text: The Vice President of Security and Data Systems (the "CISO") leads our information security organization and is responsible for managing our information security program. Our CISO has over 30 years of industry experience, including serving in similar roles leading cybersecurity programs at other public companies. Team members who support our information security program have relevant educational, industry, and professional experience. Our information security team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.

companyName: Chewy, Inc.

ticker: CHWY


text: We believe that our current preventative actions and response activities provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks. However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated, and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring, and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, to date, management has determined that none of the cybersecurity attacks the Company experienced have resulted in a material impact to its financial condition, results of operations, or business strategy. In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations, or our financial conditions, like all technology companies, we face a risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "System security risks, data protection breaches, cyber-attacks and other related cybersecurity issues could disrupt our internal operations, and any such disruption could reduce our expected net sales, increase our expenses, damage our reputation, and adversely affect our stock price," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.

companyName: DIODES INC /DEL/

ticker: DIOD

secItem: Item 1C


text: The Board's oversight of risks from cybersecurity threats The full Board of Directors receives a report from the Company's Enterprise Risk Committee in connection with each of their quarterly, regularly scheduled meetings. Twice a year, an executive employee member of the Committee presents during those Board meetings, with the opportunity for the Board to ask questions and engage in discussions regarding risks and cybersecurity threats, and the Company's plans and efforts to address them. The materials presented to the Board may include, among other topics, updates and information regarding risk controls and related initiatives, cybersecurity monitoring data, cybersecurity threats and related risks, our SOC 2 Audit, and cybersecurity insurance. Our Chief Executive Officer, our Chief Financial Officer, and our General Counsel, who are members of our Enterprise Risk Committee, regularly attend Board meetings and are available to liaise between the Board and the rest of the Enterprise Risk Committee, should the Board have additional questions or concerns that need to be addressed.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: We draw heavily on our own commercial security solutions and services to manage and mitigate cybersecurity risks. IBM maintains a Security Operations Center ("SOC") that monitors for threats to IBM's networks and systems, utilizing threat intelligence provided by a range of sources, including the IBM Security X-Force Exchange platform, which maintains one of the largest compilations of threat intelligence in the world. We also rely on tools licensed from third party security vendors to monitor and manage cybersecurity risks. We periodically engage third parties to supplement and review our cybersecurity practices and provide relevant certifications.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Cybersecurity threats continue to evolve as the threat landscape evolves. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Bank's security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access of confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

companyName: RBB Bancorp

ticker: RBB


text: The Company's VP of Information Technology, Security and Business Intelligence is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology, Security and Business Intelligence works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel. The Company's VP of Information Technology, Security and Business Intelligence has served in various roles in information technology and information security for over 18 years, including Biogen, AstraZeneca, Iron Mountain, and consulting roles at Charles River Labs, Sunovion Pharmaceuticals, Agero and DentaQuest. The VP of Information Technology, Security and Business Intelligence holds a MBA from Boston University, a Master's degree in Electrical and Computer Engineering from Utah State University, and a Bachelor's degree in Electronics Engineering from Mumbai University. The Company's Information Technology team has specific professional certifications, and has over 10 years of experience with managing risks arising from cybersecurity threats.

companyName: Axogen, Inc.

ticker: AXGN


text: On behalf of the Fund, the Advisor engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, the Advisor engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. The Advisor has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, the Advisor utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Trustees as part of periodic reports.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: Apollo's Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Apollo Debt Solutions BDC


text: The Company provides regular, mandatory trainings for applicable personnel with the purpose of providing personnel with effective tools to address cybersecurity threats and incidents, and to effectively communicate our cybersecurity risk management processes, including all related information, security policies, standards, process and practices.

companyName: WillScot Holdings Corp

ticker: WSC


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies. from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition.

companyName: Nordicus Partners Corp

ticker: NORD


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices.

companyName: AWARE INC /MA/

ticker: AWRE


text: Our cybersecurity processes are integrated into our overall enterprise risk management program and business continuity processes. In this regard, we address cybersecurity risks through a comprehensive, cross-functional approach across our technology, legal, compliance, finance and other teams aimed at preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. This integration helps ensure that the breadth of potential impacts from cybersecurity risks are considered and that our approach to managing these risks is consistent and coordinated across teams within our business. Through our enterprise risk management program, our cybersecurity risk is regularly evaluated, and we regularly report this assessment of our cybersecurity risk to management and to the audit committee of our board of directors. We also periodically review our cybersecurity risk with our entire board of directors.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Protection of our informational assets is managed by a comprehensive, multilayer strategy modeled on the National Institute of Standards and Technology ("NIST") cybersecurity framework, and combines assessments, technology, services, policies, and user education to detect, prevent, mitigate and remediate cybersecurity incidents and related risks. However, this does not imply that we meet any particular technical standards, specifications, or requirements. We have instituted cybersecurity-related policies and procedures, which are key components of our cyber defense and our efforts to protect employees and contractors, while encouraging partnerships only with responsible vendors who also invest in effective cybersecurity practices.

companyName: SOUTHWESTERN ENERGY CO


text: Management Governance Disclosure Our senior management team, which includes our Chief Information Security Officer, or CISO, is responsible for identifying, assessing, and managing material risks from cybersecurity threats, as well as for establishing processes to ensure such risks are monitored and mitigated, with the CISO taking the lead on such matters. Our CISO, who joined Appian in May 2021, brings over 17 years' experience in security and compliance initiatives, including experience in the software-as-a-service and platform-as-a-service cloud industries. We have documented the framework and process for when and by whom senior management is informed and when such information will be reported to the other parties in our Incident Response Guide, which is regularly reviewed and updated by the information security team.

companyName: APPIAN CORP

ticker: APPN


text: The Company also maintains a third-party risk management ("TPRM") program designed to identify, assess, and manage risks, including technology and cybersecurity risks, associated with vendors and other external service providers. The TPRM program defines standards and identifies management responsibilities relative to risk assessment, due diligence, contract review and structuring, and third-party oversight and ongoing monitoring; the program aligns with Interagency Guidance on Third-Party Relationships: Risk Management. The TPRM program is a second line function that is overseen by the Company's Operational Risk Manager, who reports directly to the CRO. The status of the TPRM program is reported to management on a regular basis and, periodically, to the Risk Committee.

companyName: LAKELAND BANCORP INC


text: Our VP of Engineering, who reports to the CEO, leads our cybersecurity function and is responsible for managing our cybersecurity risk and the protection of our networks, systems, and data. The VP of Engineering uses both internal and external resources to execute this process including our own INTRUSION Shield technology, to help prevent, identify, escalate, investigate, and resolve security incidents in a timely manner. The Company, with the oversight of the CEO, also requires all employees to complete an annual cybersecurity training course.

companyName: INTRUSION INC

ticker: INTZ


text: Our information security management program is ISO 27001 certified, and we undergo routine audits by an independent, certified accreditation body to maintain this certification. Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers for both internal use and external use. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include cybersecurity-related contractual terms and periodic risk assessments throughout the life cycle of the third-party relationship. Lastly, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents. We refine our cybersecurity program by staying informed on security threats, leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. In addition to our policies and procedures to manage and identify cybersecurity risks, we have an incident response plan designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see "Item 1A. Risk Factors."

companyName: CDW Corp

ticker: CDW


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the UK governments' National Cyber Security Centre. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: TMC the metals Co Inc.

ticker: TMC


text: Given the importance of information security to our stakeholders, our Board of Directors receives regular updates from our CISO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: The Board receives regular updates from the Cybersecurity Committee, including a summary of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics.

companyName: HASBRO, INC.

ticker: HAS


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cyber security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts accommodate for the ever-evolving information and cyber security threat landscape. The Chief Information Security Officer ("CISO") regularly updates these committees on the information and cyber security risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. For more detailed information about risks related to our cybersecurity, refer to Item 1A, "Risk Factors" —"A significant data breach or other disruption to our information technology systems could disrupt our operations, result in the loss of confidential information or personal data, and adversely impact our reputation, productivity, business or results of operations."

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: Our Board of Directors and our Risk Oversight Committee are actively engaged in the oversight of our information security program. Our Risk Oversight Committee assists our Board of Directors with its oversight of Etsy's management of risk exposures, including oversight of technology and information security related risks, as well as oversight of management's processes for effectively monitoring and mitigating risk.

companyName: ETSY INC

ticker: ETSY


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data and information related to our product candidates, preclinical studies and clinical trials, which we refer to collectively as Information Systems and Data.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: As of the date of this report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: The Company's cybersecurity risk management is integrated in our overall risk management processes. Our enterprise risks, including cybersecurity risks, are reviewed on a biannual basis. The review involves participation and engagement by, among others, subject matter experts like the Company's Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"), the presidents of the Company's business segments, and executive management. Mitigation plans are deployed across the Company with cross-functional collaboration as applicable. Enterprise risk management is reviewed with the Board annually.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: Our Technology Team is responsible for the implementation, monitoring, and maintenance of cybersecurity and data protection practices across the Company. The Technology Team includes members who have experience in network security, server integration and data protection. In conjunction with a cross-functional team, our Technology Team regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. In addition to our internal cybersecurity capabilities, we also regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to participate in tabletop and other training exercises. The Technology Team monitors and is informed about cybersecurity incidents through firewalls that are triggered in our information technology systems.

companyName: Techpoint, Inc.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes requiring certain vendors to complete security questionnaires, conducting risk assessments for certain vendors, reviewing security assessments, conducting security assessment calls with certain vendor security personnel, and imposing information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: We engage consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. In the last three fiscal years, we have not experienced any material cybersecurity incidents or costs.

companyName: CORVEL CORP

ticker: CRVL


text: The audit committee receives quarterly reports from the CTO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Definitive Healthcare Corp.

ticker: DH


text: The Board of Directors has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. The Audit Committee serves and functions as the Board of Directors primary oversight body to monitor the Company's cybersecurity and related information technology risks. The Audit Committee receives periodic updates from the Sr Director of Tech on the Company's policies, processes, procedures, and any significant development related to the identification, mitigation and remediation of cybersecurity risks. The Audit Committee ensures that the Sr Director of Tech provides to the Board of Directors annual updates on our cybersecurity and information technology risk. These annual updates include topics related to our cybersecurity programs and mitigation strategies, trends in cybersecurity, and other cybersecurity-related developments.

companyName: AIR T INC

ticker: AIRT


text: Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our Chief Executive Officer is informed about and facilitates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our IT Director. In addition, we have an escalation process in place to inform our Chief Executive Officer and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Our board of directors has delegated oversight of our cybersecurity program, which includes oversight of cybersecurity threats, to the audit committee. Throughout the year at each quarterly meeting, the audit committee receives updates on our cybersecurity program from senior management, including in connection with program enhancements, audits of the program and employee cybersecurity training. Our Head of Information Technology is a Certified Information Systems Security Professional who has provided program management and enterprise cybersecurity services across different organizations for over twenty years, has a Master of Information Technology Management and is responsible for day-to-day assessment and management of our information systems and cybersecurity program. Our Head of Information Technology reports directly to our Chief Financial Officer.

companyName: AIR LEASE CORP

ticker: AL


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including Any material failure, weakness, interruption, or breach in security of our information systems or data, or those of the third parties with whom we work, could prevent us from effectively operating our business.

companyName: NETSTREIT Corp.

ticker: NTST


text: The responsibilities of the Chief Information Officer ("CIO") include overseeing cybersecurity measures with the global Chief Information Security Officer ("CISO"). The CIO's background includes nearly 18 years of IT leadership at a major medical technology company and experience in various industries such as financial services, manufacturing, oil and gas, and chemicals. He holds an undergraduate degree in Management Information Systems from Augsburg University and a Master of Business Administration from Carlson School of Management at the University of Minnesota.

companyName: APi Group Corp

ticker: APG


text: Cybersecurity continues to be a particularly acute area of risk for companies of all sizes and in all industries, including us. Our management and board of directors recognize the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Both management and our board of directors are actively involved in our enterprise risk management, and cybersecurity represents an important component of our overall approach to enterprise risk.

companyName: AZEK Co Inc.


text: Identified cybersecurity risks are reported to IT, where they are assessed and responded to. Any actions taken or cybersecurity incidents identified are reported to the Director of Technology. Qualifications for these individuals include prior experience, education, and/or training in cybersecurity.

companyName: PCS Edventures!, Inc.

ticker: PCSV


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes and practices, which are integrated into the Company's overall risk management system. To protect the Company's information systems from cybersecurity threats, the Company uses various security technologies and tools that help the Company identify, escalate, investigate, manage, resolve and recover from security incidents in a timely manner. These efforts include: • ongoing collection of threat intelligence and environment awareness through monitoring, • data protection management and vulnerability monitoring through data loss prevention and exfiltration tools, • cybersecurity risk management processes and practices, • control assurance, • secure development of new products, • identity and access management, • incident response, auditing and monitoring, and • maintaining a 24x7 security operations center to allow for always available incident response.

companyName: NetApp, Inc.

ticker: NTAP


text: Additionally, in connection with our cybersecurity risk management processes, we engage consultants, including outside counsel, to review our processes or programs, benchmark and opine on best practices. We conduct tests on our ecommerce sites to identify control gaps and prioritize process improvements that align with our business and cybersecurity strategy. We also periodically engage a third-party independent review of our cybersecurity program against the NIST Cybersecurity Framework 2.0 to provide an independent assessment and perspective measured against industry standards. In addition, members of senior management participate in periodic tabletop exercises with third-party experts on crisis management best practices to apply their learnings to the company's business continuity, enterprise risk and cybersecurity programs.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: Our Audit Committee oversees the application of our ICT systems and all risks relating to cybersecurity. Cybersecurity is a standing agenda item at each of the Audit Committee's regularly scheduled meetings and the committee may engage any external advisor as needed to advise on cybersecurity matters. The Audit Committee periodically reports on such matters to the Board of Directors as part of our overall risk management and oversight framework. We have also established a management-level disclosure committee (the "Disclosure Committee"). The Disclosure Committee, which consists of employees representing our legal, finance, IT, regulatory and clinical departments, is responsible for overseeing the preparation of our public disclosure materials and assessing the materiality of events within the Company. The Disclosure Committee is also responsible for conducting our cybersecurity risk assessment and ensures constituencies from across the Company are represented in such assessment. The Disclosure Committee monitors cybersecurity incidents and risk on an ongoing basis and may engage outside consultants as needed to assess and respond to cybersecurity incidents. The Disclosure Committee reports to the Audit Committee on a variety of matters, including cybersecurity risks. In addition, our Senior Vice President of Information Technology has significant experience managing IT departments, including with regard to cybersecurity risk management and compliance. We have also engaged a third party to provide technical information technology experience to the Disclosure Committee, Audit Committee and Board of Directors.

companyName: NewAmsterdam Pharma Co N.V.

ticker: NAMS


text: Education and Awareness: Security Awareness training is provided for all new and existing employees that reviews information concerning cyber risks and user responsibilities, and heightens awareness of cyber threats. Training is documented and reported to senior management when appropriate.

companyName: RIDGEWOOD ENERGY S FUND LLC


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Trends, Risks and Uncertainties Related to Technology and Data Privacy" included Governance

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: We rely heavily on our supply chain to deliver our products to our customers and consumers, and a cybersecurity incident at a supplier or partner could materially adversely impact us. As such, we have processes in place to oversee and identify risks from cybersecurity threats associated with suppliers and our use of third-party service providers, including through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data, and proprietary algorithms. We also include security and privacy addendums to our contracts where applicable. We require that our suppliers and partners report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties.

companyName: Kenvue Inc.

ticker: KVUE


text: Management & Strategy We manage information security risk through, and as part of, MetLife's Information Security Program (the "Program"), instituted to maintain controls for the systems, applications, and databases of the Company and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures across business units and at the enterprise level for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology along with the sensitivity of the systems and the potential severity of the associated risks to MetLife and its relevant lines of business, and is managed by MetLife's CISO, collaborating with lines of business and corporate functions. Our Board of Directors oversees the Program.

companyName: METLIFE INC

ticker: MET


text: Information security policies at Koppers lay out the guardrails that ensure compliance with the program. Examples of guardrails set within the information security policies at Koppers include, where appropriate, application of the principle of least privilege when granting access (the principle that a user or entity should only have access to the specific data, resources and applications needed to complete a required task), logging and monitoring activity of privileged accounts, authorized physical and logical access to information technology (IT) systems, and requiring maintenance of confidentiality of non-public information. Standard operating procedures (SOPs) help to ensure accuracy and completeness of various IT tasks being performed throughout the organization. SOPs include incorporating data processing agreements in contracts, commissioning and decommissioning of IT systems, granting role-based user access, patch management, and change management. Training is conducted regularly for all employees who interact with Koppers IT systems. Specialized training is also conducted for employees who deal with sensitive data. Security systems have been deployed to manage vulnerabilities within the IT environment, and periodic penetration tests validate the Koppers security posture.

companyName: Koppers Holdings Inc.

ticker: KOP


text: The Company's processes also allow for the Board and the Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Committee are scheduled on a quarterly cadence, the Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the Committee. In between meetings, the Board and the Committee receive information regarding relevant cybersecurity risks (including cybersecurity incidents) that meet pre-established reporting thresholds, as well as ongoing updates regarding any such risks.

companyName: Salesforce, Inc.

ticker: CRM


text: Our board of directors oversees our enterprise risk management, including our management of cybersecurity risks. The audit committee of our board of directors has primary responsibility for the oversight of risks from cybersecurity threats. The Head of Cybersecurity, or a delegate, provides quarterly reports to the audit committee on the effectiveness and overall status of our cybersecurity program, and is responsible for reporting to the audit committee information about our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses.

companyName: Alector, Inc.

ticker: ALEC


text: As a supplier of LMR products to federal, state and municipality agencies, our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. We have retained the assistance of a Cybersecurity expert consultant, to assist internal management to evaluate processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our products and have processes to assess those issues for potential cybersecurity impact or risk. We are also implementing a process to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.

companyName: BK Technologies Corp

ticker: BKTI


text: Our enterprise risk assessment includes our key cybersecurity risks. The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including technology risks and cybersecurity threats. Our CISO provides quarterly updates to the Audit Committee of the Board, which oversees our cybersecurity risks and regularly reviews and discusses with management various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance; discussion on policies, guidelines, and processes used by management to assess and manage such matters; and the steps management has taken to monitor and control such matters.

companyName: Chewy, Inc.

ticker: CHWY


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Lafayette Square USA, Inc.


text: To date, risks from cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Olo Inc.


text: Morgan Stanley and Company's Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.

companyName: North Haven Private Income Fund A LLC


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems.

companyName: GRAYBAR ELECTRIC CO INC


text: Cybersecurity risks are overseen by the Audit Committee of the Board of Directors of the Company. The Audit Committee and the Board of Directors oversee and periodically review the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans. The Chief Information Officer ("CIO") and Director of IT Security provide regular reports to the Audit Committee, which include information about cyber-risk management, the effectiveness of the Company's cybersecurity framework, direct or emerging threats to the Company, program maturity and strategy, third-party risk management, and benchmarking against its industry peers.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. See "Item 1A. — Risk Factors — Failure to maintain the integrity of our information and information systems or comply with applicable privacy and cybersecurity requirements and regulations could harm our reputation and adversely affect our business" for more detailed information on cybersecurity risks and the potential impacts.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: The Policy applies to all directors, officers, employees and contractors of the Company and any parent, holding companies and subsidiaries regardless of their contract terms, who use the Company's technological devices.

companyName: Bit Digital, Inc

ticker: BTBT


text: The Audit Committee monitors management's responsibility in the area of risk oversight, including cybersecurity risks. At each regular meeting, the Audit Committee receives updates from the CISO, regarding trends, emergent risks to our technology infrastructure, major updates on security assessments and threat landscape, and the steps we are taking to respond to these matters. The CISO also provides an annual update to the Board, or as may otherwise be required.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. Our Board of Directors has delegated responsibility to the Audit Committee for the oversight of cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, the cybersecurity program is led by the Chief Information Security Officer who reports to the Chief Information Officer. Our Chief Information Security Officer has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint. He leads global teams in cybersecurity and infrastructure operations and regularly attends training in cybersecurity and risk mitigation. The Information Technology (IT) Cybersecurity Risk Management Committee, comprising senior IT leaders, meets quarterly and reviews trending risks and remediation efforts, and reports to the Audit Committee. When necessary, we assign resources to mitigate and evaluate risks to the enterprise level as part of our Enterprise Risk Management program.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: We have policies and processes in place for assessing, identifying, and managing material cybersecurity risks, and integrate these processes into our overall risk management systems. We conduct periodic risk assessments to identify reasonably foreseeable internal and external cybersecurity risks, the criticality of such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Marqeta, Inc.

ticker: MQ


text: The Board of Directors maintains oversight of our cybersecurity risks. The Company receives regular updates from management regarding cybersecurity program, including risk assessments, incident response capabilities, and the effectiveness of controls. Management is responsible for assessing and managing our material cybersecurity risks, as well as for the development and implementation of our cybersecurity policies, procedures, and controls, and are responsible for reporting on the program's status and any material cybersecurity incidents to the Board of Directors.

companyName: Mag Magna Corp

ticker: MGNC


text: Risk Assessment and Management At least annually, we conduct a cybersecurity risk assessment to identify key cybersecurity risks, assess the likelihood of the identified risks, and the potential business impact, and develop related mitigation and enhance plans. Our cyber risk management initiatives are integrated within the Company's overall risk management process.

companyName: Karat Packaging Inc.

ticker: KRT


text: A cybersecurity incident could materially affect our business, results of operations, financial condition, and reputation, in addition to potentially subjecting us to government investigations, litigation, fines or damages.

companyName: ARVANA INC

ticker: AVNI


text: Material Impact of Risks from Cybersecurity Threats In the last three fiscal years, we have not experienced a material information security breach incident that has materially affected our business strategy, results of operations or financial conditions. The expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Our General Business Operations and Our Corporate Structure—Security incidents or cyber-attacks could adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: We consider cybersecurity risk management, confidentiality and information security to be critical to our corporate visions and values. We employ a combination of people, technical safeguards and processes to manage these risks and protect information for which we are responsible. Our security program, policies, standards, processes, tools and talent are aligned with the purpose of preventing and mitigating any potential cybersecurity incidents and data leakage.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: Cat Financial Cybersecurity Governance Our Risk Committee provides oversight over our information security program and other matters related to cybersecurity. Our President serves as the chair of this committee, which includes among its members our Chief Risk Officer and our Chief Information Officer. Our cybersecurity program is managed by our Chief Information Security Officer, who reports on a regular basis to our Risk Committee on cybersecurity matters and who regularly collaborates with the Caterpillar cybersecurity team.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: The Corporate Governance and Nominating Committee of the Board is tasked with overseeing cybersecurity risk. Management, including the CTO, provides regular reports to the Board covering aspects such as risks, threats, the evolving threat landscape, enhancements to the cybersecurity program, and the preparedness of internal responses.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Incident Response and Recovery Planning—We have established and maintain an incident response program that governs our response to a cybersecurity incident from detection and initial assessments to incident resolution and recovery. We have a dedicated cybersecurity team led by our CISO that monitors our information systems for indications of cybersecurity threats and will employ our cybersecurity operational model within the incident response program promptly upon threat detection. Our incident response program is tested and evaluated on a regular basis.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our IT Department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business. In addition, our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our board of directors, which, together with our board of directors, evaluates our overall enterprise risk.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Our Chief Information Security Officer has extensive experience in the information technology area, with over twenty years of professional experience in the information security area, including as a result of his service as the director of security, a security architect and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC. Our Chief Information Security Officer aims to ensure rigorous oversight and execution of our cybersecurity and information security strategy.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: As a smaller reporting company, we are proactively leveraging AI and other resources to enhance our cybersecurity measures. While we do not yet have a dedicated cybersecurity team or fully formalized protocols, we are actively developing new practices, incorporating advanced technologies to identify and mitigate risks. Our efforts include ongoing assessments and the exploration of strategic partnerships to strengthen our security posture.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: To date, there have been no significant threats, including as a result of any significant cybersecurity breaches or attacks, that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."

companyName: PBF Energy Inc.

ticker: PBF


text: To ensure that associates can play their part in protecting our networks and data from cybersecurity incident exposure, all of our associates receive cybersecurity training in the form of online modules on an annual basis, routine simulations to assess risk, and retraining where necessary.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Our cybersecurity program is built upon the National Institute for Standards and Technology and other best practice frameworks. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats, including engaging an independent cybersecurity consultant to audit our systems and procedures, make recommendations for improvement and monitor remediation of any identified risks. We also conduct random vulnerability testing including network penetration testing, phishing and social engineering tests. In addition, we also require Systems and Organization Control ("SOC") type reports from our service providers for our payroll and human resources system and stock administrator.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Mosaic's cybersecurity program is comprised of people, processes and technology that are designed to adequately protect the confidentiality, integrity and availability of information technology systems and data. Mosaic has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. We have a Governance Risk and Compliance team which is a dedicated team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk. The team works closely with the Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Enterprise Risk Management committee, which is comprised of members of our executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes. Mosaic develops and continues to refine mitigation plans that adhere to industry best practices.

companyName: MOSAIC CO

ticker: MOS


text: maintain, implement, evaluate and update our cybersecurity technologies to address threats and vulnerabilities; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Our Vice President, Information Technology ("VP IT") is responsible for developing, implementing, and maintaining our processes and procedures for cybersecurity risk management and response. Our current VP IT has over thirty years of experience, which includes cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within pharmaceutical and biotechnology companies. Any cybersecurity incidents are evaluated for potential impact and are reported, as appropriate to the severity, to our management, our Information Security Committee, our executive leadership and/or our board of directors. Our Information Security Committee, which is led by our VP IT and includes representatives from our IT, finance, and legal departments, meets regularly to review the incidence, impact assessment, and resolution of cybersecurity incidents, if any, and to assess evolving risks. Our Information Security Committee provides updates on cybersecurity incidents and responses and on cybersecurity risk management as needed and provides updates to executive leadership and to our Board of Directors.

companyName: Mural Oncology plc


text: Our cybersecurity risk management program is integrated into our overall strategic risk management program, and shares common methodologies, reporting channels and governance processes that apply across the strategic risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: FIGS, Inc.

ticker: FIGS


text: Because we are aware of the risks associated with third-party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our CTO. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Versus Systems Inc.

ticker: VS


text: Despite our efforts to implement robust security measures, in reliance on administrative, technical, and physical safeguards, our risk management strategies, and practices for protecting sensitive data are subject to certain limitations. A variety of factors give rise to these limitations including the evolving nature of cyber threats, resource constraints, and the inherent risks associated with the technologies we and third-party service providers employ. Arvana relies on third parties, including cloud vendors and consultants, for various business functions.

companyName: ARVANA INC


text: Business Continuity and Incident Response Plans are maintained to ensure that critical business functions maintain uptime or can be restored as quickly as possible in the event that a natural or technological event occurs that impacts the Corporation or any of its service providers. The Information Security Officer and Information Technology Manager work together to maintain these plans and perform testing exercises that ensure the Corporation's back up technologies and procedures are working as intended and are available if the need should arise.

companyName: FIRST KEYSTONE CORP

ticker: FKYS


text: We annually engage third parties to perform cybersecurity audits to identify opportunities and enhancements to strengthen our policies and practices. We also annually engage an independent third party to perform internal and external penetration testing of our systems.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: complex password protection; multi-factor authentication with geo-location and multi-step confirmation; continuous monitoring and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response planning; and industry benchmarking. We also require cybersecurity training when onboarding new employees and contractors assigned access to Optinose networks, as well as annual, required cybersecurity awareness training for our employees and contractors assigned access to Optinose networks. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: OptiNose, Inc.


text: Our cybersecurity strategy prioritizes governance, protection, detection, analysis, and response to known, anticipated, or unexpected cyber threats, effective management of cyber risks and resilience against cyber incidents. We maintain a formal cybersecurity program structured around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), a voluntary framework created by industry and the U.S. government to promote the protection of our infrastructure from cybersecurity risks. We contract with an external auditing firm to assess our cybersecurity controls relative to industry peers using the NIST CSF, which has six functions: govern, identify, protect, detect, respond and recover. We consistently evaluate the threat landscape, adopting a multifaceted approach to cybersecurity risks that through a zero trust strategy focusing on prevention, detection, and mitigation, which includes the following programs and practices: • Our cybersecurity team conducts an annual review of cybersecurity risks at the ERM level, integrating significant cybersecurity risks into our overall ERM program. We remain committed to increasing investments in cybersecurity, which includes providing additional training for end-users, adopting a zero trust methodology, identifying and safeguarding critical assets, and reinforcing monitoring and alerting capabilities. Our proactive approach involves regular testing of defenses through simulations and penetration tests, both technically and through a comprehensive review of operational policies and procedures. At the managerial level, our cybersecurity team consistently monitors alerts and holds regular meetings to discuss threat levels, trends, and remediation strategies. Additionally, we conduct periodic external penetration tests and maturity testing to assess the effectiveness of our security controls, including processes, procedures, and our readiness to face the evolving threat landscape. • We consider and assess the cybersecurity risks associated with the utilization of third-party service providers, including cybersecurity vendors, consultants, and auditors, under our third-party risk management program. Pursuant to the program, we evaluate security and data privacy controls prior to sharing or authorizing the hosting of sensitive data in computing environments managed by third parties. In addition, our standard terms and conditions with third-party service providers feature contractual provisions mandating specific security protections. • Our cybersecurity incident response plan is designed to detect and address potential threats that may impact the confidentiality, integrity, and availability of our technology systems. The response plan includes coordinated processes for handling security and data privacy incidents, encompassing communication and effective response, and as appropriate, escalation to the Audit Committee or the Board. CF INDUSTRIES HOLDINGS, INC.

companyName: CF Industries Holdings, Inc.

ticker: CF


text: Our Information Technology department is led by the Head of Information Technology, who oversees a team that includes the Director of Infrastructure and Security. This team is responsible for developing and executing our cybersecurity strategy, policies, standards, and processes. They collaborate closely with cross-functional departments to assess, mitigate, and manage cybersecurity risks, enhancing the security of our systems and the preparedness of our employees. The Head of Information Technology holds a Master of Science in Information Technology and has 20 years of experience in the biotechnology sector. The Director of Infrastructure and Security is a Certified Information Systems Security Professional (CISSP) and brings extensive expertise in securing enterprise infrastructure.

companyName: Verve Therapeutics, Inc.


text: We rely on suppliers that are also exposed to ransomware and other malicious attacks that can disrupt business operations. Although we take steps to secure confidential information that is provided to or accessible by third parties, such measures may not always be effective and losses or unauthorized access to, or releases of, confidential information occur. Such incidents and other malicious attacks could materially adversely affect our business, reputation, results of operations and financial condition.

companyName: TECOGEN INC.

ticker: TGEN


text: Our management team, including CTO and IT Manager, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has several years of experience and have been trained for various roles in information technology and cybersecurity at numerous technology companies.

companyName: AIRGAIN INC

ticker: AIRG


text: The cybersecurity group for Customers reports to the Chief Information Officer and is overseen by the Customers' Directors' Risk Committee. Our Program is led by the CISO. The Program has been designed to conform to the ISO 27001 standard, as well as the FFIEC guidelines for cybersecurity. We use these frameworks to help our organization ensure the confidentiality, integrity, and availability of technology and services for customers, team members, and partners. Our Program is ISO 27001 certified and is audited annually by an external accredited ISO 27001 certification body. Customers has recently achieved SOC2 Type 2 attestation.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: At least annually and on a periodic basis, our audit committee receives an update from management on our cybersecurity threat risk management and strategy processes and generally receives materials on our ability to mitigate current and emerging risks, and discusses such matters with our Chief Operating Officer. Our processes require that our audit committee is designated to receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: At Nextracker, we maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate established best practices and industry standards, drawing guidance from both CIS 18 and NIST CSF. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors. 1.Information Security Assessments: We collaborate with internal and external partners to evaluate our security. 2.Vulnerability Scanning and Penetration Testing: Engaging third-party service providers to assess external and internal vulnerabilities and potential threats. 3.Cyber Risk Register Reviews: Regularly review our internal risk register to stay vigilant against potential and identified risks. 4.Risk Prioritization: We prioritize and address risks through our dedicated cybersecurity risk management program and the cybersecurity council.

companyName: Nextpower Inc.

ticker: NXT


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of BOH oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of BOH on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of BOH.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: To date, we have not experienced any prior cybersecurity incidents that have materially affected our operations, business strategy, results of operations, or financial condition. For a discussion of risks that could in the future impact our operations, business strategy or financial condition, please see " Cybersecurity breaches could have an adverse effect on our business " in our Risk Factors.

companyName: ATN International, Inc.

ticker: ATNI


text: (2)Threat Identification & Response. Our internal information security team works collaboratively with our external industry consultants to identify threats utilizing analytics and metrics, which are aligned with the MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) Framework, and mitigate attacks across various layers of our enterprise systems. We leverage the core functions of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, and Recover) to constantly work toward identifying opportunities for further improvement and development of our risk mitigation strategies. We also build upon the principles of the ISO 27001 standard and have achieved ISO 27001:2013 certification for one of our data centers. As part of our response preparedness, our executive management team participates in comprehensive tabletop exercises annually simulating cybersecurity breaches or other incidents which simulate identifying, responding and reporting of such an incident in accordance with our risk management programs.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our comprehensive cybersecurity risk management is led by our CIO who brings over 30 years of extensive experience in information technology with a specialization in cybersecurity. Her expertise spans global information systems and data, cybersecurity operations, security management strategies and tools, security assessment and remediation, as well as the design and implementation of controls to prevent and detect cybersecurity threats. BKV's cybersecurity risk management program is overseen by management at multiple levels. The CIO and Manager of Cybersecurity play key roles in assessing, monitoring, and managing the Company's cybersecurity risks. The CIO Cybersecurity governance also is supported by our IT department and CSOC. These stakeholders meet monthly to review the monthly cybersecurity assessment and remediation report. The IT department conducts extensive reviews of our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities and implements systems and tools to remediate perceived risks. These tools are designed to prevent and detect activities or events that could pose a cybersecurity risk to our business. Our third party CSOC team provides 24-hour monitoring to detect and respond to suspicious activity in real time.

companyName: BKV Corp

ticker: BKV


text: We also maintain a cyber incident response plan ("IRP") with the objective of (1) providing a structured and systematic incident response process for cybersecurity threats that affect any of our electronic information systems and networks, (2) timely and effectively identifying, resolving and communicating cybersecurity incidents and (3) managing internal and external communications and reporting. Under the IRP, a dedicated information security coordinator is responsible for implementing the IRP, as well as: • identifying the IRT and any appropriate sub-teams to address specific cybersecurity incidents, or categories of cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, communicate, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote associate and stakeholder preparedness and awareness of the IRP; and • reviewing the IRP at least annually, or whenever there is a material change in our business practices that may reasonably affect our cyber incident response procedures.

companyName: HELEN OF TROY LTD

ticker: HELE


text: Our business is managed under the direction of our Board of Directors (the "Board"), which guides our long-term strategy and represents the highest level of oversight at the Company. Our full Board oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our Board views the identification and effective management of cybersecurity threats as a critical component of its overall risk management and oversight responsibilities. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board reviews and discusses these cyber risks and threats and provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.

companyName: CoreCard Corp

ticker: CCRD


text: Our key cybersecurity processes are organized into four primary categories: • Outage and access: these processes address system intrusion and credential and password threats and risks; • Payment and loyalty rewards: these processes protect the information of our customers; • Personal data: these processes protect the payroll and healthcare data of our current and former employees and vendor information; and • Vendor partner security: these processes review the infrastructure and security processes of vendor partners that process transactions, provide cloud-based solutions and provide the backbone for our data flow.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Risk Mitigation Measures The information security team implements and maintains a multi-layered defense approach to safeguard the Company's information technology infrastructure in accordance with industry best practices and updates the Company's systems and software to address identified vulnerabilities. The Company has also developed an incident response and disaster recovery plan to respond to cybersecurity incidents.

companyName: IMAX CORP

ticker: IMAX


text: Controls to mitigate risks, including access controls, data protection, data backups, redundant systems, and incident response plans. We keep our controls up-to-date. Actions to correct any deficiencies and reduce or eliminate vulnerabilities. Written cybersecurity contingency plans, including plans for various specific scenarios.

companyName: NVE CORP /NEW/

ticker: NVEC


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats and our Interim Chief Financial Officer leads these efforts on behalf of the management team. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our Interim Chief Financial Officer is well-informed on emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents and is responsible for our internal cybersecurity programs and oversight of third-party cybersecurity vendors who monitor and execute on the prevention, detection, and mitigation of cybersecurity threats and incidents.

companyName: AVENUE THERAPEUTICS, INC.

ticker: ATXI


text: At this time, we do not believe the incidents or related litigation will have a material adverse effect on the business, operations, or financial results of Jackson Financial.

companyName: Jackson Financial Inc.

ticker: JXN


text: Cohen & Steers uses third-party service providers to assist in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and continuous monitoring of Cohen & Steers' environment. Members of the Advisor's management report key findings to our audit committee and Cohen & Steers adjusts its cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: The Corporation received written notice during 2023 that certain of its customer data was potentially included in the global incident involving Progress Software Corporation ("MOVEit Transfer"). The incident did not involve the Bank's internal network or IT systems, but was rather related to a third party prominent financial institution vendor that utilized MOVEit Transfer in its service offering to the Bank. Based on the investigation, the Bank's customers who use online and mobile banking could have had personal information copied through the cyberattack. The vendor confirmed that it implemented the recommended patches released by Progress Software Corporation for the platform. The Bank worked with the vendor to determine the potentially impacted customers and the extent of information potentially exposed and the Bank notified potentially affected customers appropriately. The incident did not impact the ongoing operations of the Bank and the Bank's cyber insurance is expected to cover many of the costs related to the incident. The MOVEit Transfer incident is the only cybersecurity incident that materially affected the Corporation during the 2023 fiscal year.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. We routinely conduct risk and compliance assessments of third-party service providers that request access to our information assets. We re-asses our third-party vendors in an ongoing basis.

companyName: Adeia Inc.

ticker: ADEA


text: As of January 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: STARGUIDE GROUP, INC.

ticker: STRG


text: Such threats and breach attempts have not materially affected our business, strategy, results of operations or financial condition. At any given time, however, we may face known or unknown cybersecurity risks and threats that cannot be fully prevented or mitigated, and we may discover vulnerabilities in our cybersecurity programs. Therefore, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on the cybersecurity risks we face, please refer to "

companyName: SRx Health Solutions, Inc.

ticker: SRXH


text: A determination that a cybersecurity incident has, or is reasonably likely to have, a material impact on the Company is reported by the Assessment Committee to the CEO and the Board's Audit Committee without delay. The Assessment Committee also provides a summary of all incidents that are determined to be immaterial to the Board's Audit Committee at the next scheduled meeting.

companyName: Lazard, Inc.

ticker: LAZ


text: We understand the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Certain cybersecurity processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated into our operations as a part of our overall risk assessment process.

companyName: Transcode Therapeutics, Inc.

ticker: RNAZ


text: As of the date of this Annual Report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. For more information, see "Risk factors - If our internal information technology systems or sensitive information, or those of our third-party CROs or other contractors or consultants, are or were compromised, we could experience adverse consequences from such compromise, including but not limited to, a material disruption of the development of our product candidates, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."

companyName: Anebulo Pharmaceuticals, Inc.

ticker: ANEB


text: Management is to perform a corporate risk assessment annually, which includes specific consideration and assessment of cybersecurity risk, proportional to the size of the Company. Service providers must meet certain security requirements such as security incident or data breach notification and response protocols, data encryption requirements, and data disposal commitments. managing cybersecurity risk, we employ a defense-in-depth strategy and regularly monitor our cyber environment for potential new threats.

companyName: Sundance Strategies, Inc.

ticker: SUND


text: We use a combination of cyber security personnel, documented processes and purpose-driven technologies and monitoring systems to identify, protect, detect, respond and recover from security incidents. These encompass incident response procedures, information security and vendor management and a combination of participation in industry consortiums, continuous monitoring, internal, as well as independent testing of systems, and team member education. Our independent testing includes both (i) periodic testing and evaluations performed by our internal audit firm and (ii) annual network penetration testing conducted through independent third parties. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. As part of these processes, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business (including, but not limited to, SEC rules, the CCPA and the Gramm-Leach-Bliley Act, as further described under the caption "Business—Regulations"), as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.

companyName: Rithm Capital Corp.

ticker: RITM


text: Veradigm's Privacy & Security Executive Council ("PSEC") provides oversight of risks from cybersecurity threats. The Chief Security Officer ("CSO") provides oversight of Veradigm's IS Program and, along with the PSEC and other members of management, reviews material cybersecurity incidents, reviews key metrics on Veradigm's cybersecurity program and related risk management programs and manages cybersecurity program goals. The CSO updates the full Board on matters relating to cybersecurity.

companyName: Veradigm Inc.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.

companyName: Blue Owl Capital Corp II


text: Our board of directors (the "Board") is responsible for monitoring and assessing strategic risk exposure, and our audit committee has been designated with the responsibility of overseeing our technology and information security, including cybersecurity, policies and practices, and the internal controls regarding information security. Our Senior Vice President of Engineering provides quarterly updates to the audit committee on these topics, as well as cybersecurity risk exposure and steps taken to monitor and mitigate such exposure. The Board receives reports from management on our information security and cybersecurity matters on an annual basis. In addition, our incident response process provides that our audit committee is notified in the event of a material cybersecurity incident.

companyName: Coursera, Inc.

ticker: COUR


text: These members of management and the Cybersecurity Executive Committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our cybersecurity playbooks and incident response plan outline our procedures, communication protocols, and information escalation processes applicable throughout the lifecycle of a cybersecurity incident. The playbooks and plans cover information flow from discovery of a possible issue through the reporting of it to Information Services management and to the Cybersecurity Executive Committee and Board as necessary. In the event of a cybersecurity event at Centuri, Centuri's leadership team informs Southwest's cybersecurity team, and the Company's Audit Committee or entire Board is briefed, as appropriate. As discussed above, members of management (our President, Chief Information Officer, and Director of Information Security) report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least twice per year, with the Audit Committee receiving more frequent updates as needed to assist in including cybersecurity items in financial reporting and monitoring attack and penetration testing results.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Operationally, we deploy multiple layers of cyber defenses including multiple tools and processes that identify security risks across our global networks, largely in real time. We also maintain good relationships with law enforcement agencies to remain informed on potential cyber risks.

companyName: AMETEK INC/

ticker: AME


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents in the last three years. However, there can be no assurance that our security efforts and measures, and those of our third-party providers, will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "Item 1A–Risk Factors–Cybersecurity incidents may adversely affect our business."

companyName: LXP Industrial Trust

ticker: LXP


text: Risks from Cybersecurity Threats As of the date of this report, no risks from cybersecurity threats, including as a result of cybersecurity incidents we have experienced in the past, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. The Company seeks to ensure effective governance in managing risks associated with cybersecurity threats, as more thoroughly described below.

companyName: NUCOR CORP

ticker: NUE


text: We apply a comprehensive approach to the mitigation of identified security risks, including monitoring our third-party IT service provider and management of our unconsolidated affiliates. As a holding company with relatively low volumes of personnel and third-party data, we have established policies, procedures and controls, including those related to privacy, information security and cybersecurity, and we employ a broad and diversified set of IT risk monitoring and risk mitigation techniques tailored to the unique nature of our business, including threat and vulnerability management, security monitoring, identity and access management, phishing awareness, risk oversight, third-party risk management, disaster recovery and business continuity management.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: We leverage industry best practices, including guidance from the National Institute of Standards and Technology (NIST), to identify, assess, and manage cybersecurity risks relevant to our business. While we don't adhere to any specific technical standards or specifications, NIST provides a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting and cloud-hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes the administration of a security questionnaire for certain providers, evaluation of certain provider's written security program, and review of security assessments and reports from certain providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Veritone, Inc.

ticker: VERI


text: We maintain and continually enhance a comprehensive, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the board of directors of our general partner. Our Chief Technology & Data Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. The Partnership follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to ongoing or previous clinical trials. (Information Systems and Data).

companyName: CHIMERIX INC


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: Supporting the Company's information security program is a third-party risk management program that manages the life cycle of external service providers and ensures that vendors meet the Company's cybersecurity requirements. This includes a periodic risk assessment of vendors and the review of vendor assessment documentation including audit reports and other independent control assessments.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Our information security team has established and implemented formal processes and policies to assess, identify, and manage risks arising from cybersecurity threats, including those associated with our internal operations and the use of third-party service providers. We continually refine our approach to address evolving cybersecurity regulations, identify potential and emerging security risks, and implement strategies to manage these risks. Ball has developed an incident response plan that includes a cyber incident materiality assessment with appropriate leadership governance. In addition, we have aligned our incident response plan with our enterprise risk and global crisis management processes.

companyName: BALL Corp

ticker: BALL


text: Identifying assets at risk from cybersecurity threats and taking mitigation measures including the implementation of data backup, recovery and restore procedures to ensure business continuity, as well as through IT controls, policies and infrastructure.

companyName: Altimmune, Inc.

ticker: ALT


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) our Cybersecurity Team works with our management team in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Cybersecurity Team and management team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the cybersecurity committee chairperson of the board of directors who may then notify the cybersecurity committee and board of directors (as appropriate), to further evaluate our overall enterprise risk.

companyName: NETGEAR, INC.

ticker: NTGR


text: Our management, represented by our Chief Financial Officer, oversees the Company's cybersecurity risk management program. Our advisor has elected to engage third-party providers to maintain its network defenses and to manage and assess cybersecurity risk management and strategy for the Company. Our advisor's third-party provider updates our Chief Financial Officer and members of our advisor's management team with any network issues on a monthly basis and makes recommendations for security upgrades as needed. Our Chief Financial Officer takes these recommendations into account in deciding which upgrades to implement. Our Chief Financial Officer will update the Audit Committee quarterly, or more frequently in the case of a significant cybersecurity incident impacting our information systems.

companyName: New York REIT Liquidating LLC


text: On February 7, 2024, the Board established the Cybersecurity Subcommittee of the Audit Committee (the "Cybersecurity Subcommittee") to assist the Board in fulfilling its oversight responsibilities with respect to assessing and mitigating the Company's cybersecurity risks. The Company's management, under the guidance of the IT Security Team, is responsible for the preparation, presentation, and self-assessment of the Company's cybersecurity policies and practices. The Cybersecurity Subcommittee shall be comprised of at least one independent director, and is tasked with reviewing and providing high level guidance on cybersecurity-related issues of importance to the Company.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Our management, including the COO and CCO, is responsible for assessing and managing material risks from cybersecurity threats. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as operations management, IT management, oversight of third-party service providers and managing relationships with outside cybersecurity experts. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Advisor.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD