text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This is intended to provide cross-functional visibility, as well as executive leadership oversight, to address and mitigate associated risks. Our internal IT group audits our information security programs, and the results are reported to our executive management and the Risk Committee of our Board of Directors by the Director of Information Technology. We also engage third-party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards. We further employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. We also carry cybersecurity insurance to protect against potential losses arising from a cybersecurity incident.

companyName: Calumet, Inc. /DE

ticker: CLMT


text: The board has created a dedicated cybersecurity subcommittee of the enterprise risk committee to oversee Farmer Mac's cybersecurity programs and practices, including the identification and mitigation of security and privacy risks. The cybersecurity subcommittee consists of three members of the enterprise risk committee. Two members of that subcommittee have successfully completed the National Association of Corporate Directors ("NACD") certificate in cyber-risk oversight program. The other member of the subcommittee is the CEO of an energy company and has direct experience managing cyber risk and cybersecurity incidents in that capacity. The chair of the board audit committee has also successfully completed the NACD certificate in cyber-risk oversight program (but is not a member of the cybersecurity subcommittee). The cybersecurity subcommittee typically meets on a monthly basis with the CISO and other members of Farmer Mac's management team to discuss the performance and effectiveness of Farmer Mac's cyber program and to receive updates on cybersecurity risks, any cybersecurity incidents, and major cybersecurity initiatives.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM

secItem: Item 1C


text: Board of Directors, through the Audit Committee, has primary oversight of responsibility for cybersecurity risks. Cybersecurity matters are reviewed at least annually, or more frequently if needed, in connection with strategic planning and risk management discussions.

companyName: Eva Live Inc

ticker: GOAI


text: In addition, to mitigate material risks from cybersecurity threats, the Company has implemented various controls, including, but not limited to, the following: • Intrusion prevention controls (such as network segmentation and firewalls); • Access controls (such as identity and access management and multi-factor authentication on critical applications and systems); • Detection controls (such as endpoint threat detection and response, and logging and monitoring involving the use of a third-party for security information and event management, with reports and alerts provided by the third-party to the CISO's team); and • Threat protection controls (such as mandatory cyber-threat training and simulated phishing campaigns with employees, vendor management programs, and vulnerability and patch management).

companyName: CARTERS INC

ticker: CRI


text: Security risks to both the Company and its customers' data and information are continuously evaluated and monitored. We actively monitor security 24 hours a day and seven days a week through our global Security Operations Center. We have implemented a multi-layered defense-in-depth approach using technologies that meet or exceed industry standards. Additionally, we expect our vendors to adhere to our data privacy and security standards and we evaluate their ability to comply as part of our vendor assessment process. This includes assessing internal and external threats to the security, confidentiality, integrity, and availability of Embecta and third party provider data and systems, as well as other risks to our operations. Embecta utilizes the ISO 27001 and 42001 frameworks, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness against emerging risks including AI. As part of our risk management process, we engage external providers to conduct periodic internal and external penetration testing and security assessments. Additionally, under our third-party risk management program, we assess vendor cybersecurity risks, including those associated with our cloud vendors and other third-parties. We maintain security and privacy policies and procedures that align with industry-standard control frameworks and comply with applicable regulatory requirements, laws, and standards. Enterprise cybersecurity policies undergo an annual review and approval by our Information Security Risk Committee ("ISRC").

companyName: Embecta Corp.

ticker: EMBC


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Policy and Incident Response Procedure. The CISO reports directly to our Chief Executive Officer. Our CISO has over ten years of IT experience and nine years of significant experience managing cybersecurity threats across our industry. The CISO may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.

companyName: Sonendo, Inc.

ticker: SONX


text: Risk Management Strategy We are guided by our Cybersecurity Charter, which includes our philosophy of information security, identifies the motivation for security, describes information security principles and terms, and defines the scope of information security policies and responsibilities for various functions. We continue to improve the maturity of our cybersecurity program, aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: Sensata Technologies Holding plc

ticker: ST


text: While the Board has the primary responsibility for risk oversight, the Audit Committee assists the Board in fulfilling its oversight responsibility with respect to the management of cybersecurity-related risks. Through its Cybersecurity Subcommittee, the Audit Committee periodically reviews and discusses with management, including the Vice President of Information Technology, (i) the Company's information security strategy, priorities and objectives; (ii) the Company's technology and information security risks, including with respect to cybersecurity and data privacy; and (iii) the steps management has taken to manage cybersecurity.

companyName: Air Transport Services Group, Inc.


text: To date, we do not believe risks from c ybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected us or are reasonably likely to materiality affect us, including our business strategy, results of operations or financial condition. See "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with third-parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures. For more information regarding the risks we face from cybersecurity threats, please see "Cybersecurity attacks, internal system or service failures may adversely impact our business and operations" in Risk Factors included in Part I, Item 1A of this Form 10-K.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: The Audit Committee of the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cybersecurity attacks. The Company's IT team consults with, and provides regular updates to, our Audit Committee, as well as members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of our cybersecurity program, and timely reports regarding any cybersecurity attack that meets established reporting thresholds. Our Audit Committee has oversight responsibility for our cybersecurity program.

companyName: GameStop Corp.

ticker: GME


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to our Business—If we or our partners or other third parties with whom we collaborate fail to protect confidential information and/or sustain a data security incident, we could suffer increased costs, material financial penalties, exposure to significant liability, adverse regulatory consequences, and reputational harm, which would materially adversely affect our business, results of operations, and financial condition."

companyName: Oscar Health, Inc.

ticker: OSCR


text: Our cybersecurity risk identification and assessment process is integrated into our enterprise risk management process. Our board of directors and key members of management across the organization rank previously identified risks, identify new or emerging risks, and provide commentary on the financial or strategic impact these risks could have on the Company. The risk survey responses are analyzed in the context of our business, recommendations are made where appropriate, and ownership of risk response is assigned to specific individuals. The results of this process are presented to our board of directors at least annually. In addition, our Information Technology (IT) Director provides quarterly updates to our board of directors on cybersecurity incidents, cybersecurity awareness activities, including results of mock-phishing exercises, regulatory and compliance matters specific to cybersecurity, and activities related to business continuity, including data validation and restore testing and tabletop exercises. Risk assessment for cybersecurity threats is embedded into these quarterly updates, with each topic discussed being assigned a risk level.

