text: We have been a target of cyberattacks and other hacking activities, as have certain of our third-party service providers. While our cybersecurity program is designed to prevent unauthorized access and protect sensitive information, including through continuous improvement of our cybersecurity measures, and we have not experienced any material cyber threats or incidents to date, we can give no assurance that we will be able to prevent, identify, respond to, or mitigate the impact of all cyber threats or incidents. To the extent future cyber threats or incidents result in significant disruptions and costs to our operations, reduce the effectiveness of our internal controls over financial reporting, or otherwise substantially impact our business, it could have a material adverse effect on our business, liquidity, financial condition, and/or results of operations. For additional discussion on our cybersecurity risks, refer to Item 1A. "Risk Factors" of

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Employing comprehensive methodologies for risk assessment, we diligently identify and evaluate potential cybersecurity threats and vulnerabilities across our systems, networks and data assets. This process involves regular examinations of emerging threats, conducting penetration tests, vulnerability scanning and thorough analysis of industry-specific risks. We actively participate in industry forums, information sharing initiatives and collaborate with relevant stakeholders to exchange threat intelligence and best practices.

companyName: NBT BANCORP INC

ticker: NBTB

secItem: Item 1C


text: The Vice President of Information Technology ("VP of IT") oversees the daily operations of our cybersecurity risk management program and plays a central role in assessing and managing critical risks from cybersecurity threats with the support of additional IT professionals. The VP of IT role is currently held by an individual who has approximately twenty years of experience in information security management, application portfolio management, and IT governance, risk, and compliance. The VP of IT periodically reports on the cybersecurity program to the Chief Financial Officer ("CFO").

companyName: PLUG POWER INC

ticker: PLUG


text: Risk from cybersecurity threats While Stewart regularly defends against, responds to and mitigates risks from IT systems and software vulnerabilities, broader cybersecurity threats and data security incidents, as of the date of this report, Stewart has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization, however, there can be no guarantee that we will not experience such an incident in the future. Stewart experienced no known material cyber breaches during the three-year period ended December 31, 2023. For additional information concerning Stewart's risks related to cybersecurity, see Item 1A. Risk Factors.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Adviser's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Adviser's overall risk management processes. In general, the Adviser seeks to address material cybersecurity threats through a entity-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: TCW Direct Lending VII LLC


text: Third Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third party systems.

companyName: LKQ CORP

ticker: LKQ


text: The TVA Board is ultimately responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk, and receives reports from the Audit, Risk, and Cybersecurity Committee ("Audit Committee"). The Audit Committee is a standing committee of the TVA Board and advises the TVA Board on a variety of matters, including TVA's processes for identifying, monitoring, and mitigating enterprise risk and reviewing and overseeing strategies for addressing TVA's cybersecurity, data, and privacy policies and response protocols. The Audit Committee meets at least quarterly. Reporting to the Audit Committee and the TVA Board is the risk counsel comprised of TVA's top leaders and the Chief Risk Officer ("CRO"), which is responsible for the highest level of management oversight of risk at TVA. The risk committee's primary purpose is to oversee TVA's management of enterprise-wide risks with policy implications reported to the TVA Board or a designated TVA Board committee. The risk committee oversees a subordinate committee that provides comprehensive risk oversight of TVA's security, artificial intelligence, privacy, and technology risks consistent with TVA's mission, strategic imperatives, and approved financial and operational plans.

companyName: Tennessee Valley Authority

ticker: TVE


text: The CIO typically reported twice a year to the Audit Committee with cybersecurity updates. During such updates, the CIO generally covered topics such as data security positions, results from third-party assessments, our incident response plan, and any material cybersecurity threats and developments. In 2023, the CIO reported to the Board of Directors on cybersecurity programs and risk mitigation efforts and enhancements to the incident response plan that were applied in 2023. Starting in 2024, the CIO is scheduled to provide the Audit Committee with cybersecurity updates on a quarterly basis.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use a number of means to assess cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third party providers.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: Our CFO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other Company management. We believe our business leaders, including our CFO, have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our CFO collaborates with other Company business leaders to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Cyber Risk Governance The Board provides strategic oversight over the Fund generally and has delegated oversight on cybersecurity matters to the Fund's Audit Committee, including oversight of risks associated with cybersecurity threats. AB's CISO, the Adviser's Chief Compliance Officer and the Fund's Chief Compliance Officer periodically report to the Audit Committee, which in turn reports to the Board on the status of AB's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Fund.

companyName: AB Private Credit Investors Corp


text: To validate our security posture, we engage independent external firms to conduct regular penetration testing, security audits, and cybersecurity consulting. We maintain ISO/IEC 27001 certification for our global enterprise. We also maintain a Cybersecurity Maturity Model Certification (CMMC) L2 certification for our U.S. Federal operations, and Cyber Essentials (CE) Plus certification for our U.K. operations. Additionally, our IT General Controls (ITGCs) undergo annual testing through Sarbanes-Oxley (SOX) audits, which examine security controls relating to system changes, access management, system configurations, and data backup processes.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: Gaia recognizes the critical importance of maintaining robust cybersecurity measures to protect our systems, data, and operations and to maintain the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, including the management of risks arising from cybersecurity threats. It is our policy to provide regular updates to our shareholders regarding material cybersecurity incidents and the steps taken to address them. We believe that transparency in this area is crucial to maintaining trust and confidence in our operations.

companyName: GAIA, INC

ticker: GAIA


text: For additional information on the cybersecurity risks that we face, also see Item 1A. "Risk Factors" of this Annual Report on Form 10-K.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: In addition, we partner with third parties to assess the effectiveness of our cybersecurity program, including audits and assessments performed under the direction of Carlyle's Internal Audit team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers the firm's cyber third-party risk management program, which assesses external service providers before onboarding and provides ongoing monitoring in accordance with certain risk-based cybersecurity criteria.

companyName: Carlyle Group Inc.

ticker: CG


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Head of Security, Head of Global Privacy, Head of Engineering, Head of Enterprise Technology & IT, Chief Business Officer, Chief Financial Officer, and General Counsel. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to the Audit Committee.

companyName: Asana, Inc.

ticker: ASAN


text: Information Security Program PNC's approach to cyber risk management, oversight, and reporting is based on a well-structured information security program. The program is responsible for protecting information assets to achieve business objectives in a secure manner and designed to keep customers' information and their funds safe and available. Program capabilities are built against industry guidance and a security framework to identify risks to sensitive information, protect that information and maintain an appropriate response and recovery capability to help ensure resilience against information security incidents.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: WTW's cybersecurity program is an ongoing process designed to identify, assess and manage WTW's risk exposures over the short-, intermediate- and long-term. Management's cybersecurity risk management strategy and processes include the following areas of focus: • Incident Response Planning: WTW has a global Information and Cyber Security Incident Response Plan ('ICSIRP' or 'Plan') for identifying and managing cyber and data security threats. The ICSIRP defines the roles and responsibilities of WTW stakeholders involved in responding to cyber and data security events, severity levels and incident categories, and it outlines a process for incident management, including escalation and communication procedures. • Technical Safeguards: WTW seeks to continuously improve implemented technical safeguards that are designed to protect WTW's information systems. Standards include controls for access management, cyber threat and incident management, data security, encryption, human resource security, network and device security, secure asset management, secure system development, security operations and third-party security. While WTW seeks to maintain adequate controls, they may not always be effective or at the level of maturity that the Company ultimately wishes to maintain. See Part I, Item 1A Risk Factors under the heading 'Data and cybersecurity breaches or improper disclosure of confidential company or personal data could result in material financial loss, regulatory actions, reputational harm and/or legal liability' for more information about WTW's technical controls, management, mitigation, and security practices as well as the risks related thereto. • Education and Awareness: WTW's policy requires annual, mandatory privacy and information security training for all WTW colleagues. • Third-Party Risk Management: WTW's risk management strategy includes a risk management process focused on third-party service providers and other parties with which we engage that is intended to align with the technology security key controls across the organization. • Threat Intelligence: Through its regular monitoring processes, WTW obtains intelligence on cyber threats relevant to the Company at strategic, operational and tactical levels to help inform and reassess its cybersecurity risk management priorities.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Assessing, identifying and managing data security, privacy and cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process, which considers all strategic, operational, compliance and financial risks across the organization. Our ERM process is conducted on an annual basis by our internal audit team through feedback from senior management, certain functional leaders and certain members of the Board. Risks are categorized as low, medium and high risks based on a quantitative and qualitative evaluation of how each risk could impact the Company's operations, current objectives and long-term strategies. Each high risk is assigned to a member of senior management as the risk owner and the Board or a Board Committee for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion. Low and medium risks are subject to various levels of internal monitoring. The annual risk assessment is reviewed with the Audit and Risk Committee of the Board and the Board.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and our vendors have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, refer to Part I, Item 1A, Risk Factors of this annual report.

companyName: CALLAN JMB INC.

ticker: CJMB


text: We have in place, and seek to continuously improve, a comprehensive system of security controls, managed by a dedicated staff. We also engage reputable third parties to perform a variety of services, including continuous monitoring of our information systems, incident response or management services, cyber-forensic investigation services, and periodic security penetration testing. In addition, we are subject to independent assessment and review by regulators and external auditors, as well as periodic audits of our security controls by our independent internal audit team. We provide regular security risk education and awareness training sessions for all staff. We maintain an ongoing internal third-party cybersecurity risk assessment program to identify potential cybersecurity threats associated with our use of third-party service providers, and consider these assessments when selecting and engaging service providers with periodic re-evaluations. See "Part I, Item 1A. Risk Factors" for additional information on information technology and cybersecurity related risks that may impact us and our financial results.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: Our Vice President of Cybersecurity and Information Technology supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: Our risk management process addresses confidentiality, availability, and integrity and includes evaluating information systems specific threats, vulnerabilities, likelihood, and potential impact. Impact thresholds, which are reviewed and approved by the Board of Directors (the "Board") and senior management, are used to define incident escalation paths from IT operations to management, the Audit Committee and the Board. This process is used to identify, manage, and communicate material risks to the business. Additional cyber incident reporting requirements are in place to comply with customers and regulatory agency requirements.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: During fiscal year 2023 we began to deploy and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management, with deployment of these tools completed subsequent to December 31, 2023. As part of the service offering from out outsourced IT security services provider, cybersecurity related alerts will be issued to us as relevant situations develop. These alerts will be evaluated in concert with our IT provider and in the event an alert requires action within our environment, such actions will be taken promptly. Our process and cybersecurity posture will continue to be refined based on the results of periodic cybersecurity assessments conducted jointly with our IT provider. We have recently begun reporting on cybersecurity in reports to the Board of Directors and will continue to do so.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: The members of management that lead the Cybersecurity Program and strategy have extensive experience in technology, cybersecurity and information security. The CIO has over 30 years of experience in various engineering, IT, operations and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management and information security. The Head of the Operational Risk Department has over 20 years of experience in technology, security and compliance roles, including experience in government security agencies.

companyName: Ceres Tactical Commodity L.P.


text: Digital information, information technology and automation are essential components of the ASB's operations and growth strategy. ASB relies on evolving and increasingly complex operational and information systems, networks and other technologies, which are interconnected with the systems and network infrastructure owned by third parties to support a variety of business processes and activities. Such activities include delivery of banking services to retail and commercial customers, customer relationship management and processing financial information and results of operations for internal and external reporting purposes. We primarily use third-party systems and infrastructure to create, collect, store, and process sensitive information, including personal information of customers, employees and their dependents.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. To manage cybersecurity risk, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. The cybersecurity strategy is memorialized within the Company's information security program. The program incorporates regulatory guidance and industry standards while leveraging industry associations, third-party benchmarking, audits, threat intelligence and peer industry groups. The information security program is reviewed by the Chief Risk Officer and presented to the Risk, Compliance and Planning Committee to periodically account for the changes in the cyber threat landscape. It is also periodically assessed by the Internal Audit department.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: Key elements of Danaher's annual Enterprise Risk Management ("ERM") program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk's probability, severity and velocity of impact, and for trending key risks; and a framework for developing and implementing countermeasures for key risks. Information technology/cybersecurity is one of five topical areas required to be addressed as part of the annual ERM program. IT and cybersecurity risks are required to be scored using the same methodology applied to all other risk categories, which facilitates an evaluation of the significance and prioritization of cyber-related risks relative to wider business risks. In addition, Danaher policy requires the reporting of certain cybersecurity incident data to Danaher's Risk Committee (comprising senior members of the legal, finance, internal audit and compliance functions) for consideration as part of the ERM process. Members of the Danaher Risk Committee present annually to the Danaher Board of Directors a report on the results of the ERM process, including with respect to information technology and cybersecurity risks. As part of our cybersecurity risk management program, we also maintain cyber insurance in amounts and subject to coverage terms that are typical for companies of our type and size. However, such insurance may not be sufficient in type or amount to cover us against damages incurred or claims related to security breaches, cyber-attacks and other related breaches.

companyName: DANAHER CORP /DE/

ticker: DHR


text: We also provide employees with policies and training in areas such as ethics, corruption, information security, social engineering, data protection, and compliance, and with regular updates on the cybersecurity program and potential threats.

companyName: Palantir Technologies Inc.

ticker: PLTR


text: Due to the critical nature of our business to the U.S. economy and national energy security and the continuous threat of cyberattacks, we regard cybersecurity as a top tier enterprise risk. Cybersecurity is integrated into our enterprise risk management program, which includes quarterly technology and cybersecurity risk assessments. We use the results of the technology and cybersecurity risk assessments for risk-based decision making to determine actions and priorities for our cybersecurity program. The technology and cybersecurity risk assessment process includes an objective, risk-ranking process; documented mitigation activities; and action plans for those risks requiring additional mitigation. These activities consider safety implications, operational disruptions, and business and financial impacts. As part of the cybersecurity program, we regularly obtain threat intelligence from various sources, which sources originate from private, commercial, and independent entities. In addition, our IT leadership routinely conducts risk quantification, simulations, and assessment exercises. We regularly engage with relevant government agencies to report and share certain security information enabling us to benchmark our capabilities, establish appropriate program targets, and adapt to emerging cybersecurity issues.

companyName: Midstream Co LLC


text: Under our program, cybersecurity issues are analyzed by subject matter experts, including those in information security, information technology, risk, and other areas to evaluate potential security, financial, operational, reputational and other risks, as well as to identify any potential data breaches or other cybersecurity incidents. Matters involving potential data breaches and other cybersecurity incidents are considered against applicable escalation and notification requirements. We monitor and periodically enhance our cybersecurity program, processes, techniques and procedures to combat evolving and adaptive cybersecurity threats.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: The security program is commensurate with the size and complexity of the Bank. Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Bank or its business strategy, results of operations or financial condition.

companyName: RBB Bancorp

ticker: RBB


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President Legal Affairs and Chief Compliance Officer, our Chief Financial Officer and internal information technology staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: scPharmaceuticals Inc.


text: Communication of our cybersecurity values and expectations is extended to our third-party solutions through specific programs, which include monitoring and rating services and open-source intelligence risk assessments. In addition to conducting posture and intelligence reviews of our vendors, our cybersecurity teams conduct evaluations of critical vendors to assess security requirements, and we assess our service level agreements to monitor whether cyber controls and practices are integrated to the levels specified in our cybersecurity standards.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: While our cybersecurity management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats, the ConocoPhillips Board of Directors has oversight responsibility for our ERM program and the individual risk management programs comprising our ERM program, including cybersecurity risk management. To help maintain effective Board of Directors' oversight across the entire enterprise, the Board of Directors delegates certain elements of its oversight function to individual committees. The AFC assists the Board of Directors in fulfilling its oversight of our ERM program and cybersecurity.

companyName: CONOCOPHILLIPS

ticker: COP


text: Third-Party Risk Management (TPRM): Our TPRM function focuses on regular external vulnerability and security assessments by a network of expert partners provide an objective evaluation of our security posture.

companyName: DecisionPoint Systems, Inc.


text: As part of our overall risk management system, we have established certain procedures to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management system is designed to align with industry best practices, including International Organization for Standardization, or ISO, standards, provide a framework for handling cybersecurity threats and incidents, and facilitate coordination across different departments of our company. As part of this system, we have a formally documented information security management program and conduct regular tabletop exercises that include participation from executive officers. In addition, we engage consultants and other third parties who are experts in the cybersecurity risk management field to review and provide testing services as well as general incident management services. These engagements directly contribute to industry certifications and attestations that demonstrate our dedication to protecting the data that we are entrusted with by customers. Our Governance, Risk, and Compliance team within the information security management program oversees and identifies material cybersecurity risks associated with our use of these third-party service providers through a formal vendor security risk management program.

companyName: APPIAN CORP

ticker: APPN


text: Cybersecuity Governance Our Director of Cybersecurity is responsible for the strategic leadership and direction of the Company's information security organization. The individual currently serving as the Director of Cybersecurity has over twenty years of experience working in information technology. The Director of Cybersecurity receives cybersecurity alerts from the Company's third-party security operations center, and provides periodic updates to the Head of Information Technology who informs the Company's executive committee, which includes the Company's Chief Executive Officer, Chief Operating Officer and, Chief Financial Officer.

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT Consulting Firm works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: Our Board has direct oversight of cybersecurity risks and strategy and receives quarterly updates from our Chief Information Officer (CIO). The Board has also delegated to the Audit Committee responsibilities related to cybersecurity and other risks of the Company. Our CIO has spent over 20 years in engineering and product development roles and our VP of Information Security and Operations has spent over 25 years in infrastructure and cybersecurity roles including in the finance and insurance industries. Additionally, one of the independent directors on our Board and a member of our Audit Committee has significant experience leading technology and information systems at some of the country's leading hospitals and adds to our Board substantial expertise and knowledge in information technology, privacy, data governance and cybersecurity. A cross-functional incident response team, which includes members of our management team, determines the apparent severity of reported potential incidents and operationalizes the cybersecurity incident response protocol.

companyName: Hub Group, Inc.

ticker: HUBG


text: The Board retains supervisory oversight responsibility for the organization and its activities, including enterprise risk management and cybersecurity threats, subject to the committee delegation described below. The Board conducts oversight of management through its subcommittees, presentations from senior leadership, and routine board-directed reporting to ensure management continues to operate and conduct business in alignment with Risk Appetite Statements.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: As is the case for all companies in our industry or with a significant digital presence, we are periodically subject to cyberattacks and other cyber incidents and, therefore, cybersecurity is an integral component of our overall enterprise information security program. We have adopted a multi-layered framework to secure our networks, systems, devices, products and services while also assessing, identifying, and managing cybersecurity risks. That framework is designed to help protect our information assets, operations, and resources from internal and external cyber threats by understanding and seeking to mitigate risks while ensuring business resiliency from unauthorized access or attack. Our cybersecurity policies, standards, and procedures include security risk assessments for high priority systems, third party compliance assessments for external vendors and suppliers, and incident management and breach response plans. which are influenced by, and periodically assessed against, recognized cybersecurity frameworks. Our incident management policy is designed to help prevent, manage, and coordinate our response to, and recovery from, potential and confirmed cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as comply with applicable legal obligations.

companyName: TechTarget Holdings Inc.


text: Our Information Security Management team, among other things, is responsible for conducting risk assessments, designing the Information Security Program to manage identified risks based on information sensitivity and the Company's operational complexity, overseeing service provider arrangements, establishing risk-based response programs for incidents of unauthorized access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program in response to changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor qualification and management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For example, we may conduct vendor qualification audits that assess a potential third party's cybersecurity risk potential. We may conduct a vendor risk assessment that evaluates the likelihood and potential impact of a cybersecurity threat involving the third-party service provider, based on factors such as the type and scope of services, the data processed, and the third-party service provider's security practices. We may request security attestations and certifications to verify that the vendor has met the relevant industry standards and best practices for cybersecurity. We may establish security clauses in our agreements with third-party service providers that address such matters as the roles, responsibilities, and expectations of both parties regarding cybersecurity, such as the security policies and procedures, the incident response and notification expectations, the remediation measures to be adopted, the responsibility for losses associated with incidents.

