text: Constellation has established programs and processes to manage material risks from cybersecurity threats including assessing and identifying existing cybersecurity risks, as well as continuously monitoring for developing risks. Our cybersecurity risk management strategy is established at the executive level and is implemented through our cybersecurity program which deploys risk-based security controls and services to protect our customers, personnel, information and cyber assets. The program aligns enterprise cyber and physical security controls with the National Institute of Standards & Technology (NIST) Cybersecurity Framework (CSF) and other industry standards such as the NERC and NRC cybersecurity standards. Cybersecurity risk is assessed and reported in our enterprise risk management program, which utilizes the Three Lines Model adapted from the Institute of Internal Auditors, for risk management to assign clear risk responsibilities across the enterprise. Through coordination with operational teams, we align on cybersecurity risk classification, categorization, likelihood, and potential impact to the company. At the highest level, our program includes multi-layered oversight by the Board of Directors and Board Committees.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: Our chief information officer and chief information security officer assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer and chief information security officer, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN

secItem: Item 1C


text: Our risk assessment efforts have indicated that we are a potential target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors, including nation-states, organized criminal groups, malicious insiders, and activists. The impacts of attacks, abuse, and misuse of the Company's systems and information include, without limitation, loss of assets, operational disruption, and damage to the Company's reputation.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from cybersecurity incidents in a timely manner. Our security operations team ("SOT"), which is comprised of internal security professionals and reports to the Chief Information Officer ("CIO"), has first line responsibility for our cybersecurity risk management processes as they relate to day-to-day operations. Our audit and compliance team ("ACT"), which is comprised of a team lead and the CIO, has second line responsibility and works in partnership with our executive leadership team ("ELT") and other internal teams to coordinate efforts, priorities and oversight. Our ACT assesses cybersecurity threats and risks based on probability and potential impact to key business systems and processes. Threats and risks that can cause major damage or service impact that the ACT considers high are incorporated into our overall risk management program. The ACT develops a mitigation plan for each identified high threat and risk and reports its progress with respect to mitigation of such threats and risks to the Technology Risk Management Committee, which is part of our ELT and consists of both management-level employees and members of the Board; such high-level cybersecurity threats and risks are tracked as part of our overall risk management program.

companyName: QXO, Inc.

ticker: QXO


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our online ordering system" in Item 1A- Risk Factors.

companyName: UNITED RENTALS NORTH AMERICA INC


text: We manage and oversee a cybersecurity risk program designed to evaluate potential threats, vulnerabilities, and the potential impact on our operations, data, and stakeholders. This program undergoes regular reviews and updates to address emerging risks. Our process for addressing risk aligns with industry standards as outlined in the NIST Cybersecurity Framework, NIST Risk Management Framework, and CIS Top 18 Security Controls.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Both the Board and the Audit Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks. As part of such reviews, our Board and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management. These periodic reviews address various topics including evolving regulatory standards, recent developments, vulnerability assessments, third-party reviews, and other information security topics that senior management deems necessary. We have also established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.

companyName: Compass Group Diversified Holdings LLC


text: Because we are aware of the risks associated with third-party service providers, we endeavor to conduct due diligence of our third-party service providers before engagement and implement contractual protections designed to address potential risks and vulnerabilities.

companyName: Snap One Holdings Corp.


text: Our Board oversees cybersecurity risk as part of its overall risk oversight function. Our information technology department (the "IT Department"), which functions as our Information Security Advisory Team, is responsible for managing our information security program and implementing cybersecurity risk management practices. The IT Department is led by our Chief Executive Officer and our Chief Technology Officer (the "IT Officers"), who oversee our cybersecurity strategy and ensure its alignment with business objectives.

companyName: RiskOn International, Inc.


text: Our Audit Committee assists the Board of Directors in its oversight of our policies, procedures and practices with respect to risk management and mitigation, including risks related to information security, cybersecurity, and data privacy and protection. Company management reviews our enterprise risk assessment with our Audit Committee and our Board of Directors and provides periodic updates with respect to our risk mitigation response plans to our Audit Committee and our Board of Directors. The Audit Committee has delegated oversight of risks related to information security, cybersecurity, and data privacy and protection to its Information Security Subcommittee, which meets at least twice a year with senior members of our cybersecurity team to discuss our cybersecurity profile and related risks, as well as to discuss updates on relevant developments in the cybersecurity threat environment. The Information Security Subcommittee reports to the Audit Committee following each subcommittee meeting, and the Audit Committee reports to our Board of Directors. Pursuant to our incident management procedures, cybersecurity incidents are reported to our Board of Directors, our Audit Committee or its Information Security Subcommittee as appropriate based on the nature of the incident.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: Our cybersecurity risk management process is aligned with our enterprise risk management framework and policy. This allows us to assess, identify, and manage material risks arising from cybersecurity threats. As part of our integrated approach to risk management, and to help safeguard the confidentiality, integrity and availability of our data and systems, we maintain a comprehensive cybersecurity program that is comprised of administrative and technical controls, cybersecurity, technology and privacy policies and procedures, management oversight, accountability structures, and technology design processes (collectively, our "Cybersecurity Program").

companyName: Oportun Financial Corp

ticker: OPRT


text: Certain third-party application providers provide critical services for our business. Our vendor management program to manage cybersecurity risks associated with our use of these providers includes audits and a review of security assessments. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and the imposition of contractual obligations related to cybersecurity on the provider.