companyName: BOISE CASCADE Co

ticker: BCC


text: Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, see Item 1A. "Risk Factors" for a discussion of cybersecurity risks that we face.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: We maintain a comprehensive, risk-based approach to assessing and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: nVent Electric plc

ticker: NVT


text: a dedicated security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; cybersecurity controls to detect cybersecurity incidents or risks within our IT Systems;

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: As part of our overall risk management process, our management engages at least annually in an enterprise risk management review and evaluation, during which management reviews the principal risks relating to our business and operations. Included in this process is a review and evaluation of our risks relating to our Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including documentation discussing each service providers' information security and privacy controls. Any failure in our or our key service providers' cybersecurity systems could have a material impact on our operating results. See Item 1A. Risk Factors — General Risk Factors — The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively.

companyName: Main Street Capital CORP

ticker: MAIN


text: We design and assess our program based on industry standards such as the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: The Company faces a wide variety of cybersecurity threats ranging from uncoordinated individual attempts to gain unauthorized access to information technology ("IT") systems to sophisticated and targeted measures known as advanced persistent threats directed at the Company, its products, its customers, supply chain and/or its third-party service providers, including cloud providers. These threats and incidents originate from many sources globally.

companyName: Johnson Controls International plc

ticker: JCI


text: Cybersecurity risk management is integrated within our enterprise risk management ("ERM") program, which identifies, prioritizes as to likelihood and magnitude, and continuously monitors the various short-term and long-term risks that Dynatrace faces and how they are being addressed. In developing our cybersecurity risk management program, we are informed by industry benchmarks and standards, including the cybersecurity framework created by the National Institute of Standards and Technology ("NIST"). We also have various security-related certifications and authorizations, including ISO 27001, SOC 2 Type II, FedRAMP and StateRAMP.

companyName: Dynatrace, Inc.

ticker: DT


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. These processes and response mechanisms are continually assessed for effectiveness, and any new security mechanisms, including several in 2024, are integrated when business needs arise or industry best practices shift.

companyName: MIMEDX GROUP, INC.

ticker: MDXG


text: training and risk awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls;

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: The members of management who are responsible for assessing and managing cyber risk are the Acting Chief Information Security Officer and the Acting Chief Information Officer of the Company who, combined, have over 30 years of experience in managing cybersecurity. Our Acting Chief Information Security Officer is responsible for our cybersecurity risk management program and reports directly to the Acting Chief Information Officer. The Acting Chief Information Officer is a member of the ERMC and accountable for informing and updating the ERMC on cybersecurity risk management. The ERMC has ultimate responsibility for the risk management of cyber risk and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in addition to the Company's cyber incident response and reporting processes.

companyName: AMEDISYS INC


text: The Company's cybersecurity risk management program is integrated with its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Seneca Foods Corp

ticker: SENEA


text: Governance of Cybersecurity Risks Our board of directors is responsible for the general oversight of cybersecurity risks and is informed of key updates to our cybersecurity processes by relevant members of our executive leadership team on at least an annual basis.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Allstate conducts periodic assessments, designed to evaluate effectiveness of implemented controls. The Company performs vulnerability scans and penetration tests to assess controls and proactively identify vulnerabilities for prioritization and remediation. Findings are managed and tracked in accordance with Allstate's governance, risk and compliance standards.

companyName: ALLSTATE CORP

ticker: ALL


text: Cyber Risk Management & Strategy As part of its overall risk management system, EOG regularly assesses its processes and practices for managing and mitigating cybersecurity risks and determines whether such risks are being effectively managed and mitigated.

companyName: EOG RESOURCES INC

ticker: EOG


text: Management of Third-Party Risk: The Company's comprehensive third -party management process includes rigorous due diligence, oversight and identification of cybersecurity risks associated with vendors and service providers.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Our Director of Information Technology, Controller and members of our cybersecurity committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Arcellx, Inc.

ticker: ACLX


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Risks and previous events with material effects It is possible that Cleco's information technology systems and networks, or those managed by third parties, could have vulnerabilities and those vulnerabilities could go unnoticed for a period of time. Cleco may also be exposed to, and adversely affected by, interruptions to its computer and information technology systems, and sophisticated cyberattacks, including cybersecurity threats and vulnerabilities in its systems, malware, and attacks targeting its information technology systems and networks. Any such prior events, to date, have not had a material impact on Cleco's results of operations, financial condition or cash flows. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls Cleco has implemented and is implementing, or which Cleco causes or has caused third party providers to implement, will be sufficient to protect its systems, information or other property. For more discussion of potential cyber threats that may affect Cleco, see Item 1A, "Risk Factors — Operational Risks — Technology, Nation-State, and Hacktivist Threats."

companyName: Cleco Corporate Holdings LLC


text: GPM's Senior Vice President of Information Technology (the "SVP of IT"), who has more than 30 years of technology experience, leads our information security team. We also use additional employees with relevant educational and industry experience to support our information security program.

companyName: ARKO Corp.

ticker: ARKO


text: Due to the size of the Company, our information technology ("IT") environment does not utilize overly complicated systems or processes. The Company does not sell products or conduct business in an online environment. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet the Company's needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. The Company uses multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment.

companyName: GREYSTONE LOGISTICS, INC.

ticker: GLGI


text: Our cybersecurity policies and procedures are designed to ensure that appropriate cybersecurity measures and controls are developed, implemented, and maintained, with assistance from a third -party service provider. These policies and procedures and the resulting safeguards are designed and evaluated in light of our risk assessments. We have implemented access controls, firewalls, and intrusion detection and prevention systems, vulnerability and patch management processes, and we also use a variety of other automated tools and manual processes to safeguard our information systems. We maintain a business continuity and disaster recovery plan designed to enhance our incident response preparedness. We also require employees to undergo security awareness training when hired and based on periodic phishing tests.

companyName: VERU INC.

