text: Our cybersecurity strategy is governed by a dedicated cybersecurity team, under the leadership of the Chief Information Security Officer (CISO). This team is responsible for the continuous monitoring and improvement of our cybersecurity posture. Furthermore, our Board of Directors regularly reviews our cybersecurity strategies and policies, ensuring they align with our overall business objectives and the evolving cybersecurity landscape.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing our (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV

secItem: Item 1C


text: Third Party Service Provider Risk Management Vendor risk assessment is part of the Company's cybersecurity program, which facilitates management of third-party service providers' IT-related risks. Third-party service providers that have access to the Company's network, data and information are subject to a cybersecurity due diligence process and the corresponding security control requirements based on the nature of the engagement. The vendor risk assessment process is reviewed at least annually.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: A key element of the Company's Cybersecurity System is to mature the system to align with the CIS18 Critical Security Controls security framework. The CIS controls are designed based on real-world data about cyber-attacks, to ensure that the measures are effective against current threats. The framework provides a prioritized set of actions, which enables the Company to focus its efforts on the most effective defensive measures first. This prioritization helps in optimizing the use of resources for maximum impact on security. This strategy provides a structured and effective approach to cybersecurity, helping the Company to protect its assets, comply with regulations, manage risks, and improve its overall security posture.

companyName: OneMeta Inc.

ticker: ONEI


text: Identify, Protect and Detect: We have designed and implemented an industry standard security architecture, policies and procedures applying least privilege, and third-party monitoring of security controls of our core enterprise systems.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: In addition, from time to time, the Board may constitute a special committee to focus on a particular cybersecurity matter or risk.

companyName: MKS INC

ticker: MKSI


text: Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and contractually impose obligations onto them related to the services they provide and/or the information they process.

companyName: Grindr Inc.

ticker: GRND


text: Strategy and Investment Our cybersecurity strategy is integral to our broader risk management policy. We invest in state-of-the-art cybersecurity technologies and infrastructure to enhance our defensive capabilities and have a dedicated system of internal controls in place to prevent, monitor and remediate cyber risks including any risks from utilization of third party service providers. Additionally, we allocate resources for ongoing staff training and awareness programs to foster a culture of cybersecurity mindfulness across the organization and maintain dedicated channels of communication with our third party service provider monitoring our virtual environment to facilitate timely cyber incident identification and remediation. Our strategic investments in cybersecurity are tailored to address the unique challenges and risks pertinent to our industry and operational scope.

companyName: INNOVATE Corp.

ticker: VATE


text: The Vice President of Information Technology (" VP of IT ") oversees the daily operations of our cybersecurity risk management program and plays a central role in assessing and managing critical risks from cybersecurity threats with the support of additional IT professionals. The VP of IT role is currently held by an individual who has approximately twenty years of experience in information security management, application portfolio management, and IT governance, risk, and compliance. The VP of IT periodically reports on the cybersecurity program to the Chief Financial Officer ("CFO").

companyName: PLUG POWER INC

ticker: PLUG


text: Third-Party Risk Assessments We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections and require those vendors and providers, that meet certain risk profiles, to meet appropriate security requirements, controls, and responsibilities.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: We are reviewing our security training protocols to ensure all employees received annual security training for all employees. This security training will be focused on overall InfoSec, privacy best practices, and review of company policies.

companyName: Rumble Inc.

ticker: RUM


text: The Company has internal disclosure committees made up of members of management to assist in fulfilling its obligations to maintain disclosure controls and procedures and to coordinate and oversee the process of preparing our periodic securities filings with the SEC. The disclosure committees are composed of members of management and is chaired by our Vice President and Corporate Controller. The disclosure committees meet on a quarterly basis and more often if necessary. The Company has policies and procedures in place to ensure that our disclosure committees are appropriately informed of any matters that should be considered in advance of applicable public filings, including cybersecurity and data privacy matters, and to address the proper handling and escalation of information to management and the Board of Directors, the Risk Oversight Committee, and/or the Audit Committee.

companyName: DIODES INC /DEL/

ticker: DIOD


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data and could have a material adverse effect on our business, financial condition or reputation. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: VISION SENSING ACQUISITION CORP.


text: We maintain standard procedures to help assess, identify and manage material risk posed by cybersecurity threats and regularly evaluate how we can integrate these procedures into our overall risk management processes. For example, we require that all of our employees who have access to our internal network complete formal cybersecurity training upon hire and on a periodic basis, including training on phishing, malware, and other cybersecurity risks. We also continuously evaluate our information technology systems and our practices that relate to our information technology systems. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with these efforts but may elect to do so in the future.

companyName: BIO-PATH HOLDINGS, INC.

ticker: BPTH


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We aim to conduct periodic incident response tabletop exercises and planned incident response drills to refine and update incident response processes.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with the analysis of our security controls and those of our key vendors;

companyName: ATN International, Inc.

ticker: ATNI


text: The Executive Vice President of Information Technology has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer of other public companies.

companyName: Verano Holdings Corp.

ticker: VRNO


text: We have established an Information Security Management System ("ISMS") comprised of policies, procedures, and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall enterprise risk management systems and processes. Our ISMS is aligned to generally accepted security standards and is certified by third-party auditors according to ISO/IEC 27001 standards. We routinely assess cybersecurity risks for materiality, including assessing any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: QUALYS, INC.

ticker: QLYS


text: Cybersecurity is an important element of the Company's overall enterprise risk management program. The Company has a multilayered system to assess, identify, and manage cybersecurity risks. The system is designed to help protect the Company's information assets and operations from internal and external cyber threats. The system is used to understand and manage risks to help support business resiliency and to protect data subjects' information from unauthorized access or attack, as well as to secure the Company's networks, systems, devices, products, and services. Cybersecurity is incorporated into the Company's enterprise risk management program through membership within and regular reporting to the Enterprise Risk Committee.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: Our third-party service providers report to our Principal Financial Officer who is responsible for the management of the Cybersecurity program. The Principal Financial Officer, on a regular basis, reports to the Audit Committee.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: We engage third-party advisory firms to conduct assessments of the maturity of our security program and, among other measures, work to be Payment Card Industry compliant where required. We also maintain incident response procedures and business continuity and contingency plans and periodically hire third parties to conduct vulnerability analyses. We also compare our processes to standards set by the National Institute of Standards and Technology and/or International Organization for Standardization, as appropriate.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: cybersecurity risk management program shall include: assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; awareness and spear-phishing resistance training of our employees, and senior management; cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and vendor management policy for service providers.

companyName: JUPITER NEUROSCIENCES, INC.

ticker: JUNS


text: This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Cyngn Inc.

ticker: CYN


text: With regard to risks posed by third-party vendors and service providers, Voya Financial has a dedicated team that is responsible for evaluating, assessing, and addressing those risks, with the ultimate goal of protecting sensitive information and the security of our operations and systems supported by those vendors and providers using a risk-based approach. This team conducts due diligence on third-party vendors and service providers, including evaluating their information security controls and related measures, to identify potential risks and implement appropriate controls.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee within the board of directors' is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Turnstone Biologics Corp.


text: At Outset, we strive to protect the confidentiality, integrity and availability of the personal data entrusted to us. We continue to invest in our cybersecurity program in an effort to enhance our ability to prevent, detect, contain, and mitigate cybersecurity threats.

companyName: Outset Medical, Inc.

ticker: OM


text: SecureTech's Board of Directors actively oversees risks, including cybersecurity threats, as part of its risk management function. However, currently, there are no dedicated processes or committees specifically informing the Board of Directors about these risks. Given our company's size and current operations, we consider the risk of significant cybersecurity incidents to be minimal.

companyName: Securetech Innovations, Inc.

ticker: SCTH


text: The security and availability of our information systems and the protection of the information we collect, create, process, and store are important to our business. We have implemented a cybersecurity program that is designed to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: multi-factor authentication;

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: Over the last two years, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect is, including our business, results of operations, or financial condition.

companyName: Decoy Therapeutics Inc.

ticker: DCOY


text: Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, asset management, tracking and disposal, incident detection and response, systems monitoring, vulnerability management policy, vendor management program, disaster recovery/business continuity plans, employee training, risk assessments, penetration testing, cybersecurity insurance, encryption of data, dedicated cybersecurity staff/officer, network security controls, asset management, tracking and disposal, data segregation, systems monitoring, and access controls.

companyName: CS Disco, Inc.

ticker: LAW


text: Our Board of Directors (the "Board") has oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the management of systemic risks, including cybersecurity, in accordance with its charter. The Audit Committee receives periodic reports from management concerning our significant cybersecurity threats and risks and the processes we have implemented to address them, and engages in discussions with management regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks. These discussions include a review of our cybersecurity-related risk assessment and risk management policies.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: We have implemented a cybersecurity governance program intended to assess, identify, and manage risks from threats to the security of our information, systems, and network. Our risk-based measures aim to proactively manage threats and prove the effectiveness of our internal controls.

companyName: Titan Machinery Inc.

ticker: TITN


text: As part of the executive team reporting to the Board, our CTO oversees our cybersecurity policies and processes, including those described in "Risk Management" above. The processes by which our CTO is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include log review from IT and operations teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: Our information security management team is led by a global CIO, to whom the CISO and Chief Technology Officer report. The CIO, who reports directly to the CEO, has more than 30 years of experience in information technology and is responsible for information technology, information security, and business applications at a strategic level across the Company's global platform. Moreover, the CIO is also responsible for reporting any information security matters to the Disclosure Committee to support the Company's compliance with applicable disclosure obligations. Our CISO has held various positions in the information security field over the past 18 years including senior level positions across multiple industries with a focus on establishing and executing systems and security strategies to protect corporate data and improve regulatory compliance. The experience of our information security management spans various job practice analysis areas and is underpinned by relevant education and certifications as well as decades of in-field experience in areas such as information security program development, information security governance, risk management and information security incident management. As discussed above, management reports regularly to the Board on our information security program.

companyName: PRA GROUP INC

ticker: PRAA


text: The Company has a Cybersecurity Plan for assessing, identifying, and managing material risks from cybersecurity threats. The intent of the Cybersecurity Plan is to provide a proactive and systemic approach to meet the evolving requirements for cybersecurity and related compliance in the utility industry. The Cybersecurity Plan's objectives include: • adopting and using established cybersecurity standards and industry best practices; • protecting personally identifiable information; • protecting infrastructure operations, including Supervisory Control and Data Acquisition (SCADA) systems at electric substations and natural gas plants; • securing customers', employees', and the Company's data; • complying with North American Reliability Corporation Critical Infrastructure Protection Reliability Standards and standards for the protection of Bulk Electric System Cyber Systems; and • continually assessing and, as necessary, enhancing the Company's cybersecurity through a managed process integrated with the Company's risk management principles.

companyName: UNITIL CORP

ticker: UTL


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see our "Risks Related to Cybersecurity, Data Privacy and Information Technology" contained in Item 1A - Risk Factors of this Annual Report on Form 10-K.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: We rely upon both internal and external resources for evaluating and enhancing our cyber posture. At least annually, our information security and internal audit teams conduct comprehensive internal and external penetration testing, supplemented by more frequent Purple-team Tests that are designed to identify critical areas of our technical environment and potential vulnerabilities that may need to be addressed. Our information security team also retains external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. We conduct tabletop exercises to prepare for potential cyber incidents and assess our cybersecurity preparedness and processes. We also require annual cybersecurity training by our employees, conduct regular exercises to help our employees recognize phishing emails and other social engineering tactics, and provide various methods for employees to report suspicious activity that may give rise to a cyber incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program's continuous improvement process.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Classified Business and Security Committee of the Board of Directors is briefed by senior leadership, as appropriate, on the cybersecurity of classified programs and the security of our classified business supply chain. Other than oversight of classified business cybersecurity, the full Board retains oversight of cybersecurity because of its importance to Lockheed Martin and the heightened risk in the aerospace and defense industry. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: The Audit Committee periodically reports to the full Board of Directors regarding its activities, which may include those related to cybersecurity. The full Board of Directors may also from time to time receive briefings from management related to our cyber risk management program. Directors may receive presentations on cybersecurity topics from our management, internal cyber security / information technology staff, or external experts as part of continuing education on topics that impact public companies.

companyName: Immuneering Corp

ticker: IMRX


text: To continually manage and control the material risks that cybersecurity threats present to the organization, ALLETE invests significantly in the cybersecurity elements outlined above. In addition, the Company has made significant investments to fulfill the operational and financial regulatory requirements laid out by the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Sarbanes-Oxley Act of 2002.

companyName: ALLETE INC

ticker: ALE


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Software and Infrastructure Engineering, Compliance and Legal teams, including our Director of Cybersecurity and Compliance. These individuals have prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: TrueCar, Inc.


text: Management's Assessment and Management of Cybersecurity Threats Members of the executive management team, along with others from senior management and others with varying areas of expertise, are engaged as part of our Cyber Risk Program: • Senior Vice President, Information Security and Compliance: Our SVP manages our Cyber Risk Program and reports directly to the Chief Legal Officer. He manages the day-to-day information security operation, oversees our security analysts and engineers and is a member of our Cybersecurity Subcommittee. He is trained in cybersecurity strategy, planning and execution and holds industry recognized security certification, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). Our SVP has extensive experience regarding cybersecurity matters and threats affecting business-to-business software and cloud service vendors such as E2open. • Chief Legal Officer: Our Chief Legal Officer, who also serves as our Acting Chief Risk Officer, supervises the SVP's management of our Cyber Risk Program and is the chair of our Cybersecurity Subcommittee of our Disclosure Committee. Our Chief Legal Officer has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims and loss mitigation. • Cybersecurity Subcommittee of the Disclosure Committee: We have created a Cybersecurity Subcommittee of our management Disclosure Committee which includes, the Chief Legal Officer, SVP and Chief Accounting Officer. The Cybersecurity Subcommittee meets to discuss and evaluate whether certain cybersecurity incidents require public disclosure and makes recommendations regarding disclosure to the Disclosure Committee. Additionally, the Chair of the Subcommittee shall convene a meeting when either: (a) she believes a reported incident or the occurrence of a series of related incidents, requires the analysis and discussion of the Subcommittee; or (b) when any member of the Subcommittee believes that such a discussion would be appropriate. Such meeting shall be convened within 48 hours of the incident, or sooner if reasonably practicable, to expediate a materiality determination for public company reporting purposes. This Cybersecurity Subcommittee is pivotal in ensuring timely disclosure of material information and complying with the SEC's final rules on cybersecurity risk governance adopted in late 2023. • Cyber Response Team: Pursuant to our Crisis Response Program, our Response Team, which comprises the Chief Legal Officer, Chief Financial Officer and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the Chief Legal Officer or Chief Financial Officer, on behalf of the Response Team, will report to or engage the Chief Executive Officer and the Chairman of the board of directors if and when an incident becomes a crisis or potential crisis.

companyName: E2open Parent Holdings, Inc.


text: Cybersecurity risk is part of management's risk oversight, although periodic reports are made to the Board of Directors of management's implementation and monitoring of our cybersecurity risks programs. Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. Management will update the Board, as necessary, regarding any significant cybersecurity incidents should they occur, so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: Airspan Networks Holdings Inc.


text: TPG employs processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: The Company's Board of Directors has assigned oversight of White Mountains's cybersecurity risk management to the Audit Committee. The Audit Committee receives periodic reports on White Mountains's cybersecurity risks and any material cybersecurity incidents at the direction of White Mountains's senior management. In addition, the Audit Committee receives reports addressing cybersecurity risks as part of the Company's overall enterprise risk management program.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: The operational risk team also has service provider monitoring in place in order to oversee and identify cybersecurity threats associated with the Partnership's use of third-party service providers. Prior to onboarding, the Partnership conducts due diligence for key new third-party services providers. This involves a diligence questionnaire sent by a cybersecurity training company that is then reviewed by the Partnership. The training company also assess the Partnership's security status during onboarding for services providers and, for critical suppliers, at regular intervals throughout the life of the supplier's contract.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: The audit committee receives periodic reports from senior management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Management's Risk Management Role Our Chief Financial Officer and our VP of Technology play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee encompassing a broad range of topics, including: • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and progress on remediation efforts; and • compliance with regulatory requirements and industry standards.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: •24x7 Security Operations and Incident Response • Identity Access Management support and governance • Security Architecture oversight and guidance • Governance, Risk and Compliance ("GRC") functions such as third-party risk management, cybersecurity policies, training, and awareness • Annual and independent penetration testing and vulnerability scanning activities conducted by trusted third parties Third party risk management, including, but not limited to, the following: • Periodic third-party reviews and assessments measuring cybersecurity services capability and maturity.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Our CDIO and VP of Platforms, Infrastructure and Cybersecurity also monitor the prevention, detention, mitigation and remediation of cybersecurity incidents through the same processes described above for the identification and management of material cybersecurity risks.

companyName: AVIS BUDGET GROUP, INC.

ticker: CAR


text: Role of the Board of Directors The Board of Directors has delegated to the audit committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The audit committee receives quarterly reports and updates from our Chief Information Officer and Vice President of IT and Information Security with respect to cybersecurity risk management. Such reports cover the Company's information security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape.

companyName: Paycom Software, Inc.

ticker: PAYC


text: The Company, as a part of its program has a documented cybersecurity incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of cybersecurity intelligence and risk sharing organizations. Employees undergo security awareness training.

companyName: KELLANOVA


text: As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, or data. In determining materiality, the Company evaluates factors such as potential financial loss, operational disruptions, regulatory implications, and reputational harm. The Company remains committed to enhancing its cybersecurity defenses through ongoing risk assessments, investment in technology, and adherence to industry best practices.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: Our Manager provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Manager's evolving information security policies, standards, processes and practices.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future. For additional information regarding the risk the Company faces from cybersecurity threats, please see the risk factors titled "We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers" and " We depend on outside third parties for the processing and handling of our records and data, which exposes us to additional risk for cybersecurity breaches and regulatory action." included in Part I. Item 1A. – Risk Factors of this report.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: In addition, risks from cybersecurity threats are integrated into Abbott's enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify and assess risks that could materially impact Abbott's business and operations.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: The CISO and CDIO work collaboratively across the business to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any future cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the organization are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CDIO are informed about, and monitor the prevention, detection, mitigation and remediation, of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: Shockwave Medical, Inc.


text: As of September 30, 2025, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: DFP HOLDINGS Ltd


text: Entergy and the Registrant Subsidiaries have incorporated certain cyber-specific response protocols and procedures into their Entergy Incident Management System framework for responding to emergency incidents. This includes the Entergy Incident Response Team Plan, which outlines Entergy's procedures, steps, and responsibilities for preparing for, detecting, containing, and recovering from an incident. The plan details the roles and responsibilities of Entergy's officers who would be engaged in such a response to an emergency incident,

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Cybersecurity threats haven't significantly impacted our operations, and we don't anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures.

companyName: DIH HOLDING US, INC.


text: Board of Directors oversees cybersecurity risks and performs an annual review of the Company's cybersecurity program, including management's actions to identify, detect, and respond to potential threats.

companyName: Cluster Group Holdings Ltd Co

ticker: CLUS


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We face risks associated with perceived or actual security breaches through cyberattacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems or those of our critical service providers."

companyName: KILROY REALTY CORP

ticker: KRC


text: We will develop and implement a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program will be integrated into our overall enterprise risk management program and includes a cybersecurity incident response plan.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Chief Information Officer, who reports to the CFO. Our Chief Information Officer has nearly 25 years of industry experience and has been with us since 2008. Our Global Head of Cybersecurity has over 20 years of cybersecurity and privacy experience, including serving in similar roles leading and overseeing cybersecurity programs at public companies.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: An overall assessment of our cybersecurity safeguards was conducted by an independent cybersecurity vendor. Our internal Cybersecurity Team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs on a regular basis. We use firewalls and protection software, and we additionally periodically rely on a third-party vendor for alerts regarding suspicious activity. A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents.

companyName: CSI Compressco LP


text: The Corporation maintains a third-party risk management program designed to identify, analyze and monitor risks, including cybersecurity risks, associated with vendors and outside service providers. Our vendor risk management team collaborates closely with the information security team to ensure third parties meet certain information security control requirements. Our information security team proactively monitors our internal systems and email gateways for phishing email attacks. Remote connections are also assessed and monitored given a portion of our workforce works remotely.

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: Cyber Governance & Oversight Members of management report to the Company's Board of Directors regarding cybersecurity matters, including the cyber risk assessments performed for the Company. As part of its risk oversight responsibility, the Board oversees our policies and strategies for mitigating cybersecurity risks.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: Our cybersecurity program was developed by integrating a range of relevant concepts and controls derived from established security frameworks. These include the National Institute of Standards and Technology Cybersecurity Framework, the Committee of Sponsoring Organizations of the Treadway Commission and related SOC 2 Control Objectives, as well as the Payment Card Industry Data Security Standard. It is important to note that while these frameworks guide our cybersecurity strategies and help us identify, access, and manage cybersecurity risks relevant to our business, this does not imply certification or that we meet or comply with any specific technical standards, specifications or requirements.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Containment —perform short-term containment, for example by isolating the network segment that is under attack; then focus on long-term containment, which involves temporary fixes to allow systems to be used in production, while rebuilding clean systems.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: Our Vice President, Enterprise Application's experience includes a Certified Information Systems Security Professional ("CISSP") certification, which is designed for security professionals with extensive knowledge in contemporary cybersecurity and information security practices. In addition, our Chief Executive Officer has broad expertise in overseeing cybersecurity programs, incident response teams and information technology departments.


text: The CISO, in coordination with the Bank's CRO, CIO and General Counsel, works across the Company to implement and monitor a program designed to protect the Company's information systems from cybersecurity threats and promptly respond to any cybersecurity incidents in accordance with the Company's cybersecurity incident response plan. The Company has recently bolstered cybersecurity leadership, with the addition of a Director of Information Security Officer ("DISO"). The DISO possesses a wealth of experience in the field of information security, notably having served as a regulator in charge of information security for over seven years. This background provides the DISO with a deep understanding of cybersecurity challenges and regulatory requirements faced by financial institutions. This expertise is invaluable in enhancing our cyber defenses and ensuring our compliance with stringent regulatory standards.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Risk management and strategy Planet Fitness recognizes the importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: One of the key functions of our board of directors is to provide informed oversight of our risk management processes. While management is assigned responsibility for the day-to-day response to material risks we face, our board of directors maintains responsibility for risk oversight, including risks related to cybersecurity threats. The Audit Committee of our board of directors is responsible for discussing risk exposures relating to cybersecurity, including current and emerging developments and threats, and the steps management has taken to monitor and control such exposures. The Audit Committee is composed of board members with diverse expertise, including financial, governance, and information security and controls, which equips them to oversee cybersecurity risks effectively.

companyName: BOISE CASCADE Co

ticker: BCC


text: On an annual basis the Company's IT Committee and Board will review and approve the information security and cybersecurity program, review and approve the business continuity plan and testing, and approve the risk assessment guidelines and methodologies.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Our Cybersecurity Risk Management Program is informed by the Center for Internet Security (CIS) Controls version 18. The CIS Controls offer a strategic framework that directs our implementation of effective cybersecurity defenses across 18 critical areas, ranging from asset management to data protection and network security.

companyName: Urgent.ly Inc.

ticker: ULY


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members depending on the circumstances, including the Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and Chief Financial Officer work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's management and its designees report to the board of directors for certain cybersecurity incidents.

companyName: Peraso Inc.

ticker: PRSO


text: At the day-to-day operational level, we maintain an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. We also periodically hold employee trainings on our privacy, cybersecurity and information management policies, conduct phishing tests and generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Board of Directors' Oversight of Risks from Cybersecurity Threats — The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats. The Audit Committee has been delegated responsibility by the Board for overseeing the Company's overall enterprise risk management program, including cybersecurity risk. The Audit Committee receives reports at least quarterly from the Director of Information Technology regarding cybersecurity matters, which may include, among other things, the results of cybersecurity audits, cybersecurity maturity assessments, other information technology matters, risk mitigation strategies, data protection and progress on initiatives. The Audit Committee Chair is responsible for reporting key cybersecurity issues regarding current and potential material cybersecurity threats and our risk mitigation response strategies to the Board. To further inform our Board and management on emerging cybersecurity issues, we periodically engage third-party cybersecurity experts to report to the Audit Committee, other directors, and management, as applicable, on topics that may include, among other things, the latest cybersecurity trends, new technologies, evolving threats in the marketplace, proposed initiatives, legislation, and reporting standards.

companyName: TALOS ENERGY INC.

ticker: TALO


text: Management Oversight Day-to day management of cybersecurity threats is conducted by our Information Technology department which is charged with identifying and reporting threats to senior management. On a quarterly basis, cybersecurity is reviewed by our Information Technology Steering Committee, which is comprised of our Chief Executive Officer, Chief Financial Officer, General Counsel and Head of Information Technology.

companyName: FUEL TECH, INC.

ticker: FTEK


text: As part of our defined cybersecurity policies and cybersecurity incident response plan, management is regularly updated on the status of the execution of our cybersecurity strategy and daily operations of the program. This includes regular reporting and evaluation of all cybersecurity incidents, not only those that may be deemed material.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: We engage a variety of third-party service providers to process and store data, including certain customer information, some of which may include personally identifiable information. We also depend on third-party service providers to host many of the systems and infrastructure used to provide our products and services. A limited number of third-party services support essential functions of our business, including the use of cloud-based technology.

companyName: Village Farms International, Inc.

ticker: VFF


text: When we experience a cybersecurity incident, we utilize our well-established incident response plans that operate both across the company and at the product and services level. Incidents are first triaged for severity, and then more deeply assessed to establish a plan of record and activate internal and external notification, disclosure, and communication plans, as applicable. Engineering and development resources are mobilized to resolve or remediate the incident. After the incident is resolved, a comprehensive post-incident review process is conducted.

companyName: MICROSOFT CORP

ticker: MSFT


text: Cybersecurity oversight forms part of the Board's risk oversight of the Company. The Board oversees efforts by management to manage the cybersecurity risks to which the Company may be exposed. The Board receives at least annual reports and meets periodically with the Chief Compliance Officer and the Managing Director of Information Technology, both of whom serve on the Committee. From its review of these reports and discussions with the Committee and management, the Board ensures it has sufficient awareness of the material cybersecurity risks to which the Company is exposed, enabling a dialogue about how management manages and mitigates those risks. The Board currently has three members who have obtained certifications in cybersecurity oversight.

companyName: DIAMOND HILL INVESTMENT GROUP INC

ticker: DHIL


text: Our board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The board carries out its risk oversight and management responsibilities by monitoring risk directly as a full board and, where appropriate, through its committees. Our board has delegated to the audit committee the oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The audit committee reports any material or notable cybersecurity incidents, findings and recommendations, as appropriate, to the full board for consideration. Our Chief Information and Innovation Officer ("CIIO") also presents to the audit committee and to the board, as appropriate, any updates, changes, or improvements on the Company's cybersecurity risk management program.

companyName: Lifevantage Corp

ticker: LFVN


text: AFG's cybersecurity program is directed by its EISG leadership team that is headed by the AFG CISO and three divisional officers who report to the CISO. This leadership group has collectively over 70 years of cybersecurity work experience, over 90 years of Information Technology ("IT") experience and over 20 years of IT audit experience. This experience involved various roles related to managing information security; developing cybersecurity strategy; implementing and monitoring effective cybersecurity controls and penetration testing. These individuals hold many industry-standard certifications including but not limited to Certified Information Systems Security Professional, Information Systems Security Management Professional, G2700 certification, GIAC Security Leadership Certification, Certified in Risk and Information Systems Control, Certified Information Security Manager, ITL certification and others. The CISO also holds a master's degree in information security. All members of this leadership team are active in their local cybersecurity communities and national conferences. They speak at local universities, local conferences, national conferences, and have conducted training sessions at international conferences like Black Hat, an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Their work has also been used in various best practice case studies by industry leading consulting and research firms.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: We manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training.

companyName: Triller Group Inc.

ticker: ILLR


text: Matson's Board of Directors has oversight of the Company's risk management process, which includes overseeing our process for identifying, assessing and mitigating significant financial, operational, legal, strategic, and other risks that may affect the Company. These risks include, among other things, risks related to cybersecurity and information security. Risk oversight plays a role in major Board decisions, and the evaluation of key risks is a core part of the decision-making process – from guidance on strategy to review of major capital expenditures.

companyName: Matson, Inc.

ticker: MATX


text: The Chief Financial Officer oversees the operation of our cybersecurity program and has over 10 years of executive experience overseeing risk management and internal controls. The Chief Financial Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Chief Financial Officer's oversight of the Company's information technology function and supervision of the Company's IT administrator.

companyName: CITIUS ONCOLOGY, INC.

ticker: CTOR


text: As part of the above planned processes, we may engage external auditors and consultants with expertise in cybersecurity to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: Iveda Solutions, Inc.

ticker: IVDA


text: The Partnership has no directors or executive officers and its affairs are managed by its General Partner. The General Partner is a wholly-owned subsidiary of MSCM. MSCM is ultimately owned by Morgan Stanley. Morgan Stanley, its businesses, the General Partner, the Partnership, and the broader financial services industry face an increasingly complex and evolving threat environment. Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of the Morgan Stanley Board of Directors (the "Board") and the Operations and Technology Committee of the Board (the "BOTC"). See "Risk Factors – The General Partner, the Partnership, the Funds and their respective service providers (including the Advisors) and operations are potentially vulnerable to cyber-security attacks or incidents" for information on risks to the Partnership from cybersecurity threats.

companyName: Ceres Tactical Commodity L.P.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes the implementation of a cybersecurity incident response plan. This plan was developed with support from our Audit Committee and in consultation with key stakeholders across our organization to ensure it accurately reflects their respective roles and responsibilities. The plan has been selectively disseminated throughout our organization to ensure appropriate coverage and to foster a cohesive and informed response to cybersecurity incidents.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: When necessary, the institution engages external assessors, consultants, and auditors with expertise in cybersecurity to evaluate and enhance its systems, policies and procedures. These external parties provide valuable insights into emerging threats and best practices, enhancing Bancorp's ability to adapt and respond effectively. Bancorp also undergoes reoccurring regulatory examinations, and any issues that are identified are actively tracked and monitored for remediation. In addition to external entities, Bancorp has internal oversight mechanisms to identify cybersecurity risks, including those associated with its use of third-party service providers and related downstream service providers. This includes thorough due diligence during vendor selection, ongoing monitoring, setting clear contractual obligations to uphold cybersecurity standards and other interventions necessary to address risk such as those addressed in Part I Item 1A " Risk Factors. "

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: Our policies, procedures and processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall enterprise risk management program. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: The Cybersecurity and Privacy Committee is co-chaired by our Information Security Officer (ISO), Product Security Officer (PSO), and Chief Privacy Officer (CPO), and its members include executive officers of the Company, including our Chief Technology Officer, Chief Financial Officer, Chief Information Officer, and Chief Legal Officer, as well as representatives from the finance, internal audit, quality, regulatory, and legal teams. Management's role in assessing and managing the material risks from cybersecurity threats is accomplished primarily through the committee.

companyName: DEXCOM INC

ticker: DXCM


text: The Company's management is responsible for the day-to-day management of risk, and our board of directors, including through its committees, is responsible for understanding and overseeing the various risks facing the Company.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: Executive management, consisting of the Chief Executive Officer and the Board, is responsible for identifying, evaluating, and responding to potential cyber risks. The Company periodically reviews its internal systems and third-party vendor protocols to assess vulnerabilities and ensure secure handling of sensitive business information.

companyName: Mercalot Inc.


text: Cybersecurity is a material part of ConnectOne's business. As a financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation, although to date the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition. See "Item 1A- Risk Factors - We cannot predict how changes in technology will impact our business; increased use of technology may expose us to service interruptions or breaches in security."

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property and proprietary business information theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; physical damage to utility and transmission infrastructure; and reputational harm. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks. As part of our enterprise risk management program, we consider cybersecurity risks alongside other risks in our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying material cybersecurity threats, assessing their severity, and deploying potential mitigations. We have implemented cybersecurity programs that are tailored to the distinct businesses of our segments.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: We depend on a variety of information systems and technologies (including cloud technologies) to manage our business. We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: Quoin Pharmaceuticals, Ltd.

ticker: QNRX


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws as well as overall business continuation risk.

companyName: Journey Medical Corp

ticker: DERM


text: Cybersecurity Governance: PyraMax Bank maintains a cybersecurity governance framework to ensure effective oversight and accountability. Key elements of the Bank's cybersecurity governance structure include:

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: The cyber security program relies on the Adviser and the Investcorp Group to engage external experts, which may include assessors, consultants, auditors, or other third parties as appropriate to evaluate its cyber security measures and risk management processes, including those applicable to the Company.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: Our Vice President & Chief Information Officer (the "CIO") leads our global information security organization and reports to the Board of Directors on matters related to cybersecurity on behalf of the Company's management. Our CIO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large industrial and technology companies.

companyName: Gentherm Inc

ticker: THRM


text: The governance structure for the Global Cybersecurity and Technology Controls organization is designed to appropriately identify, escalate and mitigate cybersecurity risks. Cybersecurity risk management and its governance and oversight are integrated into J.P. Morgan's operational risk management framework, including through the escalation of key risk and control issues to management and the development of risk mitigation plans for heightened risk and control issues. Independent Risk Management ("IRM") independently assesses and challenges the activities and risk management practices of the Global Cybersecurity and Technology Controls organization related to the identification, assessment, measurement and mitigation of cybersecurity risk. As needed, J.P. Morgan engages third-party assessors or auditing firms with industry-recognized expertise on cybersecurity matters to review specific aspects of J.P. Morgan's cybersecurity risk management framework, processes and controls.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: We conduct table-top simulation exercises to regularly test our cybersecurity incident response processes with the aim of enhancing effectiveness against evolving threats. Our incident response procedures guide our preparedness, detection, response, and recovery actions. Additionally, we maintain cyber insurance designed to address certain aspects of cyber risks.

companyName: FEDEX CORP

ticker: FDX


text: Our information security team consistently updates the General Counsel, CFO and CEO on all cybersecurity risks and incidents to ensure top management stays informed about our cybersecurity posture and potential risks. Additionally, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, granting them comprehensive oversight and the ability to provide guidance on critical cybersecurity issues.

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: We also identify our cybersecurity threat risks by using the services of a managed services provider. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor as appropriate emerging data protection laws and industry literature and implement changes to our processes that are designed to comply with such laws if needed; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including redundant firewalls, intrusion prevention and detection systems, multi-factor authentication, encryption, anti-malware functionality and access controls; • provide annual and routine mandatory training utilizing Knowbe4 (leading security awareness training module) for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct phishing email simulations for employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • utilize a managed services provider to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities we, in concert with our third party managed services provider, take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: Our board of directors has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Financial Officer ("CFO"), who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CFO was previously the chief financial officer for other mining companies where he was responsible for information technology security at such companies. Any significant Cyber incidents are reported to the audit committee and ultimately to the board of directors.

companyName: Gatos Silver, Inc.


text: A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Our board of directors addresses cybersecurity risk management as part of its general oversight function. The board oversees our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Iridium Communications Inc.

ticker: IRDM


text: Our management team is responsible for the management of risks we face, including our CIO. Our CIO has been in the role since May 2021, and has 30 years of experience in technology risk management and cybersecurity, primarily within the financial services sector.

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: These risks may include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or business partners, violation of privacy or security laws and other litigation and legal risk and reputational risks.

companyName: Chord Energy Corp

ticker: CHRD


text: We are a trusted partner for businesses of all sizes, and we take this responsibility seriously. Ensuring the secure and continuous operation of our networks and systems, as well as the processing, maintenance, and confidentiality of the sensitive information they contain, is vital to our business operations and strategy. We process records containing confidential data related to individuals and businesses. Additionally, some of our products are hosted solutions, and the volume of data we store for our customers, including personal, critical business, and other potentially sensitive information, has been growing. Technology-based organizations like ours are susceptible to targeted attacks that aim to exploit network and system vulnerabilities. A successful cyberattack could lead to the disclosure or misuse of sensitive business and personal information, disrupt our operations, damage our reputation, and deter clients and consumers from using our products and services. It could also result in litigation, the termination of client contracts, government inquiries, and/or enforcement actions. Any of these events would have a material negative impact on our business, prospects, results of operations, and financial position.

companyName: DELUXE CORP

ticker: DLX


text: Our Manager's cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, services, and our Manager's broader enterprise information technology ("IT") environment; • a team comprised of IT and Legal & Compliance personnel of our Manager principally responsible for directing (1) the cybersecurity risk assessment processes, (2) our Manager's security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes or those of our Manager; • cybersecurity awareness training of employees with access to our Manager's IT systems; • a cybersecurity incident response plan; and • a third-party risk assessment process for key service providers.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: We engage consultants, auditors, or other third parties in connection with our risk assessment processes. These professionals assist us in the design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. In addition, in order to mitigate cybersecurity risks associated with our use of third-party service providers, we require certain third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: Our board of directors is responsible for understanding the primary risks to our business, including any cybersecurity risks, and has delegated such responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. The board of directors and audit committee may also receive periodic updates from management as to our and the Adviser's cybersecurity risks and the Adviser cybersecurity program developments.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: While the Company does not employ a Chief Information Officer or consider cybersecurity threats to be a material risk to the business strategy, results of operations or financial position of the Company, the Audit Committee discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents. The Audit Committee provides regular reports to the full Board of Directors.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: We have a cybersecurity governance structure that involves the oversight and involvement of our board of directors and senior management.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that materially affected our business, financial condition and results of operations, we can provide no assurance that we will not experience a material cybersecurity incident in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the risks we face from cybersecurity threats, please see the risk factor titled "Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our cybersecurity" included in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.

companyName: vTv Therapeutics Inc.

ticker: VTVT


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of Adial's cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: ADIAL PHARMACEUTICALS, INC.

ticker: ADIL


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. These include the ongoing monitoring of our systems, including with the assistance of third-party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2024. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.

companyName: CNH Industrial Capital LLC


text: The Audit Committee, designated as the responsible body for cybersecurity oversight, ensures regular information flow about cybersecurity risks to the Board of Directors. Our cybersecurity program is led by our Chief Information Security Officer (CISO), who has over 20 years of experience in the cybersecurity field. Their expertise is supported by industry certifications, regular participation in leading advanced training programs, and advisement roles. The CISO leads a dedicated team of security professionals who provide comprehensive coverage of critical program capabilities. We prioritize transparency by providing regular reports to the Audit Committee, senior management, and relevant stakeholders, keeping them informed on evolving cyber threats, ongoing assessments, and any significant findings. This collaborative approach ensures informed decision-making and timely response to potential risks, safeguarding our critical assets and valuable information.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: We have an Information Security Team to strengthen our cybersecurity risk management activities across the Company. The Information Security Team reports to our CISO who works in collaboration with our CIO, Chief Compliance Officer and General Counsel. The Information Security Team is responsible for the oversight and operation of our Program, and the management our security standards and operating procedures.

companyName: InnovAge Holding Corp.

ticker: INNV


text: Board of Directors is responsible for oversight of our cyber-risk management program and management's role is to assist the Board of Directors in identifying and considering material cybersecurity risks, ensure implementation of management and employee level cybersecurity practices and training and provide the Board of Directors with regular reports regarding any cybersecurity attacks or vulnerabilities.

companyName: LQR House Inc.

ticker: YHC


text: The Enterprise Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of FHLBank physical and information assets in accordance with the GLB Act and the interagency guidelines issued thereunder, and applicable laws.

companyName: Federal Home Loan Bank of Topeka


text: Upon the detection of any cybersecurity incident, our CIO and DIS provide reports to our CEO and other members of senior management, including with respect to the monitoring, investigation, mitigation and remediation of the incident. Our Board and Audit Committee oversee our cybersecurity management and receive regular updates from senior management, including our CIO, on matters such as major cyber risk areas, cybersecurity monitoring and prevention technologies and practices and occurrence, mitigation and remediation of cybersecurity incidents, if any. We also periodically engage third parties to perform cybersecurity assessments to detect vulnerabilities, such as ransomware or data loss, and to provide cybersecurity incident response training.

companyName: DIAMOND OFFSHORE DRILLING, INC.


text: In the last three fiscal years, we have not experienced any cybersecurity incidents that have materially impacted or are reasonably likely to materially impact our business strategy, results of operations, or financial condition.

companyName: TrueBlue, Inc.

ticker: TBI


text: Our ERM organization, under the supervision of the Chief Risk Officer, leads our efforts to consider and assess threats to the Company and the risks that result therefrom, including cybersecurity threats and related risks. With support from Information Security, Legal, and the Privacy Office, ERM conducts periodic evaluations of our information security posture, manages regular meetings with the executive leadership team to discuss risk levels across the company, and maintains and monitors risk tolerances and escalation criteria that drive executive and the board of director communications, as further described in our disclosures related to the board of directors oversight of material risks associated with cybersecurity threats.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: We maintain a comprehensive process for: (i) identifying the assets, threats, and vulnerabilities that affect our information systems and networks; (ii) analyzing the likelihood and impact of potential cyberattacks on our assets, operations, and objectives; (iii) evaluating the existing cybersecurity controls and measures that we have in place to prevent, detect, and respond to cyberattacks; and (iv) implementing and monitoring the appropriate cybersecurity solutions and practices that reduce our cyber risk exposure and enhance our cyber resilience.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: Depending on the information systems and environment, our cybersecurity program includes various administrative, physical, and technical safeguards designed to manage and mitigate material risks from cybersecurity threats, including, for example: an incident response plan, incident detection and response, disaster recovery plans risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, a vendor risk management program, penetration testing, cybersecurity insurance, dedicated cybersecurity staff, and asset management, tracking and disposal. Additionally, we provide all employees, including part-time and temporary employees, with annual and ad hoc cybersecurity awareness training.

companyName: Immunovant, Inc.

ticker: IMVT


text: In the event a high-risk cybersecurity incident is identified, our Incident Response Team will coordinate the response in accordance with our Information Security Incident Response Plan and make necessary communications to the ECSC and executive leadership. The DOC and CIO will make any required communications to the Chief Executive Officer (CEO), with the CEO making any required communications to the Board and Technology & Sustainability Committee. Our CEO, Chief Financial Officer, General Counsel and CIO are responsible for assessing such incidents for materiality, ensuring that any required notification or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.

companyName: DANA Inc

ticker: DAN


text: Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO. Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly and summaries of key issues discussed and actions taken are provided to the Risk Committee.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: Our current cybersecurity risk assessment program consists of an annual review of our risks and policies. The program outlines governance, policies and procedures, and technology we use to oversee and identify risks from cybersecurity threats.

companyName: Stemtech Corp

ticker: STEK


text: The Company is subject to various cybersecurity risks and continuously monitors and assesses its cybersecurity measures to protect against potential threats. These risks include operational disruption, reputational harm, theft of intellectual property, fraud, extortion, harm to customers or employees, and violation of data privacy or security laws.

companyName: Science Applications International Corp

ticker: SAIC


text: We currently do not maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents experienced by the Company.

companyName: US NUCLEAR CORP.

ticker: UCLE


text: We have a third-party risk management program that assesses the inherent risks of third-party service providers and informs our due diligence and continuous monitoring of such parties. Through this process, our information security personnel, in collaboration with our vendor management operations, evaluate the information security and business continuity capabilities, risks and controls, of prospective and existing service providers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.

companyName: Aditxt, Inc.

ticker: ADTX


text: Material Risk Management The Company continually analyzes and responds to material risks from cybersecurity threats in order to manage them to acceptable levels. The results of related risk assessments are used to prioritize the risks based on their potential impact to the Company and to inform the necessary actions and the appropriate functions to be involved in responding to those risks. Garmin's cybersecurity risk management processes are integrated into the Company's overall risk management processes. Material risks from cybersecurity threats are communicated to the Company's management and Board of Directors and are evaluated and considered alongside operational, legal, and other risks faced by the Company in determining mitigating actions and the allocation of resources.

companyName: GARMIN LTD

ticker: GRMN


text: Our management team takes steps to stay informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: TAITRON COMPONENTS INC

ticker: TAIT


text: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks. Our privacy and information security policies and standards govern our business lines and subsidiaries and encompass incident response, access control, and vendor management, among others. In order to develop these policies and procedures, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business. See Item 1, " Business—Regulation—Cybersecurity and Privacy " for additional details.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Assessment and Identification conduct regular cybersecurity risk assessments to identify potential vulnerabilities across our information systems, manufacturing platforms, and third-party integrations. We prioritize risks based on their potential impact to our financial condition, operational continuity, and reputation.

companyName: Quality Industrial Corp.

ticker: QIND


text: To identify, assess and mitigate cybersecurity risk, we have implemented a global information security management program that includes administrative, technical, and physical safeguards. This program seeks to identify, detect, protect and respond to threats to our information systems. Our security operations center provides advanced threat detection and response capabilities. We maintain an insider threat program to detect, investigate and mitigate insider threat risks to Lumen assets, data, services and personnel globally.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Since August 2020, our Vice President, Chief Information Security Officer (" CISO ") has led a team of information security professionals who have the first line responsibility for our cybersecurity risk management processes and activities. Our CISO has more than 20 years of experience as an information security leader responsible for assessing and managing cybersecurity programs. He reports directly to our Executive Vice President, Chief Information and Digital Officer, who reports to our Chief Executive Officer, has over 25 years of experience managing global information technology operations, including strategy, application, infrastructure, information security, support, and execution.

companyName: Invitation Homes Inc.

ticker: INVH


text: Data and Web Security Safeguards We have implemented the following information security solutions and practices: • deployment of intrusion prevention systems designed to detect and block malicious traffic, • web application firewalls designed to protect our application from attacks, • network firewalls, • security information and event management, • user and entity behavior analytics, • endpoint detection and response designed to protect our workstation and server population, • data loss prevention software at multiple layers of our IT environment, • regular penetration testing conducted by both our internal teams and external providers, and • a multi-layered vulnerability management program designed to identify technical bugs within our product and infrastructure.

companyName: Paylocity Holding Corp

ticker: PCTY


text: Our board of directors has approved a committee comprised of directors and management called the Information Technology Committee. This committee provides oversight and governance of the technology program and the information security program. This committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur from time to time in accordance with the Business Continuity Plan in order to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity and/or privacy incidents.

companyName: Southern States Bancshares, Inc.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network. No risks from cybersecurity threats or previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition or results of operations. However, there can be no assurance that the controls and procedures in place to monitor and mitigate the risks of cyber threats will be successful or sufficient to avoid material losses or consequences in the future. The Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: IntelGenx Technologies Corp.


text: Additionally, our cybersecurity incident response plans require timely reporting to our Disclosure Committee ("DC") regarding any potentially material cybersecurity incidents. The DC is tasked with evaluating the materiality of any such incidents and is comprised of our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, and supported by key leaders across the organization, including our Chief Information Officer and CISO.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: The Company (or the third parties it relies on) may not be able to fully, continuously, or effectively design and implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.

companyName: Arhaus, Inc.

ticker: ARHS


text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Brighthouse Financial enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity program, which is managed at an enterprise level, is designed to be aligned with the National Institute of Standards and Technology ("NIST") framework, which organizes the management of cybersecurity risks into five categories: identify, protect, detect, respond, and recover.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, our first priority is to contain the cybersecurity incident as quickly as possible consistent with the procedures in our IRP.

companyName: Public Storage

ticker: PSA


text: Security Governance – The Company's Board of Directors has designated a subcommittee of the Board that meets quarterly to provide oversight of risks from cybersecurity threats. The Company's Vice President and Chief Security Officer ("CSO") reports to this subcommittee to inform them on the Company's threat and risk landscape, and the management of cybersecurity incidents. This subcommittee consists of board members and the Company's executive leadership team. The CSO also leads a cross-functional, executive-level Security Council that meets quarterly and governs all aspects of the Company's security program. The Company maintains a risk-based security program that is supported by a comprehensive set of policies, procedures, and standards based on the NIST cybersecurity framework, which includes administrative, physical, and technical safeguards.

companyName: CINCINNATI BELL INC