text: During 2024 and through the date of this Annual Report on Form 10-K, though the Partnership and our service providers may have experienced cybersecurity incidents, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Partnership, including our business strategy, result of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Our IT Security Department aims to monitor and assess these risks to maintain the security and continuity of our operations. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. Please see "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management program, using outside specialists where deemed necessary.

companyName: Mersana Therapeutics, Inc.

secItem: Item 1C


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our CFO, who reports to our Board, to manage the risk assessment part of our overall risk management system, we monitor our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings integrated into new employee onboarding processes and engage consultants, experts, or other third parties in connection with our risk assessment processes. These third parties assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: Role of Management Our cybersecurity risk management program and activities are led by a dedicated CISO who is also our Vice President of Information Technology. Our CISO reports to our Senior Vice President and CIO, and oversees a team of information security professionals within the Information Security Group. Our CISO joined IDEXX in 2024 and has more than twenty years of business and technical experience leading information technology teams, including cybersecurity teams, at high tech, marketing and healthcare companies. Our CISO, in close collaboration with our CIO is responsible for our cybersecurity-related governance programs, overseeing testing of our compliance with standards and remediation of known risks, and leads our employee training program.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the audit committee and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the board's oversight is proactive and responsive. The audit committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of MetaVia.

companyName: MetaVia Inc.

ticker: MTVA


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," under the heading "Cybersecurity risks could result in the loss of data, interruptions in our business, damage to our reputation and subject us to regulatory actions, increased costs and financial losses, each of which could materially adversely affect our business and results of operations," which should be read in conjunction with the information above.

companyName: New Mountain Net Lease Trust


text: Our Chief Information Officer and our VP, Infrastructure have extensive experience in the information technology area, including cybersecurity. In particular, our Chief Information Officer has over 10 years of professional experience in the information security area, including as a result of his service as an IT VP at companies such as Prologis, and holds certifications relating to cybersecurity. Further, our VP, Infrastructure has over 15 years of professional experience in the information security area, including as a result of roles of increasing responsibility at Summit Materials and his service as a senior systems engineer at various companies.

companyName: Summit Materials, LLC


text: Third-Party Service Provider Risk Management Our third-party risk management process is designed to identify, assess, and mitigate risks associated with third-party service providers, including cybersecurity risks. An initial assessment is conducted to assess the cybersecurity risks associated with a third-party provider based on various criteria, such as whether the third-party provider has access to our network, data, and information systems. Third-party providers that are identified through the initial assessment as warranting further review are subject to additional risk assessment. In parallel, we have designed a contracting process to mitigate cybersecurity risks by specifying the rights and responsibilities of the parties.

companyName: CONOCOPHILLIPS

ticker: COP


text: Additionally, we maintain an Incident Response Plan that provides established procedures for timely reporting and escalation of significant cybersecurity incidents; our commitment involves promptly notifying regulatory authorities, customers, and other stakeholders in the event of any material cyber incidents that may impact our operations or the security of sensitive information. The Incident Response Plan is coordinated through the Director of Information Technology ("Director of IT") and key members of executive management who are responsible for escalation as part of the Plan.

companyName: Bogota Financial Corp.

ticker: BSBK


text: Cybersecurity training is provided to all employees as part of the overall cybersecurity program. The Company contracts with third party vendors to conduct internal and external penetration tests against the Company's networks and IT assets to ensure controls are operating in an appropriate manner.

companyName: FIRST BANCSHARES INC /MS/


text: Our operations rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information (including personal information) in our systems and networks. We also rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information in the systems and networks of our customers and third parties, including suppliers, sellers and servicers, financial market utilities, and other third parties. Cybersecurity risks for companies like ours continue to increase. Like many companies and government entities, from time to time we have been, and expect to continue to be, the target of attempted cybersecurity incidents and other information security threats, including those from nation-state and nation-state supported actors.

companyName: Universal Token

ticker: UTKN


text: The Company integrates risk management into its overall cybersecurity strategy and has implemented processes designed to identify, assess, prioritize, and manage risks to protect data, intellectual property, and information assets. As part of our risk governance and management, the Company has developed procedures to; identify and evaluate risks, measure them against predefined criteria, devise and execute strategies to mitigate identified risks, continuously monitor and review risk profiles, and communicate risks to relevant stakeholders. Addressing cybersecurity risks involves a comprehensive approach that encompasses both internal assessments and external information sources. For instance, the Company engages in security assessments conducted by internal and external experts to ensure compliance with security policies and industry frameworks; and vulnerability assessments to discover vulnerabilities in networks, systems and applications. The Company has strategically reduced its hardware footprint by eliminating on-premise datacenters and moving IT infrastructure into cloud-hosted and Software as a Service (SaaS) providers. As a result, the Company is streamlined and agile to respond quickly to market fluctuations and changes in the industry. Additionally, the Company leverages cloud-hosted and SaaS providers that offer Service Level Agreements (SLAs) and adhere to compliance and regulatory requirements for the industry. We oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk. The Company performs ongoing risk assessments that evaluate IT systems and assess the likelihood of occurrence, estimate potential impact, and plan for remediation.

companyName: Vireo Growth Inc.

ticker: VREOF


text: We have also engaged a third party service provider to monitor our IT infrastructure and information systems for security threats, escalate any threat to our IT team, and assist us in responding to threats, vulnerabilities and risks. Our cyber risk management program is aligned with the standards, guidelines and best practices of the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: DIAMOND OFFSHORE DRILLING, INC.


text: We have continued to invest in an evolving state-of-the-art cybersecurity framework of tools, processes, training, and people designed to efficiently assess, identify, and remediate material risks that could affect business operations, financials, or public reputation. Our multi-layered approach to cybersecurity involves regular network monitoring, vulnerability scanning, advanced threat detection, and incident response capabilities against recognized cyber threats to our business and stakeholders, including ransomware, data breaches and insider threats. We regularly update our security measures, as necessary, to ensure we address all new threats and technologies, using the National Institute of Standards and Technology ("NIST") Framework as a guide, when appropriate and relevant to our business.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: Our cybersecurity policies and procedures encompass data privacy, incident response, information security and risks from our use of third-party vendors. In order to help develop these policies and procedures, we monitor applicable privacy and cybersecurity laws, regulations and guidance in the regions where we do business, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.

companyName: Civeo Corp

ticker: CVEO


text: We may engage third parties from time to time, including consultants and auditors to conduct assessments of information systems. We have policies and processes in place to govern third-party access and the risks associated with such access.

companyName: Greenbrook TMS Inc.


text: Our Chief Information Officer ("CIO"), Director, Cyber Security (who reports to the CIO) and our Director, Technology Compliance (who ultimately reports to the Chief Legal Officer) have primary responsibility for the implementation of our cybersecurity program and the management of our responses to information technology and security risks, including risks related to cybersecurity threats. Our cybersecurity program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards Technology.

companyName: YETI Holdings, Inc.

ticker: YETI


text: The Registrants have third-party vendor risk management processes to oversee and identify risks from cybersecurity threats associated with their use of third-party service providers. Enterprise Security works cross-functionally across the companies to review new vendors and their proposed solutions as they are engaged by the Registrants. The Enterprise Security team's monitoring and assessment of third-party cybersecurity practices is continuous and ongoing throughout the Registrants' relationship with the third party. Based on this process, the Enterprise Security team may require specific security controls on the third-party application, system, hardware or software being deployed. Enterprise Security monitors vendors for disclosed vulnerabilities and change in scores from external risk scoring agencies.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Heading our cybersecurity program is our Chief Information Officer ("CIO"). Our CIO has over 30 years of experience in Software Engineering and Information Technology/Cybersecurity and is supported by skilled professionals from our Information Technology team. This seasoned team provides regular updates to our Enterprise Risk Management Steering Committee (the "ERM"), composed of our Chief Executive Officer, Chief Financial Officer, Chief Administrative Officer, and other members of our senior leadership. Our Audit Committee and Board of Directors receive regular reports from the ERM, as well as directly from our CIO on a quarterly basis. These reports cover various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. SUNOPTA INC.

companyName: SunOpta Inc.

ticker: STKL


text: Our CISO reports to our executive leadership team composed of our Chief Executive Officer, Chief Financial Officer, and Chief Information Officer on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology leaders also meet regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics. We have also developed a cross functional disclosure working group to assess elevated cybersecurity incidents and, as appropriate, report on such events to Avantor's standing Disclosure Committee to conclude on the materiality of the incident and any need for regulatory reporting.

companyName: Avantor, Inc.

ticker: AVTR


text: Management's Role in Cybersecurity Risk Management TIAA's management, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Account. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. Management of the Account is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Account, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.

companyName: TIAA REAL ESTATE ACCOUNT


text: Company has implemented basic cybersecurity measures designed to protect our digital infrastructure and data integrity. These measures include secure data storage solutions, the use of firewalls and antivirus software, and access controls to limit the exposure of sensitive are committed to continually assessing our cybersecurity posture and adapting our strategies to mitigate potential cyber threats. This includes staying informed on the latest cybersecurity trends and threats, as well as best practices for protection.

companyName: NEXIEN BIOPHARMA, INC.

ticker: NXEN


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Board has appointed a Chief Information Security Officer (CISO). Together with the Director of Risk Management, they provide direction and oversight for information and cyber-security related activities across the Company—including existing and emerging initiatives, service provider arrangements, incident response, business continuity management, staff training, monitoring of key controls and adjusting the information security program in response to changes in operations and internal/external threats and vulnerabilities. In this role, the CISO leverages 24 years of information technology experience and has maintained various applicable cybersecurity and IT audit certifications.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: Cybersecurity is a significant and integrated component of the Corporation's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Corporation has not, to its knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Corporation.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Key elements of our cybersecurity risk management program includes: • a cybersecurity department principally responsible for (i) our cybersecurity risk assessment, management, and compliance processes, (ii) development and maintenance of our security controls, and (iii) our monitoring for and response to cybersecurity incidents; • engagements with external professionals and internal subject matter experts designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment, including, but not limited to risk and compliance assessments, security scanning and testing, and periodic updating of our risk management framework; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls, including, but not limited to cybersecurity tools and technology, cybersecurity services, threat intelligence information, professional services consulting, and contract staff augmentation; • training of our employees in cybersecurity awareness and payment card compliance and additional training for cybersecurity personnel, software developers, and senior management in cybersecurity-related topics including, but not limited to, incident response, secure software development, and training commensurate with job responsibilities; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management program designed to evaluate the cybersecurity capabilities of new and existing centrally-managed vendors based on their criticality to our business and risk profile.

companyName: Hyatt Hotels Corp

ticker: H


text: Our information security program is designed to meet the needs of our clients who entrust us with their sensitive information. We maintain International Organization for Standardization 27001 certification for our enterprise-wide information security management system and program. Where applicable, we align to other industry standards or frameworks, including the Cloud Security Alliance's Cloud Controls Matrix, the Payment Card Industry Data Security Standard, the Health Insurance Portability and Accountability Act, and the CSF HiTRUST Common Security Framework.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: The Company engages leading cybersecurity firms to assist with its security engineering and operations; provide independent evaluations of its security posture through regular assessment, penetration testing, or ethical hacking; and to audit and provide advice on how to make its security operations and controls more effective.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: The Board also has a standing committee (the "Cybersecurity Committee"), comprised of certain members of the Board, that advises it on cybersecurity matters and provides strategic guidance and direction for our cybersecurity program. The Cybersecurity Committee convenes as necessary to address critical or emerging cybersecurity concerns and to ensure alignment on approach. Our CIO and CISO collaborate with the Cybersecurity Committee and report to the entire Board on a quarterly basis, or more frequently as needed. Additionally, the Cybersecurity Committee reviews the outcomes of our regular tabletop exercises with our CIO and CISO and ensures that lessons learned have been incorporated into the overall strategy.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: The CFO also apprises the Board of cybersecurity incidents promptly for more significant incidents and in the aggregate for less significant incidents.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: The Board receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from our information systems manager. The Board also receives briefings from management on the cybersecurity risk management program as needed.

companyName: VPR Brands, LP.

ticker: VPRB


text: Our Board considers cybersecurity risk as part of its risk oversight function. In connection with the Audit Committee's oversight of the Company's risk management, the Audit Committee reviews with management, at least annually, the Company's cybersecurity risk exposure and the steps management has taken to monitor or mitigate such exposure, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes. In addition, management will update the Audit Committee and the full Board, as necessary, regarding cybersecurity incidents, that we may experience.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: The Board of Directors, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. They receive reports regarding such risks from management, including our Vice President of IT. They also oversee the response to any significant cybersecurity incidents. Our Vice President of IT, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Globus and reports directly to the Chief Operating Officer.

companyName: GLOBUS MEDICAL INC

ticker: GMED


text: As part of our Sarbanes-Oxley controls, our Internal Audit department tests our IT policies including those pertaining to passwords, backup and recovery, user access, change control and hardware and software maintenance. These audits assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of financial reporting systems and data. Additionally, key employees complete a survey containing questions about cybersecurity in connection with the quarterly Sarbanes-Oxley certification process. If any control deficiencies that represent material cybersecurity risks are identified in connection with these audits, those would be reported to the Audit Committee and Board of Directors. We also obtain SOC 2 certifications from certain of our third-party service providers.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: On July 26, 2023, the SEC adopted a rule requiring enhanced disclosure of cybersecurity risk management, strategy, and governance. Microvast's SVP of Information Technology, is responsible for risk assessment and management. This individual has experience in developing security policies, enforcing compliance, orchestrating incident responses, and implementing cybersecurity strategies.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. The Investment Manager's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on the Investment Manager's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: Oversight of Cybersecurity Risks The board and our audit committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our board and/or our audit committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Business Manager and the measures we, and the Business Manager are taking to mitigate such risks. In addition to such reports and updates, our board and/or our audit committee receive updates from management as to changes to our and the Business Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the board or audit committee, as appropriate.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership briefs the board of directors on our cybersecurity and information security posture, and our board of directors is informed of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: The Company considers cybersecurity risks as part of our overall risk management process. The management team works closely with our IT consultants and IT auditors to ensure potential risks are mitigated within our systems.

companyName: Epsilon Energy Ltd.

ticker: EPSN


text: We have taken a multifaceted approach to addressing cybersecurity risks, including leadership from our senior management and Board of Directors, direct supervision and operational execution from our information technology ("IT") department and active involvement of employees. The Company's senior management devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. We periodically assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our IT team reviews cybersecurity risks, and we have a set of Company-wide policies and procedures concerning cybersecurity matters, including policies related to encryption standards, remote access, multi factor authentication, confidential information, the use of the internet, social media, email and wireless devices and incident response.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Our efforts to create a secure digital environment start with the governance and oversight of our data security and privacy policies and strategy. At the Board level, cybersecurity is overseen by the full Board and by the Board's Audit Committee, which has primary responsibility for overseeing cybersecurity and privacy risks. At least quarterly, the Board and/or the Audit Committee receives reports on data protection and cybersecurity matters from senior information technology ("IT") leaders, including our Chief Information Officer ("CIO") and CISO, as well as the Chair of our Data Security and Privacy Governance Committee (discussed below). In addition, at least annually, our full Board holds a meeting dedicated to cybersecurity topics. Periodically, our Board receives presentations on cybersecurity matters from third-party cybersecurity experts.

companyName: HOME DEPOT, INC.

ticker: HD


text: Audit Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks. Our Head of Information Security has primary responsibility for our entity-wide information security program. Our current Head of Information Security has held that position since 2019 and has broad information technology and cybersecurity experience as a result of that role and past work experience which includes cybersecurity consulting. Our Head of Information Security regularly briefs senior leadership on our cybersecurity and information security posture including on the prevention, detection, mitigation, and remediation of cybersecurity incidents, and senior leadership will then brief the Audit Committee. In the event of an incident, we intend to follow our incident response playbook, which outlines our planned response from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: To date, QNB has not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect QNB, including its business strategy, results of operations, or financial condition. As discussed under "Risk Factors" in Item 1A, however, the sophistication of cybersecurity threats continues to increase, and the preventative actions taken by QNB to reduce the risk of cybersecurity threats or incidents may not be sufficient in a particular circumstance. Accordingly, QNB may not be able to anticipate all cybersecurity breaches no matter how well designed or implemented QNB's cybersecurity controls and procedures are, and QNB may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: QNB CORP.

ticker: QNBC


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: CERUS CORP

ticker: CERS


text: Our board of directors oversees our biennial enterprise risk assessment process that we utilize to assess key risks within the company, including security and technology risks and cybersecurity threats. The audit committee of our board of directors oversees our internal control over financial reporting, including with respect to financial reporting-related information systems. The audit committee receives internal audit reports conducted by an independent audit firm on various cybersecurity matters. In addition, our risk management committee reviews and evaluates reports monthly, and as needed, related to cybersecurity activity and incidents.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. Our Senior Director, Head of IT oversees the cybersecurity program through risk management, employee security training, and oversight and escalation of threat monitoring and incident response. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. In the event of a major security incident, we have established an escalation path for stakeholder notification and remediation efforts, and major incidents are immediately escalated to the Head of IT, Chief Financial Officer, and Chief Operations Officer. In 2024, we proactively conducted a thorough and robust cybersecurity assessment, performed by an external cybersecurity partner, to evaluate our risks and identify key areas to improve our cybersecurity posture. We have implemented processes when evaluating third-party service providers, for example by reviewing available audit reports including the System and Organization Controls (SOC 2) reports and requesting disclosure of any previous cybersecurity events. We also perform quality audits of certain regulated vendors, which includes an assessment of the vendor's information technology system and associated controls.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: We also periodically retain outside expertise to conduct a maturity assessment of our program against industry standards and participants. Our program is informed by industry standards such as, for example, the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity ("NIST CSF"), but this does not imply that we meet all technical standards, specifications or requirements under the NIST CSF or other sources.

companyName: BEST BUY CO INC

ticker: BBY


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, including through a formal annual risk assessment. These efforts include a wide range of activities, including external audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, endpoint reduction response, security operation centers, vulnerability and patch management programs and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Shockwave Medical, Inc.


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our Company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.

companyName: GenFlat Holdings, Inc.

ticker: GFLT


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to " Cyber-attacks or other failures in telecommunications or information technology systems and deficiency in our, or those of third parties upon which we rely, cybersecurity could result in information theft, data corruption and significant disruption of our business operations. " under Item 1A, "Risk Factors," in this annual report on Form 10 -K.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: Our Senior Director of Information Technology ("IT"), internal IT, information security and legal functions, and third-party service providers (collectively, "Cybersecurity Team") help identify, assess and manage the Company's cybersecurity threats and risks. Our Cybersecurity Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment. The Cybersecurity Team uses various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, scanning the threat environment, evaluating our and our industry's risk profile, maintaining policies designed to coordinate our efforts with law enforcement to respond to threats, internal and external audits, conducting threat assessments, conducting third party threat assessments, and conducting vulnerability assessments.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Commencing in 2024, our Audit and Risk Committee, on behalf of the board of directors, is overseeing our cybersecurity risk management program.

companyName: BOSTON OMAHA Corp

ticker: BOC


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of emerging industry-wide trends in cybersecurity risks along with specific risk areas our company has greater risks throughout the year, including, among others, those relating to cybersecurity threats. These reports come from the Company's Chief Information and Operations Officer (the "Head of IT") to include our enterprise risk profile on a quarterly basis. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are industry-standard metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Neuronetics, Inc.

ticker: STIM


text: Our cybersecurity program is overseen by the Company's CTO in close collaboration with the CEO and our legal and compliance teams. O ur CTO has a technical background and is well informed about cybersecurity risk management best practices, as well as our Company's risk management framework. Our legal and compliance teams supporting the Company's cybersecurity efforts bring a wealth of experience from prior positions, as well as participation in ongoing training sessions and industry events.

companyName: Spire Global, Inc.

ticker: SPIR


text: Due to the size of the Company, our information technology ("IT") environment does not utilize overly complicated systems or processes. The Company does not sell products or conduct business in an online environment and our primary transactional activity is done through partnerships with oil and gas operators and other investment managers. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet the Company's needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. The Company uses multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment. We also engage a separate third-party vendor to provide staff IT security education, testing for social engineering vulnerabilities, and reporting on employee training.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Director, Information Technology who reports to our Head of Human Resources and the Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: Potential threats, our response to such threats, and our evaluation of any residual risk are communicated quarterly to the audit committee. As necessary, the chief information and operations officer provides interim updates to the audit committee and, as appropriate, the board of directors, concerning high-priority or material information or cybersecurity threats. Our chief information and operations officer also provides a quarterly update to the audit committee regarding our ongoing information and cybersecurity initiatives; the current cybersecurity landscape and emerging threats; and metrics on the effectiveness of certain aspects of our information and cybersecurity program.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: The Information Technology and Information Security sub-committee is a sub-committee of the management level Enterprise Risk Management Committee and is represented by managers within various departments and includes the CISO, the Chief Technology Officer ("CTO"), and the Chief Information Officer ("CIO") and other key departmental managers from throughout the entire company. This sub-committee meets quarterly to provide oversight of the technology management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. Meetings with key team leaders occur as required and in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Company's Executive Leadership Team meets monthly with the CISO, CIO, and CTO and reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at various meetings and responses to any actions taken to/from the Enterprise Risk Committee on a quarterly basis or more frequently as may be required by the IRP.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: To help mitigate risks associated with third party vendors and service providers, the Corporation has implemented an extensive Vendor Management process, overseen by the Vendor Management Committee. All new vendors undergo due diligence analysis by the Corporation's Vendor Management team, including review of their cybersecurity, data and privacy protection, and business continuity practices of those vendors with access to Corporation or customer data. Annual due diligence follow-up reviews are performed for all existing vendors on an ongoing basis and the results are reported to the Vendor Management Committee.

companyName: FIRST KEYSTONE CORP

ticker: FKYS


text: Cyber Risk Management and Strategy • We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and routine review of our policies and procedures in an effort to identify risks and refine our practices. We engage certain external parties to enhance our cybersecurity oversight. • In an effort to deter and detect cyber threats, we perform annual phishing tests with employees. We also conduct annual cybersecurity and prevention training for employees, which may cover topics such as social engineering, phishing, password protection, confidential data protection, and mobile security, and is designed to educate employees on incident reporting. We also use technology-based tools, including third-party tools and solutions, designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. • We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems.

companyName: Bicara Therapeutics Inc.

ticker: BCAX


text: Our IT Application Security Program includes reviews and assessments of security vulnerabilities and remediation. We use commercially reasonable efforts to update security systems regularly to protect against known vulnerabilities. We plan to perform vulnerability scans at least quarterly and penetration testing annually as well as after any significant infrastructure or application modification. Whitebox and blackbox security testing and manual penetration testing is performed to monitor security controls and defenses.

companyName: JACK IN THE BOX INC

ticker: JACK


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. Our IT leadership reports to our Chief Executive Officer (CEO) periodically and on an as-needed basis to manage our risk assessment and mitigation process. We monitor and test our safeguards and regularly conduct training for our employees on these safeguards, in collaboration with human resources, IT, and management. We are committed to promoting a company-wide culture of cybersecurity risk management.

companyName: CHINA AUTOMOTIVE SYSTEMS INC/2


text: In addition, the Audit Committee, with the assistance and advice of Company management and third-party consultants, oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The Audit Committee receives periodic reports from Company management regarding cybersecurity risk factors.

companyName: BATTALION OIL CORP

ticker: BATL


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: XCel Brands, Inc.

ticker: XELB


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO. The CISO works closely with the CIO, Chief Privacy Officer ("CPO"), and other members of the legal team who report to the General Counsel, to review the cybersecurity program while monitoring global data protection regulations and cyber security laws. The CISO, CIO, and CPO, collectively, have over 35 years of work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our CISO is currently a board member for the National Technology Security Coalition, a non-profit, non-partisan trade association serving as the voice of CISOs to help improve national cybersecurity and has served on the board of advisors of many security technology companies.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: Risk Management Leadership The primary responsibility for assessing, monitoring, and managing our cybersecurity risks lies with our highly experienced CISO. With two decades of cybersecurity expertise, including multiple CISO roles, our CISO plays a pivotal role in developing and executing our cybersecurity strategies. His responsibilities include overseeing governance programs, addressing known risks, leading employee security training, and executing the incident response plan in case of a cybersecurity incident.

companyName: NERDWALLET, INC.

ticker: NRDS


text: Our Director of IT Security & Risk Management holds an undergraduate degree in computer science and a master's degree in business administration from Texas Tech University and has served in various roles in information technology for over 20 years, including serving as an IT security consultant and performing IT audit work for PricewaterhouseCoopers, Deloitte, and Grant Thornton. He then returned to the industry to oversee the IT security program for classified systems at a publicly-traded defense contractor. He next joined a publicly-traded energy services company to lead the IT security program before joining us in 2019. Certifications he has held at various points throughout his career include the following – Certified Information Systems Auditor (CISA), Check Point Certified Security Administrator (CCSA), Check Point Certified Security Expert (CCSE), Cisco Certified Network Associate (CCNA), Cisco Certified Network Professional (CCNP), and Microsoft Certified Professional (MCP).

companyName: U.S. SILICA HOLDINGS, INC.


text: 2023 Cybersecurity Incident On November 19, 2023, we became aware of a cybersecurity incident that impacted certain of our systems. We promptly commenced an investigation, retained leading experts to assist the Company, notified law enforcement authorities, regulatory authorities and other stakeholders and followed our incident response plans. In addition, we took containment measures such as blocking access to certain of our systems resulting in varying levels of disruption to our businesses. The incident was contained on November 26, 2023.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: We utilize a combination of technology controls, service providers, and processes to actively monitor and protect our network and systems. All employees are required to participate in a number of information security training and awareness programs on an annual basis, which include training on how to identify and report cyber risks and events.

companyName: AECOM

ticker: ACM


text: Ongoing Mitigation Efforts The Company has implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management. In addition, the Company has continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture. The Company has focused on its incident response procedures and retained a leading incident response provider. The Company has also recently strengthened its disaster recovery procedures. The Company's solutions incorporate cybersecurity features that are routinely analyzed. In addition, the Company maintains insurance that responds to cyber-attacks, which coverage limit and cost is discussed and reviewed with the Audit Committee annually.

companyName: OMNICELL, INC.

ticker: OMCL


text: Our corporate information security team is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The corporate information security organization manages an enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this effort is our technical solution that provides monitoring of our data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.

companyName: RideNow Group, Inc.

ticker: RDNW


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see the risk factor "Data protection, cybersecurity and data privacy issues could negatively impact our business" in Item 1A of Part I of this Report.

companyName: NCR Voyix Corp

ticker: VYX


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief financial officer, and the Contran CIO regularly brief the board of directors on our cybersecurity and information security posture, and our board of directors is apprised of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.

companyName: NL INDUSTRIES INC

ticker: NL


text: Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service provider risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Commercial Vehicle Group, Inc.

ticker: CVGI


text: See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.

companyName: GameStop Corp.

ticker: GME


text: However, we recognize the importance of cybersecurity and are in the process of developing more robust strategies. We plan to: Develop a Cybersecurity Framework: Establish a formal risk assessment process to identify vulnerabilities. Cybersecurity Expertise: Consider hiring or consulting with cybersecurity professionals to guide our strategy. Training: Begin employee training on cybersecurity awareness to prevent common threats like phishing.

companyName: Global Innovative Platforms Inc.

ticker: GIPL


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors– Intellectual Property Tax, Regulatory, and Litigation Risks" in this annual report on Form 10-K.

companyName: CINCINNATI BELL INC


text: Our VP of Technology leads all components of our IT functions. Our VP of Technology has over 29 years of experience in the IT profession, including 7 years with Smart Sand.

companyName: Smart Sand, Inc.

ticker: SND


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate our business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Steele Creek Capital Corp


text: Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks to our IT systems and information. As a part of this process, we have engaged an independent third-party specialist to review our cybersecurity environment, including formal reviews and assessments, and we have requested specific, actionable recommendations for improvement and implementation.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Operationally, we, along with CoreSite, each perform periodic penetration testing to identify weaknesses in systems and networks so that they can be addressed appropriately. At least once per year, we also engage an outside cybersecurity firm to perform independent testing. Our vulnerability management program is in place to adequately identify, classify, prioritize and remediate vulnerabilities affecting assets. Our security operations program monitors our systems and networks, and is responsible for investigating, responding to, and reporting any potential security incidents in a timely manner. Our Incident Response Plan includes steps to determine materiality of any such incident and escalate matters to the Board and our employees are regularly trained on the plan. We conduct an incident response exercise at least annually to ensure a timely, consistent and compliant response. In 2024, we performed an IT-focused tabletop exercise which simulated multiple types of cybersecurity incidents, including (a) compromised credentials, (b) brute force attack, (c) uncleaned malware and (d) ransomware. This tabletop exercise was facilitated by a third-party.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: We have an incident response plan under which certain cybersecurity incidents are escalated within the Company to senior executives on the cybersecurity risk management committee, and, where appropriate, reported to the Board and Audit Committee in a timely manner. At the management level, our cybersecurity risk management committee, comprised of senior executives representing functional and business areas, including our legal team, has broad oversight of the Company's risk management processes. Members of the Company's cybersecurity risk management committee includes certain IT leadership and the General Counsel. The committee meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cyber security risks. Certain IT leadership and the General Counsel attend each cybersecurity risk management committee meeting to report on ongoing cybersecurity matters. Our IT leadership also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.

companyName: Leslie's, Inc.

ticker: LESL


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk assessment process. We have a cybersecurity-specific risk assessment process designed to assess identified material risks from cybersecurity threats. This process is designed to help us manage our material risks from cybersecurity threats and protect against, detect, and respond to cybersecurity incidents.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Cybersecurity risk management is an integral part of Payoneer's control infrastructure and is included as an overall risk in our enterprise risk management program. Payoneer's cybersecurity risk management program is designed to align with industry best practices like National Institute of Standards and Technology ("NIST") and Control Objectives for Information Technology ("COBIT") which help provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Risk Committee of the Board of Directors (the "Risk Committee") of material cybersecurity threats and incidents. Our cybersecurity team is responsible for assessing our cybersecurity risk management program considering industry best practice and aligning to regulatory requirements and engages with third-party security experts for advisement on cybersecurity risk assessments and system enhancements. In addition, our cybersecurity team provides training to employees on a periodic basis.

companyName: Payoneer Global Inc.

ticker: PAYO


text: We have adopted the internal policies mentioned above to implement reporting procedures for any cybersecurity incident and a cybersecurity management framework to continuously monitor and access risk. These policies are developed and periodically reviewed by our IT department. The processes outlined above have also been integrated into our overall risk management strategy.

companyName: DORIAN LPG LTD.

ticker: LPG


text: The Company has cybersecurity risk management processes, including physical, technological and administrative controls, intended to protect the confidentiality, integrity and availability of the Company's information technology infrastructure and systems or any information residing therein. The Company relies on third party service providers to operate, maintain and monitor its information technology infrastructure and systems and to assess, identify and manage material risks from cybersecurity threats with respect thereto. The Company's management monitors its service providers. The Company's service providers are tasked with notifying the Company's management of any material cybersecurity incident that negatively impacts the Company's information technology infrastructure and systems or any information residing therein. Material and potentially material cybersecurity incidents would be assessed by the Company's executive officers for remediation and future prevention and detection.

companyName: AMREP CORP.

ticker: AXR


text: As part of our overall approach to integrated risk management, we have established an information security program that includes policies, processes, and organizations to assess, identify and manage risk from information security threats, including cybersecurity threats, and including risks related to third parties, such as partners, vendors, and suppliers. The program also includes an incident response plan that is designed to provide controls and procedures for responding to cybersecurity or other security incidents. We have established an Information Security team that is responsible for overseeing the program across the Company, including with respect to information, personnel, and facilities. The Information Security team is led by our Chief Information Security Officer, or CISO, who coordinates with other departments in areas such as facilities, physical security, operations, data protection, information technology, product development, finance, legal and compliance.

companyName: OneStream, Inc.

ticker: OS


text: We focus on process, which includes policies, procedures and governance structures designed to help us identify, assess and response to cybersecurity risks. We have a written cybersecurity framework that closely aligns with NIST's CSF. In addition, we maintain a cyber incident response plan to facilitate our response to cybersecurity incidents and formed an Incident Response Team composed of the Chief Information Security Officer, the Chief Legal Officer, the Chief Operating Officer, the Chief Risk Officer, the Head of Investor Relations, and the Associate General Counsel. The foregoing officers also include within their working teams, non-management employees who are best positioned to identify, assess, respond to and galvanize both internal and third-party resources necessary in the event of a cybersecurity incident. We test the resiliency of our systems through penetration and disaster recovery tests to continually improve our business continuity plan against an ever-changing threat landscape, create redundancies where appropriate for the protection of the Company's assets, have engaged a security operations center to provide 24/7 monitoring of our environment to detect and respond to suspicious activities in the network, and have cybersecurity insurance. We periodically perform an independent third-party cybersecurity maturity assessment of our systems, policies and procedures focused on the NIST's CSF and the SEC's Office of Compliance Inspections and Examinations cybersecurity guidance.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Management describes how risks from cybersecurity threats could materially affect its business strategy, results of operations, or financial condition, as part of its risk factor disclosures at Part I, Item 1A of this Annual Report on Form 10-K.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: While our Board has the ultimate oversight responsibility for the risk management process, the Audit Committee is responsible for oversight of our cybersecurity strategy and risks. The Vice President of IT & Digitization and other members of management provide t he Audit Committee with quarterly and as needed updates on the Company's cybersecurity strategy and risks. In addition, the Board is provided with an annual cybersecurity update that addresses similar topics to those discussed with the Audit Committee on a quarterly basis.

companyName: CTS CORP

ticker: CTS


text: (a) Cybersecurity Risk Management Strategy We have developed our cybersecurity risk management program (Cybersecurity Framework), including a cybersecurity incident response plan, based on the National Institute of Standards and Technology Cybersecurity Framework’s (NIST CSF) principles: Identify, Protect, Detect, Respond, and Recover, and our Cybersecurity Framework is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our cyber ecosystem. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: Our assessment and management of material risks from cybersecurity threats will be integrated into the Company's overall risk management processes. For example, our Information Security Management committee will evaluate material risks from cybersecurity threats against our overall business objectives and report to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: SunPower Inc.

ticker: SPWR


text: We rely on computer, information, network, and communication technology and related systems to operate our business and to protect confidential, restricted, and sensitive company, customer, and partner information. We have a multi-layered cybersecurity risk management program designed to identify risks related to the organization's digital and physical assets, review and assess existing security measures, and implement and manage solutions to mitigate cyber risks. These solutions are designed to protect our facilities, our systems, our partners, our customers, and our financial data in case we experience a cyber incident. Protection includes phishing detection, social engineering, executive targeting, brand impersonation, configuration mistakes, sensitive data leakage, leaked credentials, malicious attacks, third-party risks, vulnerabilities, insider threats (both intentional and unintentional), and password attacks. This type of ongoing vulnerability risk management is crucial as the organization and the external threat landscape evolves. This cybersecurity risk management program is incorporated as part of the Primoris Enterprise Risk Management Program.

companyName: Primoris Services Corp

ticker: PRIM


text: We leverage internal and third-party auditors and independent third-party sources to periodically review our processes, systems, and controls related to our cybersecurity security program. This includes assessing control design and operating effectiveness and recommendations to strengthen our cybersecurity program. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Risks from the cybersecurity threats we have faced to date have not materially affected, and we believe are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition. However, due to evolving cybersecurity threats, we may not be able to protect all information systems, and integrating information systems as we acquire new businesses or expand our business may expose us to unexpected liabilities or increase our vulnerability. See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Additionally, Amedisys performs periodic internal and third-party assessments to evaluate our cybersecurity controls and regularly evaluates our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity threats or personal data breaches.

companyName: AMEDISYS INC


text: Risk and vulnerability management encompassing both proactive and predictive defenses which provides opportunities to assess, remediate, and validate; and Managed detection and incident response, including advanced endpoint protection.

companyName: Seneca Foods Corp

ticker: SENEA


text: At a management level, our cybersecurity risk management efforts are led by our Chief Information Security Officer, or CISO, who reports directly to the CDIO. Our current CISO was appointed as our Vice President and Chief Information Security Officer in 2024, and brings more than 25 years of experience in cybersecurity, technology and risk management. He has more than 15 years of experience in the healthcare industry, including his service with the Company since 2022. Prior to joining us, he served as Deputy Chief Information Security Officer at another large healthcare organization. Further, our CDIO has expertise in cybersecurity risk management through his more than 25 years of experience in cybersecurity, technology and data privacy roles, including his service as the Company's CISO from 2021 to 2024 and his service as CISO at another large organization prior to being employed by us. In addition to our CISO and CDIO, other individuals on our cybersecurity team have cybersecurity experience or certifications relevant to their respective role.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Despite our efforts, there is the ever-present risk that our systems and/or data will suffer a successful cyber incident such as unauthorized access, use, disclosure, modification, or destruction by hackers, cybercriminals, state-sponsored actors, insiders, or other malicious actors. We have experienced attempts to compromise our systems and/or data. These attempts included phishing attacks, malware infections, and unauthorized access attempts. We do not believe that these attempts, if successful, would have resulted in a material adverse effect on our business, financial condition, or results of operations. We continue to be diligent in preventing, detecting, and responding to cyber incidents. However, we cannot guarantee that we will not suffer cybersecurity incidents in the future. See Item 1A. Risk Factors "Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions."

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: The availability of our products and services and fulfillment of our customer obligations depend on the continuing operation of our information technology and communications systems. Accordingly, cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Board, as described below, acting through the Audit Committee. The Company's cybersecurity policies, standards and practices leverage recognized frameworks established by the International Organization for Standardization.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Form 10-K.

companyName: TELA Bio, Inc.

ticker: TELA


text: Management also shares knowledge to protect our infrastructure and learn from recent developments. In addition to InfraGard, our SVP & CRO is a member of The Northern California Regional Intelligence Center, which is part of the California State Threat Assessment System supporting public safety as an intelligence and information sharing nexus in Northern California. Our CISO also actively participates on the Safety and Security Committee of the National Association of Water Companies to collaborate with members of our industry and learn best practices.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Our overall strategy in combatting cybersecurity risks includes a variety of measures, including: use of antivirus software, virtual private networks, email security, as well as other software and system-wide measures such as multi-factor of updates and patches as they become available from our software suppliers and consultants and maintaining the current versions of major software to reduce the exposure to vulnerabilities;

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: Program Highlights The CMRF is anchored by our Enterprise Information Security Framework ("EISF"), which adheres to the guidelines set forth by the National Institute of Standards and Technology ("NIST") 800-53 Framework. To enhance comprehensiveness, our policies also harmonize with other leading frameworks such as the ISO 27001 Standard, Family Educational Rights and Privacy Act of 1974 ("FERPA"), Payment Card Industry Data Security Standard ("PCI DSS"), Gramm-Leach-Bliley Act ("GLBA"), California Consumer Privacy Act ("CCPA"), General Data Protection Regulation ("GDPR"), and other pertinent local, state, national, and international regulations governing data privacy and information security. Our cybersecurity program has adopted controls mapped to these frameworks and incorporated them into Adtalem's policies, risk registers, control testing plans, and vendor assessments.

companyName: Covista Inc.

ticker: CVSA


text: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by our Vice President of Information Technology ("VP IT") to the Board's Audit Committee and senior management annually. Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually. In this way, our program to manage cybersecurity risk integrates with our overall risk management processes.

companyName: CODEXIS, INC.

ticker: CDXS


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as practicable in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Wynn Resorts has established a separate committee comprised of the General Counsel, the Chief Financial Officer, the Chief Privacy Counsel, and the CISO. The Materiality Committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: Upon completion of these risk assessments, the third-party information technology providers help the company assess how to reconfigure or implement additional procedures to mitigate any potential cybersecurity threats.

companyName: Capstone Holding Corp.

ticker: CAPS


text: The current CTO holds an undergraduate degree in computer science and a master's degree in business administration. and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: We have implemented a risk-based approach designed to identify, assess and manage cybersecurity threats that could materially affect our business and information systems. We attempt to identify and assess risks from cybersecurity threats by evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, and completing third-party cybersecurity threat assessments.

companyName: Annexon, Inc.

ticker: ANNX


text: to be newly formed" management positions responsible for assessing and managing cybersecurity risks will be a Director of Cybersecurity and a Chief Information Officer ("CIO"), who will report directly to our CFO. Presently our CFO is undertaking the actions of both the Director of Cybersecurity and CIO. The CIO will be responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy.

companyName: FinTrade Sherpa, Inc.

ticker: FTSP


text: Michael Kraus, Vice President of Compliance and Information Technology, leads our information security program with his expertise, honed by over 30 years of experience in the high-tech industry designing and deploying high-performance communication networks. Mr. Kraus has global network building experience which we believe helps to bolster our security posture.

companyName: SES AI Corp

ticker: SES


text: Notwithstanding the Company's processes for assessing, identifying and managing risks from cybersecurity threats, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. During 2025 and 2024, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: AMREP CORP.

ticker: AXR


text: Monitoring and Mitigation In addition to the ongoing cybersecurity program management carried out by the Vice President of Information Security, the Company also has the Buckle Incident Response Team ("BIRT"), a cross-functional group with relevant expertise and authority to support all aspects of the incident response, recovery, and reporting of a security incident. BIRT uses a well-defined incident response plan that outlines processes to prepare for and detect cybersecurity threats, analyze the severity, materiality, and impacts, determine who should be notified and involved in the Company's response, and define actions necessary to contain and recover in the event of an incident. As part of this process, cybersecurity incidents surpassing a certain level of severity necessitate communications to the Board of Directors. On an annual basis, the Company performs tabletop exercises designed to enhance BIRT's readiness and effectiveness in handling cybersecurity incidents.

companyName: BUCKLE INC

ticker: BKE


text: of Consultants and Advisors engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information, including with respect to protection of our e-mail, system access, network monitoring, endpoint protection, vulnerability assessments and penetration testing. We engage cybersecurity consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as a third-party consulting firm to perform tabletop exercises and evaluate our cyber processes including an assessment of our incident response procedures.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: Assessment, Identification and Management of Material Risks from Cybersecurity We recognize the importance of maintaining cybersecurity measures to safeguard our information systems and to protect the confidentiality and availability of information located on our information systems. Given this importance, we have integrated the consideration of operational risks related to cybersecurity into our enterprise risk management program, which is reviewed and updated annually and the results of this review are presented to the Board.

companyName: RAND CAPITAL CORP

ticker: RAND


text: We manage identified cyber risks by designing and implementing information security policies and controls addressing a wide range of current cyber threats. These policies and associated standards are designed to comply with current applicable legal and regulatory requirements and align with recognized frameworks for cybersecurity risk management. We review and update these policies and controls regularly in order to confirm ongoing alignment with the constantly changing threat landscape and evolving compliance requirements.

companyName: GLOBE LIFE INC.

ticker: GL


text: Our Executive Vice President of Operations oversees risks of cybersecurity threats and will report, as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us. To date, our Executive Vice President of Operations has not had to report any cybersecurity incidents to the Board. Our Executive Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the Company for over 10 years. Among other things, he has been responsible for day-to-day access management, network security and data protection solutions. Our Board of Directors has oversight of management to eliminate cybersecurity risks.

companyName: Birchtech Corp.

ticker: BCHT


text: Cybersecurity threats have not impacted our operations, and we do not anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, the preventive measures we adopt may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of artificial intelligence ("AI") technologies, and the potential challenges in implementing timely preventive measures.

companyName: Appsoft Technologies, Inc.

ticker: ASFT


text: The Nominating and Governance Committee receives periodic reports from our CISO Information Security concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Nominating and Governance Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Enovix Corp

ticker: ENVX


text: Under the leadership of the Company's Senior Vice President of Information Technology, the Company's information technology department is primarily responsible for assessing and managing material risks to the Company's information systems. Certain members of the Company's information technology department, including the Senior Vice President of Information Technology, have obtained specialized security certifications and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Senior Vice President of Information Technology and other senior members of management that generally meets quarterly. This committee receives updates from the Company's information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.

companyName: SITE Centers Corp.

ticker: SITC


text: The board of directors oversees the Company's practice for assessing, identifying and managing material risks from cybersecurity threats. The Audit Committee, consisting of all of the board's independent directors, with one member holding the CERT Certificate in Cybersecurity Oversight, reviews and discusses with management and the independent auditor on the Company's significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: The Company has established comprehensive incident response and recovery plans and continues to regularly test and evaluate the effectiveness of those plans. The Company's incident response and recovery plans address and guide its employees, management and the Board on its response to a cybersecurity incident.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: Industrial Control System and Supervisory Control and Data Acquisition infrastructure protection at electric substations and natural gas plants; and leading the Company's Cyber Incident Response Team.

companyName: UNITIL CORP

ticker: UTL


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats. a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section of this Annual Report.

companyName: Rubber Leaf Inc

ticker: RLEA


text: Our customers and suppliers face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Management Oversight and Governance The CTrO, reporting to the Company's Chief Engineering Officer ("C/E"), is responsible for designing and implementing a security program and strategy based on the mandate provided by the Board and senior management. The CTrO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 15 years, including serving as the Chief Security Officer of two other large public technology companies. He also holds an undergraduate and master's degree in computer science. We believe the Company's business leaders, including our CEO, CFO, C/E and CLO, who have experience managing cybersecurity risk at the Company and at similar companies, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.

companyName: Salesforce, Inc.

ticker: CRM


text: Our companywide cybersecurity policy sets the framework for our approach to cybersecurity. Each business unit and our corporate headquarters designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under our approach to cybersecurity, each business unit designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. Our cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter. Our policies and procedures are also designed to oversee and identify material cybersecurity risks related to third-party vendors and service providers.

companyName: GENERAL DYNAMICS CORP

ticker: GD


text: Safeguarding our information systems as well as the information that we receive and store about our customers, employees, vendors, and others is a priority for Gap Inc. We maintain a cybersecurity program with technical and organizational safeguards that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, including threats associated with the use of third-party systems. The program leverages our overall enterprise risk management and business continuity planning processes. Cybersecurity risk management processes are also embedded within our operating procedures, internal controls, and information systems.

companyName: GAP INC

ticker: GAP


text: We maintain a comprehensive process for identifying, assessing and managing material risks arising from cybersecurity threats, and have integrated these into our overall risk management processes. Our senior leadership team, along with representatives from our information technology, legal, human resources and finance departments, are responsible for developing the Company's overall risk management program and are also responsible for executing our cybersecurity policies.

companyName: ANI PHARMACEUTICALS INC

ticker: ANIP


text: The Company's Senior Vice President of IT Security ("SVP of IT Security") has over 35 years of experience in the informational technology field, with 19 years of healthcare IT experience with an emphasis in IT security and computer forensics. The SVP of IT Security has operational responsibility for ensuring the adequacy and effectiveness of the company's risk management, control and governance processes, who periodically reports to the Operational Risk Committee ("ORC"), responsible for applying the policy decisions and, in coordination with the Chief Digital Officer and Chief Executive Officer, reports to the Board of Directors at least annually or more regularly at the discretion of the ORC.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: The CIO leads our global information technology organization and has nearly 30 years of information technology leadership experience, including acting as CIO at two cloud-based technology providers. The Senior Vice President of Research and Development has more than 25 years of information technology experience, including at another publicly traded technology company. Our CISO reports to the CIO and is responsible for leading our information security organization and overseeing our information security program. The CISO has over 20 years experience in information technology and security, including serving as Chief Information Security Officer at another cloud-based technology provider. Team members who support our cybersecurity risk management program have relevant education and experience in the fields of cybersecurity, risk management, security architecture, data protection, application security, audit, compliance, incident response, identity governance and governance of enterprise information technology.

companyName: OneSpan Inc.

ticker: OSPN


text: External Assessments. We engage independent third parties to conduct infrastructure and application security assessments and penetration testing. These third parties also help us assess our internal preparedness.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Cybersecurity Program.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: Management has established policies and processes to identify, analyze, mitigate, and manage cybersecurity risks relevant to our platform, and has integrated these processes into the Company's overall risk management processes. Various types of risks are considered, including, but not limited to, fraud, technological, compliance, and vendor risks. Our program for assessing, identifying, and managing material risks from cybersecurity threats includes the following key controls: • To protect our systems and applications, we maintain endpoint security protection on all employee laptops and desktops, including industry-standard firewalls, monitoring, and intrusion detection practices. • We require multi-factor authentication to access our critical systems and applications. • We employ strong password standards for our systems and applications. We also employ firewalls across our infrastructure to guard against threats. • We provide ongoing security training to our employees and contractors about information security policies and practices, including phishing simulations. • Our process for managing third-party risk includes security assessments of key third-party service providers before entering into or renewing business with them or granting them access to our data or information systems. Additionally, we impose contractual restrictions on these providers based on their risk profile. • We maintain enterprise-wide policies and procedures for reporting and managing security incidents, including prompt reporting of all incidents. We perform incident response simulations on at least an annual basis.

companyName: Ibotta, Inc.

ticker: IBTA