ticker: VERU


text: Our approach to third-party cybersecurity underscores a commitment to robust risk management and adherence to industry best practices. By implementing comprehensive measures in line with recognized standards, we ensure that our third-party cybersecurity protocols are aligned with rigorous standards. Regular assessments, SOC reviews, and collaborative efforts are integral components of our strategy, aimed at fostering a secure and resilient ecosystem that safeguards sensitive information and maintains the integrity of our digital infrastructure in partnership with external entities.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: The cybersecurity function within the Company, which comprises, in part, our information technology ("IT") security director (who has several years of commercial experience and a master's degree of information systems with a focus on cybersecurity) and other members of our technical staff management, along with our legal advisors, risk management team, and overall information security function, helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT security department, under the direction of our Chief Information Officer ("CIO") and led by our IT security director, identifies and assesses risks from cybersecurity threats by monitoring cybersecurity and operational risks using various security tools designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes automated tools, security assessment and monitoring; restricted physical access to servers and network equipment, system audits and third party assessments, third-party IT vendor risk management process to assess and manage risk presented by our IT vendors, third party threat assessments, evaluating threats reported to us, and annual review of cybersecurity insurance policies and the associated levels of coverage based on current risks.

companyName: biote Corp.

ticker: BTMD


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. Employees who access our systems are required to undergo annual cybersecurity training and, each year, employees are required to test their understanding of our cybersecurity policies. Further, our employees that handle personally identifiable information are required to undergo training, including phishing exercises and awareness programs on the appropriate management, use and protection of that information.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: We maintain a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology systems and information.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Our current CSO has significant experience leading cybersecurity efforts at large enterprises, having held top information security positions at a number of international large- and mega-cap companies during her career. She also holds a master of science in security risk management and is qualified as a certified information security manager with the Information Systems Audit and Control Association. Our CSO has been with the company or its subsidiaries for over five years.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: The committee vested with cybersecurity oversight consistently conducts periodic reviews of GlobalX's cybersecurity policies, procedures, and controls. These reviews are pivotal in ensuring the ongoing effectiveness of the company's cybersecurity framework and its alignment with emerging threats and evolving industry best practices. Regular updates are meticulously implemented to fortify the company's cybersecurity resilience in response to emerging risks and evolving regulatory requirements.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: Material Effects from Cybersecurity Incidents Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems or networks, or those of our managers, employees, and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. Nuvera considers cybersecurity risk a serious threat to our assets and our people and has put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; any retained external cybersecurity consultants; and alerts and reports produced by security tools deployed in the IT environment. Our management team reports information about cybersecurity risks to the Committee.

companyName: Wag! Group Co.


text: Board Oversight of Cybersecurity Matters The Board considers oversight of CVR Partners' risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Partnership's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, AI use and governance, and efforts to prevent and mitigate such risks. The Audit Committee subsequently reports on these activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.

companyName: CVR PARTNERS, LP

ticker: UAN


text: First, we have designed and assessed our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our businesses and technology infrastructure.

companyName: System1, Inc.

ticker: SST


text: We also maintain an incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate identified incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct regular tabletop exercises to test and fortify the controls of our cyber incident response program. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.

companyName: DROPBOX, INC.

ticker: DBX


text: All of the software that we use is Commercial Off the Shelf Software (COTS) and Microsoft, Dropbox, and Google cloud services. We do not develop, modify, or customize any software for our own use. We rely on the cybersecurity measures and practices of our software and cloud service providers and update our software and systems regularly to address any known vulnerabilities or issues. We also limit the access and use of our software and cloud services to authorized personnel and encourage them to use strong passwords and multifactor authentication.

companyName: Mitesco, Inc.

ticker: MITI


text: Our Chief Operating Officer will be tasked with staying informed about, and monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes we plan to develop and as described above, including the operation of an incident response plan, and report to the Board of Directors on any appropriate items.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee. The Head of Information Technology regularly provides information security updates to named executive officers and briefs our Board of Directors or Audit Committee on relevant information security issues at least twice a year. We also provide periodic cybersecurity training for members of our Board of Directors.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: Our information technology governance, including cybersecurity, is documented through written policies, procedures, guidelines, and standard operating procedures. All of our employees are required to undergo quarterly cybersecurity training. This training includes cybersecurity policies, cyber threats, and incorporating best practices into daily routines. Contractors and vendors that have access to our data, devices, or services are required to complete cybersecurity training prior to receiving access. Employees, vendors, and contractors with access to our operational technology network are required to undergo additional training specific to operational technology interactions. We maintain a Supplier Code of Conduct that is provided to our providers of materials and services during the onboarding process and that conveys our expectations regarding use and access requirements when using our technology resources.

companyName: Midstream Co LLC


text: See the risk factor titled "Our computer systems and networks are subject to attempted security breaches and other cyber incidents and a significant disruption in, or breach in security of, our information technology systems or certain products could materially and adversely affect our business or reputation." in Risk Factors in Part I, Item 1A of this Annual Report on Form 10-K for further information.

companyName: ANALOG DEVICES INC

ticker: ADI


text: As part of our cybersecurity program, we perform an annual cybersecurity risk assessment to evaluate our cybersecurity program and related controls. The cybersecurity risk assessment follows the guidelines published by the National Institute of Standards and Technology, which are aimed at identifying and determining the potential impact of threats and vulnerabilities and assessing the controls in place to mitigate those threats and vulnerabilities. Risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, operations, or financial condition.

companyName: Unum Group

ticker: UNM


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: Our board of directors recognizes the important role of information security and mitigating cybersecurity and other data security threats. Although our full board of directors maintains ultimate responsibility with respect to risk management oversight, our board has delegated oversight of the Company's information security program and matters of cybersecurity to the Audit Committee of the board of directors. The Company's senior officers, including its Chief Information Officer, are responsible for the operation of the information security program and regularly communicate with the Audit Committee on the state of the program, risks faced by the Company and the Company's risk mitigation efforts related thereto.

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program, including education sessions regarding cybersecurity topics from our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), internal security staff or external experts.

companyName: Teads Holding Co.

ticker: TEAD


text: Additionally, the Company's management leverages manual controls to verify data integrity and mitigate risk, considering the Company's size and business model. Management also provides interim and year-end reports to the Board of Directors on the Company's and its subsidiaries' IT General controls (ITGC) related to cybersecurity and information security matters.

companyName: Bit Digital, Inc

ticker: BTBT


text: The VP of MIS has expertise assessing and managing cybersecurity risks, and is a member of both the Risk Committee and Cybersecurity Committee. He has served in his current role since 2014 and has held several senior-level information technology roles in his 32-year tenure with the Company. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: Our management, including our Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We perform due diligence in order to identify and evaluate cyber risks of third party service providers. Third party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. Third party service providers deemed critical undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.

companyName: Terra Property Trust, Inc.

ticker: TPTA


text: In support of the GIS team, the CISO leads the Information Security Steering Committee, a group of internal security leadership positions that ensure alignment between the company's information security program and company objectives.

companyName: Anywhere Real Estate Group LLC


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While we have not experienced cybersecurity incidents that have materially affected our business, operations, or financial condition to date, we recognize that evolving cyber threats present a continuing risk. A successful cybersecurity breach, particularly one affecting our critical systems or third-party service providers, could result in operational disruptions, financial losses, reputational damage, legal or regulatory consequences, and loss of customer confidence. For example, unauthorized access to our systems could lead to data theft, fraud, or extended downtime impacting our ability to provide financial services. If such an event were to occur, it could have a material adverse effect on our results of operations and financial condition.

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: We adhere to a risk management framework based on applicable laws and regulations, incorporating industry standards and recognized practices to handle cybersecurity risks across our products, services, infrastructure and corporate assets. To evaluate and address cybersecurity threats, we analyze factors such as threat intelligence, first- and third-party vulnerabilities, changing regulatory requirements and observed incidents. We regularly conduct risk assessments to gauge the effectiveness and maturity of our systems, identifying areas for improvement. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. We also maintain a privacy risk management program to assess risks related to user data collection, with an independent third-party privacy assessor to ensure compliance. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions, alongside annual cybersecurity and privacy training for all staff members.

companyName: Intellicheck, Inc.

ticker: IDN


text: Key components of our Information Security Program include: • Risk Management: We conduct regular risk assessments to identify, evaluate, and prioritize potential threats and vulnerabilities. Based on our understanding of the risk landscape relevant to the Company, we have implemented targeted controls and allocated resources to mitigate risks to an acceptable level. • Policies and Procedures: Our Information Security Program is supported by a set of clear and enforceable policies and procedures. These documents outline standards for data handling, access control, password management, incident response, and other critical security practices. We regularly review and update our policies and procedures to ensure alignment with industry best practices and regulatory requirements. • Access Control: We enforce strict access controls, which include role-based least-privileged access, strong authentication methods and regular access reviews to limit system and data access to authorized personnel only. • Security Awareness Training: We believe that our employees are our first line of defense against cyber threats. We provide comprehensive security awareness training programs to educate staff about common risks, phishing attacks, social engineering tactics, and best practices for maintaining a secure information technology environment. We also provide security updates and alerts to keep our employees informed of active and emerging external cybersecurity threats. • Technical Controls: Our Information Security Program incorporates a layered approach to technical controls. This includes firewalls, intrusion detection and prevention systems, endpoint protection, encryption mechanisms, and continuous monitoring tools to detect and respond to security incidents in real-time. • Incident Response and Business Continuity: Despite our proactive measures, we recognize that security incidents may still occur. Therefore, we maintain a robust incident response plan, detailing procedures for detecting, analyzing, containing, and recovering from security breaches. Additionally, we have comprehensive business continuity and disaster recovery plans in place to ensure minimal disruption to our operations in the event of a cybersecurity incident. • Compliance and Auditing: Our Information Security Program is designed to comply with relevant regulations and industry standards. We undergo regular internal and external audits to assess our adherence to these requirements and demonstrate our commitment to maintaining a strong security posture.

companyName: Eagle Bulk Shipping Inc.


text: Our information security team serves as a first line of defense, including managing cyber risk strategy execution and owning the day-to-day management of these risks. Our enterprise risk management function, which includes members of our executive leadership team, serves as a second line of defense, bringing holistic risk oversight while serving as a partner to the business to help strategically manage risk. In particular, cybersecurity risks are monitored by a team composed of members of our executive team, who in turn provides updates to the Audit Committee of our Board of Directors, who is responsible for assisting the Board of Directors with oversight over cybersecurity risks.

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations, and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: We have implemented incident response and breach management processes, which have four overarching and interconnected workflows: (1) detection and analysis of a security or privacy incident, (2) investigation, mitigation and remediation, (3) reporting and notification, and (4) post-incident analysis. Such incident responses may involve participants from our information security, network, information Technology, development, executive and legal teams.

companyName: Bandwidth Inc.

ticker: BAND


text: The audit committee receives periodic reports from our information technology function concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Repare Therapeutics Inc.


text: The Company's Board of Directors ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by Bain Capital's CISO regarding the overall state of the Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents potentially impacting the Company.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: We engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. Our information technology team led by our Vice President of Information Technology (VP of IT) frequently collaborates with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices, and industry trends.

companyName: Adeia Inc.

ticker: ADEA


text: We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: We also engage an external auditor to conduct an annual Security and Organizational Controls 2 (SOC 2) examination of the security controls for systems storing customer data. The external auditor additionally conducts an annual payment card industry (PCI) data security standard review of our security controls that protect payment information.

companyName: AGILYSYS INC

ticker: AGYS


text: As of the date of this filing, to our knowledge, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats or previously identified cybersecurity incidents, but there is no assurance that we will not be materially affected in the future by such risks or future incidents. For more information on our cybersecurity related risks, see ITEM 1A. RISK FACTORS.

companyName: ROSS STORES, INC.

ticker: ROST


text: The Audit Committee of our Board of Directors receives periodic reports from the Associate Director of IT concerning Sangamo's significant cybersecurity threats and risk and the processes we have implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Our cybersecurity management process is based on an internally developed Intelligence Policy and a Vulnerability Management Framework. Cybersecurity risk management is currently independent of enterprise risk management. Our Vulnerability Management Framework addresses discovery, risk rating, remediation timeliness required per risk, and obligations on reoccurring third-party security products. Risks that fall outside the required remediation timeline are documented on the risk register, which is discussed during periodic Cybersecurity Steering Committee meetings.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: Cybersecurity is also included in our product development life cycle and part of our vendor and business partner evaluation process. Our product development approach considers cybersecurity best practices and builds security controls into our product design. Additionally, we conduct security risk assessments prior to engaging third-party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards and require they adhere to mutually agreed upon security requirements, controls and responsibilities.

companyName: Veradigm Inc.


text: Information Security Program ("Program") is designed to protect personal and proprietary information in compliance with federal and state requirements. The Program aims to: ensure the security and confidentiality of employee and customer personal information, as well as Company proprietary information;

companyName: Outdoor Holding Co

ticker: POWW


text: External and internal audits are conducted periodically to assess the effectiveness of our cybersecurity measures. These audits include an annual technology risk assessment by our Cybersecurity and IT departments. Our Internal Audit team also conducts cybersecurity risk assessments which include, among other things, evaluating governance of our cybersecurity processes and functions, assessing our ability to identify, validate and remediate vulnerabilities, and evaluating penetration studies. Results of our Internal Audit assessments are shared with our Enterprise Risk Management ("ERM") team, our Technology Risk Committee, and in accordance with our governance structure which includes, among other things, the Audit Committee of our Board of Directors.

companyName: HERBALIFE LTD.

ticker: HLF


text: Management is responsible for the day-to-day administration of Intuit's cybersecurity policies, processes, practices, and risk management. The Audit and Risk Committee of our Board of Directors provides primary oversight of cybersecurity risks and the Company's efforts to mitigate those risks.

companyName: INTUIT INC.

ticker: INTU


text: Our Board of Directors ("Board") holds overall oversight responsibility for the Company's strategy and risk management, including in relation to cybersecurity risks. The Board exercises its oversight function through the Audit Committee, which oversees the management of risk exposure across various areas, including data security risks, in accordance with its charter. In addition, the Audit Committee is specifically responsible for the review and approval of any cybersecurity incident disclosure, as set forth in the Committee's charter. In the event of a potentially significant cybersecurity incident, the Audit Committee's charter requires that management promptly communicate and consult with the Audit Committee.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Tyler's Chief Information Security Office ("CISO") leads the information security responsibility at Tyler. He has spent his career in information security, joining Tyler in 2018 and previously working in the payments and semiconductor manufacturing industries. He is a Certified Information Systems Security Professional ("CISSP") and a Certified Data Privacy Solutions Engineer ("CDPSE").

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.

companyName: Jingbo Technology, Inc.

ticker: SVMB


text: The Company takes measures to regularly update and continuously improve its cybersecurity program, including conducting independent program assessments, performing penetration testing and scanning the Company's systems for vulnerabilities using external third-party tools and techniques to test security controls, auditing applicable data policies and monitoring emerging laws and regulations related to information security. The Company also periodically engages third-party consultants to assist in assessing and enhancing its cybersecurity program. The Company has implemented risk-based controls to protect its information, customer information, third-party information, its information systems and its business operations. The Company follows the National Institute of Standards and Technology (NIST) Cybersecurity Framework and has adopted security-control principles based on NIST, other industry-recognized standards and contractual requirements, as required.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: The program is aligned with industry frameworks and controls from the National Institute of Standards and Technology, including NIST Cybersecurity Framework, v2.0. Leveraging these frameworks and controls allows the Company to identify the fundamental security capabilities and controls necessary to maintain and enhance the program. The Company utilizes a wide range of capabilities to maintain and enhance cybersecurity, including threat intelligence, penetration testing, multi-factor authentication, and endpoint detection and response. The Company maintains a cyber incident response plan, which is tested periodically. The Company maintains a cybersecurity insurance policy, which gives us access to expert forensic and legal experts to help manage a major incident or a data breach. We have rolled out a formal cybersecurity awareness training program to our entire workforce as part of our annual ethics and compliance training. Additionally, the Company conducts ongoing phishing and social engineering simulations that are tied to our cybersecurity awareness training program, and our workforce is encouraged to report any suspicious activities to our cybersecurity team. The Company also has processes in place to oversee and identify risks from cybersecurity associated with the use of third-party service providers that could impact our business. We review available data related to our third-party service providers and assess the appropriateness of our service providers' cybersecurity programs and practices to ensure risks are properly mitigated.

companyName: REV Group, Inc.


text: We believe these members of our executive team have the appropriate expertise, background, and experience to manage risks arising from cybersecurity threats. Alexis L -Qu c is one of the co-founders of our company and has served as our Chief Technology Officer and a member of our board of directors since June 2010. Mr. L -Qu c has extensive knowledge and experience from building and leading the development of our technology and from his decades of experience in the technology industry. Prior to co-founding Datadog, Mr. L -Qu c worked at Wireless Generation from March 2004 to December 2010, where he most recently served as Director of Live Operations. Previously, Mr. L -Qu c held engineering positions at a number of technology and software companies, including IBM Research and France T l com S.A. Mr. L -Qu c received his M.S. in Computer Science from CentraleSup lec. Emilio Escobar has served as our Chief Information Security Officer since September 2020. With two decades of experience in information security and compliance, Mr. Escobar has worked at large enterprises, medium-sized companies, and governmental organizations. Previously, Mr. Escobar served as the Vice President of Information Security for Hulu, where he played a pivotal role in setting up key security functions. Prior to that, Mr. Escobar worked for PlayStation, where he built and ran the software security teams. Mr. Escobar holds a BS in Computer Science from the University of Puerto Rico.

companyName: Datadog, Inc.

ticker: DDOG


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Financial Officer and our VP of IT who has over 40 years of experience in information technology and cybersecurity and manages the Company's information technology infrastructure.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to provide protection for our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, as well as secure our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. As part of our overall risk mitigation strategy, we maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We have engaged external parties, including consultants, computer security firms and risk management, and legal and governance experts, to enhance our cybersecurity oversight. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: ARVINAS, INC.

ticker: ARVN


text: We have developed a cybersecurity program that continuously evaluates material risks to our business and applies controls in an attempt to help avoid or mitigate them. Our key cybersecurity risks include, among others: brand and reputational damage, business disruption, regulatory and compliance risk, sensitive data loss, and reliance on third parties.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: Management and Strategy are externally managed by our Manager, and as such rely on our Manager to manage our day-to-day operations pursuant to our Management Agreement. Services provided under the Management Agreement are performed by individuals who are employees of our Sponsor or one or more of its affiliates. We, our Manager and our Sponsor are also party to an Employee and Cost Sharing Agreement. Pursuant the Employee and Cost Sharing Agreement our Sponsor provides our Manager with access to, among other things, the information technology ("IT")

companyName: Belpointe PREP, LLC

ticker: OZ


text: IT policies including cybersecurity have been developed in conjunction with independent third parties that specialize in cybersecurity, cloud, and digital infrastructure. The policies include employee security awareness, employee onboarding and offboarding, incident response protocols, business continuity including backup protocols, and disaster recovery. Dedicated Company IT personnel supported by independent third-party cybersecurity resources are responsible for implementing and monitoring cybersecurity measures, conducting risk assessments, and ensuring compliance with regulatory requirements. The IT team regularly attends webinars providing cybersecurity training and industry updates to stay abreast of trends and apply learning throughout the Company.

companyName: Guardion Health Sciences, Inc.


text: The Company recognizes the critical importance of maintaining the trust and confidence of business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. The Company uses third-party vendors to manage its information technology systems, including but not limited to services in cloud security, email filtering, endpoint security, darkweb reporting, antivirus/antimalware, employee security awareness training, and asset management and support. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Management reviews the security policies, procedures, and certifications of all third-party service providers prior to engagement.

companyName: Cryomass Technologies, Inc.


text: We have endeavored to implement policies, standards and technical controls based on the National Institute of Standards and Technology framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: We have implemented a multi-layered system designed to protect and monitor data and cybersecurity risk. Regular assessments of our cybersecurity safeguards are conducted both internally and by independent third-party cybersecurity vendors. Additionally, our internal audit department conducts regular audits to identify, assess and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies and education programs in response to audit findings. • Incident Identification and Response: We have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. While processes are in place to minimize the chance of a successful cyberattack, we have established incident response procedures to address a cybersecurity threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, contain and remediate any such cybersecurity incidents that occur. In the event of any breach or cybersecurity incident, we have a cross-functional incident response plan, which includes the involvement of our executive management team, established incident levels, and associated notification procedures, including escalation procedures upon discovery of cybersecurity risks to our Board of Directors, outside counsel and law enforcement, if deemed material or appropriate. Further, we conduct periodic incident response tabletop exercises and planned incident response drills with various members of our management team to continuously refine and update our incident response processes. • Cybersecurity Training and Awareness: We maintain a formal information security training program for all employees and contractors that includes training on matters such as phishing and email security best practices. We have implemented a requirement that all employees and contractors participate in information security training at least quarterly and have deployed internal phishing campaigns to measure the effectiveness of the training program. • Access Controls: We provide users with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information. • Systems and Processes: We use a combination of tools to identify cybersecurity incidents. We use firewalls and protection software in addition to working with a third-party cybersecurity vendor to scan internal and external networks for threat and intrusion detection. Our cybersecurity team regularly tests our controls through penetration tests, vulnerability scans and attack simulations. • Encryption and Data Protection: We have encryption methods in place to protect certain sensitive data. This includes the encryption of customer data, financial information and other confidential data. We also have multiple programs in place to monitor our retained data and take actions to secure the data.

companyName: Chord Energy Corp

ticker: CHRD


text: Cybersecurity Incidents During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have encountered routine cybersecurity threats and attempted attacks, such as phishing emails and malware attempts, our security measures have effectively mitigated these risks without causing material disruption.

companyName: Sunrun Inc.

ticker: RUN


text: Although risks from cybersecurity threats have not to date materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we may, from time to time, experience threats to and security incidents related to our data and systems. In the year ended December 31, 2024, we did no t detect any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: TEN Holdings, Inc.

ticker: XHLD


text: While we have experienced threats to our data and systems, to date, we are not aware that we have experienced a cybersecurity incident that had, or is reasonably likely to have, a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational, or other business harm as well as financial costs and regulatory action. See "Item 1A. Risk Factors–Technology Risks" of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: Our Vice President, Information Technology is responsible for managing and assessing material risks from cybersecurity threats and leads our information security program and team, which is comprised of several members devoted to infrastructure and information systems security and management. Our Vice President, Information Technology has over 20 years of industry experience, including over 15 years at our Company, serving in roles throughout his career such as engineer, infrastructure manager, Director of Information Technology Infrastructure, and Global Director of IT.

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: Equifax has invested significantly to develop and maintain an information security program with processes, technology and controls to protect the information, systems and resources of the Company. We have a Security team operating under the leadership of our Chief Information Security Officer ("CISO"), including approximately 400 cybersecurity professionals. The key elements of our information security program, including our cybersecurity risk management strategy, are described below.

companyName: EQUIFAX INC

ticker: EFX


text: As a company that collects and retains large volumes of customer and employee data, including payment card numbers and other personally identifiable information, we face significant and persistent cybersecurity risks. The protection and integrity of that data is important to us, which is demonstrated by the significant efforts and investments made to implement various measures to manage the risk of a security breach or disruption.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: We recognize the value and importance of cybersecurity and data protection and understand the potential harm to our business from cybersecurity incidents. Accordingly, we place a high priority on mitigating risks associated with cybersecurity threats and any cybersecurity incidents.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: We have in place a cross-functional, enterprise-wide cybersecurity program that is integrated into our overall risk management process and strategy and has direct involvement from our senior management and board oversight. Our cybersecurity program is based on industry standard CIS critical security controls. The top risks facing our Company, including those related to cybersecurity, are included in our overall enterprise risk management program that is managed by a cross-functional group chaired by our compliance and internal audit functions.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Board of Director Oversight of Cybersecurity Risks Our Board of Directors provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from the Company's Chief Compliance Officer ("CCO"), which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: We employ a comprehensive cybersecurity risk assessment program designed to evaluate threats, vulnerabilities, and the potential impact on our operations, data, and financial condition. This program is regularly reviewed and updated to address emerging risks. Our process for addressing risk is based on banking industry best practices outlined in FFIEC and National Institute of Standards and Technology ("NIST") frameworks. We engage various third-party service providers in connection with our cybersecurity processes.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our Chief Information Officer's experience includes over 10 years of working in the cybersecurity field in various industries, including the financial services industry.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, who has 25 years of experience in information technology including IT leadership in Department of Defense Research, who reports to our Chief Financial Officer, or CFO, who has over 20 years of experience as a CFO, including supervisory responsibility over IT and cybersecurity functions.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: A comprehensive approach to assessing, identifying, and managing cybersecurity risks is part of the Company's overall risk management strategy. A combination of internal and external monitoring services help identify, manage, and assess how management responds within our enterprise risk management processes. Any known cybersecurity incidents would be reported to our board, chief executive officer, and disclosure committee for evaluation.

companyName: CENTERSPACE

ticker: CSR


text: Cybersecurity Risk Management and Strategy We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: We use third-party service providers to perform a variety of functions throughout our business, including, but not limited to infrastructure support and maintenance, supply chain resources, contracting services and software integrations. These vendors are reviewed as part of our vendor management program, including the management of cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Personalis, Inc.

ticker: PSNL


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Intellicheck, Inc.

ticker: IDN


text: Our CIDO has served in various roles in IT and information security for more than 20 years. She holds an undergraduate degree in information management and technology. Our Director of Cybersecurity has served in various roles in IT and information security for more than 18 years, including in the military and the healthcare and retail industries.

companyName: Sensata Technologies Holding plc

ticker: ST


text: The Company believes its risk management strategy and governance programs related to cybersecurity matters are appropriate for a growing banking system of its size, but we continue to monitor them and improve upon them as warranted under our programs, policies, and procedures. Finally, we maintain customary cybersecurity insurance that we believe is appropriate for our industry and comparable to our peers.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: Further, our IRP establishes a corporate incident response team, which is responsible for providing oversight, direction, and governance of incident response policies and processes and is composed of certain company stakeholders, including our Chief Financial Officer, General Counsel, Vice President of Information Technology and our third-party CISO.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: We recognize that cybersecurity threats are constantly evolving and that maintaining robust security measures is an ongoing process. Below is an overview of our cybersecurity risk management and the measures we have in place:

companyName: BlueOne Card, Inc.

ticker: BCRD


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors."

companyName: Vivani Medical, Inc.

ticker: VANI


text: We provide regular awareness training to our employees and contractors, including periodic phishing tests, to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments dealing with sensitive data types.

companyName: GMS Inc.


text: As part of the cybersecurity incident response process described above, we engage third-party experts as needed to support incident response, such as external legal advisors, cybersecurity forensic firms and other specialists.

companyName: CONOCOPHILLIPS

ticker: COP


text: The Company provides mandatory annual training for personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Quarterly internal phishing tests are performed, and periodic and/or thematic email communications are provided throughout the year to raise awareness. Individual training is given to personnel as needed.

companyName: BADGER METER INC

ticker: BMI


text: Utilization of the CIS Critical Security Controls (CIS Controls) Cybersecurity Framework as a benchmark for evaluating the effectiveness of our cybersecurity measures.

companyName: QHSLab, Inc.

ticker: USAQ


text: We evaluate cybersecurity risks as part of our overall enterprise risk management. A steering committee of senior executives meets quarterly to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans, and provide updates on mitigation efforts already underway. Our cybersecurity team keeps up to date on the latest threats and risks through multiple channels and is also involved in evaluating risks associated with any new proposed service providers. We employ a Cybersecurity Engineer, reporting directly to our Chief Technology Officer, who manages our cybersecurity team that is comprised entirely of security professionals with industry recognized certifications. The cybersecurity team within BIO-key is responsible for assessing and managing risks associated with both our internal operations and our use of third-party service providers and informing/gaining feedback from the cybersecurity steering committee.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: Cybersecurity risk management is part of the Company's overall risk management. Our cybersecurity risk management is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third-party service providers. Our primary third-party service providers, utilize two (2) factor authorization as well as login and password protections with email verifications.

companyName: Guru App Factory Corp

ticker: GAFC


text: Our Chief Risk Officer has 20+ years of experience developing and leading global risk organizations across multiple Fortune 500 companies. He holds an undergraduate degree in aerospace engineering from the Georgia Institute of Technology.

companyName: NCR Atleos Corp

ticker: NATL


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Operations—Our business is highly dependent on communications and information systems, and systems failures or cybersecurity incidents could significantly disrupt our business, which may, in turn, negatively affect the market price of our common stock and our ability to operate our business" in this report.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: Following the March 2024 Private Placement, our focus has been on the identification of a privately held company to complete a reverse merger or similar strategic transaction. While we continue to maintain minimal distribution, marketing, and sales support, we have scaled down operations to the core functions of a U.S. Nasdaq listed company to conserve cash and focus on the functions needed to pursue potential strategic alternatives. We have implemented risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection/onboarding process and a review of SOC 1 reports on an annual basis.

companyName: CapForce Inc.

ticker: OPGN


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.

companyName: GlobalTech Corp

ticker: GLTK


text: Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and reports to our CEO. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by our group.

companyName: Greenpro Capital Corp.

ticker: GRNQ


text: Upon detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management. Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Director of Cyber Security. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: To date, there have not been any previous cybersecurity incidents that materially affected, or are reasonably likely to materially affect, us. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors – Risks Related to Technology and Cybersecurity.

companyName: Inotiv, Inc.

ticker: NOTV


text: Our chief technology officer, with 14 years of experience in information technology, artificial intelligence and software engineering, is responsible for managing and assessing risks related to cybersecurity and data governance. Our chief technology officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, through our security incident response process. Our chief technology officer supervises our vice-president of information technology, who has primary operational responsibility for managing the overall cybersecurity posture and strategy, managing internal and external cybersecurity resources and organizing and leading efforts to prevent, detect and respond to cybersecurity incidents and threats. Prior to joining the company, our chief technology officer previously served in various data and technology leadership roles, including most recently as chief data officer at another biotechnology company. Our vice-president of information technology has 25 years of experience in information technology and most recently served as senior director of information technology operations and infrastructure at another biotechnology company. As part of our quarterly disclosure committee process, our chief technology officer discusses with our chief executive officer, chief financial officer and other members of the disclosure committee, any significant cybersecurity issues, including any potential risks related to cybersecurity incidents.

companyName: COMPASS Pathways plc

ticker: CMPS


text: Our cybersecurity program includes employee training and a computer security incident response plan (the "CSIRP") that provides controls and procedures designed to timely and accurately report material cybersecurity incidents. Employees receive regular security training, and we conduct periodic phishing testing to assess whether our employees require additional training. Additionally, we provide our employees with easy-to-use tools to report potential phishing emails. The CSIRP establishes an organizational framework and guidelines to assist the Company in identifying, responding to, and recovering from computer security incidents both at the company and its third-party service providers in connection with incidents that may impact the company, including the security incident management team (the "SIM Team"), a legal team (the "Legal Team") and the computer security incident response team (the "CSIRT"). Each of the SIM Team, the Legal Team, and the CSIRT, often in consultation with the VP of Information Security, has a discrete set of responsibilities and obligations under the CSIRP. The CSIRT is a broad, cross-functional team of management stakeholders assigned with coordinating, developing, and managing the Company's response to computer security incidents when activated.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Following these risk assessments, we will redesign, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant, who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process. As part of our overall risk management system, we monitor and periodically evaluate our safeguards and advise our executives on these safeguards.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: The Bank maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: We face a number of cybersecurity risks in connection with our business. We have in the past experienced threats to and breaches of our data and systems, including ransomware, malware and computer virus attacks, including a ransomware attack in October 2021 which had a material adverse impact on our business strategy, results of operations or financial condition to date. For more information about the cybersecurity risks we face and have experienced, see the risk factor entitled "We have experienced a cyber security breach in the past and may be vulnerable to future security breaches, data privacy, and other information technology failures that could have a material adverse effect on our financial performance and operating results and disrupt our operations" within Item 1A- Risk Factors.

companyName: Sinclair, Inc.

ticker: SBGI


text: Recognizing the complexity and evolving nature of cybersecurity threats, Wayfair engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. Working with these external experts enables us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.

companyName: Wayfair Inc.

ticker: W


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are evaluated. Despite these efforts, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change, and efforts to overcome security measures become increasingly sophisticated. We cannot eliminate all cybersecurity risks or provide assurance that we have not had occurrences of undetected cybersecurity incidents. During the reporting period covered by this Annual Report, the Company did not identify any risks from cybersecurity threats that the Company believes materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Lomond Therapeutics Holdings, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us or our results of operations, cash flow or financial condition. However, the scope and impact of any future incident, or the identification of new information related to prior cybersecurity incidents, cannot be predicted. See "Item 1A. Risk Factors" for more information about our cybersecurity-related risks.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Our Board of Directors and Audit Committee are responsible for overseeing our cyber security risk management and strategy. Our Vice President of Finance provides periodic briefings to the Audit Committee including our cybersecurity risks and activities, any potential cybersecurity incidents and related responses, cybersecurity systems testing and, activities of third parties.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Director of Information Technology. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Inhibrx, Inc.


text: The processes by which such persons or committees are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Energy & Water Development Corp

ticker: EAWD


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee receives timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the Audit Committee discusses our approach to cybersecurity risk management with our Chief Information Officer ("CIO"). The Audit Committee makes regular reports to the full Board regarding our information technology risks. Each member of our Audit Committee is experienced in the area of information security, either as a result of their professional history, their current responsibilities in overseeing processes and controls in this area at the Company, or both. The Audit Committee may discuss such processes and controls with our internal accounting and security teams and independent registered public accounting firm.

companyName: POTBELLY CORP

ticker: PBPB


text: We have established a comprehensive incident response and recovery plan to identify, protect, respond to and recover from cybersecurity threats and incidents. The plan includes processes for the activation of the crisis management team (comprised of the Company's Chief Executive Officer, Chief Financial Officer and General Counsel), incident handling, and prompt and fulsome reporting to the Board upon discovery of a breach that could reasonably be material upon further investigation. Our procedures require reporting up the chain of command, even while materiality assessments are still being determined. In addition, we have pre-negotiated contracts with external third-party incident response providers to guide and assist the internal crisis management team as needed.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: At the management level, the CISO leads the ongoing technical and business functions that include cybersecurity, information assurance, network security, systems engineering, and information security management. A dedicated information security division reports to the CISO. The CISO has over 30 years of experience in information systems security including physical, cyber, and IT, disaster recovery, business continuity planning, secure software development, and cloud services and security, among others. The CISO holds multiple designations from the International Information System Security Certification Consortium, including Certified Information Systems Security Professional and has been a member of various boards including IT, Cybersecurity and Enterprise Risk Committees. Organizationally, the CISO reports to the CIO, but also provides reporting directly to and has access to the Risk Committee of the Board of Directors. The CIO has over 30 years of experience in financial services information technology.

companyName: BankUnited, Inc.

ticker: BKU


text: At the management level, our cybersecurity program is led by our CDTO and our CISO. Our CDTO has served in various information technology roles for over 27 years, including as Chief Digital and Technology Officer of Kimberly-Clark and as Executive Vice President and Chief Digital Officer of Toyota Motors North America, Inc. Our interim CISO has served in various information technology roles for over 20 years. Our interim CISO also has several information technology-related certifications, including the Certified Information Systems Security Professional ("CISSP") certification. Our interim CISO reports to our CDTO, who in turn regularly reports to our Chairman of the Board and Chief Executive Officer. We have protocols by which certain cybersecurity incidents are reported promptly to the Chairman of the Board and Chief Executive Officer, or the Audit Committee, as appropriate.

companyName: KIMBERLY CLARK CORP

ticker: KMB