text: We recognize that our clients entrust us with highly sensitive data. We also recognize our attendant responsibility to safeguard the accessibility, confidentiality, and integrity of this data. Our information security program consists of policies, procedures, systems, controls and technology designed to help us prevent, identify, detect and mitigate cybersecurity risks. Our processes are informed by cybersecurity events we have observed within the Company, across our industry, and across the cybersecurity landscape. We utilize the risk management framework for risk assessments as defined by the ISO 27001 Information Security Management Standard. We have integrated cybersecurity risk management into our overall risk management framework by conducting annual enterprise risk management assessments and IT risk management assessments, implementing periodic key risk indicator tracking, and holding periodic meetings among multiple department stakeholders to address cybersecurity risks. We review our information security policies at least annually and in connection with certain process changes to ensure that they meet the needs of the organization and the goals and objectives of the information security program.

companyName: Paycom Software, Inc.

ticker: PAYC


text: We use the results of the above-described tools and strategies to assess the sufficiency of the safeguards in place to manage material risks from cybersecurity threats, to enhance such safeguards, or implement new safeguards, as necessary. We have several safeguards in place to manage material risks from cybersecurity threats. We have security awareness training for our employees, including ongoing simulated phishing email campaigns. We utilize firewalls, anti-virus software, encryption on stored data and communication channels, secure web portals for remote access to our systems, password security, and two-factor authentication. We continuously update our software and security patches. We restrict inbound email attachments, certain websites, and cloud-based drives. We monitor and restrict information transfers to and from unauthorized IP addresses. We also have physical security safeguards for our locations and data centers. We back up our systems and data regularly. In addition, we have a disaster recovery program designed to help us quickly respond to and recover from an interruption of critical IT services.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS

secItem: Item 1C


text: Our Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board and through its committees. The Audit Committee meets annually to review enterprise security, technology risks and cybersecurity threats, risk assessments and areas of emerging risks, incidents and mitigation strategies, and industry trends.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: The Playbook provides understandable and flexible processes for analyzing and responding to Incidents. In the event of an Incident, the Playbook provides the CMT with predefined steps to follow to respond to, and escalate, cyber security incidents, as appropriate.

companyName: ROBERT HALF INC.

ticker: RHI


text: The Bank maintains policies, controls and training programs concerning customer information security, including transaction processing. The Bank deploys universal conditional access policies, requires multi-factor authentication for external network access and on-line banking access by Bank customers, and maintains additional access controls for network security and transaction processing. The Bank also has policies and controls to identify, classify and limit access to non-public customer information, including a comprehensive third-party vendor management cyber/information security risk management program.

companyName: BankFinancial CORP


text: As of December 31, 2024, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have invested in the protection of our data and information systems and the monitoring of our systems on an ongoing basis, such efforts may not in the future prevent material compromises to our information systems, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and practices.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: The CISO has primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. Our CISO has 25 years of experience in information technology and cybersecurity generally, which has been gained from a combination of education, including relevant degrees, and prior work experience.

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: The SHUSA CISO is responsible to oversee, develop, and maintain the Information Security Program, including assessing risks and managing controls appropriate to the size and complexity of SHUSA and its subsidiaries. The SHUSA CISO is also responsible to inform the SHUSA Board of Directors, management, and staff of information security risks. The SHUSA CISO has relevant experience to effectively carry out this role, including 20 years of experience within the IT and information security fields.

companyName: Santander Holdings USA, Inc.


text: Our Cybersecurity team informs executive management about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. This may include briefings from internal security personnel; sharing publicly or privately available threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and forwarding alerts and reports produced by network monitoring and security tools we deploy.

companyName: PRICESMART INC

ticker: PSMT


text: The Company engages a national security firm to improve its cybersecurity posture and keep current with evolving cybersecurity risks. The Company's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The Company's technology team gauges the effectiveness of its tools with periodic testing and evaluations.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: We have in place an Incident Response Procedure policy to define our response to unauthorized network intrusions or other significant information security incidents, collectively cybersecurity incidents. The policy defines the standard operational process to determine if an event observed on a system could have caused a breach of the system or a compromise of sensitive data. This policy serves to establish a formal process to report incidents and track response activities. It also defines escalation processes within the Information Security team and to our Cybersecurity Incident Response Team. It is the responsibility of the Cybersecurity Incident Response team to determine if an incident is material. The Cybersecurity Incident Response Team consists of members from functional groups across our organization including executive management, IT, Information Security, legal, finance and operations. We may include other individuals, including third parties, as appropriate depending on the nature of the incident and system(s) involved. This cross-functional group allows us to address the operational impacts of cybersecurity incidents as and when they occur and to guide decisions related to materiality and, if applicable, disclosure. The Cybersecurity Incident Response Team is responsible for extrapolating cybersecurity incident event information into quantitative and qualitative impacts as they relate to our financial condition and operations. In addition, the Company's Incident Response Procedure policy includes reporting to the board of directors for certain cybersecurity incidents.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: We believe that effective cybersecurity depends upon the successful implementation and maintenance of a comprehensive information security program. Deploying suitable security technology, which encompasses analytics and automation, and leveraging the expertise of highly skilled security and risk professionals, is crucial in our strategy. Additionally, we prioritize data governance and data-centric security as integral components of our approach to ensure compliance, uphold privacy standards, and safeguard customer data.

companyName: Dayforce, Inc.

ticker: DAY


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we or Cohen & Steers fail to implement effective information security policies and procedures."

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: The Audit Committee of our Board of Directors ("Audit Committee") provides direct oversight over cybersecurity risk and acts in an advisory capacity to our management team, primarily, as it relates to cybersecurity, our Chief Information Officer ("CIO"), and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: Management of Material Risks & Integration into Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management and have incorporated cybersecurity considerations into our decision-making processes. Our risk management team works closely with our IT department to identify, evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our risk management team also provides regular reporting to management on our enterprise cybersecurity risk posture.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Investment Adviser 's cybersecurity program and cybersecurity incidents impacting the Company, if any.

companyName: Brightwood Capital Corp I


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of IT. Our Vice President of IT has over 20 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Vice President of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan.

companyName: SEKISUI HOUSE U.S., INC.


text: Board Oversight of Cybersecurity Matters The Audit Committee is tasked with overseeing the Partnership's cybersecurity matters. Pursuant to the Audit Committee's charter, one of the Audit Committee's responsibilities is to discuss the Partnership's major risk exposures with management, including those related to cybersecurity, and the steps taken by management to monitor and control such exposures, including the Partnership's risk assessment and risk management guidelines, policies and practices.

companyName: Summit Midstream Partners, LP


text: Our Vice President of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Vice President of Information Technology has over 25 years of experience working with life science companies and venture capital firms in the information technology field, a certificate from HarvardX (Cybersecurity: Managing Risk), and an active membership in Health-ISAC.

companyName: Inozyme Pharma, Inc.


text: Our company recognizes the critical importance of addressing cybersecurity threats and managing associated risks. As part of our risk management strategy, our Board of Directors actively oversees and reviews our strategic direction, considering our risk profile and exposure.

companyName: AMERICAN BATTERY MATERIALS, INC.

ticker: BLTH


text: In addition, the Company has established a Security Incident Response, Disaster Recover, and Business Continuity Team ("SIRT/DR/BCP") led by the CSO and consisting of (i) Chief Executive Officer, (ii) Chief Product Officer, (iii) Chief Financial Officer, (iv) President, Chief Operating Officer, and (v) Chief Legal Officer/ General Counsel and others. When any defined incident occurs, the SIRT/DR/BCP team convenes to drive a remediation plan based on its security incidence response escalation process designed to contain potential incidents, investigate the root causes and corrective action required, notify relevant stakeholders and determine reporting requirements.

companyName: Upland Software, Inc.

ticker: UPLD


text: The CTO and Vice President, Engineering and Security in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO"), among others, work collaboratively across functions to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communication, we monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Nerdy Inc.

ticker: NRDY


text: Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents during the period covered by this report. However, to assess, identify, and manage risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested, and expect to continue to invest, significant resources to maintain and enhance our information security and business continuity programs designed to preserve the confidentiality, integrity, and availability of our information technology assets and data under our control. As a result, the risk of cybersecurity threats has materially affected our business strategy. It is inevitable that cybersecurity incidents will occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of each cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members, any loss of or unauthorized access to data, lost revenue, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of Boston


text: Director of Information Technology leads our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Director of Information Technology manages a team of information technology professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, incident response, insider threats and regulatory compliance. Our Director of Information Technology brings extensive experience in cybersecurity, including conducting DIBCAC (Defense Industrial Base Cybersecurity Assessment Center)

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: The Company engages in the regular evaluations of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including tabletop exercises and vulnerability testing, focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on certain of our cybersecurity measures, including audits and penetration testing. For example, we annually engage qualified third-party auditors to independently assess and attest to and/or provide certifications of compliance with the HIPAA Security and Privacy Rule, SOC2 Type 2, the Payment Card Industry Data Security Standard (PCI-DSS), and UK CyberEssentials. The results of such assessments, audits and reviews are presented to the Audit Committee and members of the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on such assessments, audits and reviews.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: Our Board of Directors is actively involved in overseeing our cybersecurity risk management and shares oversight responsibility and processes with the Audit Committee of the Board of Directors (the "Audit Committee").

companyName: Broadcom Inc.

ticker: AVGO


text: We may engage consultants and other third parties as needed in connection with our risk assessment policies and processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Zhuoxun Hongtu Inc.


text: Our Chief Financial Officer has been responsible for our IT functions for 20 years and has managed the IT function of companies generally for the last 35 years. The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, periodically.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: As customer preferences and business-efficiency demands lead to a more connected and digitized world, cybersecurity and privacy risks have become critical business issues. Luxfer understands the systemic nature of cybersecurity threats to the safety and security of our Company, customers, and employees. As such, Luxfer is committed to safeguarding and protecting our information technology ("IT") network, equipment, and systems against cybersecurity threats to ensure our future security and reduce risk.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Plan and Cybersecurity Incident Materiality Assessment Policy We seek to align with industry-standard cybersecurity frameworks designed to protect our information systems and both Company and customer data from unintentional disclosure, cybersecurity incidents, events, and other threats of varying severity levels. As part of our alignment efforts with these frameworks, we maintain the IRP, which outlines the actions to be taken after identifying an incident that affects or could potentially affect our information systems and the people responsible for managing and overseeing those actions.

companyName: ADT Inc.

ticker: ADT


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks, while we engage consultants who are responsible for day-to-day assessment and management of cybersecurity risks and who report regularly to the board of directors. We have previously experienced cybersecurity incidents, from time to time. These incidents have not materially affected our business strategy, results of operations or financial condition. We are not currently aware of any cybersecurity incidents that would have a material effect on our business strategy, results of operations or financial condition. Nevertheless, there is always a risk that a phishing attempt, ransomware or other attack by a bad actor could have a material adverse effect on our financial position or results of operations. Based on information currently available, management does not believe that there is a reasonably likely risk of these issues, nevertheless the possibility of one occurring cannot be completely ruled out.

companyName: GUIDED THERAPEUTICS INC

ticker: GTHP


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. However, we are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions. Cyber intrusions require a significant amount of time and effort to assess and remedy, and our incident response efforts may not be effective in all cases. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors - Cybersecurity incidents or other security breaches involving our computer systems or the systems of one or more of our vendors could materially and adversely affect our business.

companyName: Eagle Bulk Shipping Inc.


text: We face a number of cybersecurity risks in connection with our business. We are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Although such risks and attacks have not materially affected us, including our business strategy, consolidated results of operations or consolidated financial condition, to date, our security programs and measures may not prevent all intrusions, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the information technology systems related risk factor in Item 1A: Risk Factors - Risks Relating to Business Strategy and Operations.

companyName: CINTAS CORP

ticker: CTAS


text: Key cybersecurity risks are incorporated into our enterprise risk management framework. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risk management actions into six categories: govern, identify, protect, detect, respond, and recover. The Company's cybersecurity risk management program and strategy includes the following: • Cybersecurity Operations Centers - We, along with certain third-parties, operate several global cybersecurity operations centers, which provide 24/7 monitoring and incident response capabilities. In the event of an alert, our cybersecurity operations centers coordinate the investigation and remediation of such alerts. • Partnerships with Cybersecurity Companies - We partner with specialized cybersecurity companies and organizations, leveraging third-party technology and expertise. These partnerships help monitor and maintain the performance and effectiveness of our cybersecurity tools and program. • Annual and Periodic Assessments by Third Parties - Our cyber risk management program undergoes periodic assessments by third parties including annual penetration and disaster recovery tests. • Policies and Training - We maintain company-wide policies and procedures concerning cybersecurity, which are reviewed and approved by appropriate management members. All employees are required to complete cybersecurity training periodically, with additional specialized trainings for certain roles. We conduct monthly phishing simulation exercises with mandatory training on failure. • Incident Response - In case of a cybersecurity incident, we follow a documented incident response process, which outlines steps from detection to mitigation, recovery, and notification, including notifying senior leadership and the Board as appropriate based on severity. • Third-Party Service Providers - In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: We contract with several outside cybersecurity experts to audit and test security controls on a regular basis. Any risks or control gaps identified as a result of such assessments, audits, and reviews are reported to the senior leadership of all functional areas of the Company, the Audit Committee of the Board (the "Audit Committee"), and the Board as appropriate, and we adjust our cybersecurity policies, standards, and practices as necessary.

companyName: Dayforce, Inc.


text: The day-to-day monitoring, identification, and assessment of information security risks and incident response functions are managed centrally by our core cyber incident response team (the "CIRT"), which operationalizes our Cyber Incident Response Plan (the "Plan"). The Plan includes processes to triage, assess severity of, escalate, contain, investigate and remediate information security incidents, including those associated with our third-party service providers, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Under the Plan, the CIRT may escalate matters as necessary to our CISO and CIO, General Counsel, and other senior leadership, depending on the severity classification of the incident. In addition to the ordinary-course Board and Audit Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including information security risks.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Our cybersecurity risk management strategy is integrated into our risk management practices and is embedded in each of our three lines of defense, as detailed below. We use a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.

companyName: AMERICAN NATIONAL BANKSHARES INC.


text: We have implemented an incident response plan and playbook, encompassing procedures designed to respond to and recover from cybersecurity incidents. In collaboration with third-party security consultants, we conduct ongoing reviews and tabletop exercises of these procedures, which provide detailed descriptions of the roles and responsibilities of key stakeholders, as well as the protocols for communication and coordination during an incident. The procedures also outline guidelines for escalating incident information to our Cybersecurity Steering Committee, senior management, our Audit Committee (which, as discussed below, has been delegated the responsibility for our Board of Directors (the "Board") cybersecurity risk oversight function), our full Board, and for providing timely public disclosure when necessary.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: In connection with the regular assessment of third-party service providers performed by our procurement organization, our information protection team performs a third-party assessment of each vendor's information security practices and protocols, including its readiness to protect against and respond to cybersecurity breaches. Third-party service providers are categorized in tiers depending on the significance of their operations to the Company's business processes and risk assessments for vendors in the highest tier are completed periodically. With respect to cyber, we have procedures to verify each service provider's information security controls, and each vendor completes a cyber questionnaire that also addresses their resiliency in the event of an intrusion to their systems. We proactively communicate with suppliers to understand mitigation steps taken when major cyber exposures are identified.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the CISO. The CISO, has obtained cybersecurity credentials for the role, possesses expertise in the technical domain, and receives assistance from industry experts in decision-making. The CISO oversees the information security policies and data protection programs, implementation of protective and detective tools, tests the Company's compliance with standards, and remediates known risks. These initiatives include phishing simulations, semi-annual cybersecurity education to employees, and competency assessments. Additionally, the Company conducts table-top incident response practices and other measures to enhance overall cybersecurity preparedness. These efforts underscore the organization's commitment to addressing a wide range of potential threats and cybersecurity challenges.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Our Chief Financial Officer and Head of IT and Cybersecurity oversee our cybersecurity policies and procedures, including those described in "Risk Management and Strategy" above. Under such policies and procedures, our Chief Financial Officer and Head of IT and Cybersecurity are responsible for reporting to our audit committee regarding any cybersecurity incidents. The audit committee, in turn, provides periodic reports to our board of directors regarding our cybersecurity processes, including the results of cybersecurity risk assessments.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Cybersecurity, Information Technology and Data Management Practices," which is incorporated by reference into this Item 1C.

companyName: General Motors Financial Company, Inc.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They work in conjunction with our Nominating and Governance Committee Chair and member. Our CISO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Enovix Corp

ticker: ENVX


text: Our information technology, communication networks, enterprise applications, accounting and financial reporting platforms and related systems are integral to our operations. We use these systems, among others, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our operations rely on securing, collecting, storing, transmitting, and processing proprietary and confidential data.

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: Our management team, including the Executive Director of Information Security and Chief Technology Officer (CTO), are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a cumulative 22 years of experience in assessing and managing risk throughout organizations. In addition, hold industry specific certifications such as Certified Information Systems Auditor (CISA) and Certified Data Privacy Solutions Engineer (CDPSE).

companyName: Ceribell, Inc.

ticker: CBLL


text: Roles and Responsibilities Cybersecurity is an important element of our risk management processes and an area of particular focus for Reliance's Board of Directors and management. The Company's Sr. Director, Information Security ("ISD") serves as single point of communication and coordination for protecting the Company and its digital information. The ISD performs an initial assessment of each reported cyber incident and escalates all non-trivial cybersecurity incidents and risks to the CRC. The CRC is primarily responsible for assessing and managing material risks from cybersecurity threats and is comprised of a cross-functional team including the ISD, the Chief Information Officer ("CIO") as well as senior representatives from the Company's risk management, finance and legal functions. The ISD has 17 years of cybersecurity experience, including 6 years with Reliance. The ISD maintains industry recognized credentials relevant to his role.

companyName: RELIANCE, INC.

ticker: RS


text: The Board oversees the Company's information security program, which includes oversight of the cybersecurity program and management of cybersecurity risks. The Board receives annual updates from the Company's CISO, and/or members of the executive leadership team. Such reports typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans and the evolving cyber threat landscape and a detailed threat assessment relating to information technology risks. Notice of potential material cybersecurity incidents to the Audit Committee Chair and the Board is provided for in the Cybersecurity Incident Response Plan (the "CIRP") and the Cybersecurity Incident Disclosure Control Procedure (the "Cyber Disclosure Procedure").

companyName: ROBERT HALF INC.

ticker: RHI


text: The Company's Board of Directors (the "Board"), as a whole, has oversight responsibility for our strategic and operational risks. The Board regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including updates on the internal and external cybersecurity threat landscape, incident response, assessment and training activities, and relevant legislative, regulatory, and technical developments. Our Vice President of Information Technology presents, at least annually, to the Board, an overview of our cybersecurity threat risk management and strategy as well as provides reports regarding the evolving cybersecurity landscape, including emerging risk. Our Vice President of Information Technology and other members of his team remain informed about cybersecurity threats through the reporting framework as described above under Cybersecurity Risk Management and Security – Cybersecurity incident response plan and testing.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has ultimate responsibility for oversight of cybersecurity risks, but primary responsibility for cybersecurity risk oversight has been delegated to the audit committee.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: The Company does not believe that it has experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company and its business strategy, results of operations and/or financial condition.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: The execution of the ISP relies on our committed investment in people, processes, and technology. We have invested in market-leading technology and award-winning security partners to execute key processes that ensure the confidentiality, integrity, and availability of company assets.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: Our Chief Trust Officer provides quarterly briefings to the Audit Committee regarding our cybersecurity risks and state of our Trust program, including recent cybersecurity incidents and related responses, cybersecurity systems testing, and data protection initiatives and metrics. Our Audit Committee regularly updates the board of directors on such reports. In addition, our Chief Trust Officer provides briefings on cybersecurity risks and activities to the board of directors at least annually. Our Chief Trust Officer may also brief the board of directors regarding significant cybersecurity incidents.

companyName: Autodesk, Inc.

ticker: ADSK


text: The Director of Information Technology is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company's cybersecurity strategy. Furthermore, the Director of Information Technology provides cybersecurity awareness training to the Company's employees and regularly communicates updates on best cybersecurity practices and improvements in the cybersecurity program.

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: Our chief information officer and chief information security officer assess our cybersecurity readiness through internal assessment tools, as well as third-party assessments, audits, penetration tests, and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer and chief information security officer, as appropriate.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity, the CISO brings a wealth of expertise to her role. Her background includes extensive experience as an enterprise CISO and she is well-recognized within the industry. Her in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: Flywire Corp

ticker: FLYW


text: We recognize the critical importance of maintaining the trust and confidence of business partners, employees and patients, toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the UK governments' National Cyber Security Centre and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Our board of directors has ultimate responsibility for oversight of our risk management, and delegates cybersecurity risk management oversight to the audit committee. The audit committee, which is responsible for ensuring that management has processes in place designed to identify, evaluate and manage cybersecurity risks and incidents, regularly reviews our cybersecurity program with management and reports to the board of directors. Cybersecurity reviews by the audit committee generally occur at least quarterly. A number of our directors have experience in assessing and managing cybersecurity risk, including by serving on other public company audit committees having responsibility for cybersecurity oversight.

companyName: Perception Capital Corp. IV


text: Our cybersecurity program assists in the management of risks associated with the confidentiality, integrity and availability of data and systems within the company environment to effectively support our business objectives and customer expectations. The program provides guidance to business stakeholders on cybersecurity risks as input into their risk management processes that balance cybersecurity risk with other important risks that may include strategic, regulatory, economic and financial considerations. THERMO FISHER SCIENTIFIC INC.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: As part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and in our MD&A at Item 7 of this Annual Report on Form 10-K, we describe whether and how risks from identified cybersecurity threats, including any previous incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. These disclosures are incorporated by reference herein. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. This includes penalties and settlements, of which there were none.

companyName: SunCoke Energy, Inc.

ticker: SXC


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Additionally, we engage a third-party vendor regularly to benchmark our information security program's maturity against the NIST CSF.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: The Corporation utilizes third-party threat analysis tools such as penetration testing and vulnerability scanning to assist in understanding and supporting the measurement of information security related risks. Additionally, the Corporation uses a third-party tool to help management identify current cybersecurity risks and control maturity levels, and to evaluate overall cybersecurity preparedness. The Corporation has also implemented a gap analysis and action plan designed to identify potential actions that would improve our overall cybersecurity posture, and periodically reevaluates both cybersecurity risks and controls to assure they are commensurate with our size and complexity and are keeping pace with the overall cybersecurity threat environment.

companyName: C & F FINANCIAL CORP

ticker: CFFI


text: Our operations and other aspects of our business rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our portfolio investments and the integrity of the Company's information systems.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: We utilize several cybersecurity tactics, techniques, processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K), including, among others, the following: • maintain a Security Operations Center to support visibility to cybersecurity incidents in real time; • require all salaried employees to complete an annual cybersecurity training program where specific threats and scenarios are highlighted based on our analysis of current risks to the organization; • provide regular cybersecurity awareness and confidential information protection training and conduct phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintain a Cybersecurity Incident Response Plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination of our response to such incidents, should they occur; • maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; • monitor emerging data protection and cybersecurity laws, and implement changes to our processes and systems designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct several cyber-specific penetration tests per year; and • engage consultants and other third parties, as appropriate, in connection with our cybersecurity practices.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: Our membership in the Data Privacy Board, a group comprised of some of the world's largest companies with the mission of engaging in confidential, leader-level discussions, offers opportunities for unbiased benchmarking and support from peers across various industries. We continue to build privacy resilience across international operating environments.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: Our Director of Cybersecurity in cooperation with the Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to our internal Cybersecurity Steering Committee. Our Director of Cybersecurity has over 20 years of experience leading cybersecurity oversight and holds cybersecurity certifications such as the CISSP ("Certified Information Systems Security Professional").

companyName: Workhorse Group Inc.

ticker: WKHS


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to our Information Technology Steering Committee, Audit Committee and to our board of directors.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: Cybersecurity risk management is an integral part of our digital posture and enterprise risk management strategy. Cybersecurity is critical to maintaining the trust of our customers and business partners, and we are committed to protecting our and their confidential and sensitive information, including personal information, and mitigating cybersecurity risks that impact our systems and networks. We maintain technologies, programs and processes designed to assess, identify, manage and mitigate cybersecurity risks. Our efforts include regular monitoring of Leidos-managed programs for internal and external cybersecurity threats, providing cybersecurity training to our employees during the onboarding process and annually, and continually reviewing and refining formal policies and procedures designed to deter, identify and remediate cybersecurity incidents. We regularly perform evaluations of our cybersecurity program and continue to invest in our capabilities to keep our customers, partners, suppliers and information assets in our possession safe. Although we employ service provider due diligence and onboarding procedures to identify potential cybersecurity risk, our ability to monitor the cybersecurity practices of our service providers is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks and other assets owned or controlled by our vendors.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: In February 2024, we chartered the Information Systems, Data and Cybersecurity Governance Committee (the "Cybersecurity Committee"), which is comprised of the Company's business unit leaders and is responsible for the management of our cyber risk exposure and monitoring the effectiveness of the cybersecurity program. The Cybersecurity Committee will report the progress of cyber risk reduction initiatives to our senior leadership and the Audit Committee on a periodic basis.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Our Board of Directors has delegated oversight responsibilities for enterprise risk, including cybersecurity risk, to the Audit Committee. The Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide periodic updates to the Audit Committee regarding the Company's cybersecurity risk management program. The Company has a cybersecurity incident response plan that includes a process to evaluate cybersecurity incidents for materiality. The escalation protocol includes reporting potentially material cybersecurity incidents to senior members of management for further evaluation. Any cybersecurity incident determined to have a material impact on the Company is timely reported to the Audit Committee.

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: Board Oversight of Cybersecurity. The Audit Committee of the Company's Board of Directors (the "Audit Committee"), acting pursuant to authority delegated by the full Board of Directors, actively oversees the Company's cybersecurity strategy and risks from cybersecurity threats, as well as the Company's broader enterprise risk management framework. The Company's management-level Enterprise Risk Committee meets regularly to review the Company's risk profile and develop mitigation strategies with respect to those risks. The Audit Committee reviews the enterprise risk matrix prepared by the Enterprise Risk Committee on an annual basis.

companyName: EVgo Inc.

ticker: EVGO


text: The TISC oversees the governance of the Company's enterprise technology and information security programs, including strategy, management principles, risk and compliance. The TISC reviews the policies, strategy, emerging topics, risks and general compliance of the programs to ensure they are adequate and sufficient to govern and manage the associated risk of the Company. The TISC coordinates and communicates with the Audit and Risk Committee on risk-related items through the Company's Enterprise Risk Management Committee. The TISC provides a forum for advising and sharing information among members of the Company's senior leadership team and is comprised of Company risk owners with expertise across a wide range of financial, technical, operational, strategic, and cybersecurity skill sets. The TISC is co-chaired by the Chief Technology Officer, who is responsible for the enterprise-wide information technology program and the CISO, who is responsible for the enterprise-wide information security program. The CISO is a Certified Information Systems Security Professional (CISSP), with over 20 years of experience in a combination of information technology and information security roles. The CISO has over nine years of direct leadership experience in the field of information security, and holds a Bachelor's degree in Information Technology, with an Associate's degree in Computer Network Managemen t.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer. Our Chief Financial Officer has been responsible for our IT functions for 20 years, and has managed the IT function of companies generally for the last 35 years. Our IT manager has managed our IT functions for over 20 years. The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, periodically.


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. This program, along with a robust information technology internal controls framework, helps to ensure the confidentiality, integrity and availability of our information systems. The program includes elements for identifying, assessing and managing material risks from cybersecurity threats. Our incident response and change management policies and procedures were designed based on guidelines from the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: To mitigate material risks posed by cybersecurity threats to our critical networks, third-party services, and data assets, we have instituted a comprehensive suite of information security processes. These measures encompass the diligent identification, assessment, and management of potential risks, threat monitoring services, and vulnerability assessments.

companyName: Whitestone REIT

ticker: WSR


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including IT security leadership, the PFO, CEO, General Counsel ("GC") and third-party consultants as needed. IT security leadership, the P FO, CEO and GC work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Once a cybersecurity incident is contained the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions or validation of files or data that may have been affected.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Cybersecurity threats have not materially affected our business strategy, results of operations or financial condition to date, but we, our collaborators and our third-party vendors and service providers may in the future be the target of cybersecurity threats, any of which could have a material adverse effect on our business. For a description of the cybersecurity risks we face and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Mersana Therapeutics, Inc.


text: We engage consulting firms and other third parties in connection with our cybersecurity risk management processes. For example, third parties are engaged from time to time to conduct evaluations of our security controls, including penetration testing and independent audits, and to advise the Board of Directors, the Audit and Compliance Committee of the Board of Directors and/or our senior management team regarding cybersecurity matters.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: We employ a risk management framework aligned with relevant laws, regulations, and industry standards to manage cybersecurity risks across our products and services, infrastructure, and organization. Our internal risk assessment processes incorporate various factors, including tracking threat intelligence and identified first- and third-party vulnerabilities, evaluating evolving regulatory requirements, and analyzing internally observed cybersecurity threats and incidents. We regularly conduct an internal risk assessment to evaluate the effectiveness of the security of our systems and of our processes, identify areas for remediation, and explore opportunities for enhancement, such as cloud and endpoint security enhancements, application programming interface ("API") security, and contractor access management. We utilize third-party security experts and consultants on an annual basis to assess and improve our cybersecurity risk management tools and processes and to benchmark against industry standards.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.

companyName: New Mountain Net Lease Trust


text: Our Audit Committee, as well as our Chief Financial Officer, Chief Legal Officer, and other members of our executive management as appropriate, receives periodic reports from our head of Information Technology concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various periodic presentations related to cybersecurity threats, risk and mitigation.

companyName: GERON CORP

ticker: GERN


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. The Board of Directors and Chart senior management recognize cybersecurity as a company-wide risk, and the c hief information officer/chief information security officer ("CIO/CISO"), as a member of the Chart senior management, works to organize these functional teams given the individual's experience and background of over 25 years within various IT roles, including the build out of the cybersecurity capability within Chart and at prior companies. Individuals that oversee cybersecurity risk management have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Third-party cybersecurity consultants are periodically retained by the Company to conduct targeted security control assessments, and to review the Company's security policies, standards, procedures, and controls, when applicable. Annual third-party penetration testing is used to simulate cyber-attacks and to identify potential vulnerabilities. The Company subscribes to paid third-party threat intelligence services that provide real-time information on emerging threats. The Company engages security partners to provide advisory services related to security technologies and practices.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: cybersecurity risk management program includes the following: a multidisciplinary team comprised of personnel from information technology ("IT"), internal audit, accounting, and legal, as well as third-party cybersecurity experts principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents, and a third-party security operations center.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: The Company has dedicated incident management and response teams in place to facilitate response protocols and execute designed strategies necessary to mitigate business risk and support recovery initiatives. The Incident Management Team structure is based on the Incident Command System and follows a flexible, adaptable approach with response team membership designed to support expanding response team needs. An Incident Response Task Force (IRTF) is in place to oversees the assessment of cybersecurity incidents and operational response needs. The CISO and the Head of Regulatory Affairs/Relations co-lead IRTF response.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: In addition, the Company has established procedures to ensure that management responsible for overseeing the effectiveness of disclosure controls is informed in a timely manner of known cybersecurity risks and incidents that may materially impact the Company's operations and that timely public disclosure is made as appropriate. The Company's Cybersecurity System is led by the Chief Executive Officer ("CEO") in collaboration with other third-party cybersecurity service providers which in turn assist in monitoring our exposure from significant information technology suppliers, significant software as a service providers and major vendors with access to our information technology systems. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming. The Company does not maintain cyber insurance coverage at this time. During the last three years, the Company has not experienced a material security breach and, as a result, the Company has not incurred any material expenses from such a breach. Furthermore, during such time, the Company has not been penalized or paid any amount under any information security breach settlement.

companyName: OneMeta Inc.

ticker: ONEI


text: On a regular basis, the CISO discusses with the CRO information security risk issues, risk mitigation progress and developments and information security enhancement initiatives. The CISO reports to the TOC quarterly on information security developments and emerging risks, both in the industry and specific to the Company. The CISO and CRO report on the information security program, including the status of information security-related key risk indicators, to the TOC and the ERMC. The Information Security Policy is also approved by the TOC on an annual basis.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Our board of directors is responsible for overseeing our risk management program, and cybersecurity is a critical element that has been integrated into our overall risk management program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Zymeworks Inc.

ticker: ZYME


text: During the past year, there have been no material risks from cybersecurity threats or prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our cybersecurity risk management program and the associated controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or malicious employee actions, program failures, and other risks that could materially impact our financial condition, results of operations and cash flows. For risks regarding cybersecurity and our information systems, please refer to Item 1A. "Risk Factors" in this annual report.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: Governance; Board Oversight Our Audit Committee is responsible for reviewing our information security programs, including cybersecurity. Our IT team provides regular updates to the Audit Committee on our IT security strategy, secure score assessments, penetration testing results, and status of risk mitigation activities, where applicable. Our IT team also notifies the Audit Committee and Executive Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities, as appropriate.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition; however, see "Item 1A. Risk Factors" in this Annual Report for a discussion of effects that a cybersecurity threat or incident could have on our business strategy, results of operations or financial condition. We cannot provide assurances that we will not experience cybersecurity incidents in the future or that any future cybersecurity incidents will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Premier, Inc.


text: We have never had a breach of cyber-security at any point in our past. The risk to us of cybersecurity threats is in data storage of customer questions and emails.

companyName: Trans American Aquaculture, Inc

ticker: GRPS


text: As part of our Risk Governance, our Board of Directors reviews and approves the Program on an annual basis. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing management's reporting on Program effectiveness. In addition to Board Oversight, we also have Governance, Risk, Information Technology, Information Security, and Compliance functions that monitor and address enterprise risks, including cybersecurity risks.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Network security configurations Risk Management and oversight of third parties Our cyber security and infrastructure team's experience includes a combined 102 years of experience. Further, our Director of Information Security, IT Governance Risk and Compensation Manager, Cybersecurity Team Lead, and Industrial Security and Network Senior Analyst all hold the Certified Information Systems Security Professional (CISSP) credential, widely recognized as the global standard for information security expertise. CISSP certification demonstrates advanced knowledge across eight security domains, a minimum of five years of industry experience, and adherence to strict ethical standards. This designation reflects our leaders' ability to align technical controls with business risk, ensuring robust governance, regulatory compliance, and resilience against evolving cyber threats. Our team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our Board is responsible for the oversight of cybersecurity risk management. The Board delegates oversight function of the cybersecurity risk management program to the Audit Committee. Our CFO reports to the Audit Committee on the program. The Audit Committee provides updates to the Board on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on a regular and as-needed basis. The Audit Committee also notifies the Board of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: Our Board considers cybersecurity risk and other information technology risks as part of its risk oversight function. Our Audit Committee reviews policies with respect to major risk assessment and risk management and reviews with management the steps taken to monitor and control such exposures. As part of this function, our Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes.

companyName: Global Net Lease, Inc.

ticker: GNL


text: Our CISO, in coordination with our CIO and our Information Security team, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 10 years of experience in cybersecurity and information technology risk management, including at another large public company. He also has a degree in computer science. Our CIO has over 15 years of information technology experience, which includes managing information security systems, developing cybersecurity strategies and implementing effective information and cybersecurity programs.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from Firm management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of Operational Risk report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to the Firm Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our Board.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: The Company has not been impacted by any previous cybersecurity incidents that would materially affect business operations, customer relationships or financial conditions.

companyName: KOSS CORP

ticker: KOSS


text: Further, in support of our ISMS, we utilize certain third-party service providers, primarily in the following capacities: 1) incident response partners that assist with performing incident simulations and who are available to assist in the event of an actual cybersecurity incident; 2) third-party experts to conduct penetration testing on AAM systems and certain third-party systems, as necessary; and 3) leveraging third-party expertise to assist with testing IT controls and performing gap analysis over IT processes and procedures. AAM's Chief Information Security Officer (CISO) manages and monitors these third-party service provider relationships and works closely with AAM's information security, procurement, legal and internal audit departments to ensure proper evaluation and security assessment of critical third-party service providers and data processors.

companyName: Dauch Corp

ticker: DCH


text: Additionally, we rely on AB and the Adviser to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Fund, and AB's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on AB to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Fund. AB's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.

companyName: AB Private Credit Investors Corp


text: We manage risks from cybersecurity threats through our overall enterprise risk management process. Management has created an information security program, which encompasses a dedicated information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. We "proactively" assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include internal audits, external audits, penetration tests, and engagement of third parties to conduct analyses of our information security program. Through our centralized enterprise risk management function, we also maintain processes for overseeing and identifying risks associated with third party service providers with whom we do business, including risks related to cybersecurity.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. With the assistance and advice of our expert consultants, responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our Director of Information Technology, who reports to our Chief Executive Officer.

companyName: BATTALION OIL CORP

ticker: BATL


text: Our business is highly dependent on information technology. In the ordinary course of our business, we store sensitive data, including our proprietary business information and that of our business partners, and non-public personally identifiable information of mortgage borrowers, on our networks. The secure maintenance, processing and transmission of this information is critical to our operations. Computer malware, viruses, ransomware and phishing attacks remain widespread and are increasingly sophisticated. We are frequently the target of attempted cyber threats, as are many other organizations within the financial servicing industry. We continuously monitor and develop our information technology networks and infrastructure to help prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses, and other events that could have a security impact. Despite these security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations or trading activities or damage to our reputation, all of which could have a material adverse effect on our business, results of operations and financial condition. For additional information on these risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: In 2023, we conducted a tabletop training with an executive officer and an outside director simulating cybersecurity events and appropriate responses. We intend to continue to conduct such simulation training with this group on a periodic basis. Other directors and officers of the Company will be given the opportunity to participate in such training. In addition, our outside directors are encouraged to attend continuing education relating to cybersecurity. In 2023, two directors received certificates in cybersecurity oversight or emerging technologies.

companyName: FTI CONSULTING, INC

ticker: FCN


text: The Audit Committee also reviews our cybersecurity management strategy and initiatives on a regular basis with our CTO and CISO. Both the Audit Committee and Board will promptly be made aware of any significant cybersecurity incident, as specified in our cybersecurity incident response plan.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: We describe the risks from cybersecurity threats, including previous cybersecurity incidents, in section "Risk Factors" (Part I, Item 1A of this Form 10-K). As of the date of this Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, the cybersecurity threat environment is increasingly challenging, and we, along with the entire digital ecosystem, are under constant and increasing threat. As discussed above, our business strategy is tied to the SFI and we are committed to continuously monitoring cybersecurity threats, enhancing the security of our products, investing in our cybersecurity infrastructure, and collaborating with peers, customers, service providers, regulators, and governments to advance our and the entire digital ecosystem's cybersecurity defenses and resiliency.

companyName: MICROSOFT CORP

ticker: MSFT


text: We provide recurring information security training (which includes cybersecurity training) to our associates and certain third parties based on access, risk, roles, policies, standards and behaviors.

companyName: Walmart Inc.

ticker: WMT


text: Hawkins is committed to maintaining robust cybersecurity practices to safeguard our operations, data, and stakeholders' interests. We monitor our cybersecurity landscape and adapt our strategies and governance practices to mitigate risks in this rapidly evolving area.

companyName: HAWKINS INC

ticker: HWKN


text: Management continuously assesses the potential impact of risks from cybersecurity threats on the Company, and regularly evaluates how such risks could materially affect the Company's business strategy, operational results, and financial condition. As noted above, an assessment of the cybersecurity program leveraging the Cybersecurity Framework is completed annually by an independent and qualified external third-party cybersecurity assessor. Additionally, Concentra receives a certified System and Organization Controls 2, Type 1 assessment, a voluntary compliance standard for ensuring that the Company properly manages and protects the sensitive data in its care, conducted by an independent and qualified external third-party assessor. The Company has not experienced a cybersecurity breach or information security breach during the past three fiscal years. The Company, from time to time, has been notified of third-party information cybersecurity breaches, but none of them has had a material impact on the Company's operations or financial results. The Company annually purchases a cybersecurity risk insurance policy to help defray the costs associated with any covered cybersecurity incident. Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted.

companyName: Concentra Group Holdings Parent, Inc.

ticker: CON


text: At the management level, our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, operations, legal and compliance stakeholders meet regularly to discuss strategies designed to preserve the confidentiality, integrity and availability of our and our customers' information by identifying and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. Our Executive Security Committee, which includes our Chief Operating Officer, our CIO, our Chief Technology Officer, our Chief Development Officer, our General Counsel and other cross-functional participants, meets monthly to evaluate our cybersecurity risks and related response efforts.

companyName: Bandwidth Inc.

ticker: BAND


text: Our cybersecurity program is led by our CISO, who manages a team of cybersecurity professionals. Our CISO has over 20 years of experience in cybersecurity and technology, including as a CISO at another public company. Members of our cybersecurity team, combined, have over 80 years of cybersecurity experience and members of the team hold various professional certifications, including Certified Information Systems Security Professional ("CISSP").

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Risks Associated with Third-Party Service Providers The Company's GRC oversees assessments of third-party service providers in collaboration with our IT contracts, data privacy, technical architecture, and legal teams. An initial review for any cybersecurity threat is completed when the provider is onboarded, with subsequent periodic reviews conducted thereafter. These subsequent reviews occur at different intervals, based on the nature of the business relationship, the type of data being exchanged (if any), and the overall potential impact to the Company, and include consideration of factors such as the third party's cybersecurity capabilities, data protections and privacy measures, and technical capabilities as related to required integrations with the Company's systems.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: The CSO chairs the Corporate Security Council, which holds regular meetings consisting of senior executive management and reviews and oversees cybersecurity risks. The VP – Cybersecurity chairs the Cybersecurity Governance Council, which governs actions to ensure that the Registrants are effectively managing cybersecurity risks, as well as the Cybersecurity Steering Committee, that drives accountability, establishes work priorities, and directs a portfolio of key cybersecurity projects and initiatives.

companyName: PPL ELECTRIC UTILITIES CORP


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our Enterprise Risk Management ("ERM") process. The Risk Management team meets at least annually with cybersecurity leadership to discuss identified cybersecurity-related risks and the potential likelihood and severity of each risk. Through the ERM process, cybersecurity risks are presented to the executive leadership team, including the CEO and CFO, as well as reported to the AFC.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: The cybersecurity team is led by the Vice President of Information Security and the Senior Vice President of IT. Our team is comprised of highly skilled analysts, all of whom hold professional certifications and have undergone extensive training to assist in safeguarding our sensitive customer data.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: In an effort to deter and detect cyber threats, we provide all employees with routine response and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents promptly. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.

companyName: Replimune Group, Inc.

ticker: REPL


text: A key element of our technology and cybersecurity program strategy is fostering training and awareness. Our training and awareness program includes annual cybersecurity awareness training and role-based phishing tests for our employees and for third parties with access to our systems.

companyName: BIOGEN INC.

ticker: BIIB


text: We also simulate responses to cybersecurity incidents by conducting tabletop exercises. Our cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: We continually evaluate cybersecurity risks as part of our overall risk management strategy. Cybersecurity risks are assessed, identified, and managed through various ongoing and scheduled processes, technologies, and techniques, including, but not limited to periodic IT Risk Assessments, vulnerability scanning, penetration testing, employee cybersecurity awareness testing, and threat intelligence analysis. The Company receives cybersecurity alerts and threat intelligence from Open Source Intelligence ("OSINT") threat intelligence feeds, the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), and government agencies, among other sources. The Company also continuously monitors its systems and networks. Management regularly reviews the evaluation of risks through these and other methods to mitigate risks and allocate resources in alignment with the overall risk management strategy.

companyName: PACIFIC PREMIER BANCORP INC


text: The Risk Committee meets six times a year during which management provides updates to the committee regarding the material risks facing the Company. As part of this reporting, the Chief Risk Officer and the Risk Management Department have created a risk management program that identifies and evaluates the risks associated with various aspects of the Company's business and report their assessments to the Risk Committee for review or approval. Within the risk management process, cybersecurity risks are specifically reviewed and addressed, including risks related to current or proposed products and services to be offered by the Company, as well as the efforts taken or to be taken to mitigate such risks.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Our Chief Commercial Operations Officer and Chief Product Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. They stay informed about and monitory the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal and external security team members, threat intelligence and other information obtained from public or private sources and alerts and reports produced by security tools deployed in the IT environment.

companyName: CALIX, INC

ticker: CALX


text: The Company maintains an incident response plan that is distributed to its business units for customization according to their specific operations and internal reporting structures. The Company leverages third-party cybersecurity experts to review the response plan and facilitate incident response exercises for its business units. The Company licenses third-party software that provides incident response simulation capabilities and playbooks and makes that available to its business units and also retains a third-party cybersecurity firm to provide assistance if needed during a cybersecurity incident.

companyName: Graham Holdings Co

ticker: GHC


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers.

companyName: S&P Global Inc.

ticker: SPGI


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by a specialized vendor that assists the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: Our cybersecurity risk management approach is supplemented by external and internal management audits against commonly accepted frameworks, including SOC-2 and ISO 27001, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program through which security researchers can help identify vulnerabilities in our systems before threat actors do. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.

companyName: DROPBOX, INC.

ticker: DBX


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: The success of the Company's information security program relies not only on ownership by the CIO's organization but also on an active and collaborative relationship within the business. The Company requires all employees to complete cyber training annually. For 2024, the Company maintained a security learning management system with phishing simulations distributed regularly to enhance cyber resiliency. Additionally, the Company leverages communications, contests, policies, videos, and visuals to continuously raise awareness among employees.

companyName: Dorman Products, Inc.

ticker: DORM


text: Michelle H. Caveness, age 51, is Senior Vice President and Chief Manufacturing Officer overseeing global manufacturing and operations support. Ms. Caveness joined Eastman in 1996 and has held leadership roles of increasing responsibility in engineering, technology and manufacturing as well as on cross-functional business teams. Prior to her current role, she was vice president, Tennessee operations site leader and global operations support, leading one of the largest manufacturing sites in the United States and associated sites across the globe. Ms. Caveness was appointed to her current position effective January 2025.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Continuous Improvement We recognize the cybersecurity landscape is dynamic, and we strive to continuously refine our processes based on emerging threats and industry best practices. We conduct reviews of our cybersecurity risk management processes and make adjustments to adapt to the evolving threat landscape.

companyName: Snap One Holdings Corp.


text: A cybersecurity roadmap that is built from the risk assessment and feeds into our annual IT expenditure plan and which outlines the actions and investments we intend to take to enhance our cybersecurity posture and capabilities.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: We are committed to appropriate cybersecurity governance and oversight. Our technology and cybersecurity program is the principal responsibility of our board of directors. Our board of directors will regularly review the cybersecurity policies and incident response plans to ensure the company remains vigilant against cybersecurity threats.

companyName: TANCHENG GROUP CO., LTD.

ticker: QSJC


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: Our cybersecurity risks are identified and addressed through a comprehensive approach led by our Information Assurance team. The Information Assurance team works collaboratively across the organization to develop strategies for preserving the confidentiality, integrity and availability of Corporation and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made to management and the Audit Committee of the Board of Directors ("Audit Committee") in a timely manner.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: We are committed to continuously evaluating and enhancing our cybersecurity measures as our business evolves. However, investors should be aware that our current capabilities may not fully address all cybersecurity risks. We encourage investors to consider the inherent risks associated with our limited resources and lack of formal cybersecurity policies when evaluating our Company.

companyName: FLEXPOINT SENSOR SYSTEMS INC

ticker: FLXT