companyName: MANNKIND CORP

ticker: MNKD


text: Our cybersecurity risk management program is guided by frameworks and standards promulgated by the EU, National Institute of Standards and Technology, Cloud Security Alliance ("CSA") and International Organization for Standardization/International Electrotechnical Commission ("ISO/IEC"). While we seek to maintain ISO/IEC 27001:2013, ISO/IEC 27017 and the SOC 2 Type 1 certifications, this does not imply that we specifically or comprehensively comply with technical specification or requirements, only that we use all the above-mentioned standards and regulations as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: We maintain and actively update a cybersecurity incident response plan that outlines the steps we take to identify, investigate and take action in response to any potentially material cyber incidents. Our incident response plan ensures that our Chief Information Officer, members of our senior management team and select members of our legal staff, are timely informed of and consulted with respect to any potentially material cyber incidents.

companyName: BlueLinx Holdings Inc.

ticker: BXC


text: We rely on our systems and networks to support our business activities. As some of these networks and systems are managed by third parties, our cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers. We also leverage third-party experts and vendors to help manage our cybersecurity program, audit the effectiveness of our existing cybersecurity controls, and make recommendations for improvements and best practices. We utilize a Managed Detection and Response service that provides threat intelligence, technology, and specialist expertise to protect our systems and networks from cyber threats. We require all third parties with access to our information systems or data to maintain industry standard cybersecurity programs and to report actual or suspected security incidents to us.

companyName: Howard Hughes Corp


text: We have implemented various processes and tools to identify cybersecurity threats, detect potential attacks, and protect our data and information technology. We periodically evaluate evolving cybersecurity risks and legal and compliance requirements, and we make ongoing strategic investments to address those evolving risks and requirements. We also participate in multiple cybersecurity forums that share threat intelligence and best practices.

companyName: STARBUCKS CORP

ticker: SBUX


text: Our Cyber Incident Response Plan employs an operational incident-handling capability that includes preparation, detection, analysis, containment, eradication, recovery, and communication procedures.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Our management team, including our cybersecurity team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk management processes. Our cybersecurity team includes Vice President of Information Technology and Information Security Officer with a team of eight full-time information technology professionals and several outside security vendors to manage our information security program. Our Vice President of Information Technology and Information Security Officer have served in various roles in information technology and information security, and together they have over 55 years of experience in this field. The cybersecurity management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Executive Officer and Chief Financial Officer, as well as our Board of Directors.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and responding to Cybersecurity Events when they occur.

companyName: PROS Holdings, Inc.


text: We have implemented a cross-functional information security program to assess, identify and manage material risks from cybersecurity risk, which includes seeking input from our employees, management, third-party vendors, the Audit Committee of the Board of Directors ("Audit Committee") and the Board of Directors.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Security governance We have established processes aimed to assess, identify and manage material risks from cybersecurity threats. Our ERM organizational process includes annual risk assessments. Our cybersecurity team, which is led by our Chief Information Officer and Chief Information Security Officer (the "CIO/CISO"), is responsible for identifying, assessing and managing strategic and operational cybersecurity risks. Our cybersecurity team shares information regarding such risks with our Security Steering Committee, which consists of our General Counsel, Chief Financial Officer, CIO/CISO, and members of our IT, Legal and ERM functions. Both our Security Steering Committee and our ERM function support the Board's oversight of cybersecurity risk.

companyName: PENTAIR plc

ticker: PNR


text: We, like other companies in our industry, face cybersecurity risks in connection with our business. However, to date, risks from cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, and financial condition. For more information on our cybersecurity related risks, see "Risk Factors" under Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Climb Bio, Inc.

ticker: CLYM


text: Use of Third Parties To regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address cybersecurity-related issues, we engage with information security and forensics firms with specialized industry knowledge. Our collaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and testing and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties, regulators and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized access to our processing systems.

companyName: CORPAY, INC.

ticker: CPAY


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; an IT security team (including Chief Operating Officer (COO)) principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Erasca, Inc.

ticker: ERAS


text: In connection with improving the management of cybersecurity risk, the Company has: audited our systems with the help of information security consultants; completed ransomware simulations and enhanced our Disaster Recovery and Business Continuity Plan to reflect lessons learned; conducted recovery simulation of our proprietary database to determine restoration timing;

companyName: AGREE REALTY CORP

ticker: ADC


text: Our Board is responsible for risk oversight, and may delegate specific areas of oversight to committees of the Board, which report to the full Board. The Audit Committee of the Board in turn is specifically charged with reviewing cybersecurity risk management and the steps management takes to monitor, control and mitigate such risks. In connection with such review, the Audit Committee receives quarterly reports from the Chief Technology Officer on, among other things, the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In addition to the quarterly reports, the Audit Committee performs an annual review of the Company's cybersecurity program. The annual review consists of a summary of all systems, processes and staffing in place to mitigate a cybersecurity incident using the NIST framework as a guideline.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: The audit committee, in turn, provides periodic reports to our board of directors regarding our cybersecurity processes, including the results of cybersecurity risk assessments.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), regulatory guidance, and other industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our CISO and our Chief Information Officer ("CIO"), along with key members of their teams, regularly collaborate with peer banks, industry groups, law enforcement, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: Our managed service provider is a System and Organization Controls (SOC) 2 accredited IT services firm that completed an annual audit, providing evidence of ongoing compliance to obtain the SOC 2 designation. This managed service provider has over a decade of experience delivering services and consulting related to regulatory security requirements. Our managed service provider is responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engage d to ensure that our cybersecurity program is designed to function effectively in the face of evolving cybersecurity threats. The managed service provider provides regular briefings to members of our management team on cybersecurity matters, including threats, events and program enhancements.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: We recognize the importance of securing our data and information systems and have a process for assessing, mitigating, and managing cybersecurity and related risks.

companyName: INTRUSION INC

ticker: INTZ


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure of our information technology systems, including cybersecurity attacks or other data security incidents, could significantly disrupt the operation of our business." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: PEDEVCO CORP

ticker: PED


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for assessing, identifying, and managing material risks from cybersecurity threats. This process is supported by both management and our Board of Directors.

companyName: Zevia PBC

ticker: ZVIA


text: We use a layered defense management approach to managing cybersecurity. The Bank's cybersecurity operations function is headed by the VP of IT who is responsible for managing information security risks by developing and implementing information security strategies, architecture, and procedures and acts as the first line of defense. The VP of IT oversees a team of internal and external security professionals in safeguarding our critical data, systems, and assets against threats, breaches, and attacks. The VP of IT is also responsible for ensuring the confidentiality, integrity, and availability of information assets.

companyName: Bogota Financial Corp.

ticker: BSBK


text: LNC's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with LNC's Chief Information Security Officer (" CISO ") having primary responsibility with respect to material risks from cybersecurity threats. LNC also has a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and LNC's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: As part of their oversight of cybersecurity risk, the Board and Audit Committee regularly review detailed cybersecurity reports, which include analyses of the threat landscape, recent incidents, and the efficacy of our cybersecurity strategy. In addition, the Chief Information Officer provides bi-annual updates to the Audit Committee and annual briefings to the full Board on our cybersecurity posture, strategy, and risk management. These reviews and updates are complemented by ongoing cybersecurity training for board members to enhance their decision-making and oversight effectiveness.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Impact of Cybersecurity Threats Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents to date. However, to assess, identify, and manage material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested and expect to continue to invest significant resources to sustain and enhance our information security and controls or to investigate and mitigate security vulnerabilities.

companyName: RYVYL Inc.

ticker: RVYL


text: Our approach to cybersecurity governance, risk and compliance is based on overarching guidelines, standards and best practices developed by the U.S. National Institute of Standards and Technology (NIST), a department of the U.S. Department of Commerce. Our information security governance oversees the process of coordinating the cybersecurity team(s) responsible for the mitigating of business risks posed by IT-related resources. Our governance framework of authority and accountability ensures prioritized initiatives have the required structure, sponsorship and funding to appropriately address the foreseen risks. Risk management includes an assessment of the risks posed to us by an IT solution, including cloud hosted and/or other third-party environments and systems. Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain or who have access to our client or employee data on our systems. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: In an effort to deter and detect cyber threats, we have a required cybersecurity training program that is provided to all new employees during on-boarding and semi-annually to employees with access to our IT resources, which aims to raise awareness and foster a culture of cybersecurity among our workforce. We also have an ongoing process of sending simulated phishing emails to employees. The results of these simulated attempts are monitored and reported to each employee's manager. Training includes such cybersecurity topics as social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training also emphasizes the importance of reporting all incidents immediately.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: The Company has established a cybersecurity incident management policy to facilitate the Company's management of cybersecurity incidents. Monitoring and detection systems have been implemented to help identify and remediate cybersecurity threats. All potential security events and/or confirmed security incidents, as appropriate, are reported and logged in to the Company's authorized incident management systems. The Company's incident response team ("IRT"), along with the third-party security system providers, aims to review, analyze, categorize and take action on reported security events. We also have an Incident Response Plan that is designed to be triggered if a security event is identified as a security incident. Consideration shall also be given to individually immaterial incidents that occur as part of a series of related unauthorized occurrences and are material when considered in the aggregate.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: The Company maintains an Information Security Policy and Standards that details how material risks from cybersecurity threats are assessed, identified, and managed: • Risk assessment – a periodic risk assessment is performed by the Chief Information Security Officer using the National Institute of Standards and Technology cybersecurity framework and rates risks by criticality. • Risk identification – vulnerabilities and risks are identified through functions performed by the Chief Information Security Officer which includes assessments using automated tools, monitoring activities, reviewing threat intelligence, and responding to incidents. Risks are also identified through independent assessments performed by third-party consultants and the internal audit function. • Risk management – the Chief Technology Officer oversees a process designed to protect against and remediate risks according to their criticality and presents to the Risk Oversight and Audit Committees of the Board of Directors and management at least semi-annually. The Chief Information Security Officer also presents to the Board of Directors and Risk Oversight Committee on cybersecurity and data privacy matters at least annually.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: As a highly regulated global financial services company, we understand the substantial operational risks for companies in our industry as well as the importance of protecting the information and data of our clients, third parties and employees and the resilience of our systems. As such, our Global Informational Security (GIS) Program is designed and operated to mitigate information security risks and threats to the company. Its intent is to safeguard the confidentiality, integrity and availability of our information and services. The GIS Program is designed to strengthen the integrity of the global markets we support, protect CME Group's information assets, maintain client, third party and employee trust, support our pursuit of strategic objectives, contribute to shareholder value and preserve our reputation and brand. We implement technical, physical and administrative safeguards to protect the confidential and sensitive information of our clients, third parties, employees and other information under CME Group's stewardship. We manage cybersecurity risk to the organization as part of our business strategy, risk management and financial functions in alignment with our overall Enterprise Risk Management Program and regularly engage with the risk committee of the board of directors and the board of directors as a whole regarding the effectiveness of the GIS Program and the management of our cybersecurity risks.

companyName: CME GROUP INC.

ticker: CME


text: In addition, we have processes designed to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. For example, our Terms and Conditions within our agreements with suppliers, vendors, contractors, consultants, partners and others with whom we do business (collectively "Suppliers") generally require that our Suppliers safeguard and protect the information entrusted to them, as well as information generated or developed by them, from unauthorized access, destruction, use, modification or disclosure. We also encourage the our Suppliers to maintain risked-based cybersecurity programs designed to mitigate emerging threats to their information systems, products, services and supply chain, while complying with all applicable contractual and legal requirements. However, we may have little or no oversight with respect to security measures employed by third-party service providers, which may ultimately prove to be ineffective at countering cybersecurity threats.

companyName: TRIMAS CORP

ticker: TRS


text: We are a blank check company with no business operations. Since our Initial Public Offering, our sole business activity has been to search for and select a prospective acquisition candidate. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third-party service providers, we may be subject to attacks on or security breaches in our or such third parties' systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of such third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: WinVest Acquisition Corp.

ticker: WINV


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of its critical systems and information. The Company's cybersecurity risk management program employs several different measures, including perimeter monitoring, endpoint monitoring and user management, designed to assess and identify cybersecurity risks. The Company's technology management team is principally responsible for managing the Company's cybersecurity risk assessment and management processes. The Company's technology management team performs enterprise-level risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. The Company's technology management team and third-party professionals perform penetration tests, vulnerability scans, and patch management to assess and protect the confidentiality, integrity and availability of its critical systems and information. The Company provides training to its employees on cybersecurity matters, performs periodic awareness testing to facilitate compliance with the Company's cybersecurity policies, and maintains a method for its employees and consultants to communicate any suspected cybersecurity incident. In addition, the Company evaluates key third-party service providers before the Company grants the service provider access to its information systems and has a process in place to ensure that future access is appropriate.

companyName: ESSEX PORTFOLIO LP


text: The Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Please see "Risk Factors" in Item 1A in this Annual Report on Form 10-K for further discussion regarding the Company's cybersecurity risks.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: The Audit Committee actively participates and offers guidance in strategic decisions related to cybersecurity. This involvement helps ensure that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: LogicMark, Inc.

ticker: LGMK


text: The ISO is responsible for overseeing day-to-day operations of the Information Security Program, coordinating, or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our Information Technology Steering Committee, Enterprise Risk Management Committee, and the Board of Directors Audit Committee. The ISO reports to the Chief Risk Officer.

companyName: COMMUNITY WEST BANCSHARES /


text: Monitoring Cybersecurity Risks and Incidents Our Director of IT Infrastructure and Cybersecurity meets regularly with members of our executive team to discuss and review risks related to cybersecurity. The reviews may include evaluations of risks and incidents identified by third-party providers retained to review our cyber risk as well as cybersecurity threat scenario planning. Identified risks related to cybersecurity threats may also be analyzed as part of our ERM process.

companyName: Cactus, Inc.

ticker: WHD


text: The CIO also has extensive leadership experience in computer product engineering and information technology fields, including responsibility for overseeing cybersecurity risk management and digital risk management. The CIO also holds a bachelor's degree in computer science. The Senior Risk Council meets regularly to discuss the risk management measures implemented by the Company, including measures to identify and mitigate data protection and cybersecurity risks. The Senior Risk Council receives regular updates on cybersecurity incidents from the CISO and CIO.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: We believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our Vice President, IT has served in various roles in information technology and information security for over three decades, which includes experience in the biotech, pharmaceutical and healthcare industries and experience in cybersecurity risk management and data privacy compliance.

companyName: Celcuity Inc.

ticker: CELC


text: Our management team is responsible for day-to-day assessment and management of cybersecurity risks. On our management team, our Chief Information Officer has primary oversight of material risks from cybersecurity threats. The Chief Information Officer is Charles River's Senior Vice President responsible for the Global Technology organization and for information protection at Charles River. The Chief Information Officer has more than 25 years of experience in the field, including serving as the Senior Vice President of Charles River's Digital Transformation organization, leading the development and implementation of information technology strategies and roadmaps for digital and automation solutions.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its Director of IT, who reports to the CFO. The qualifications of the Director of IT include over 25 years of IT management, cybersecurity, and information governance experience. The Director of IT is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Management's role includes:

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: The Company utilizes multiple training methodologies to ensure associate awareness of cybersecurity risks and practices. Associates are required to undergo security awareness training when hired and annually thereafter. In addition, the Company conducts tabletop exercises and other readiness exercises to enhance incident response preparedness. Disaster recovery plans have been put in place, and are tested, to prepare for potential disruptions in technology on which we rely.

companyName: DILLARD'S, INC.

ticker: DDS


text: Management has engaged third-party vendors to assist in monitoring our cybersecurity risk management programs and identifying and responding to any incidents. Additionally, third-party vendors are routinely engaged to evaluate how effectively management as a whole manages cybersecurity risk. We also utilize third-party cybersecurity vendors to assess its protections against identified vulnerabilities.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services. The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer depending on the severity of the threat.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: The Audit Committee of the board of directors provides direct oversight over cybersecurity risk and provides updates to the board of directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters.

companyName: Syros Pharmaceuticals, Inc.

ticker: SYRS


text: Cybersecurity risk management is an important part of and is integrated into our overall enterprise risk management framework, with cybersecurity risks being among the core enterprise risks identified for oversight by our Board of Directors (the "Board") through our annual enterprise risk assessment. We maintain an enterprise-wide cybersecurity risk assessment program and framework that is designed to identify, assess, and manage cybersecurity risk, vulnerabilities, and threats. The foundation of our cybersecurity program is based on the International Organization for Standardization ("ISO") and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In alignment with the concepts and principles articulated in these standards, we have implemented controls related to cybersecurity threats and incidents including monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying, and managing material cybersecurity risks, we: • Leverage technology solutions designed to provide protection for our assets and detect threats in our environment; • Regular vulnerability assessments and penetration testing in efforts to identify, assess, and remediate weaknesses; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery policies and procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing designed to ensure that the Company's mission-critical systems are recoverable, in support of our business continuity needs; and • Work with each of our business and corporate groups with our internal cybersecurity program to integrate cybersecurity requirements into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, executive management, as well as our Board, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Our board of directors has approved management committees including the Information Technology Committee, which focuses on technology impact, and its business impact. This committee provides oversight and governance of the technology program and the information security program. This committee is chaired by the Information Technology Director and includes the Chief Information Security Officer, the Chief Operating Officer, and the Chief Risk Officer. This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the board of directors on an annual basis (or more frequently as may be required by the Incident Response Plan).

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and/or financial condition. See "Part I, Item 1A. Risk Factors" contained in this Annual Report for a discussion of the risks we face from cybersecurity threats.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: Risk Management and the ordinary course of our day-to-day business, we receive, process, use, store, and share digitally data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our this end, we have implemented a Security Incident Response Plan ("SIRP") designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. Our SIRP is managed and monitored by a dedicated security/information systems team and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, the Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024. The Company does not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. However, as discussed under " Item 1A. Risk Factors," specifically the risks titled "Disruptions, failures or security breaches of our information technology infrastructure could have a negative impact on our operations," the sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: HERSHEY CO

ticker: HSY


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, and more frequently as relevant, the Audit Committee receives an overview from management covering topics such as security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.

companyName: Talkspace, Inc.

ticker: TALK


text: • Training and Awareness: We have robust cybersecurity training programs with frequent touch points for all employees to empower them to act responsibly and keep cybersecurity top of mind. We use monthly activities to keep employees engaged with cybersecurity, including newsletters, articles on the Sensata intranet, and mock phishing campaigns. We regularly update our comprehensive training program, which covers a wide variety of topics, from protecting work machines and personal information to social innovation and how employees can protect their digital lives at home. • Supplier Engagement: We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided. • Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, our risk register, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management. • Technical Safeguards: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.

companyName: Sensata Technologies Holding plc

ticker: ST


text: The Company remains dedicated in its commitment to cybersecurity and compliance cyber risk management and will continue to invest in and prioritize cybersecurity to protect all critical information.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Rhinebeck Bank engages with a range of independent external data security professionals, including cybersecurity risk assessors, consultants, internal and external auditors, and insurance professionals to obtain a holistic view of our cybersecurity landscape. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultations on cybersecurity enhancements to proactively address new and evolving risks and strengthen our cyber security program.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: Employing appropriate incident prevention and detection software (e.g., antivirus, anti-malware, firewall, endpoint detection and response, identity and access management, multifactor authentication, virtual private network, web content filter, spam filter, data loss protection software, security information and event management software); Employing industry-standard encryption protocols; Employing backup/disaster recovery software; Conducting regular vulnerability scans of Company systems and networks.

companyName: CAMBER ENERGY, INC.

ticker: CEIN


text: The Audit Committee (Committee) of our Board of Directors has primary oversight responsibility for the Company's risk assessment and risk management activities, including addressing risks related to cybersecurity through policies and processes, and considering any recommendations for improvement of relevant controls. The chairperson of the Audit Committee updates the full Board of Directors on these matters as deemed appropriate.

companyName: Container Store Group, Inc.


text: Incident Management While we continue to invest in our information security defenses, including cybersecurity defenses, if our security systems or those of third parties are penetrated or circumvented such that the confidentiality, integrity or availability of information about us, our customers, transactions processed on our networks or on third-party networks on our behalf, or third parties with which we do business is compromised, we could be subject to significant liability that may not be covered by insurance, including significant legal and financial exposure, actions by our regulators, damage to our reputation or loss of confidence in the security of our systems, products and services that could materially adversely affect our business. For more information about the risks posed by cybersecurity threats, see "Item 1A. Risk Factors — Operational and Other Risk — If the security of our systems, or the systems of third parties we rely upon, is compromised, our business could be disrupted and we may be subject to significant financial exposure, liability and damage to our reputation. "

companyName: Discover Financial Services


text: Our Head of Information Technology ("Head of IT") is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has more than eight (8) years of experience in information security and over eighteen (18) years of IT experience in the biotechnology and pharmacology industr. Our Head of IT directly reports to, and meets periodically with, our Senior Vice President of Finance and Administration to discuss and review our cybersecurity risk management processes.

companyName: ImageneBio, Inc.

ticker: IMA


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Our Board of Directors plays an important role in overseeing cybersecurity risks. Our Board of Directors has established an oversight structure for monitoring the effectiveness of and risks related to the cybersecurity program. The Audit Committee has been designated by the Board to oversee cybersecurity and information technology risks. The Audit Committee receives quarterly cybersecurity updates from our CISO, and the chair of the Audit Committee meets with the CISO individually on a quarterly basis. These updates often address topics such as ongoing efforts to improve our cybersecurity posture, operational metrics, incident metrics and mitigation actions, and may include key metrics such as those related to cybersecurity maturity, risk reduction, cybersecurity program health, and audit and compliance activities. The Audit Committee updates the Board on its activities at each regularly scheduled Board meeting. Updates related to cybersecurity are provided to the Board on an annual basis as part of an overall ERM update. In addition to this regular reporting, significant cybersecurity events may also be escalated on an as-needed basis through the company's organizational structure in accordance with the IRP.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Oversight responsibility over cybersecurity risk is shared by the Board and the Audit Committee, with the Audit Committee being primarily responsible for overseeing risks related to cybersecurity, data protection, and privacy matters. The Audit Committee regularly reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape, in addition to the results of third-party reviews and assessments of our security controls. Our CDIO or CISO provide regular cybersecurity updates in the form of written reports and presentations to the Audit Committee at its quarterly meetings, which are also provided to the full Board. We also have protocols by which certain cybersecurity incidents are escalated and, where appropriate, reported to the Audit Committee in a timely manner.

companyName: LOWES COMPANIES INC

ticker: LOW


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents see Item 1A, "Operational Risks – Security breaches, computer malware, or other cyberattacks involving the confidential information we maintain could significantly damage our reputation, expose us to litigation and enforcement actions, and substantially harm our business and results of operations."

companyName: DELUXE CORP

ticker: DLX


text: The Company deploys measures which leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats. The Company has invested and continues to invest in risk management and information security and data privacy measures in order to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses. Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations. Refer to Item 1A. Risk Factors in Part I of this Annual Report on Form 10-K, which should be read in conjunction with the foregoing information, for additional information on cybersecurity risks the Company faces.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Our Chief Financial Officer (CFO) is primarily responsible for assessing and managing cybersecurity risks across the company based on the assessments by our Senior Director of IT and third party IT specialists. Additionally, our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Director of IT with assistance from third party IT specialists. Our CFO has extensive experience managing risks at our company and at similar companies in the past, including risks arising from cybersecurity threats. Our Senior Director of IT has over 25 years of experience in IT security, and data analytics.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its information technology systems and data. The Company recognizes the increasing volume and sophistication of cybersecurity threats and takes seriously its responsibility to protect these information technology systems and data. The Company considers risks associated with cybersecurity alongside the Company's other risks as part of its overall risk assessment process. The Company's Vice President of Information Technology and his staff monitor the Company's information systems to provide a comprehensive approach to assess, identify, manage, mitigate, and respond to cybersecurity threats.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: To facilitate effective management, our cybersecurity leadership team holds regular discussions with our dedicated cybersecurity team on cybersecurity risks, threat intelligence, incident trends, security audits, and the effectiveness of our training and testing. Our cybersecurity leadership team convenes regularly to review and monitor programs designed to prevent and detect cybersecurity threats and mitigate and remediate cybersecurity incidents. Our cybersecurity leadership team also receives comprehensive reports on security incidents, threat intelligence, and vulnerability assessments from our cybersecurity team.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management's plans for monitoring and testing compliance with data security regulations.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: EverCommerce Inc.

ticker: EVCM


text: Incidence Response and Recovery Planning: An Incident Response Plan that dictates how the Manager prepares, identifies, contains, remediates, and recovers from various vulnerabilities, threats, and events, including cybersecurity events impacting the Fund.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: We established and maintain incident response and recovery plans that address our response to a Cybersecurity Event, and test and evaluate such plans on a regular basis.

companyName: PROS Holdings, Inc.


text: Incident Response Policy The Board of Directors is responsible for overseeing the risks from cybersecurity threats. Each month, the Board is presented with the executive overview of the Cybersecurity Continuous Monitoring Review Report ("Report") prepared by the Company's third-party chief information security officer. The Board of Directors reviews the Report each month and, if warranted, directs senior management of the Company to take necessary and appropriate actions in accordance with the IR Policy (as defined below).

companyName: NORWOOD FINANCIAL CORP

ticker: NWFL


text: The Audit Committee of our Board ("Audit Committee") is responsible for the oversight of cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. Multiple times per year, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Vice President of IT, who is responsible for cybersecurity and is supported by our Chief Legal Officer. Members of the Audit Committee also regularly engage in ad hoc conversations with management on cybersecurity-related matters and news events and discuss any updates to our cybersecurity risk management and strategy programs. When incidents occur, depending on the nature and severity, the Audit Committee Chair is notified immediately, and incidents are further reviewed periodically with the Audit Committee. Material cybersecurity matters are also periodically reviewed with the full Board of Directors.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: Future Directions Urgently will continue to invest in cybersecurity technologies, enhance our staff training programs, and foster collaborations with cybersecurity experts. Our board-driven, proactive approach to cybersecurity risk management is integral to our mission of delivering value to our customers, employees, and shareholders, safeguarding our reputation, and ensuring the long-term success of our company.

companyName: Urgent.ly Inc.

ticker: ULY


text: To facilitate the prevention, detection and timely response to information security threats, we have a dedicated CISO whose team is responsible for managing our information security strategy, policies, standards, and processes. The information security team provides security monitoring and response and provides regular reports to the CISO to inform about and monitor the prevention, detection, mitigation and remediation of cybersecurity risks. The CISO, who also serves as our data protection officer, reports directly to our Chief Digital & Technology Officer ("CDTO"), who reports directly to our Chairman, President and Chief Executive Officer.

companyName: AAR CORP

ticker: AIR


text: The board of directors' Audit Committee receives periodic reports from our Vice President Information Technology concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also receives regular reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: MACROGENICS INC

ticker: MGNX


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. Our third-party vendors may also experience threats and cybersecurity incidents from time to time.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations.

companyName: BioCorRx Inc.

ticker: BICX


text: We plan to establish a security and privacy awareness program that runs throughout the year and includes training for all company personnel to enhance employee awareness of how to detect and respond to cybersecurity threats as well as more targeted training for company personnel that have increased responsibility for mitigating certain potential cybersecurity plan to review and update our policies, procedures, processes and practices to address changes in the threat landscape and as a result of lessons learned from suspected, actual or simulated incidents. We also plan to review industry best practices to assist in evaluating responses to new challenges and risks. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: Trio Petroleum Corp

ticker: TPET


text: During the fiscal year ended June 30, 2024, we did not identify risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. See "Security breaches, loss of data and other disruptions have in the past and could in the future compromise sensitive information related to our business or our participants, or prevent us from accessing critical information and expose us to liability, and could adversely affect our business and our reputation" in Item 1A "Risk Factors" in this Annual Report.

companyName: InnovAge Holding Corp.

ticker: INNV


text: Cyber Risk Management and Strategy We have implemented and maintain a risk management program that includes processes for the identification, assessment, management and mitigation of cybersecurity risks. This program utilizes numerous technological and human security controls, processes, and procedures to address risks including, but not limited to, those identified by threat intelligence providers, internal stakeholders, and security management programs. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: The Company maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of the Company's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into the Company's corporate risk register. The program includes general controls for managing changes in and access to the Company's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.

companyName: APA Corp

ticker: APA


text: The Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which is currently James Hickey, regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company. The CCO is responsible for assessing and managing material risks from cybersecurity threats that may impact the Company.

companyName: X1 Capital Inc.


text: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: Kandi Technologies Group, Inc.


text: To operate our business, we utilize certain third-party service providers and vendors to support a variety of functions. We seek to engage reliable, reputable service providers and vendors that maintain cybersecurity programs, and we implement a vetting process to ensure that all third-party service providers and venders comply with our cybersecurity program requirements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: Governance & Oversight The Board has delegated primary oversight of the Company's risks from cybersecurity threats to the Technology Committee. Our management team, including our CISO, provides quarterly updates to our Technology Committee and annually to the full Board regarding our cyber security activities and other developments impacting our digital security. We have protocols by which certain cyber security incidents are escalated within the Company and, where appropriate, reported to the Board and Technology Committee in a timely manner.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: The IT management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our VP of Information Technology has over 20 years of experience managing global IT operations, including strategy, information security, applications, infrastructure, support and execution.

companyName: Seer, Inc.

ticker: SEER


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with global regulatory controls and aligned with National Institute of Standards and Technology Cybersecurity Framework; user and employee awareness of cyber policies and practices; information systems configuration management; third-party risk management systems; identity and information asset protection; infrastructure security systems; and cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also engage a range of third-party experts in connection with various development, implementation, and maintenance activities related to our cybersecurity program, including audit and compliance, threat hunting, monitoring, and end-user support.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: Internal and External Penetration Testing of SCC's Technology Infrastructure: This service is contracted at least annually to identify and remediate vulnerabilities that may exist at the infrastructure and critical operation systems levels.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors - "Risks Related to our Business, Operations and Strategy."

companyName: LCI INDUSTRIES

ticker: LCII


text: Lumen's CSO has extensive experience working in the public and private sectors leading security organizations, risk management functions, and driving large information technology deployments. He has an Engineering degree, a Master of Business Administration, a Chief Information Security Officer Certification, and a Global Information Assurance Certification Security Leadership Certification. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

companyName: Level 3 Parent, LLC


text: The Company's Cybersecurity System is led by the Chief Information Officer ("CIO") in collaboration with a third-party virtual Chief Information Security Officer ("vCISO") and other third-party cybersecurity service providers which in turn assist in monitoring the Company's exposure from significant information technology suppliers, significant software as service providers and major vendors with access to the Company's information technology systems. The Company's CIO has 10+ years of cybersecurity industry experience. Further, team members who support the Company's cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems, and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM). During the last three years, the Company has not experienced a material security breach and, as a result, the Company has no t incurred any material expenses from such a breach. Furthermore, during such time, the Company has not been penalized or paid any amount under any information security breach settlement.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: The Company has established an Information Technology Steering Committee consisting of department leaders. The committee focuses on strategic and tactical delivery as well as policy oversight. All such policies are approved by the board of directors. All Information Security activity is led by the Information Security Officer.

companyName: BV Financial, Inc.

ticker: BVFL


text: Our cyber risk management program is based on recognized industry practices and standards in cybersecurity and information technology. These standards include the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001. Security controls are managed using an information security management system ("ISMS"), providing a systematic approach consisting of people, processes, and technology. NOV's ISMS aims to minimize risk and ensure business continuity by proactively limiting the impact of security incidents.

companyName: NOV Inc.

ticker: NOV


text: • Third Party Cybersecurity Service Providers – We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures and process execution, including incident detection, investigation, analysis and response, eradication and recovery. Additionally, several external entities evaluate our cybersecurity program, including the U.S. Defense Contract Management Agency, the Defense Industrial Base Cybersecurity Assessment Center and a Cybersecurity Maturity Model Certification Third Party Assessment Organization, to assess and certify our cybersecurity regulatory compliance. We also engage with external auditors and consultants who conduct audits and assessments of our cybersecurity controls. • Product Security – We provide cyber threat intelligence to, and collaboration with, our product security teams and share expertise in cyber vulnerability, exploit and resilience technology that can be applied to network infrastructure and company product offerings.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: We maintain a robust cybersecurity program that we have designed with the goal of identifying, deterring, detecting, responding to, and managing potential cybersecurity risks and threats.

companyName: LOWES COMPANIES INC

ticker: LOW


text: CFBank also has a third-party risk management program. Management performs periodic reviews of third-party vendors on their cybersecurity and business continuity capabilities to ensure they meet contractual requirements and satisfactory audit testing results. Vendors not meeting CFBank's risk requirements are notified to make improvements and, if the vendors cannot mitigate the identified risks, CFBank management looks to identify alternative vendors. Vendor risk assessments are retained by CFBank.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: The Company relies on the Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Advisor's risk management program and processes, which include cyber risk assessments.

companyName: Kennedy Lewis Capital Co


text: – PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: • PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG's risk management program and reviewing the most significant risks facing PSEG, including cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risk is mapped primarily to the Board's Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice, as administered by the CISO. • IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, of overseeing PSEG's cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed about cybersecurity risks by the CIDO and/or the CISO, during the IOC's four regularly scheduled meetings per year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risks, cybersecurity updates from the CISO and/or CIDO, and reviews of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO regularly attend IOC meetings. In addition, the IOC meets with the CISO in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. • Audit Committee—The Audit Committee has the charter responsibility of overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives a cybersecurity update twice a year from the CISO, either with the full Board or the IOC in attendance. Audit Committee members have a courtesy invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair as noted above. • Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: The operation of our business is dependent on the secure functioning of our digital information systems and infrastructure. Our cybersecurity risk management program intends to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: Management reviews and approves the Company's cybersecurity policies and procedures and communicates these policies and procedures to all employees to ensure adherence to established security protocols. Compliance with Regulations: Management implements and maintains compliance with relevant cybersecurity regulations and standards applicable to the Company.

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: Management of the Sponsor is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Trust, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Fidelity. The Sponsor is also made aware of material cybersecurity incidents which impact the Trust.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: Our Director of Information Technology, assisted by our managed information technology service provider and other third party service providers, lead the Company's cybersecurity risk management processes. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing threat intelligence reports and feeds, conducting scans of certain environments, and other tests.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: The Head of IT, or a delegate, informs the Cybersecurity Subcommittee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes. The Cybersecurity Subcommittee is also primarily responsible for advising the Disclosure Committee and the Company's CEO and Interim CFO regarding cybersecurity disclosures in public filings. The Head of IT, with the General Counsel in attendance, also notifies the Audit Committee chair of any material cybersecurity incidents.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors. The Incident Response Plan is coordinated through the Management Director of Information Technology and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Federated Hermes' Global Technology Organization (GTO), which is headed by Federated Hermes' CIO, has a dedicated Information Security Group (ISG) responsible for day-to-day oversight of the cybersecurity program. The ISG, which is headed by Federated Hermes' Chief Information Security Officer (CISO), coordinates cybersecurity activities with Federated Hermes' business functions and third-party service providers. The ISG also oversees and coordinates cybersecurity efforts with counterparts at FHL. Federated Hermes' Information Security and Data Governance Committee (ISDG) provides executive management oversight of the ISG and Federated Hermes' cybersecurity program. Federated Hermes' Chief Compliance Officer (CCO), CRO and General Counsel, as well as Federated Hermes' CIO, CISO, Chief Financial Officer, and other senior members of Federated Hermes' management, are members of, and Federated Hermes' Chief Audit Executive attends meetings of, the ISDG.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, please refer to the discussion under the heading, "We use advanced information and communication systems to run our operations, compile and analyze financial and operational data, and communicate among our employees, customers, and counterparties, and the risks generally associated with information and communications systems could adversely affect our results of operations. We continuously work to install new, and upgrade existing, systems and provide employee awareness training around phishing, malware, and other cyber security risks to enhance the protections available to us, but such protections may be inadequate to address malicious attacks or inadvertent compromises affecting data security or the operability of such systems" included in Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.

companyName: Catalent, Inc.


text: Our Board of Directors is tasked with overseeing data privacy and cybersecurity risks. They regularly review the Company's cybersecurity program with management, evaluating the adequacy of controls and security for our information technology systems. Additionally, they assess the Company's response plan in case of a security breach affecting these systems. Annually, the Board of Directors receives updates on potential cybersecurity incidents, data privacy, and compliance programs, engaging in active discussions with management on cybersecurity risks.

companyName: Vanguard Green Investment Ltd

ticker: VGES


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our controls. We conduct penetration testing or other application security testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems. We also maintain a vendor risk management program designed to identify and mitigate potential risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, use of contractual cybersecurity and incident notification provisions, and ongoing monitoring of vendors, as appropriate. We also conduct employee training on data protection, including cybersecurity, among other topics.

companyName: Snap Inc

ticker: SNAP


text: Training and Awareness All new hires receive cybersecurity awareness training. All employees, including incident response personnel and senior management, receive periodic training and are periodically subject to evaluations to confirm their cybersecurity knowledge and awareness.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Tables of Contents • Regular testing and assessments of our systems and controls to evaluate the information security program maturity and effectiveness using cybersecurity frameworks (such as ISO 27001, PCI DSS, and SOC 2) and to identify and address potential vulnerabilities—and as appropriate, we adjust our policies, standards, and processes based on testing and assessment results; • A vulnerability management program to determine the in-scope systems, patch systems based on criticality, and disclose potential vulnerabilities; • A cybersecurity incident response plan and scenario-specific playbooks for responding to various types of cybersecurity incidents; • Business continuity and disaster recovery plans to support more effective response and recovery efforts in the event of a significant cybersecurity incident or disruption; • The use of external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls; • Commercially available and customized security technologies and security and business controls to limit access to and use of such sensitive data; • A security awareness and training program for our employees and contractors, with role-based training for certain personnel and positions; and • A third-party risk management framework designed to monitor and address cybersecurity risks from various third parties (including vendors, service providers, and other contractors) that includes diligence regarding the third party's cybersecurity capabilities and additional monitoring of certain third parties based on the results of diligence. In addition, we have established standard contractual terms and conditions regarding cybersecurity applicable to third parties, as well as further downstream parties, that may be tailored to the use case and sensitivity of any data or business processes involved.

companyName: INTUIT INC.

ticker: INTU


text: The Company employs third parties in fulfilling certain aspects of its information security and cybersecurity programs. For example, we engage third parties to: monitor our network 24/7/365, escalate security alerts, when applicable, perform penetration testing, conduct social engineering tests and assist management with technology upgrades/installations. The CISO monitors information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the CISO, CRO, and their respective teams, work with our service providers to understand and document any incidents, along with managing the impact to us and reporting such significant incidents to senior management, ITSC, ERMC, and the Board Risk Committee.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Head of IT oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. Our Head of IT also coordinates with our legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our management team is informed about the effectiveness of the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes.

companyName: RYVYL Inc.

ticker: RVYL


text: The Audit Committee will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cyber incidents and ongoing risk management efforts. These updates will enable the Audit Committee to provide informed reports on cybersecurity matters to the full Board.

companyName: Onconetix, Inc.

ticker: ONCO


text: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation, and the CIO is also continually informed about any developments in cybersecurity, including potential threats and industry techniques for risk management to address those threats. The role of the CIO includes implementation and oversight of effective processes to monitor our information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CIO regularly reports to senior management on our cybersecurity risks and actions taken to mitigate that risk.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY