a zero-day vulnerability in Fortra's systems. Based on the information we have obtained from Fortra and our own diligence, we understand that this activity only affected Fortra's systems, and did not involve unauthorized access to our information systems. However, the threat actor in this incident accessed certain of our customers' employees' and other third parties' data and such data included protected health information, as defined by the Health Insurance Portability and Accountability Act, and personally identifiable information. We engaged outside experts to assist in investigating and responding to this incident and have provided the required notifications to the data owners, and where appropriate, to the individuals affected by the incident and to various State Attorneys General.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: The audit committee receives periodic reports from the Chief Financial Officer concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: The Company did not experience a material cybersecurity incident during the year ended December 31, 2023. However, the possibility of future cybersecurity incidents, as well as cybersecurity and technology risks more generally, could have a material adverse effect on the Company's business, financial condition, results of operations, cash flows or reputation. See "Item 1A. Risk Factors – Cybersecurity and Technology Risks" for more information.

companyName: Red Violet, Inc.

ticker: RDVT


text: Cybersecurity is complex and subject to constantly evolving threats. Accordingly, we engage a range of external experts, including cybersecurity consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third-party experts includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Quanterix Corp

ticker: QTRX


text: We face cybersecurity risks due primarily to our position in the industry and identity as a financial service company with potential for harm that could occur to us, our investors and our customers were we to suffer impacts of a material cybersecurity incident. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. In addition, the environment and threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network and services which are also dependent on third parties (multiple law firms, banks, settlement and title entities) and their technology, and to prevent their occurrence and recurrence where practical through changes, updates and enhancements to our internal processes and tools; however, we aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent subject matter expert third parties who hold industry leading certifications such as Certified Information Systems Security Professional (CISSP), GIAC Certified Intrusion Analyst (GCIA), and GIAC Certified Incident Handler (GCIH).

companyName: Shepherd's Finance, LLC


text: Our information security program is led by our chief information security officer ("CISO"), who has over 25 years of experience in technology management, has 9 years of banking experience, and is a certified information systems security professional. The CISO oversees our "information security team" within our information technology department, which includes our identity and access management group, our security operations center group, and our security engineering and security architecture groups. These groups develop, deploy, monitor, and manage multiple processes, systems, and controls, including embedded controls within the technology we use, designed to help identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents. In addition to our information security team, we also employ a senior vice president of IT governance and risk who has over 18 years of IT governance, risk, and compliance experience and is responsible for the development, monitoring, and reporting of IT-related key risk indicators ("KRIs"), including KRIs related to cyber risks. Both our CISO and our senior vice president of IT governance and risk report to our chief information officer ("CIO"), who has more than 25 years of technology leadership experience, including leadership experience at global financial institutions, and is responsible, among other things, for oversight of our information technology environment, strategy, and security risks.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: As potential new threats to security are identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our IT Manager and expert consultants who report to our Chief Financial Officer. Our Chief Financial Officer has relevant expertise gained from nearly 20 years' experience overseeing our information technology matters, including cybersecurity concerns. With respect to cybersecurity, our consultants support our risk assessment and scoring, securing devices and networks, vulnerability management, proactive monitoring, responding to cyber threats and more. They act as our security operations center, as well as a seamless extension of our IT department.

companyName: UR-ENERGY INC

ticker: URG


text: The audit committee of our board of directors (the "Audit Committee") is responsible for overseeing cybersecurity risk and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: We contract with external firms to assess our cyber security controls relative to our peers using the NIST CSF. We also have a third-party risk management program that assesses risks from vendors and suppliers. In addition, we maintain a Business Continuity and Disaster Recovery Plan as well as a cybersecurity insurance policy.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: The Company's Director of IT is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying cybersecurity threats and incidents and managing the material risks associated with the cybersecurity threats. The Company's Director of IT engages third-party vendors and cybersecurity consortiums periodically for cybersecurity-related guidance and certifications. In the event of a cybersecurity incident, the Company's process calls for the Director of IT, Chief Financial Officer, and Corporate Controller work to assess and respond to the incident and provide briefings to the Chief Executive Officer and the Audit Committee of the Board of Directors.

companyName: US ENERGY CORP

ticker: USEG


text: We employ a comprehensive set of cybersecurity policies and guidelines and a strong security training and awareness program to communicate policy directives and current threats to 1st Franklin employees. Additionally, we have a strong due diligence and risk assessment process to identify and manage risks associated with our use of third-party service providers.

companyName: 1st FRANKLIN FINANCIAL CORP


text: Management's Role in Cyber Security Risk Management The Chief Compliance Office of the Company oversees the Company's compliance oversight function generally and relies on Investcorp Group's Heads of Technology and information security team for assessing and managing material risks from cyber security threats impacting the Company. Investcorp Group's Heads of Technology and information security team have extensive experience in managing cyber security and information security programs for financial services companies with complex information systems. The information security team includes seasoned professionals who are experienced with information security protocols and receive appropriate training and industry certifications regarding information security. The Chief Compliance Officer is responsible for this oversight function as Chief Compliance Officer to the Company more broadly and has significant experience in the financial services industry, during which time the Chief Compliance Officer has gained expertise in assessing and managing risks applicable to the Company.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: Corporate Governance The Board of Directors is responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk. The Audit Committee has the primary responsibility for overseeing risk management, including oversight of cybersecurity risk management practices and performance. The Audit Committee generally receives reports at each regular quarterly meeting provided by the CSO, the CISO, the CIO, and the General Auditor on the cybersecurity management program. The reports focus on the programs and protocols in place to mitigate cybersecurity risks, led by the CSO. Among other things, the reports may include: recent cyber risk and cybersecurity developments; industry engagement activities; legislative and regulatory developments; cyber-risk governance and oversight; selected cyber risk metrics and activities; cyber risk incident response plans and strategies; cybersecurity drills and exercises; assessments by third party experts and Internal Audit; and major projects and initiatives.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: We are focused on the growing threat of cybersecurity risks we face in today's global business environment and have identified cybersecurity as an important enterprise risk. Our cybersecurity risk management program is part of our overall enterprise risk management program, and focuses on identifying, assessing, managing, and remediating material risks from cybersecurity incidents. We rely on risk-based security controls, including access limitations and contractual requirements on third-party service providers, as part of our overall approach of protecting the integrity, availability and confidentiality of our important systems and information.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and to protect the confidentiality, integrity, and availability of its data.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: In connection with our enterprise risk management process, we identify, prioritize, monitor and seek to ameliorate key risks that may affect the Company, including risks from or relating to cyber threats. We have enterprise-wide security policies, standards and controls that seek to incorporate best practices in security engineering, technology architecture and data protection. Our policies and controls include security measures designed to protect our systems against unauthorized access. We also maintain cybersecurity protection measures with respect to our information technology systems, including with respect to the protection of our customer data, vendor data and employee information. We have also implemented specialized training and education programs to seek to guard against cybersecurity events, such as enterprise-wide communications, presentations, phishing simulations and focused training for specific roles, as well as a general cybersecurity training program required for all employees. We also engage third parties to perform regular reviews of our security framework controls to promote objectivity. Our processes to identify, assess and manage material risks relating to cyber threats include risks associated with third party service providers, including cloud-based platforms. We believe that these policies and controls provide us with an appropriate comprehensive assessment of potential cyber threats.

companyName: COLUMBUS MCKINNON CORP

ticker: CMCO


text: Important to these programs is Invesco's investment in threat-intelligence, its active engage ment in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.

companyName: Invesco CurrencyShares Canadian Dollar Trust

ticker: FXC


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Forza acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Forza X1, Inc.


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. We must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.

companyName: Aditxt, Inc.

ticker: ADTX


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through its audit committee.

companyName: Cue Health Inc.


text: As of the date of this Annual Report on Form 10-K, cybersecurity threats have not materially affected and we believe are not reasonably likely to materially affect AMG, including our business strategy, results of operations, or financial condition.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: We have also established a cross-functional leadership team to oversee our information security and privacy programs and practices, as well as to assess, identify, manage, and mitigate security and privacy risks. Members of this team also report periodically to the Board of Directors, Audit Committee, and members of our senior leadership team. This team includes senior leaders from our legal, privacy, information security, information technology, infrastructure, and compliance teams, including our Chief Privacy Officer, our VP, Security, and our Chief Legal Officer. Our Chief Privacy Officer has held various roles advising Dropbox and two other large publicly-traded technology companies on a variety of privacy, regulatory, and product counseling issues since 2010. Our VP, Security joined Dropbox in 2022 and has held roles in cybersecurity, engineering, and operations, including leadership positions, with a variety of companies for over 20 years. Our Chief Legal Officer has been with us since 2011, having served as our Chief Legal Officer or General Counsel for a total of over seven years, and has over 20 years of experience in the legal profession.

companyName: DROPBOX, INC.

ticker: DBX


text: The Board and Audit Committee receive regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Commerce.com, Inc.

ticker: CMRC


text: of a Third-Party MSSP: The Company consults with an external Managed Security Services Provider for continuous support, monitoring, and guidance. Security Practices: Baseline controls such as password policies and antivirus software provide foundational protection. a Comprehensive Cybersecurity Framework: Establishing a formal risk assessment process to better identify and manage vulnerabilities. Cybersecurity Governance: Reviewing and formalizing Board-level oversight and considering additional training or expertise at the management level.

companyName: Genvor Inc

ticker: GNVR


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the Chief Executive Officer, the Chief Financial Officer, the General Counsel, the CIO and other senior members of the Company. Such individuals work with our incident response team to help us assess, mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the technology committee of the board of directors for certain cybersecurity incidents.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: We are not currently engaged in any substantive business activity except the search for potential assets, property or businesses to acquire, and we have no current plans to engage in any other activity in the foreseeable future unless and until we complete any such acquisition. In our present form, we are deemed to be a "shell company"

companyName: ATLANTICA INC

ticker: ALDA


text: We believe that we employ appropriate standards, guidelines and best practices to manage cybersecurity-related risk and have implemented comprehensive controls consistent with the requirements of the International Organization for Standardization ("ISO") and assess our cybersecurity maturity levels against the National Institute of Standards and Technology ("NIST") framework, including, but not limited to, the following: • Intrusion prevention controls (such as network segmentation and firewalls); • Access controls (such as identity and access management and multi-factor authentication on critical applications and systems); • Detection controls (such as endpoint threat detection and response, and logging and monitoring involving the use of a third-party for security information and event management, with reports and alerts provided by the third-party to the CTO's team); and • Threat protection controls (such as mandatory cyber-threat training and simulated phishing campaigns with employees, vendor management programs, and vulnerability and patch management).

companyName: Childrens Place, Inc.

ticker: PLCE


text: Any failure to prevent or mitigate security breaches, cyber-attacks or other unauthorized access to our systems or disclosure of our customers' data, including their personal information, could result in loss or misuse of such data, interruptions to our service system, diminished customer experience, loss of customer confidence and trust, impairment of our technology infrastructure, and harm our reputation and business, resulting in significant legal and financial exposure and potential lawsuits and could cause the value of such securities to significantly decline or be worthless. In addition, any violation of the provisions and requirements under relevant laws and regulations with respect to cyber security, data security and personal information protection may subject us to rectifications, warnings, fines, confiscation of illegal gains, suspension of the related business, revocation of licenses, cancellation of qualifications being entered into the relevant credit record or even criminal liabilities.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: The Company's CISO has over 15 years of experience in cybersecurity, information security and information risk management, including several years each in security engineering and in operations, as well as running incident response organizations. The CISO's organization includes a dedicated team of centralized information security experts and a network of security professionals embedded in each business unit and function.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: Our CISO reports to our CIO who, in turn, reports directly to our CFO. Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams.

companyName: Seagate Technology Holdings plc

ticker: STX


text: The Bank conducts an extensive training program, from entry-level to executive-level, focused on information security and customer data privacy. As part of its Enterprise Risk Management protocols, the Company and the Bank maintain insurance policies appropriate for the scope of its operations, including coverage for risks related to cyber/information security and customer data privacy.

companyName: BankFinancial CORP


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks, no less than quarterly, and regularly receives updates from third parties on various business risks, which include cybersecurity matters. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third party providers will be involved as deemed necessary based on the potential impact.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD


text: Given the increasingly complex and sophisticated cyber threat landscape, we try to be vigilant to predict and prevent attacks. Commvault has prioritized cyber resilience measures and leverages governance processes and procedures to mitigate potential business impacts if and when an adverse event occurs. To date, Commvault is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Commvault, including its business strategy, results of operations or financial condition. Although no material impacts have been recorded to date, IT system failures, network disruptions, cybersecurity incidents, and data breaches could adversely impact our business, internal controls, results of operations, and financial condition. For example, in February and April 2025, Microsoft notified the Company about unauthorized activity within our Azure environment by a suspected nation-state threat actor. As part of the ongoing investigation regarding this activity, the Company immediately activated its incident response plan, issued security advisories, and implemented several advanced security measures, including enhanced rotation of credentials and strengthened security monitoring, among other proactive measures.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: Microvast's SVP of Information Technology and the Information Security Manager are responsible for assessing as well as managing and determining the risks that could potentially have material impact on Microvast operations and business activity.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: We address the cybersecurity threat risk posed by employees and third parties with access to our IT systems, including that we integrate cybersecurity risk management into the culture of our organization by: maintaining policies addressing various aspects of security necessary to protect our IT assets and data; requiring cybersecurity awareness and training programs for persons with access to our IT systems to build their cybersecurity skills and knowledge; consistent messaging to our employees (including from our top leadership) of the importance of managing cybersecurity risk, participating in our cybersecurity training and following our cybersecurity policies; and routinely testing responses by our employees to mock efforts to breach our cybersecurity protections.

companyName: Sylvamo Corp

ticker: SLVM


text: Autoliv has established an Enterprise Risk Management framework aligned to the ISO 31000:2019 to ensure that the context, principles, and processes for risk management are embedded and integrated with the operations of the company. All risks across the Autoliv risk universe, including cybersecurity, are assessed with bottom-up risk assessments and subsequently are aggregated and reported to the Audit and Risk Committee of the Company's Board of Directors.

companyName: AUTOLIV INC

ticker: ALV


text: We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding the risks to us associated with cybersecurity incidents, see Item 1A. "Risk Factors".

companyName: YUM BRANDS INC

ticker: YUM


text: We maintain a Business Continuity and Incident Response Program that provides a documented framework for responding to actual or potential incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our CEO and Board of Directors as appropriate. The Business Continuity and Incident Response Program is coordinated by the Information Security Officer and key members of management are embedded into the Plan by its design. The Business Continuity and Incident Response Program facilitates coordination across multiple areas of our organization and is evaluated at least annually.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: Peabody's enterprise risk management (ERM) framework considers cybersecurity risk alongside other company risks as part of the Company's overall risk assessment process. The ERM team collaborates with the Chief Information Security Officer (CISO), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: As detailed elsewhere in this Annual Report on Form 10-K, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, proprietary and other types of information. We use state of the art systems with respect to the type of information processed, and employ processes designed to oversee, identify, and reduce the potential impact of a security incident with a third-party vendor or customer or otherwise implicating the third-party technology and systems we use. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber-attacks, we may not be able to protect all information systems. Any incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences.

companyName: MAGNITE, INC.

ticker: MGNI


text: The Company's risk management program includes procedures, systems, and processes for assessing, identifying, and managing material risks from cybersecurity threats. Overall, we address cybersecurity risks through Board of Directors (the "Board") and management oversight and a system of controls and procedures designed to protect the confidentiality, integrity, and availability of the Company's information assets. The Company employs a comprehensive system of monitoring, detection, internal reporting, and prompt escalation of certain cybersecurity incidents, plans for incident response and recovery, technical safeguards, third-party risk management, and mandatory training and awareness campaigns.

companyName: MANITOWOC CO INC

ticker: MTW


text: We devote significant resources to cybersecurity and risk management processes and continue to expand investments in information security and cybersecurity by attracting and retaining top talent, fostering continuous education and improvement, and leveraging advanced technology and innovative solutions, including partnerships with third-party vendors, to strengthen our information security and cybersecurity capabilities. W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements, industry guidelines, and best practices. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a Third-Party Risk Management program to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements with our service providers that include requirements related to cybersecurity and data privacy, however, we cannot guarantee that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Our board of directors oversees our risk management process directly and through its committees. The audit committee of our board of directors has the power and responsibility to coordinate our board's oversight over our risk management procedures and to discuss with our management our policies with respect to risk assessment and risk management. Our board of directors has delegated to its audit committee oversight authority of our information security (including cybersecurity) risk management.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: Public Disclosure Considerations: In alignment with regulatory requirements and our commitment to transparency, management evaluates the necessity and timing for public disclosure, balancing patient privacy, legal obligations, and public interest.

companyName: QHSLab, Inc.

ticker: USAQ


text: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Our cybersecurity risk management team regularly updates the Technology, Innovation and Cyber Committee and Board of Directors on cybersecurity risks as they relate to our information and operational technology systems and our suppliers and partners, as well as provides regular updates on enterprise cybersecurity incidents and key defenses and mitigation strategies. Our cybersecurity risk management team regularly reviews and manages enterprise cybersecurity risks, controls, program policy and processes, including training, oversees policy and program development, implementation, and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Additionally, our cybersecurity risk management team regularly monitors and leads efforts to address and remediate, as appropriate, enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of Peapack-Gladstone Bank's efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of Peapack-Gladstone Bank infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and Peapack-Gladstone Bank's supply chain. We also actively monitor our email gateways for malicious phishing e-mail campaigns and monitor remote connections as a significant portion of Peapack-Gladstone Bank's workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to Peapack-Gladstone Bank's information security program, to assess their design and operating effectiveness and make recommendations to strengthen the Bank's risk management program.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our business and operations could suffer in the event of system failures, cyberattacks, or deficiency in our cyber security," which disclosures are incorporated by reference herein.

companyName: G1 Therapeutics, Inc.


text: Clients and customers are also sources of cybersecurity risk to us, the Adviser, J.P. Morgan and its affiliates and its information assets, particularly when their activities and systems are outside of J.P. Morgan's own security and control systems. J.P. Morgan engages in periodic discussions with its clients, customers and other external parties concerning cybersecurity risks including opportunities to improve cybersecurity.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Chief Operating Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: Following these risk assessments, responses may include re-design, implementation, and maintenance of reasonable safeguards to minimize identified risks and address any identified gaps in existing safeguards and regularly monitoring of the effectiveness of our safeguards.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: Our cybersecurity program engages third parties when necessary. In the past, we have had cybersecurity incidents and we have made, and continue to make investments, seeking to address these threats, including monitoring of networks and systems, hiring of experts to evaluate and test our systems, employee training and security policies for employees and third-party providers. All third parties that we use have been vetted and have significant reputations in the industry. As such, controls from the third-party vendors have been deemed to be adequate prior to any goods or services having been provided.

companyName: ALLIENT INC

ticker: ALNT


text: We use independent third parties to perform ethical hacks of key systems and penetration tests of our network and certain applications to help us better understand the effectiveness of our controls and to implement more effective controls, and we engage with third parties to conduct reviews of our overall program to help us better align our cybersecurity program with what is required of a large financial services organization.

companyName: STATE STREET CORP

ticker: STT


text: We devote significant resources to cybersecurity and cybersecurity risk management processes to adapt to the changing cybersecurity landscape and to respond to emerging threats. We maintain a cybersecurity risk management program to assess, identify, manage, mitigate and respond to material risks from cybersecurity threats to both our corporate information technology environment and to customer-facing products. This program is integrated into our overall Enterprise Risk Management ("ERM") program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring and management of risks.

companyName: CONDUENT Inc

ticker: CNDT


text: Management of Cybersecurity Risks Our management of cybersecurity risks is integrated into our company-wide enterprise risk management program. As part of this process, our risk management team works closely with our IT department to identify and evaluate potential cybersecurity risks to the Company and to develop controls to mitigate and protect against those risks.

companyName: ENTEGRIS INC

ticker: ENTG


text: In addition, the importance of cybersecurity protection and its practice at the manager and employee level is frequently communicated to the staff globally. Specifically, VanEck's Chief Information Security Officer, reporting to the co-chair of the Risk Management Committee, is responsible for conducting the firm's cybersecurity risk assessment, as well as providing regular staff educations with a special emphasis on proper desktop and email security and conduct. Special training is also given to recently on-boarded staff. VanEck's Chief Administrative Officer and Chief Technology Officer, together with VanEck's Chief Information Security Officer, are responsible for the day-to-day operations of the firm cybersecurity infrastructure including normal operations as well as any remedial work required in response to an incident. The communication responsibility in the event of an incident is shared by VanEck's CEO and the General Counsel.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: As a high-profile global media and information services company with a wide array of digital products and services, the Company is subject to risks associated with cybersecurity threats. The Company has developed and implemented a cybersecurity program designed to manage these threats, including the assessment, identification and management of cybersecurity risks, and related protection, response, mitigation and recovery efforts. The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company's Chief Information Security Officer ("CISO"), who reports directly to the Company's Chief Technology Officer ("CTO"), and supported by designated cybersecurity risk leaders at the Company's business units. The Company's cybersecurity program is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leverages a defense-in-depth approach to managing cybersecurity risk. The governance, principles and framework for the program are set forth in the Company's Global Cybersecurity Governance Principles Framework and are complemented by a set of global cybersecurity policies designed to promote secure cyber and data practices among Company personnel. The Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams. In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, multi-factor authentication, encryption, endpoint detection and response, email and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.

companyName: NEWS CORP

ticker: NWSA


text: The Company maintains a cybersecurity risk management program that includes, but is not limited to, periodic risk assessments and employee awareness training initiatives, as well as the employment of security analytical and assessment tools. We also maintain a cybersecurity incident response plan designed to help the Company defend against evolving cybersecurity threats, which sets out criteria for incident classification and procedures to escalate incidents to the appropriate stakeholders. Internally, we regularly monitor and assess the various components of our cybersecurity infrastructure, with the support of third-party consultants.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: Risks from cybersecurity threats have not materially affected or are currently viewed as not reasonably likely to materially affect us, our business strategy, results of operations or financial condition. However, the scope and impact of any future cybersecurity incidents cannot be predicted and there can be no assurance that our information security program will be effective in preventing material cybersecurity incidents in the future. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Our internal information technology systems, or those of our third-party CROs, CMOs, or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug candidates' development programs and our commercialization of any products for which we receive regulatory approval."

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: IT and/or IS inform the CIO concerning cybersecurity risks and events, including any mitigation and remediation efforts. Cybersecurity incidents are escalated to an incident response team ("IRT"), which is headed by the CIO. The IRT is responsible for overseeing our incident response strategy, including remediation. For ongoing events, those responsible for investigating the incident are required to continuously update the IRT and the CIO until the event is considered to be resolved. Significant cybersecurity incidents are referred to a committee responsible for evaluating whether the incident is material using criteria based on our ERM program. This committee is comprised of a cross functional team of various senior members of management including the areas of Finance, Accounting, Legal, IT Security, and Risk.

companyName: Installed Building Products, Inc.

ticker: IBP


text: 1. We leverage a threat intelligence platform watchlist to curate, monitor, alert, and provide a risk rating to third-party vendors. This platform also offers a dashboard and real-time reporting, enabling us to stay ahead of potential threats by providing continuous oversight and actionable intelligence.

companyName: TRANSCAT INC

ticker: TRNS


text: The Corporation uses third-party vendors, including a managed security service provider, to assist in monitoring, detecting, and managing cyber threats. The Board of Directors has established risk management guidelines for third-party vendors. Further, the Corporation conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. The Corporation generally has agreements in place with its service providers that include requirements related to cybersecurity and data privacy. Due diligence and oversight procedures may include, but are not limited to, reviews of financial information, internal control reports, business continuity and disaster recovery plans, and information security and cyber security policies and associated tests of effectiveness. The Corporation cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cyber incident from impacting our systems or information. Additionally, the Corporation may not be able to obtain adequate or any reimbursement from its insurance coverage or from its service providers in the event it should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, the Corporation may be held responsible for cyber incidents attributed to its service providers in relation to any data that the Corporation shares with them.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our management-level Technology and Operational Risk Committee, which governs our technology and operational risk tolerances, including cybersecurity and third- and fourth party provider risks. This committee includes the Chief Information Security Officer and is co-sponsored by the Chief Information Officer and the Chief Risk Officer. These individuals have relevant financial, technical, and business degrees, hold relevant certifications, and each have over 20 years of experience in their respective areas of expertise, with a minimum of 10 years in leadership roles, including multiple years at financial institutions. The Committee is responsible for escalating key risks to our Management Risk Committee, which includes all members of our Executive Leadership Team, as well as our Head of Business Risk, who operates within our first line of defense.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Our cybersecurity protection strategy incorporates a Vulnerability Management process and solution to assist in the identification of potential vulnerabilities in our systems. If vulnerabilities are identified, we utilize a follow-on process to remediate such vulnerabilities. A third-party software-as-a-service (SaaS) provider conducts code scanning and vulnerability assessments of our external-facing websites. Furthermore, multiple cybersecurity controls exist on and around our servers and end-user systems to prevent unauthorized system and data access and data leakage. Additionally, third-party vendors conduct yearly penetration tests to search for risks to our systems utilizing techniques commonly used by bad actors.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Cybersecurity risks are overseen by the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, which include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, and violation of data privacy or security laws.

companyName: Hillenbrand, Inc.

ticker: HI


text: The Company has implemented a comprehensive cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks. This approach is informed by industry best practices, including the NIST Cybersecurity Framework ("CSF") and Risk Management Framework ("RMF"). The program is designed to prevent disruptions to operations, protect critical assets, and ensure compliance with applicable regulations such as the California Consumer Privacy Act ("CCPA"), the General Data Protection Regulation ("GDPR"), and the Securities and Exchange Commission ("SEC") cybersecurity disclosure requirements.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not affect the Company's business in a material manner. At the effective date of this Annual Report, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Kingfish Holding Corp


text: During 2024, there were no identified cybersecurity risks or threats, including as a result of previous cybersecurity incidents, that had, or were reasonably likely to have, a material effect on our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents or disruptions may not be fully insured. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: The Head of IT reports to the Chief Financial Officer (CFO), and attends regular meetings with the CFO to discuss updates relating to the Company's cybersecurity program. The Head of IT also provides cybersecurity updates on a quarterly basis to the Company's executive team.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: As part of our business operations, the Company engages with a number of third parties, including but not limited to, online software service providers, vendors, consultants, and partners. These third parties are analyzed based on business criticality and impact and must be cleared through a formal cybersecurity risk assessment process before being allowed to integrate with Sandisk's information systems, access confidential data, or provide electronic services to members of our workforce.

companyName: Sandisk Corp

ticker: SNDK


text: Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyber threats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: BioNexus Gene Lab Corp

ticker: BGLC


text: Our information technology department, supported by certain service providers, identifies, assesses and manages the Company's cybersecurity threats and risks. Our information technology department (led by our Director of IT Operations and Security), identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, real-time monitoring of network events, subscribing to reports and services that identify cybersecurity threats, evaluating threats and actors reported to us, conducting scans of the threat environment, evaluating our and our industry's risk profile, coordinating with law enforcement concerning threats when appropriate, conducting (and working with third parties, as appropriate) assessments and audits for internal and external threats and vulnerabilities, and using of external intelligence feeds.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: We rely on our technology network infrastructure and information systems to operate our business, rent our equipment, interact with vendors and customers, support and grow our customer base and bill, collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Such attacks have become more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: H&E Equipment Services, Inc.


text: In the event of a significant cybersecurity incident, we establish an incident response team that works in conjunction with the IT Department to identify, contain, eradicate and, if necessary, recover from a cybersecurity incident. Through third parties we are also able to rapidly deploy forensic analysis, legal services, notification and call center services and credit and identity monitoring if required.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: Our senior management and our Board of Directors are aware of the critical nature of managing risks associated with cybersecurity threats.

companyName: Loop Media, Inc.

ticker: LTPVQ


text: Monitor Cybersecurity Incidents The Senior Vice President of Information Technology monitors the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The Senior Vice President of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Senior Vice President of Information Technology is equipped with an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Matador Resources Co

ticker: MTDR


text: We leverage a combination of cyber security frameworks to protect its assets. We use the controls from these frameworks as well as guidelines and best practices from the industry to develop our cybersecurity plan. Our cybersecurity plan and its elements are reviewed regularly to ensure they meet the requirements and expectations of our security needs. We have an information security policy in place, which includes monthly meetings with outside cybersecurity experts to review and maintain the procedures up to current standards.

companyName: USBC, Inc.

ticker: USBC


text: As one of the elements of the Corporation's overall enterprise-wide risk management approach, the Information Security Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the heading "Governance," the ERC has delegated to senior management responsibility for managing the Information Security Program. Senior management carries out this mandate through the Operational Risk and Enterprise Risk Management Committees. To maintain alignment and appropriate insight regarding information security activities, an Information Security Steering Committee provides general program insight. • Collaborative Approach: The Corporation has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security organization oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense Center and the Incident Response Plan: The Corporation has a Security Operations Center, known as the "Cyber Defense Center," which provides continual security monitoring 24 hours per day, seven days per week, where resources actively deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. The Corporation's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled. • Third-Party Risk Management: Management of the Corporation's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Corporate Risk Management. The process provides awareness and collaboration across all internal teams including Information Security and Business Resumption. A Technical Requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. This process is aimed at advocating the necessary security, infrastructure, and application standards or controls so that information systems and the third party have recovery plans in place. • Security Awareness and Education: The Corporation provides annual, mandatory training for personnel regarding security awareness as a means to equip the Corporation's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Corporation's information security policies, standards, processes and practices.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: Our day-to-day cybersecurity efforts are led operationally by our Chief Technology and Digital Officer and Senior Vice President, Technology who have over 10 and 25 years, respectively, of networking and information technology management or executive experience, and oversee a team of in-house cybersecurity specialists. Our Cybersecurity Committee, comprised of representatives from key management groups including accounting, finance, legal, internal audit, and information technology, also supports our cybersecurity efforts. The Cybersecurity Committee consults with representatives from senior management and retains third-party contractors as needed. The role of the Cybersecurity Committee is to oversee cyber risk assessments, monitor applicable key risk indicators, review cybersecurity training procedures, establish cybersecurity policies and procedures, and implement enhancements to our cybersecurity infrastructure. The Cybersecurity Committee meets monthly, or more regularly as necessary, and ensures that senior management, and ultimately, the Board, is given the information required to manage and exercise proper oversight over cybersecurity risks and ensure that escalation procedures are followed in the event of a cybersecurity incident.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: The Company also has a business continuity/disaster recovery plan (the "BCP"), which it actively manages to prepare for any business continuity challenges it may face. Our BCP provides for the resiliency and recovery of our operations and services to our customers. The plan is supported and complemented by a robust business continuity governance framework, a life safety program as well as an enterprise-wide annual exercise and training to keep the program and strategies effective, scalable and understood by all employees. We believe both the Security Program and BCP adhere to industry best practices and are subject to periodic testing and independent audits.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: Our Board of Directors has overall responsibility for risk oversight and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee reports on its activities, findings, and other matters to the full Board of Directors quarterly, or more frequently as events or circumstances may require. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The CAO and CISO present an update to the Audit Committee on our cybersecurity risks and risk management strategies and processes at each regularly scheduled, quarterly meeting. These presentations include assessments on the threat landscape; emerging risks, threats, or vulnerabilities; updates on our risk management activities, including investments in risk mitigation and governance; compliance with laws and regulations; internal controls; and updates on incidents.

companyName: TRIUMPH GROUP INC


text: We conduct a regular cybersecurity risk assessment process through our CISO and dedicated information security team, which reports to the Information Security Steering Committee. This committee meets at least quarterly to review current program progress and discuss and evaluate risks that could be material to our business, including cybersecurity threats. The Information Security Steering Committee is comprised of key leadership across the Company to support cross-functional representation.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: Cybersecurity risk management is a critical priority for our Company, and we recognize the increasing sophistication and prevalence of cyber threats globally. We face ongoing risks related to cyber-attacks, data breaches, and system disruptions, which could materially impact our operations, financial results, and reputation. These risks encompass a broad spectrum, including potential disruptions to our critical energy infrastructure, compromise of confidential or sensitive operational and commercial data, theft of intellectual property, and financial losses resulting from business interruption, remediation costs, and regulatory penalties. Our cybersecurity program is designed to align with industry-leading standards, including the widely recognized NIST Cybersecurity Framework (CSF), and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. This framework guides our approach to cybersecurity risk management through five core principles Identify, Protect, Detect, Respond, and Recover, which enable what we believe is a comprehensive and proactive security posture. Our cybersecurity program is comprised of policies, procedures, controls, and tools designed to mitigate cybersecurity risks. We maintain a risk assessment process which includes steps for identifying cybersecurity threats, assessing the severity and impact, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. This program includes preventative controls, continuous monitoring, incident detection and response capabilities, and regular security assessments and updates. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements.

companyName: Venture Global, Inc.

ticker: VG


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data"). Our information security function is led by our Director of Information Technology, overseen by our Senior Vice President of Finance and Financial Planning, with the support of our third-party specialists. Our information security function helps identify, assess and manage risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including automated tools, domain name system filtering, antivirus protection, vulnerability scanning and penetration testing.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: The Evergy Companies' cybersecurity organization use the NIST CSF to model the security program. The Evergy Companies have implemented a layered defense model to protect against cyber intrusions and attacks. The Evergy Companies employ security practitioners with cybersecurity and information technology degrees and certifications and with extensive experience, with several holding top secret and secret federal government clearances. The Evergy Companies have a 24-hour Security Operations Center that monitors for security events and the Evergy Companies frequently engage with multiple third parties to analyze network traffic. Further, the Evergy Companies regularly and as needed engage cybersecurity consultants and third parties to assist with the identification, assessment and mitigation of cybersecurity risks and assessment of the Evergy Companies' risk mitigation practices.

companyName: Evergy, Inc.

ticker: EVRG


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains and recognize cybersecurity measures have become more critical due to remote work, and we continuously evaluate improvements and new measures to protect our information and computing systems. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security or eliminate all risks associated with cyberattacks to us or third parties with whom we do business. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: We have dedicated substantial resources to prevent and manage cybersecurity risk. We have administrative, technical, and physical security measures in place, as well as policies and procedures to require third parties to whom we transfer data to implement and maintain appropriate security measures. We proactively employ multiple methods at different layers of our systems which are designed to defend against intrusions and attacks and protect our data. We also consider the threats and challenges that we and other companies face as cybersecurity attacks grow in frequency and complexity.

companyName: Dynatrace, Inc.

ticker: DT


text: The Board's Audit Committee oversees our ERM program, which includes cybersecurity risk management as a focus area. The full Board also receives periodic reports from management on the ERM program.


text: We have processes to identify and mitigate cybersecurity risks stemming from our relationships with third parties, including protocols to assess vendors' cybersecurity programs before we engage them and to monitor vendors, once engaged, for ongoing compliance with our cybersecurity standards.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Members of our management team have prior work experience in supervising and implementing cybersecurity risk mitigation efforts in highly-regulated industries. Our internal cybersecurity personnel and retained external cybersecurity consultants also have a breadth of expertise across core cybersecurity disciplines including governance, risk, compliance, and security architecture.

companyName: SURGE COMPONENTS INC

ticker: SPRS


text: Our Board of Directors has delegated risk management oversight responsibility for information security, which includes data privacy and cybersecurity, to the Governance and Nominating Committee. In addition, beginning in fiscal 2025, the Company's Board of Directors appointed a special committee of the Board of Directors (the "Technology Committee") to oversee and advise on technology-related strategies, investments, risks and innovations to enable alignment with the Company's strategy, operational priorities and cybersecurity protections. Among other responsibilities, the Technology Committee oversees the Company's cybersecurity framework, data privacy practices, and information security programs and scorecards.

companyName: TYSON FOODS, INC.

ticker: TSN


text: Oversight of Third-party Risk In the course of our business, we regularly exchange data and information with certain third parties in various ways, exposing us to risk related to the cybersecurity posture of and information management practices of those third parties. To try to mitigate this risk, we have implemented processes that may, depending upon the nature of the relationship with the third party, require security assessments and data integration design reviews prior to allowing our systems to connect with theirs. In addition, we seek to require these third parties to adhere to pre-established cybersecurity standards. Where applicable, we try to obtain contractual commitments with those third parties to ensure these security requirements are met.

companyName: NORDSTROM INC


text: We use the Three Lines Model in order to ensure our information security program's effectiveness and readiness. Our first line is our IT Security Operations, which implements and executes upon a robust control framework, while our Information Security Assurance function maintains an information security assurance program that includes external penetration management. Our second line is our Risk and Compliance functions. Our Risk function performs table top exercises, "red team" testing and stress testing, while our Compliance function ensures regulatory requirements are identified proactively and monitors compliance with our internal policies and procedures. Our third line consists of our Internal Audit function, which provides objective assurance and testing over internal policies and procedures related to our information security program.

companyName: Enstar Group LTD


text: Proactive cybersecurity monitoring for threat detection and swift response, Tools to address vulnerabilities and protect information assets, Endpoint security measures, geo-fencing, and geo-blocking on firewalls, and Automatic email prioritization to help our information technology department efficiently address the most critical threats.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Audit Committee reviews cybersecurity on a quarterly basis. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to our peers. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board of Directors and the Audit Committee discuss our approach to cybersecurity risk management with the Chief Information Security Officer (CISO) and other cyber team members, as well as senior leadership.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: We are constantly assessing our environment for cybersecurity threats, and we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. At the time of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. See Part I, Item 1A. Risk Factors – "Evolving cybersecurity and data privacy requirements (in particular, compliance with applicable federal, state and foreign laws relating to handling of personal information about individuals) could increase our costs, and any significant cybersecurity or data privacy incident could disrupt our operations, harm our reputation, expose us to legal risks and otherwise materially adversely affect our business, results of operations and financial condition."

companyName: AMERICAN AIRLINES, INC.


text: We have a dedicated team of information security professionals (our "information security team") who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, software security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO"). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team's structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive culture of security, whereby all e Plus employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.

companyName: EPLUS INC

ticker: PLUS


text: Our cybersecurity program is overseen by our head of human resources, information technology (IT) and facilities, who manages our third-party providers of IT services. We have engaged contractors to provide cybersecurity standards, architecture and processes. As part of our service agreement with our contractors, we receive identification and reporting of risks to our management and board. Our information technology team maintains a security operations center intended to identify anomalous activity. Further, our policies require all employees to notify our compliance, legal or information technology functions in the event of a cybersecurity incident.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Operating Officer (COO) or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness. We have regular and ongoing security education and training for employees and recovery and resilience tests. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessments results are shared with the IT Committee and Board of Directors.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: As described above, we have engaged a third-party IT and cybersecurity firm to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Members of this dedicated third-party IT and cybersecurity team include a virtual chief information security officer (vCISO) who is responsible for the overall development and implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer, and director of information security. Our management, including our Chief Executive Officer, oversees the work of our third-party IT and cybersecurity team and regularly communicates with members of the team. Through the policies and controls described above, including our incident response policy, representatives of the third-party IT and cybersecurity team as well as members of our management, including our Chief Executive Officer, are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents. The representatives of our third-party IT and cybersecurity team who lead our cybersecurity risk management and risk assessment process have collectively over 30 years of prior work experience in various roles managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans. The members of the cybersecurity team hold degrees in computer engineering and cybersecurity as well as advanced cybersecurity certifications, including a Certified Information Systems Security Professional (CISSP) certification, a Certified Information Systems Auditor (CISA) credential and a Certified Information Security Manager (CISM) certification. Other members of our third-party cybersecurity team have also obtained various professional certifications and advanced training in the areas of information security and cybersecurity.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: The Chief Financial Officer (CFO) and designees are responsible for reviewing and approving the Cybersecurity Risk Management processes, or exceptions to such processes. External Counsel is consulted on legal matters related to Cybersecurity Risk or Incident Management as deemed necessary by leadership.

companyName: Drilling Tools International Corp

ticker: DTI


text: The Company's EVP of Technology is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our EVP of Technology has over two decades of experience as a senior executive in technology-driven enterprises with expertise across cybersecurity, compliance, manufacturing process engineering, database architecture, interface programming and more.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: Related to Cybersecurity Risks Our Executive Director of Information Technology (IT) reports directly to our Chief Financial Officer (CFO) and is responsible for the strategic leadership and direction of our cybersecurity program, with support from our Associate Director of Information Security and Associate Director of IT. With over 20 years of experience in IT and cybersecurity risk management, our Executive Director of IT works alongside individuals across other Company management functions to establish and implement our cybersecurity risk management strategy. Our Executive Director of IT is informed of and monitors cybersecurity incidents through communications with system users as well as monitoring our intrusion detection systems and firewalls.

companyName: Adicet Bio, Inc.

ticker: ACET


text: Littelfuse strives to assess and update its cybersecurity program on a regular basis using an Information Security Management System (ISMS) comprised of three main elements – 1) independent internationally recognized vendors and technologies for assessments and monitoring, 2) strong internal controls based on industry standards, and 3) Board and Senior Leadership governance and support.

companyName: LITTELFUSE INC /DE

ticker: LFUS