companyName: CHIMERIX INC


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have developed the following processes as part of our strategy for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: 1847 Holdings LLC

ticker: LBRA


text: We maintain the following processes to assess, identify, and manage risks from cybersecurity threats: • Ongoing Threat Assessment. We maintain multiple threat intelligence subscriptions, and we monitor relevant cybersecurity resources on an ongoing basis to identify and anticipate potential threats to our network infrastructure. • Layered Security. We use multiple tiers of security as part of our efforts to reduce our exposure to cyberattacks. We leverage and maintain perimeter network defense solutions to discourage network-intrusion attempts. Within our network, we leverage endpoint security and ransomware detection and prevention solutions, and we use continuous monitoring of alerts and activities to identify and respond to any irregularities that could be associated with threats. • Training and Awareness. We conduct awareness training for our employees as part of our efforts to enable them to identify and report cybersecurity threats. We require cybersecurity training during employee and contractor onboarding, and we seek to reinforce the training through phishing tests on at least a quarterly basis as part of our efforts to reduce the potential for successful phishing and social-engineering attacks. • Cybersecurity Tool and Processes and Industry Standards. We refer to industry standards, such as those issued by NIST and ISO, as part of our efforts to maintain best practices across our environment and we use various cybersecurity tools and processes designed to manage cybersecurity threats including network and systems authentication, network and infrastructure architecture security, endpoint security, and operating system patching. • Third-Party Network Security Assessments. We engage a third-party consultant to conduct external penetration testing at least annually. Our cybersecurity processes are adjusted as needed based on the results of these assessments. The assessment results are reported to the Audit Committee and Board, and our external auditor reviews our cybersecurity solutions and posture on at least an annual basis. • Third-Party Risk Management. We conduct information-security assessments before allowing sensitive data to be hosted by third parties. We also ensure SOC-1 or SOC-2 compliance for our third party providers, including our banking, payroll, and stock-plan administration relationships.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Commvault's Management, including the CEO, CFO, CLCO, CISO, Chief Information Officer ("CIO"), and Senior Vice President of Engineering, is responsible for our cybersecurity risk management strategy, operational decision-making, and incident preparedness and response. The current CISO holds a Bachelor of Science in Information Technology, industry certifications such as CISSP, CISA, CISM, is affiliated with various CISO professional working groups, and has over twenty-five years of experience in information security, compliance, technology, and program management across financial, telecommunications, audit, healthcare, retail, and professional services organizations. Management ensures cybersecurity risks are communicated through the establishment of the ERMC and the CSOT and regular, or as needed, reporting to the Audit Committee and the Board. The ERMC is responsible for the implementation, maintenance, and execution of our enterprise risk management program. The ERMC meets quarterly, or as needed, to assess, consider, and manage material risks including cybersecurity threats across the business. The CSOT is responsible for the significant operational decisions in the event of an active cybersecurity incident. The CSOT meets as needed, with the Audit Committee Chair as an optional attendee, to provide counsel and foster productive communication between Management and the Board.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: NEXTNAV INC.

ticker: NN


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management process. In addition, we have implemented a cybersecurity third party risk management process designed to assess the cybersecurity practices and monitor certain critical third parties, and to assist the business in making risk-informed technology services decisions. Our practice is to perform due diligence on certain third parties who maintain Sensitive Information, including CROs that manage and administer our clinical trials, and our CDMOs that manufacture our drug product to be used in clinical trials. Additionally, we monitor these third parties through frequent program management meetings as well as joint steering committee meetings in certain cases.

companyName: aTYR PHARMA INC

ticker: ATYR


text: In the ordinary course of our business, we may process proprietary, confidential, and sensitive data, including personal data (such as health-related patient data), intellectual property, and trade secrets (collectively, "sensitive information"). We rely upon third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, employee email, CROs, and other functions. The secure maintenance of this sensitive information and our information technology systems is important to our operations. To this end, we have processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by our third-party information technology consultants and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment.

companyName: PALISADE BIO, INC.

ticker: PALI


text: The Company's Security Operations Center ("SOC") functions as the central point for all cybersecurity events that occur on our information systems. The SOC provides end-to-end operations to monitor, detect, alert and respond to any unusual, suspicious or malicious activities. In 2023, we expanded the SOC's operational hours to 24 hours a day, 7 days a week, utilizing both internal and third party resources for that full coverage. We conduct risk assessments and compliance audits against the above-referenced standards and regularly benchmark and evaluate program maturity with industry leaders. We also engage both internal and external auditors and third party information security experts to examine our cybersecurity processes. Additionally, the Company undergoes the PCI certification process and obtains the related certification on an annual basis.

companyName: Bancorp, Inc.

ticker: TBBK


text: Third-Party Service Providers: The Sponsor engages with various third-party service providers for critical operations and services. The Sponsor conducts cybersecurity risk assessments of all vendors and business partners with access to our networks or sensitive information. These assessments ensure that third-party cybersecurity policies align with our cybersecurity standards.

companyName: Amplify Commodity Trust

ticker: BDRY


text: Our Board of Directors ("Board") oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure to our strategic objectives. While the Board reviews the Company's cybersecurity program annually, the Nominating, Governance, and Risk Committee ("NGR Committee") of the Board has primary responsibility for cybersecurity as part of its risk oversight mandate. The NGR Committee is updated on cybersecurity matters from our Chief Information Security Officer ("CISO") and members of the CISO's team at least twice annually. The CISO discusses management's actions to identify and detect threats and reviews the structure of and enhancements to the Company's defenses as well as management's progress on its cybersecurity strategic roadmap. The NGR Committee Chair reports to the full Board after each Committee meeting, including information relating to the cybersecurity discussions.

companyName: INSULET CORP

ticker: PODD


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.

companyName: Cohen & Co Inc.

ticker: COHN


text: Our Audit Committee Charter tasks this committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures. The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives an information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues. The CISO also attends the regularly scheduled Board meetings to give his information security report to all members of the Board.

companyName: CITIZENS, INC.

ticker: CIA


text: Our CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, Chief Information Officer, Chief Risk Officer, and Chief Audit Executive, among certain other senior executives, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 30 years of experience in information security and is a Certified Information Systems Security Professional. As described above, our CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.

companyName: Carlyle Group Inc.

ticker: CG


text: While LightPath Technologies faces various cybersecurity threats as part of routine operations, no risks have been identified to date that could materially impact the company's operations, strategy, financial condition, or overall business performance.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: The Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST Special Publication 800-53, and the Payment Card Industry standards, as applicable, and designed to comply with applicable laws and regulations, including HIPAA and the New York Department of Financial Services Cybersecurity Regulation, as applicable. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and Payment Card Industry standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. The Program is aligned with the Company's overall enterprise risk management system and processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Control procedures are assessed regularly to confirm their effectiveness. The Company undergoes an annual Service Organization Controls ("SOC") Type 2 attestation report covering the performance of safeguards deployed to protect certain Company systems and applications. The Company maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Our Board of Directors has established oversight mechanisms with respect to risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity, including the responsibility to review and discuss with management and the Company's auditors, as appropriate, management risks relating to data privacy, technology and information security. The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may adversely affect the Company and on cybersecurity risks in general at least once each year.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: Our CISO, reporting directly to our Chief Information Officer ("CIO"), is responsible for designing, developing and implementing our overall information security program that sets forth a governance structure and processes to ensure regular risks assessments and timely reports regarding cybersecurity risks. We actively scan across our information infrastructure for security vulnerabilities inherent in our business as we rely extensively on information and technology systems for managing transactions, tracking financial performance, and storing sensitive data. We also continuously monitor and assess risks associated with the interconnected nature of many of our information and technology systems, such as ERP platforms, supply chain management systems, and electronic payment gateways. In the normal course of our monitoring process, upon identifying certain vulnerabilities within our business and information systems during a recent security assessment, our information security team, in close collaboration with a third-party expert, promptly began to remediate these vulnerabilities to prevent any potential compromise of our systems or data.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: Risk Management and Strategy Cybersecurity (cyber) risk is differentiated from information technology risk by threat interactions that yield high impact consequences and ever-increasing probability. While standard security operations address most day-to-day incidents, cyber risk includes motivated threat actors who often use advanced tools, techniques and processes to evade detection or inflict maximum damage to an organization's information assets. Cyber threats and attacks adapt and evolve rapidly, so First Financial works to continuously enhance controls and processes to protect its networks, applications, and data from attack, damage or unauthorized access. Critical components to the Company's cyber risk control structure include corporate governance, threat intelligence, security operations, security awareness training and patch management programs. Cyber risk mitigation includes effectively identifying, protecting against, detecting, responding to and recovering from cyber threats.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: We face a variety of risks related to cybersecurity, such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We employ a range of tools and services, including regular network and endpoint monitoring utilizing leading market monitoring tools, audits and vulnerability assessments including penetration testing to inform our risk identification and assessment. Our Audit Committee of the Board of Directors provides oversight of our cybersecurity risk management and strategy processes, which is led by our Chief Financial Officer.

companyName: Quantum-Si Inc

ticker: QSI


text: We have established processes for assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Security Officer ("CISO"). Our CISO has been in the role since September 2020, and has 15 years of experience across external and internal audit, technology risk management, and cybersecurity spanning various industries primarily within the financial services sector, but also including healthcare, technology, consumer products, and manufacturing for both regional and multinational corporations.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Our Board of Directors recognizes the importance of cybersecurity and has oversight responsibility for cybersecurity risks. The Board of Directors receives updates on our cybersecurity program at least quarterly from our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). In addition, the Board's Audit and Finance Committee, which is composed entirely of independent directors, receives quarterly reports regarding our ERM program and top risks, including those relating to cybersecurity.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: We aim to deploy a cyber-risk management program which is intended to assist in assessing, identifying, and managing material risks from cybersecurity threats to our data and information systems. This program will be implemented to ensure that cybersecurity considerations are included in decision-making processes throughout the Company.

companyName: Totaligent, Inc.

ticker: TGNT


text: We engage in the periodic assessment and testing of our processes that are designed to address cybersecurity threats and incidents, including with respect to third-party vendors. The results of such assessments are reported to management and the Board. Adjustments to our cybersecurity processes are made as necessary.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: The Company recognizes that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each employee is required to complete information security and data privacy training to build awareness of cybersecurity risks to the organization. The Company has engaged a third-party vendor to periodically send each employee an email that mimics a potentially harmful phishing attempt each month and to report to management the results of the phishing security test.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: • Performance Evaluation: The Board's annual evaluation of the Chief Executive Officer's performance includes assessing the effectiveness of implementing cybersecurity policy and measures and ensuring that cybersecurity policies and practices are effective and aligned with organizational goals. • Cybersecurity Culture: The Board fosters a cybersecurity-aware culture throughout the organization, supporting management's efforts to integrate risk management, including cybersecurity, into the operating culture.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Human errors or sabotage: Company employees or a third-party having access to the system could cause errors or allow for sabotage that may cause company losses. Our procedures seek to identify the risks that can be caused by human error or intent and includes processes to mitigate with a particular focus on training employees to avoid human errors.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity. At least quarterly and following any material cybersecurity incidents, the Audit Committee reviews management's assessments and management of information security, cybersecurity and technology risks, including the information security and risk management programs and strategies and mitigation strategies. The Audit Committee also reviews the response to data security incidents and breaches as well as the management of third-party cybersecurity risk.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see "Risk Factors - An information security breach of our systems or our data centers operated by third-party providers, the loss of, or unauthorized access to, client information, or a system disruption could have a material adverse effect on our business, market brand, financial condition and results of operations."

companyName: Thryv Holdings, Inc.

ticker: THRY


text: Recognizing the ever-evolving nature of cybersecurity threats, we have established a cybersecurity risk management program designed to safeguard the confidentiality, integrity, and availability of our critical systems and data. This program integrates into our overall enterprise risk management framework and draws guidance from industry standards and best practices, including the National Institute of Standards and Technology Framework. aIdentification and assessment of cybersecurity risks that could impact our operations, facilities, third-party vendors, critical systems, and information. bUtilizing threat intelligence and historical adversarial activity to inform risk assessments and readiness evaluations. aImplementing administrative, physical, and technical controls designed to protect data and systems, as established in our Cyber Security policy.

companyName: IREN Ltd

ticker: IREN


text: Our board of directors oversees our overall risk management process and significant risks facing us, including cybersecurity risks. The audit committee, which is comprised solely of independent directors, has been designated by our board of directors to oversee cybersecurity risks. Our board of directors oversees and evaluates strategic risk exposure, while our executive officers manage the significant risks we encounter on a daily basis.

companyName: 89bio, Inc.


text: Our Head of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports; the Head of IT may be called upon to brief the board as well.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: At the management level, our CEO provides general management, oversight and mitigation of Cars Commerce's risk. The Chief Legal Officer and the Chief Technology Officer are the key executives responsible for managing Cars Commerce's Information Security function and ensuring that Cars Commerce's information security processes comply with applicable laws, SEC requirements and contractual obligations respectively. Cars Commerce's Information Security Team, in conjunction with the Information Security Governance Committee are responsible for assessing and managing material risks from cybersecurity threats and providing management direction and support for information security. The Information Security Team is composed of skilled professionals with relevant information and cybersecurity education, certifications and experience. The Information Security Team coordinates the Cars Commerce Information Security Governance Committee, comprised of senior business leaders who support Cars Commerce's Information Security Management System based on their area of expertise. Working together the teams initiate and control the implementation and operation of information security within Cars Commerce.

companyName: Cars.com Inc.

ticker: CARS


text: To address significant cybersecurity incidents and other crisis events, we maintain a business incident response plan, which identifies key stakeholders, defines escalation processes, and sets the thresholds above which our cybersecurity, legal, and crisis management teams will inform management's Executive and Disclosure Committees as well as when the CEO and his designee will inform the board of directors of an incident. For cybersecurity incidents below these crisis thresholds, we maintain subordinate incident response plans and standard operating procedures used by our security incident response team. Like many companies, we, and some third parties on which we rely periodically experience cybersecurity incidents. However, as of September 30, 2025, we were not aware of any direct or third-party cybersecurity incidents in the past three fiscal years that have materially affected our business strategy, results of operations, or financial condition.

companyName: VISA INC.

ticker: V


text: While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we face certain ongoing risks from cybersecurity threats, that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations, and/or financial condition. For more information about these risks, see the risk factor titled, "Our business could be negatively affected by security threats, including cybersecurity threats, destructive forms of protest and opposition by activists and other disruptions" under Item 1A of Part I of this Annual Report.

companyName: Amplify Energy Corp.

ticker: AMPY


text: The Company conducts annual cybersecurity awareness training for all employees, new-hire cybersecurity training, monthly simulated phishing tests, and additional training for specific departmental requirements as part of the Company's risk mitigation efforts. The Company also maintains cybersecurity insurance; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.

companyName: SITE Centers Corp.

ticker: SITC


text: We have developed an incident response plan outlining immediate response actions, including internal and external communication protocols. Under the plan, we have identified a management group comprising our Chief Executive Officer, Chief Financial Officer, and Corporate Controller. The plan provides that any cybersecurity incident will be reviewed by this group to determine whether it is material for securities law purposes and whether public disclosure is required, following consultations with outside counsel and/or the Board of Directors.

companyName: US NUCLEAR CORP.

ticker: UCLE


text: Our cybersecurity risk management and identification has been integrated into our broader enterprise risk management framework which is regularly reported on to the Audit Committee of our Board of Directors. Additionally, our CIO and CISO provide periodic reports to our Board of Directors, as well as to our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cybersecurity risks and threats, the status of activities to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: RXO, Inc.

ticker: RXO


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, General Risks" for more information regarding cybersecurity risks.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: A cross-functional management team, including members of our information security, technical infrastructure, engineering, and legal departments, is responsible for identifying, assessing, and managing the risks from cybersecurity threats that are relevant to our business, as well as managing our response to any cybersecurity incident (and, depending on an incident's potential nature and severity, reporting it to our Audit Committee and considering with management whether public disclosure is appropriate or required). This team has primary responsibility for our cybersecurity risk management program, including our cyber and data security incident response plan, supervises our internal personnel and third-party service providers, and communicates our cybersecurity risk management processes to management, our Board, and our Audit Committee. This team reports to our CTO, who has more than 15 years of experience in the technology sector, and possesses nearly 60 years of combined experience in cybersecurity matters, including threat assessment and detection, mitigation technologies, incident response, cyber forensics, and regulatory compliance. In addition to relevant educational and industry experience, members of this team, including the heads of our information security and technical infrastructure departments, hold relevant cyber and information security certifications, including from ISACA (Certified Information Security Manager and Certified Information Systems Auditor) and ISC2 (Certified Information Systems Security Professional). This team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including, as appropriate, the operation of our cyber and data security incident response plan, briefings from internal security personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including our third-party service providers, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Our CIO and other members of the information security organization routinely engage with our CFO regarding cyber risk management activities and provide updates and data, as needed, to other members of our executive team to facilitate decisions regarding security matters. No less than twice per year, and more frequently as appropriate, our CFO and CIO also provide updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee of our Board of Directors, and provide other information as needed to facilitate the committee's oversight of our cybersecurity risk. Additionally, some of our Board members have completed specialized director training on cybersecurity risk.

companyName: Freshpet, Inc.

ticker: FRPT


text: As indicated above, our management, with oversight from the Board, performs an annual ERA and cybersecurity is among the main risks identified by the ERA for Board-level oversight. Our full Board has oversight of our efforts in cybersecurity and meets regularly with our Vice President – Information Technology (three times during fiscal 2025) on our cybersecurity risks and programs. The Board is also updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: We also address cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our customer and employee data or our information technology systems. Third-party risks are included in the ERM program and the cybersecurity program. Diligence is performed on third parties that have access to information technology systems, data or facilities that house such systems or data. High-risk vendors are identified and continually monitored for cybersecurity threat risks. Additionally, third parties that have access to information technology systems, data or facilities that house such systems or data, agree by contract to manage their cybersecurity risks, provide notification in the event of a cybersecurity incident, and be subject to cybersecurity audits.

companyName: WISCONSIN POWER & LIGHT CO


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, members of the ITC, along with other lines of business heads, report to the management Enterprise Risk Management Committee (the "ERMC"), which in turn reports to the Board Audit and Risk Committee quarterly. The ERMC consists of the Company's Chief Risk Officer, Chairman & CEO, President, Chief Financial Officer, Treasurer, Chief Compliance Officer, Chief Technology Officer and Chief Credit Officer. In addition, the Company's Chief Technology Officer attends Company Board of Directors meetings and provides an information technology ("IT") report at each meeting.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: We have experienced incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to affect us materially, our business strategy, results of operations, or financial condition. As external events evolve, we will continue to evaluate and address these conditions as needed in our Business Continuity and Incident Response programs. For additional information regarding risks from cybersecurity threats, please refer to " Item 1A. Risk Factors – General Risks – Security breaches and other disruptions could compromise our proprietary information and expose us to liability, which would cause our business and reputation to suffer. "

companyName: ATECH (PARENT) RESOLUTION CORP.


text: The Bank engages trusted third parties to audit and examine its processes, review the security of its network infrastructure, and assist the Bank in designing and implementing robust cybersecurity systems. These trusted third parties help the Bank and the Company improve and test their cybersecurity readiness. The Bank engages third party vendors to monitor and test its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.

companyName: PEOPLES FINANCIAL CORP /MS/

ticker: PFBX


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our management team have prior work experience in supervising and implementing cybersecurity risk mitigation efforts in highly-regulated industries. Our internal cybersecurity personnel and retained external cybersecurity consultants also have a breadth of expertise across core cybersecurity disciplines including governance, risk, compliance, and security architecture.

companyName: Cipher Digital Inc.

ticker: CIFR


text: Identifying and assessing cybersecurity risk is fully integrated into our overall risk management systems and processes. The Company is committed to developing and maintaining cybersecurity processes that protect the confidentiality, integrity and availability of Company, employee, customer and partner information against a growing number of increasingly sophisticated cybersecurity threats and threat actors. Our cybersecurity program is designed to protect our infrastructure from potential threats, to allow us to assess, identify and manage material risks from cybersecurity threats and to endeavor to secure the integrity of our data systems using techniques, hardware, and software typical of companies of our size and scope, which are described further below. For example, we leverage the National Institute of Standards and Technology Cybersecurity Framework's ("NIST CSF") principles in developing our cybersecurity program to monitor our security environment and manage risk.

companyName: Sotera Health Co

ticker: SHC


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by head of administration and our managed service provider. Our head of administration has over four years of experience addressing cybersecurity risks. Our head of administration is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our head of administration oversees the Incident Response Plan and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: The Audit Committee of the Allstate Board oversees the effectiveness of the cybersecurity program. The Audit Committee retains an external cybersecurity advisor to consult on cybersecurity matters and perform assessments of the Allstate Information Security Program.

companyName: ALLSTATE CORP

ticker: ALL


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Technology providers identifies and addresses known cybersecurity risks on a continuous basis. In addition, we stive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.

companyName: Vyome Holdings, Inc

ticker: HIND


text: Cyber Risk Management Personnel. Through training and compliance programs, the concept that all employees are responsible for the data and critical systems they access is reinforced. The information technology department has the responsibility to implement cybersecurity controls under the overall guidance of the cybersecurity team. This cybersecurity team includes internal cybersecurity experts that have a combined 28 years of general information technology experience and 18 years of cyber specific related experience. The internal cyber team members have obtained various degrees and certificates in network administration, security administration and information system management. We also partner with a third-party cybersecurity firm that assists us and many other clients in setting direction, implementing cybersecurity technology and supporting our security operations center. Our internal information technology department is led by two directors, one with 25 years of experience in information technology leadership roles at Knife River and the other with 15 years of experience in information technology roles at MDU Resources and Knife River combined. The information technology department, including the cybersecurity team, reports to the vice president of support services, who has 18 years of information technology leadership and operational leadership experience with Knife River and over 30 years of total information technology experience. The vice president of support services reports to the chief executive officer.

companyName: Knife River Corp

ticker: KNF


text: Our management team, including our Chief Legal Officer and Chief Information Security Officer ("CISO"), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management process and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has a degree with a focus on information technology, and is a Certified Information Systems Auditor with over 20 years of experience in information technology related roles, including building and leading cybersecurity, risk management and information protection teams. Our CISO reports to our Chief Legal Officer who oversees cybersecurity, and holds a Carnegie Mellon University Software Engineering Institute CERT Certificate for Cybersecurity Oversight. The other members of the operational cybersecurity team collectively have decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for the cybersecurity team.

companyName: KLA CORP

ticker: KLAC


text: The Trust understands the importance of preventing, identifying, assessing, and managing material risks associated with cybersecurity threats. To manage material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, the Trust undertakes the below-listed activities: Monitoring emerging data risks, laws, and regulations pertaining to cybersecurity; vulnerability scans of the Trust's digital infrastructure; training for employees, including regular phishing email simulations; Reviewing third-party service providers to assess each vendor's cybersecurity processes prior to engaging and on an ongoing basis; access controls that restrict third-party service provider access to systems necessary to provide services; a cyber risk assessment, internally or by engaging a third party, to evaluate cybersecurity program, policies, and procedures;

companyName: Frontier Funds


text: Our networks and systems are continuously monitored by a combination of third-party service providers and an internal cybersecurity team. Management is promptly notified of cybersecurity incidents. Audit Committee is promptly notified by our management of any material cybersecurity breach. Board of Directors is briefed at least annually on the state of our cybersecurity program.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Impact of Cybersecurity Risks on Business Strategy, Results of Operations or Financial Condition Substantially all of the Company’s business is conducted online. Accordingly, there is a risk that a cybersecurity incident that impacts our ability to conduct business online (including any loss of confidence by consumers and counterparties in our information security practices or capabilities) could have a material adverse impact on our business strategy, results of operations or financial condition. The Company’s approach to the management and mitigation of cybersecurity risks reflects the online nature of our business. To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. As part of the Company’s overall risk mitigation strategy, we maintain cyber liability insurance coverage. Such coverage, however, may not be sufficient to cover us against related claims. For additional information, see “Risks Related to our Business and Industry,” in Item 1A, “Risk Factors” in this Annual Report.

companyName: QUINSTREET, INC

ticker: QNST


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Relating to Our Business – We may have risks associated with security of our information technology systems".

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: Our risk management program is designed to identify, assess and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cyber security component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Our information technology systems may be vulnerable to disruption and cyberattacks, which could place our systems at risk from data loss, operational failure or compromise of confidential information." in this annual report on Form 10-K.

companyName: Gatos Silver, Inc.


text: We have implemented and maintain a cybersecurity risk management program, which consists of, among other things, comprehensive processes to identify, assess, manage, and mitigate material cybersecurity threats as part of our broader enterprise risk management program. We utilize an internal team of cybersecurity professionals and, to some extent, data privacy professionals to oversee this program. Where appropriate, we obtain input from external experts on our program, including with respect to prevailing cybersecurity practices and the latest cyber threat trends. Cybersecurity Team.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: Board Governance and Management Cybersecurity risk is managed as an enterprise risk in the Company's enterprise risk management process. Responsibility for risk oversight and management generally lies with the Company's Board. To effectively manage oversight of our cybersecurity risk management practices, since 2019 the Board has delegated such responsibility to the Company's Audit and Finance Committee. The Company's Chief Information Security Officer ("CISO") and the Information Security team provide reports to either the Audit and Finance Committee or the Board on a quarterly basis on various matters, such as current and emerging cybersecurity risks to the Company, risks and incidents that were escalated to management during the prior quarter (including those that did not require immediate escalation to the Audit and Finance Committee and/or full Board), internal and external assessments of the Company's information security program, and a roadmap of projects and major initiatives to manage its information security posture.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: We have a cybersecurity program to identify, monitor, and mitigate cybersecurity risks. The security program consists of responsibilities for information security and incident response and is overseen by a third-party consultant with guidance from subcontracted cybersecurity vendors that our third-party consultant contracts. We consider cybersecurity risks alongside other company risks and consult with subject matter experts where necessary to identify cybersecurity risks, and evaluate their nature and severity.

companyName: CEA Industries Inc.

ticker: BNC


text: Risk Management & Strategy Shentel's Risk Management Program defines the framework for risk identification and assessment, including cybersecurity risks. Our overall Risk Management Program integrates processes for assessing, identifying and managing material risks from cybersecurity threats. Cybersecurity risks are identified through various means including, but not limited to, regularly conducted security assessments, external and internal penetration testing, data privacy assessments, external security evaluations, the testing and implementation, as applicable, of new technologies, and continuing education and awareness of existing and new threat vectors, industry trends, changes in the environment and changes in the overall technology landscape. Pursuant to our Information Security Program, once a cybersecurity risk is identified, the Information Security team, in collaboration with other areas of the organization, will assess the risk and implement an appropriate response. Security risk assessments comprise the reasonably foreseeable impacts to the Company and its stakeholders due to the threats and known vulnerabilities associated with the operation and use of information systems and the environments in which those systems operate.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and design and assess our program using the National Institute Cybersecurity Framework ("NIST CSF") as a set of guiding principles.

companyName: Power REIT

ticker: PW


text: A review of cybersecurity risks is integrated into our annual enterprise risk assessment that occurs as part of our annual strategic planning process and is included in our quarterly disclosure controls and procedures. Our annual enterprise risk assessment process involves the identification and assessment by senior line-of-business and functional leaders, as well as our Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"), of the risks relevant to their lines of business and functional areas, the materiality of those risks, our risk tolerances and our plans to manage and mitigate the risks to the extent prudent and feasible.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Among the duties and responsibility of our Information Security Team are the following: Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, including legal counsel; cybersecurity consultants; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and forensic investigators.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Third-party Risk we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: M2i Global, Inc.

ticker: MTWO


text: CSC's Board of Directors oversees management's processes for risk management, and the Risk Committee of the Board of Directors assists the Board in fulfilling its oversight responsibilities with respect to managing risks, including cybersecurity risks. Integrated within the Company's overall enterprise risk management program, Schwab has an established information security program that knits together complementary tools, controls, and technologies to protect systems, client accounts and data. We continuously monitor the systems and work collaboratively with government agencies, law enforcement, and other financial institutions to address potential threats. We deploy advanced monitoring systems to identify suspicious activity and deter unauthorized access by internal or external actors. We also maintain policies, standards, and procedures, which apply to employees, contractors, and third parties, regarding the standard of care expected with all data, whether the data is internal company information, employee information, or non-public client information. This includes limiting the number of employees who have access to clients' personal information and internal authentication measures enforced to protect against the unauthorized use of employee credentials. All employees who handle sensitive information are trained in privacy and security. Schwab also engages with external firms specializing in discrete areas of cybersecurity to assess the Company's practices, vulnerabilities, and overall cyber risk posture.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see "Item 1A - Risk Factors - Technology and Operational Risks."

companyName: FB Financial Corp

ticker: FBK


text: Our management team, including our CTO and VP, IT, is responsible for assessing and managing our material risks from cybersecurity threats. The VP, IT's team has primary responsibility for the day-to-day operation and implementation of our overall cybersecurity risk management program and supervises both our internal cybersecurity team and our retained external cybersecurity consultants. The VP, IT's team also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: Childrens Place, Inc.

ticker: PLCE


text: Management Personnel responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CEO, Mr. Ben-Yohanan. With over 10 years of experience in the field of corporate auditing, Mr. Ben-Yohanan brings a wealth of expertise to his role. His background includes extensive experience as a corporate auditor for Fortune 500 firms. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CEO oversees our governance programs, tests our compliance with standards, remediates known risks, and interacts directly with our external cybersecurity experts.

companyName: Clubhouse Media Group, Inc.


text: Our CEO and CFO provide prompt reports to the Board regarding cybersecurity risks and incidents as they are revealed, as well as periodic reports, as appropriate, regarding the Company's cybersecurity activities.

companyName: INVO Fertility, Inc.

ticker: IVF


text: Incidents are delegated to an appropriate incident response team for assessment, investigation, and remediation. Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Chief Privacy Office, Human Resources, Procurement, Finance and Operations, and Corporate Security. The incident response teams advise and consult with the GC and the SVP Sponsor, as appropriate.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: periodically and on an as-needed basis to manage our risk assessment and mitigation process. We monitor and test our safeguards and regularly conduct training for our employees on these safeguards, in collaboration with human resources, IT, and management. We are committed to promoting a company-wide culture of cybersecurity risk management.

companyName: Wetouch Technology Inc.

ticker: WETH


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process—Our business and operations may suffer in the event that our information technology systems, or those used by our CROs or other contractors or consultants, fail or suffer security breaches."

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: Our officers, contractors and third-party IT vendors help assess, identify and manage our cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools; conducting audits and threat assessments for internal and external threats; analyzing reports of threats and actors; evaluating our and our industry's risk profile; and evaluating threats reported to us.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: Notwithstanding our defensive measures and processes, the threat posed by cyberattacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks. To date, the Corporation has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Corporation.

companyName: FIRST OF LONG ISLAND CORP


text: Visa's cybersecurity program has been established to identify, analyze, mitigate, monitor, and govern cybersecurity risk and was designed around widely accepted international standards, such as ISO 27002 and the Payment Card Industry Data Security Standards, as well as applicable legal and regulatory requirements. We implement our cybersecurity program primarily through our Key Controls, which define the requirements for the protection of Visa information and technology assets. All employees must complete annual training on our Key Controls and are required to comply with the requirements. Exceptions to the Key Controls must be approved by an established senior management working group, which is overseen by our Corporate Risk Committee (CRC), the management committee responsible for overseeing Visa's cybersecurity program and other operational risks. The Key Controls are updated and reviewed annually by our Cybersecurity Governance, Risk and Compliance team and approved by management committees to ensure they continue to address evolving cybersecurity threats and associated legal and regulatory obligations.

companyName: VISA INC.

ticker: V


text: Our Director of IT Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall IT risk management strategy, communicating key priorities to relevant personnel, overseeing cybersecurity operations, and managing the cybersecurity technologies, processes, and projects. Our Executive Director of IT Data Management, Analytics and Integration is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and conducting regular reviews of security assessments and other security-related reports.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO