text: Invesco's information security program is led by its Chief Information Security Officer (CISO) who reports directly to the GCSO and has over 25 years of experience, specializing in information security and risk management. Our manager's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect our information assets. The program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.

companyName: Invesco DB Multi-Sector Commodity Trust


text: We are committed to maintaining robust governance, oversight and management of cybersecurity risk. We have established and implemented processes, supported by written policies and procedures, to detect, assess, classify, respond to, report, track, and resolve cybersecurity threats or incidents. We have implemented systems and controls to address the information technology risks to our organization, our business partners and our customers. We employ a layered security approach leveraging diverse strategies including data loss prevention, identity and access management, network security, vulnerability management, end-point security and information security education and awareness, among others. As a federally regulated institution, the Company strongly supports an environment that facilitates and abides by the Confidentiality, Integrity, and Availability security principles.

companyName: BankUnited, Inc.

ticker: BKU

secItem: Item 1C


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risk titled "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: PodcastOne, Inc.

ticker: PODC


text: Effect of Risk We face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks, and other security incidents, including perpetration by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we, together with our contracted third-party cybersecurity advisors, maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring of internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by management.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: As a smaller reporting company with cybersecurity processes centered on RED Technologies, we may not be sufficiently protected against such occurrences. See Item 1A. Risk Factors, " Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss " of this Annual Report for a discussion of cybersecurity-related risks.

companyName: CONX Corp.


text: Our vulnerability management program involves regular scanning and testing of systems, endpoints, virtual environments, and cloud-based assets to identify potential software flaws, misconfigurations, or exposure points. Once vulnerabilities are detected, we prioritize remediation based on risk impact and business criticality, ensuring that all gaps are addressed in a timely and effective manner. This proactive approach enables us to maintain a hardened infrastructure, reduce attack surface, and align with industry best practices and regulatory part of our secure development lifecycle (SDLC), we conduct both automated and manual code reviews to ensure that the applications we deliver to our users are resilient against exploitation and designed to prevent data leakage. By embedding security controls throughout the development process — from design to deployment — we uphold confidentiality, integrity, and reliability. This approach not only protects sensitive user data, but also reinforces trust in our platform and supports long-term compliance with regulatory frameworks.

companyName: Zedge, Inc.

ticker: ZDGE


text: Our Executive Information Security Risk Management Committee ("ISRM Committee") consists of our CISO, CEO, Chief Financial Officer ("CFO"), CTO, as well as representatives from the client services and yield teams. The primary purpose of the ISRM Committee is to act on behalf of our executive management in fulfilling the oversight responsibilities with regards to the identification, analysis, and mitigation of all internal and external operational and strategic information security risks. The ISRM Committee is also responsible for the effective administration and adherence to our information security program, policy, standards, and guidelines. In the quarterly ISRM Committee meetings, our CISO provides updates on current information security trends and risks in the industry and covers how we, as a company, analyze these trends, and how we mitigate identified information security risks. The ISRM Committee also reviews the status of our phishing testing results and considers additional information security awareness and training measures, so we can minimize phishing risks and other human-related risks.

companyName: AdTheorent Holding Company, Inc.


text: The ERM process is incorporated into our disclosure controls and procedures. Representatives of each of our ERM, Internal Audit, legal and compliance teams sit on the Company's management Disclosure Committee, which is responsible for, among other things, the design and establishment of disclosure controls and procedures to help ensure the timeliness, accuracy and completeness of corporate disclosure. Our IT security and privacy teams, who are responsible for assessing cybersecurity threats and risks, in turn maintain policies and procedures designed to ensure appropriate escalation of cybersecurity incidents to meet external disclosure requirements. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) regularly meet and coordinate with our Chief Privacy Officer (CPO). Each of the CIO, CISO and CPO also advise members of the Disclosure Committee, including our Chief Legal and Public Affairs Officer (CLO), on disclosure matters on an as-needed basis.

companyName: DAVITA INC.

ticker: DVA


text: Lumen's CSO has worked in the public and private sectors in information security since 1997 and has been a chief security officer since 2017. His technical and process certifications include CISSP, ITIL Foundation, Six Sigma Certified, CISCO CCNP, and CCNA, and he oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

companyName: QWEST CORP

ticker: CTBB


text: As of the date of this annual report, we have not experienced any cyber security incident that has materially affected our business. See "RISK FACTORS" for a discussion of cybersecurity risks that may affect us.

companyName: OGLETHORPE POWER CORP


text: Board of Directors The Board has delegated the primary responsibility for oversight of cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews compliance and disclosure control procedures for cybersecurity matters. Members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the "CIO"), Chief Information Security Officer (the "CISO") and the Senior Vice President, General Counsel and Secretary (the "General Counsel"), provide regular updates to the Audit Committee regarding data protection and cybersecurity risks and the Company's new and existing cyber risk controls intended to mitigate them. The Audit Committee regularly briefs the full Board on these matters, and the full Board also receives briefings from management and third-party cybersecurity advisors on the Company's cybersecurity program, as appropriate. The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Audit Committee and the full Board.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Interim Chief Financial Officer and our Chief Legal Officer. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.

companyName: Fossil Group, Inc.

ticker: FOSL


text: The Advisor partners with several third-party technology providers to monitor and protect internal IT infrastructure and data. The Advisor has hired Marco Technologies as the organization's Managed IT provider with tools that systematically update hardware and software while also monitoring uptime to ensure seamless business operations. Marco Technologies also provides cyber security trainings, which all Advisor personnel are required to complete on a monthly basis. The Advisor utilizes Red Canary to provide 24/7 monitoring on all end points with triggers to isolate and mitigate any suspicious cyber activity. Finally, High Point Networks provides physical and cloud-based network data backup solutions for the Advisor. In collaboration with the Advisor, an extensive data back-up plan is in place with Return to Operations objectives of less than 24 hours. Although our CFO does not come from an information technology background, she relies on her extensive organization and project management experience to coordinate and manage the third-party providers who perform our cybersecurity function and to implement our cybersecurity incident response plan described below.

companyName: Sterling Real Estate Trust


text: To date, there have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. See the section titled "Risk Factors—General Risk Factors—A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business and operations." in this Annual Rep ort for more information.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or reported by our third-party monitoring service that may affect our information services, and have processes to assess those issues for potential cybersecurity impact or risk. We impose security requirements upon our suppliers and CROs, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.

companyName: MetaVia Inc.

ticker: MTVA


text: Our President, Product and Technology ("President of P&T"), Chief Data Officer ("CDO"), the senior-most employee responsible for cybersecurity management, and other members of our cybersecurity and audit teams, help identify, assess, and manage cybersecurity threats and risks that may affect our business and operations. To help us in assessing these threats, we use various methods, including, as applicable, using a combination of manual and automated tools, subscribing to threat reports and external intelligence feeds, conducting vulnerability assessments and penetration tests, collaborating with law enforcement, and operating a bug bounty program.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's use of third-party service providers, we conduct a security risk assessment on all proposed new third party vendors who will have access to our information and data. We have standard contractual language that we require for vendors who will have access to sensitive data.

companyName: LL Flooring Holdings, Inc.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Following this cybersecurity event, the Company immediately implemented several key learnings from the incident, including using a three-pronged approach focused on further reducing exposure, raising greater security awareness, and further strengthening the Company's cybersecurity defenses. This approach resulted in the Company further hardening its identity computing environments as part of its progress to a zero trust environment, heightened cybersecurity awareness efforts through increased comprehensive information security awareness training for employees on a quarterly basis, and the strengthening of the Company's cybersecurity defenses through implementation of multifactor authentication for Privileged Access Management and Endpoint Detection and Response solutions across the Company's computing environment.

companyName: OMNICELL, INC.

ticker: OMCL


text: We use a risk-based approach to identify, assess, protect, detect, respond to, and recover from cybersecurity threats, utilizing industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework, internal controls, and robust technological toolsets. Our information security program includes, among other aspects, penetration and vulnerability assessments and management, intrusion detection systems, antivirus and malware protection, encryption, access control, high availability and redundancy, and employee training. Risks identified by the CIO and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The CIO also routinely discusses trends in cyber risks and our strategy with our Audit Committee and management on a regular basis, in addition to an annual review and discussion with the full board.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: We have created, and assess our program against, an integrated cybersecurity framework using various National Institute of Standards and Technology (NIST) security standards, guidelines and best practices. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use various NIST security standards, guidelines and best practices to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: AMERICAN AIRLINES, INC.


text: The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. The CCO delivers quarterly reports to the Board of Directors of the Company. Team members who support the Company's information security program have relevant educational and industry experience.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: FactSet's information security program is grounded in a risk-based approach. Our information security team undertakes various activities to assess, identify and manage risks from cybersecurity threats, including managing security controls, conducting penetration testing, leading training and tabletop exercises (including an annual tabletop exercise with the ELT), and conducting internal and external vulnerability assessments. All FactSet's employees receive mandatory annual cybersecurity training; software engineers receive training on secure software development best practices; and other ad hoc training is provided to employees on the latest cyber threat landscape. In addition, we also perform quarterly "phishing simulations" to test the effectiveness of our security training program.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: We have a program for organized response in the event of a cybersecurity incident. Our Chief Information Officer receives alerts disseminated via the program and reports to the Chief Executive Officer as deemed prudent. In the event the incident rises to the level of a crisis, the cyber component of our crisis management plan is triggered. The plan guides a cyber crisis management team, including representatives from our legal, information technology, finance and operations areas, in analyzing the type, scope, cause, impact and other details of the crisis. Our analysis includes without limitation identifying affected systems and exposed data, and in making key decisions to abate, mitigate or respond to the crisis, drawing on pre-identified third-party sources of forensic and other expertise as deemed necessary or advisable. Responsive steps include oversight of any warranted or required communications, including without limitation potential outreach to law enforcement, and informing the Board or Audit Committee of the incident as required by the plan. A final step is for the team to review lessons learned during the incident with the purpose of strengthening future crisis response. The team periodically reviews and practices its protocols to enhance its effectiveness.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: We execute a comprehensive approach to cybersecurity risk management, helping ensure the data customers and other stakeholders entrust to us remains safe and secure. Our board of directors (the "Board"), Compliance Committee, and Information Security Program leaders are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established standards, policies, practices, and processes focused on identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats. To date, the Company is not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategies, results of operations, financial condition, or cash flows. However, while we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure, we cannot provide absolute assurance that any potential future cybersecurity threats or incidents will not materially affect us or our business strategies, results of operations, financial condition, or cash flows. For further discussion on cybersecurity related risks, see the "Risk Factors" section of Item 1A of this annual report on Form 10-K.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: Risks from Cybersecurity Threats From time to time, we have experienced attempts by unauthorized parties to access or disrupt our information technology systems. To date, we have not experienced any known material breaches or material losses related to cyber-attacks. However, a failure of our information systems or a cybersecurity breach could materially and adversely affect our business, results of operations and financial condition. See Item 1A, "Risks related to Cybersecurity or Misappropriation of Our Critical Information."

companyName: MSA Safety Inc

ticker: MSA


text: The Nominating and Corporate Governance Committee of our board of directors bears primary responsibility for oversight of cybersecurity risks. The Nominating and Corporate Governance Committee is briefed on cybersecurity risks at least once each year and any material cybersecurity incidents by our chief information officer and our chief financial officer, as further described below. The Nominating and Corporate Governance Committee is composed of directors equipped with diverse skills needed to oversee the difference facets of cybersecurity risks effectively, including risk management, public company leadership, innovation and technology, corporate governance and finance.

companyName: Array Technologies, Inc.

ticker: ARRY


text: The Company has also designed its information technology systems and infrastructure to protect its and its customers' data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company's operation of cardholder data environments. The Company's cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting.

companyName: CoreCard Corp

ticker: CCRD


text: Chubb management continues to prioritize investments in cybersecurity to protect the confidentiality, integrity and availability of our data. In accordance with our cybersecurity risk assessment processes, we have deployed a set of cybersecurity controls to protect Chubb. We also maintain a data security incident response plan, applied at an enterprise level, to facilitate our ability to rapidly detect and address data security incidents with the goals of: (i) minimizing risk to data and systems; (ii) quickly recovering and resuming operations; (iii) where applicable, providing timely notice of an incident to regulators and providing timely notice and remediation services to affected individuals; (iv) minimizing potential brand damage; (v) managing litigation, investigations and disputes that may arise in the aftermath of an incident; and (vi) identifying opportunities to enhance Chubb's data security approach. Consistent with our incident response plan, the CISO informs the Chief Privacy Officer, who is a member of our legal team, and they notify other members of management of significant cybersecurity incidents and provide them with regular updates on the status of such incidents, including mitigation, remediation, and steps to avoid recurrence.

companyName: Chubb Ltd

ticker: CB


text: In addition, the information security team is responsible for obtaining and maintaining Service Organization Control Type 2 ("SOC-2") certification for the Company's product portfolio. The Company has obtained SOC-2 certification for many of its products, which subjects those products to an annual compliance audit conducted by a third party, and we work to include progressively more products within the scope of the audit year over year.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management advisors, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight including by gaining valuable insights into the ever-evolving cybersecurity landscape. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: AGIOS PHARMACEUTICALS, INC.

ticker: AGIO


text: We depend on IT and OT for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.

companyName: Delek US Holdings, Inc.

ticker: DK


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We engage third-party cybersecurity and information technology ("IT") experts who work with our Chief Risk Officer and Chief Accounting Officer to review and test our IT environment, and to identify potential risks from cybersecurity threats and proactively mitigate their potential effect; the results of which are presented to management and the audit committee of our board of directors. Our team of IT experts hold various relevant certifications and have extensive experience in assessing, detecting, responding to and mitigating cybersecurity risks.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: The Company's protective technologies include firewall and email protection against malware and phishing campaigns, and information system access management solutions such as multifactor authentication (MFA). We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. The security monitoring and detection tools we utilize leverage Endpoint Detection and Response (EDR) and Security Incident and Event Management (SIEM) augmented with threat intelligence information from multiple sources. We have further enhanced the security posture of the Company by implementing data security technologies and measures to reduce the impact of attempts to steal or destroy data. These technologies are tested regularly by both internal resources and external experts that evaluate the technology and identify vulnerabilities for mitigation and/or remediation. Our security program leverages Company and third-party security professionals and services to achieve an appropriate level of security and resilience that is reviewed periodically by an IT steering committee that includes senior officers such as the CEO, CFO, Chief Legal Officer, CIO, CISO, Chief Operating Officer and Chief Technology Officer, and the efficacy of these programs is also reviewed quarterly with the Audit Committee of the Company's Board of Directors. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors cybersecurity scores of key suppliers and customers.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: Key elements of our cybersecurity program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors that have access to our critical systems and information based on our assessment of their criticality to our operations and respective risk profile.

companyName: ARDELYX, INC.

ticker: ARDX


text: As of December 31, 2023, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Director of Technology, is primarily responsible for this cybersecurity component and is a key member of Bank management, reporting directly to the Chief Operations Officer and, as discussed below, periodically to the Bank Board.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: The Markel information security and data protection program is led by a Chief Information Security Officer (CISO) who supervises a team of security and data protection professionals across the globe. Markel's global information security and data protection program leverages the Cybersecurity Framework from the National Institutes of Standards and Technology as well as industry best practices. Markel also is able to map to both ISO (International Organization for Standardization) and BSI (British Standards Institution) among other cybersecurity standards. Markel's CISO has been with Markel 14 years and has 23 years' experience in information technology, with 18 years in information technology security, and is a certified Information Systems Security Professional (CISSP).

companyName: MARKEL GROUP INC.

ticker: MKL


text: These processes include internal and external vulnerability management systems, security grading systems, scanning systems, firewalls and breach alert systems, among others. Such systems and processes are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. As part of our risk management process, we conduct monthly vulnerability scans, annual penetration testing, phishing tests, annual risk assessments, and ad-hoc application security assessments. We also maintain a variety of playbooks for our incident response plan that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity and compliance training at least annually.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: Our IT systems architecture is embedded with cybersecurity features. We utilize a range of third-party software providing layers of defense against cyberattacks, and we have employees and consultants whose jobs are to continually assess and reduce the potential attack surface, to monitor, detect and respond in near real time to incidents to minimize damage, and to enhance the security environment and scale with business needs as they evolve. We conduct continuous monitoring of our potential cybersecurity vulnerabilities and attack vectors.

companyName: Sylvamo Corp

ticker: SLVM


text: Our President and Chief Executive Officer, Senior Vice President, Chief Financial Officer and Treasurer, and Senior Vice President, General Counsel and Corporate Secretary each hold degrees in their respective fields, and have an average of over 20 years of experience managing risks at the Company and similar companies, including risks arising from cybersecurity threats.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: The Company engages third-party cybersecurity assessments to ensure an objective evaluation of its cybersecurity stance, including the effectiveness of its risk management strategies. Oversight of cybersecurity risks posed by third-party service providers is systematically managed, ensuring that all external risks are identified and mitigated. The Company did not have any material cybersecurity breaches during the year ended December 31, 2024.

companyName: T Stamp Inc

ticker: IDAI


text: We maintain the following processes to assess, identify, and manage risks from cybersecurity threats: • Ongoing Threat Assessment. We maintain multiple threat intelligence subscriptions, and we monitor relevant cybersecurity resources on an ongoing basis to identify and anticipate potential threats to our network infrastructure. • Layered Security. We use multiple tiers of security as part of our efforts to reduce our exposure to cyberattacks. We leverage and maintain perimeter network defense solutions to discourage network-intrusion attempts. Within our network, we leverage endpoint security and ransomware detection and prevention solutions, and we use continuous monitoring of alerts and activities to identify and respond to any irregularities that could be associated with threats. • Training and Awareness. We conduct awareness training for our employees as part of our efforts to enable them to identify and report cybersecurity threats. We require cybersecurity training during employee and contractor onboarding, and we seek to reinforce the training through phishing tests on at least a quarterly basis as part of our efforts to reduce the potential for successful phishing and social-engineering attacks. • Cybersecurity Tool and Processes and Industry Standards. We refer to industry standards, such as those issued by National Institutes of Standards and Technology ("NIST") and International Organization for standardization ("ISO"), as part of our efforts to maintain best practices across our environment and we use various cybersecurity tools and processes designed to manage cybersecurity threats including network and systems authentication, network and infrastructure architecture security, endpoint security, and operating system patching. • Third-Party Network Security Assessments. We engage a third-party consultant to conduct external penetration testing at least annually. Our cybersecurity processes are adjusted as needed based on the results of these assessments. The assessment results are reported to the Audit Committee and Board, and our external auditor reviews our cybersecurity solutions and posture on at least an annual basis. • Third-Party Risk Management. We conduct information-security assessments before allowing sensitive data to be hosted by third parties. We also ensure SOC-1 or SOC-2 compliance for our third party providers, including our banking, payroll, and stock-plan administration relationships.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: The Audit Committee receives reports from management on the Company's cybersecurity risks and the Company's cybersecurity program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents.

companyName: STAAR SURGICAL CO

ticker: STAA


text: Our CISO is an experienced cybersecurity senior executive with more than 25 years' experience building and leading cybersecurity, risk management, and information technology teams. In performing his role, he regularly reviews enterprise cybersecurity risks, controls, program policy and processes, including training, oversees policy and program development, implementation and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Our CISO is regularly apprised of enterprise cybersecurity events, threats and activities, including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.

companyName: RTX Corp

ticker: RTX


text: Our Board of Directors is responsible for the oversight of our information security program and establishes our information security risk appetite. The Technology Committee of our Board approves certain Bank-wide governing policies, including our Information Security Policy, as well as other standards, guidelines, and procedures for IT and information security. It also oversees the development of mitigation plans, monitors the tactical implementation of policy, and engages in detailed risk assessments.

companyName: Federal Home Loan Bank of Des Moines


text: Our cybersecurity and compliance team regularly collects data on cybersecurity threats and risk areas, monitors our systems, and conducts testing to assess our processes and procedures and the threat landscape. The CIO receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Our Chief Technology Officer, Vice President of Cybersecurity and Information Security, as well as Engineering, Legal, Risk Management teams, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, automated and manual tools, third party threat assessments and intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and the industry's risk profile, evaluating reported threats, performing internal and external audits, conducting assessments for internal and external threats, conducting assessments to identify vulnerabilities, and conducting red/blue team testing and tabletop incident response exercises jointly with external third parties.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Internal and external experts regularly evaluate our information security program, with results reported to senior management and our Board of Directors. We actively collaborate with vendors, industry experts, and intelligence and law enforcement communities to continually assess and enhance the effectiveness of our information security policies and procedures.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Coinbase Global, Inc.

ticker: COIN


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents or incurred any material expenses related to cybersecurity incidents. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors – "The Company depends on its information systems to run its business and any significant breach of or disruption to those systems could materially disrupt the Company's business" and "If the Company were to experience a significant privacy breach, it could be subject to costly government enforcement actions and private litigation and suffer significant negative publicity which could materially and adversely affect the Company's results of operations," which are incorporated by reference into this Item 1C.

companyName: MOVADO GROUP INC

ticker: MOV


text: Assessments and Audits The Company uses various methods to assess our cybersecurity maturity and IT risk management program, including periodic self-assessments and engagements of independent third-party assessors and consultants. We engaged third-party experts for the initial development of the IT risk management program, including preparation of the program charter, IT risk register, and responsibility assignment matrix. We use these external engagements to provide multiple assessments of our cybersecurity functions, including a compromise assessment, a security posture assessment, and a cyber-defense assessment.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Impact of Cybersecurity Risks We assess, on an ongoing basis, the potential impact of risks from cybersecurity threats on us and our business. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the sections titled "Risk Factors— If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" and "Risk Factors— We and the third parties with whom we work are subject to stringent and evolving obligations related to data privacy and security. These obligations include U.S. and foreign laws, regulations, and rules; contractual obligations; industry standards; and policies. Our (including the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations and actions (which could include civil or criminal penalties); private litigation (including class-action claims) and mass arbitration demands; disruptions to our business operations; adverse publicity; and other adverse consequences that could negatively affect our operating results and business."

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: In addition, the Company regularly self-assesses against its internal policies, using its internal risk assessment process and a variety of frameworks, such as the New York Department of Financial Services Cybersecurity Requirements for Financial Services Companies, the Insurance Data Security Model Law as adopted and modified by various states and the Payment Card Industry Data Security Standard.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: The cybersecurity threat landscape is dynamic and volatile and requires significant investment. To date, risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition. As discussed more fully under Item 1A, Risk Factors in this Annual Report on Form 10-K, although our processes are designed to help identify, detect, prevent, respond to, and mitigate cybersecurity risks, cybersecurity threats are rapidly evolving and we may not be able to anticipate, prevent, or detect all such attacks and there is no guarantee that a future cybersecurity incident could not materially affect our business strategy, results of operations, or financial condition.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Information Systems Security The Sponsor's CISO oversees the maintenance of an inventory of information systems ("Information Systems") employed by the Sponsor of the Trust either directly or through a vendor. Information Systems include electronic and physical systems used to store, process or transmit information either directly or through a service provider.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we: • Monitor emerging data protection laws and implement changes to our processes to comply • Conduct periodic customer data handling and use requirement training for our employees • Conduct periodic vulnerability assessments and mitigate vulnerabilities for our systems and processes that include sensitive data; • Conduct regular security awareness trainings and phishing simulation attacks • Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • Perform periodic gap analyses to review our cybersecurity controls for gaps and implement the closure actions Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: VAPOTHERM INC


text: During 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding the cybersecurity risks we face.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: The Audit Committee receives cyber-related updates from management, including our CISO at committee meetings. During meetings, our CISO updates the committee on Moderna's cybersecurity posture, potential threats and risk mitigation strategies, and the progress of the Company's cybersecurity initiatives, as appropriate. The Chair of the Audit Committee and management provide regular briefings on such matters to the full Board of Directors, as appropriate.

companyName: Moderna, Inc.

ticker: MRNA


text: Security Policy and Requirements As part of the Company's Crisis Management Plan, the Company's cybersecurity Incident Response Plan (the IRP) provides a framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to discovering, investigating, containing, tracking, mitigating, and remediating cybersecurity incidents, including a framework for elevating and reporting findings and keeping senior management and other key stakeholders informed and involved, based on assessments regarding the scope or significance of incidents. The IRP applies to the Company's extended computing environment, including electronic information resources that are owned or used by the Company and are routinely relied on to support our operations.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Our VP of Information Technology, and our management committee on cybersecurity, which includes the Company's audit committee, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The VP of Information Technology has twenty years of experience in IT on-premise and cloud infrastructure, enterprise applications, and operations across large and mid size life science companies with a focus on IT controls for compliance an security.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our designated team of IT professionals that reports to our Board of Directors, to manage the risk assessment and mitigation process. The IT team is tasked with monitoring system performance, identifying potential cybersecurity vulnerabilities, and implementing timely mitigation strategies.

companyName: QMIS TBS Capital Group Corp.


text: The oversight of our cybersecurity risk management process is integrated into our overall risk management process. Through our enterprise risk management process, which involves a broad cross-functional group across many areas of expertise and is structurally independent of our business lines, we identify and assess risk and risk-mitigation actions, including with respect to cybersecurity risks. Our Chief Information Officer ("CIO") provides oversight of our cybersecurity risk, which is addressed by a group of stakeholders that includes our information technology ("IT") and cybersecurity leadership and IT leaders within our various facilities, with cybersecurity risk input provided from this team to our senior leadership team on a regular basis. Our CIO provides key updates on risk and mitigation strategies to the Audit Committee.

companyName: SHYFT GROUP, INC.


text: Overall, the Company believes it has established a robust framework for confidentiality, integrity, and availability of information, adhering to relevant security standards, practices, and compliance requirements. In addition, the Company maintains insurance to help protect against risks associated with cybersecurity threats. The Company does not believe that any risks from cybersecurity threats have materially affected, or are reasonably likely to materially affect, the Company, including the Company's business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business and operating results." in this Form 10-K.

companyName: Penumbra Inc

ticker: PEN


text: Board oversees risk management after receiving briefings from advisors and also based on its own analysis and conclusions regarding the adequacy of our risk management processes. The Board continuously evaluates and manages material risks including geopolitical and enterprise risks, financial risks, environmental risks, health and safety risks and cybersecurity risks.

companyName: FLEXIBLE SOLUTIONS INTERNATIONAL INC

ticker: FSI


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, managed cybersecurity service providers, professional service firms, including legal counsel, forensic investigators, and penetration testing service providers.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: We have a cross-organizational steering committee, the Information Security Steering Committee ("ISSC"), that supports direction and governance of our enterprise-wide Information Security Program. The ISSC is chaired by the CISO and is comprised of accountable senior business leaders including the Chief Compliance Officer ("CCO"), Chief Risk Officer ("CRO"), legal counsel, and human resources, procurement and business segment leaders. In addition to the ISSC, we have defined risk functions to cover overall enterprise risks and information technology and cybersecurity risks, including: • IT Risk Management program led by the CISO • Compliance led by the CCO • Internal Audit led by Chief Audit Executive ("CAE") • Enterprise Risk Management programs led by the CRO • Third-Party Risk Management, comprised of business and information security leaders • IT Due Diligence, comprised of business, technology and information security leaders • Corporate Insurance Program, including cybersecurity insurance, led by the Treasurer To evaluate cybersecurity and privacy incidents and enable the Company to comply with public disclosure requirements, we have defined escalation criteria in support of our incident response processes. We have a Cyber Incident Response Taskforce, comprised of our Chief Privacy Officer, our CISO, and applicable legal counsel and business and corporate services leaders, which is responsible for reviewing such incidents and reporting relevant incidents to a subcommittee of our disclosure committee in order to assess the materiality of an incident as well as reporting to the senior leadership team, the chief legal officer, the CEO and ultimately the Board based on the facts and circumstances of an incident.

companyName: Elevance Health, Inc.

ticker: ELV


text: Our Board of Directors and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Audit Committee receives quarterly reports on information security from our SVP IT Infrastructure & Security. Additionally, Executive Leadership is briefed on information security at least quarterly by members of our IT security, compliance, governance, and audit teams. The Audit Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.

companyName: FASTENAL CO

ticker: FAST


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, financial, or competitive in nature, information related to our clinical trials and preclinical studies and information of our employees, or Information Systems and Data.

companyName: Kura Oncology, Inc.

ticker: KURA


text: –Executive Management – Technology Governance Committee: The Technology Governance Committee consists of certain members of executive management, including the Chief Accounting Officer, Chief Information Officer, Chief Commercial Officer, Chief Strategy Officer, and Corporate Vice President, IT Infrastructure Operations and Security. This committee evaluates projects involving information technology, including reviewing best practices and change management needs and communicating a company-wide approach. Therefore, the information technology department is aware of system and application implementations prior to execution to facilitate proper application and infrastructure security both during implementation and after implementation. Internal audit is notified of system and application implementations as part of this process as well. The internal audit department works with the information technology department to review information technology projects to ensure key projects are appropriately planned, designed, developed, tested, deployed and maintained, including verifying proper security both during and after implementation.

companyName: CEDAR FAIR L P


text: Our CISO provides the Audit and Risk Committee with no less than quarterly updates on the status of the Cybersecurity Program, information systems and any material security incidents, or more frequently if circumstances warrant, including on topics related to information security, data privacy and cyber risks and mitigation strategies.

companyName: Oportun Financial Corp

ticker: OPRT


text: Our cybersecurity risk management process, which encompasses regular monitoring and periodic assessments, is designed to identify and mitigate cybersecurity threats and vulnerabilities. These efforts are aligned with the broader objectives of our ERM team and are regularly reviewed and refined in consultation with our Technology Risk Committee.

companyName: HERBALIFE LTD.

ticker: HLF


text: Management and Strategy Our business operations depend on the availability, integrity, and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers, and other third parties on which we rely. We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats, and as such, have implemented and maintain a cybersecurity risk management program to assess, identify and manage risks from cybersecurity threats. This program is integrated into our overall enterprise risk management process, and is embedded in our operating procedures, internal controls, and information systems. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks involving our vendors and service providers. However, we rely on the third parties to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: 5&2 Studios, Inc.


text: Our cybersecurity team continuously monitors network activity using advanced threat detection tools. Through automated alerts, behavioral analytics, and threat intelligence, security anomalies are identified in a timely manner. Routine vulnerability scanning and independent penetration testing further enhance our ability to detect weaknesses before they can be exploited.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: We engage an external Head of Information Technology consultant to work with the company, including the Chief Operating Officer, Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us.

companyName: Equillium, Inc.

ticker: EQ


text: The Board of Directors is responsible for overseeing the Company's cybersecurity program. In connection with carrying out these oversight responsibilities, the Board of Directors delegated certain matters to the Technology Committee (the "Technology Committee") of the Board of Directors. The Technology Committee is central to the Board of Directors' oversight of cybersecurity risks and is responsible for assisting the Board of Directors in its oversight of technology and innovation strategies, as well as developing plans related to information systems and cybersecurity. The Technology Committee meets at least quarterly and is composed of three board members with diverse skills and experience, including risk management, technology, and finance, which the Board of Directors considers to be helpful in overseeing cybersecurity risks. The Technology Committee reports quarterly (and more frequently if necessary) to the Board of Directors on the activities of the Technology Committee since its last report, including material developments with respect to the risks from cybersecurity threats.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Trust underpins our mission and values and we believe that cybersecurity is important to our success. We are susceptible to a number of cybersecurity threats, including those common to most industries as well as those we face as a global media organization whose systems store and process subscriber, user, employee and other personal and Company data. We, and third parties with which we work and on which we rely, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any such third party could harm our reputation; require us to expend resources to respond to and recover from such a security incident or defend against further attacks; divert management's attention; subject us to liability; or otherwise adversely affect our business. Because of these risks, we take cybersecurity seriously.

companyName: NEW YORK TIMES CO

ticker: NYT


text: We regularly perform evaluations of our information security program and our information technology infrastructure, including through the use of tools and services for network and endpoint monitoring, vulnerability assessments and penetration testing, among other things. We have implemented security monitoring capabilities designed to alert us to suspicious activity and have an incident response program to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.

companyName: SAIA INC

ticker: SAIA


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.

companyName: Revance Therapeutics, Inc.


text: Our management team, including the Director of IT Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 20 years of Information Security experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.

companyName: Paragon 28, Inc.


text: Our Information Security Officer ("ISO") is responsible for implementing, supervising and maintaining the WISP, including the implementation of prevention measures. The ISO reports directly to the VP Network Systems/Services Engineering, who is also our Chief Information Security Officer ("CISO"). The CISO establishes the company-wide system security plan and defines the parameters of users' access privileges. The CISO has over 30 years in the network, security systems engineering fields and has been with KVH for 15 years. Before KVH, the CISO worked in the telecom and ISP spaces covering transport, design and implementations. In these roles, the CISO was responsible for all network-oriented security and developed in-depth experience on core security platforms. At KVH, the CISO has been lead on security as a service for customer implementations.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: Our Vice President - IT and IT Security manager have developed expertise in cybersecurity, data protection, compliance, enterprise architecture and design, data analytics, and digital transformation through years of experience in the information technology space. Our Vice President - IT is designated as the senior executive responsible for cybersecurity and reports directly to our CFO. She and the IT Security manager have comprehensive information technology background with over 30 years of information technology experience. These individuals are responsible for the day-to-day implementation of our cybersecurity program.

companyName: TEAM INC

ticker: TISI


text: At the direction of the Audit Committee, the CIO and SIRT monitor internal and external cybersecurity threats and review and revise the Company's cybersecurity defenses on an ongoing basis. The Company's CIO, together with other members of the SIRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; and risk management and incident response. The CIO prepares reports on IT general controls and cybersecurity metrics for the Audit Committee on a regular basis, and the CIO presents those reports to the Audit Committee and addresses any questions and concerns raised by the Audit Committee. At least annually, the Audit Committee meets with the CIO in person to discuss cybersecurity in greater detail. The Audit Committee reports to the Board regarding cybersecurity matters, and the Board addresses cybersecurity issues either directly with management or through the Audit Committee.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification. This includes notifying functional areas (such as legal and human resources), senior leadership and the board as appropriate.

companyName: VALHI INC /DE/

ticker: VHI


text: We interact with the information technology networks and systems of third parties for many aspects of our business. We consider and evaluate cybersecurity risks associated with the use of independent third-party service providers. To help UPS understand and mitigate potential cybersecurity risks, we generally utilize measures such as vendor risk assessments, periodic technical assessments of third-party vendors' controls and contracts governing the use of and access to our data and compliance with our security requirements.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: AFG has adopted the National Institute of Standards and Technology ("NIST") framework which provides a comprehensive method for developing a flexible, repeatable, performance-based and cost-effective approach to identifying and managing cybersecurity risks. The Company uses the framework to assess and improve its security posture.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity standards and practices are guided by CIS's Critical Security Controls, which provides a framework for prioritizing best practices to improve the Company's cyber security measures.


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk management, including cybersecurity. The Board receives quarterly updates to the Cybersecurity Program from the Company's management. These updates include the results of the cybersecurity risk assessments, the planning and results of the periodic testing by our third party IT and cybersecurity consultants, updates and enhancements to the Cybersecurity Program and the Incident Response Plan, and reporting of additional cybersecurity data metrics.

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: Risk Management Expertise With over 22 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company's security infrastructure. In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats. The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan. The AVP, IT Security is a Certified Information Security Manager (CISM) and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: Our cybersecurity program aims to incorporate industry best practices, including standards such as ISO 27001 and the NIST Cybersecurity Framework, and focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address cybersecurity risks, threats and incidents. Our practices include, among other things, security awareness training and simulations, technologies and processes to monitor our systems, assessments of controls, and incident response processes. We engage with industry groups and forums to stay informed of industry practices and developments. We monitor developments in the threat landscape that may affect our systems or services and assess their potential impacts on and risks to our cybersecurity posture. We engage external service providers, where appropriate and from time to time, to assist us with aspects of our program, such as assessing and testing controls, providing threat intelligence information and incident response. We also have processes in place to manage cybersecurity risks associated with third-party service providers. Certain key security controls are tested annually by independent third-party auditors. We regularly refine our cybersecurity processes as we determine necessary to address developments in the threat landscape, advance our control and technology capabilities, respond to regulatory requirements and standards, and implement improvements based on the results of internal and external assessments.

companyName: Genpact LTD

ticker: G


text: Our management team is responsible for oversight and administration of our cyber risk management program, and for informing our Board and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants who may be engaged by us for strategic cyber risk management, advisory and decision making. To the extent we utilize third-party vendors to provide information technology services for various areas, including human resources functions (e.g., payroll), we generally require these vendors to monitor and protect their information technology systems against cyber-attacks and other breaches. The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Member(s) of management brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: Quoin Pharmaceuticals, Ltd.

ticker: QNRX


text: We engage third party assessors/consultants in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We conduct vendor risk assessments before onboarding identified third-party service providers to review each such service provider's cybersecurity practices and to assess factors such as access controls, incident response capabilities, overall cyber maturity and applicable certifications.

companyName: RAMBUS INC

ticker: RMBS


text: The Company's cybersecurity risk management program also includes ongoing threat research and analysis conducted with the assistance of third parties, including on emerging threat attack vectors, tactics, actors and motivations. The Company also engages in ongoing network monitoring and has implemented a vulnerability management and patching program. Further, CPKC employs structured vetting and ongoing risk management processes to identify and mitigate cyber risks associated with the use of third-party service providers, including specifically in the area of technology.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: Information Technology and Cybersecurity Risk Management As is the case for all large companies, we are regularly subject to cyberattacks and other cyber incidents and, therefore, cybersecurity occupies a pivotal role within our risk management process. We adhere to a risk-based, multi-layered "defense in depth" approach that is dedicated to the identification, protection, detection, response, and recovery from cyber threats and incidents. We understand that a single technology, process, or business control cannot wholly prevent or mitigate all potential risks. Therefore, we employ a multitude of technologies, processes, and controls, each functioning independently but collectively forming a cohesive strategy aimed at minimizing risk. This strategy is evaluated through various means, such as frequent research and industry security briefings among our information technology group, internal and external audits, independent program assessments, control attestation reports, penetration testing, and other exercises that gauge its effectiveness. Threats and incidents connected with third party service providers are considered and managed under this process as well.

companyName: Ameresco, Inc.

ticker: AMRC


text: Systems Safeguards: We deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.

companyName: BOYD GAMING CORP

ticker: BYD


text: The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. CISO and the Chief Executive Officer ("CEO") play a pivotal role in informing the Audit Committee on cybersecurity risks.

companyName: SideChannel, Inc.

ticker: SDCH


text: Our Incident Response Program and Plan describes the major phases of an incident management lifecycle which includes the preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Qualys' 24x7 Security Operations Center ("QSOC") and CSIRT conduct Incident Response Plan testing and training on a periodic basis through tabletop exercises or simulated attack scenarios. This testing appraises our readiness to respond to such scenarios and tests the completeness and accuracy of the incident response plan. The QSOC and CSIRT teams drive these exercises to participants via various cyber security incident scenarios in the form of multiple injects. Exercise participants primarily consist of members from various Qualys departments such as security operations, IT operations, network operations, and other departments depending on the selected scenario.

companyName: QUALYS, INC.

ticker: QLYS


text: Longbridge also regularly engages third parties to perform assessments of its cybersecurity posture, including cyber risk assessments, penetration testing, user access control reviews and independent reviews of Longbridge's information security control environment and operating effectiveness. The results of such assessments, tests and reviews are reported to our Audit Committee and Board of Directors, and Longbridge adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.

companyName: Ellington Financial Inc.

ticker: EFC


text: In developing their cybersecurity programs, the Registrants are guided by various frameworks including the NIST Cybersecurity Framework, a voluntary framework that consists of standards, guidelines and best practices for managing cybersecurity risk, that is widely used by critical infrastructure industries to help determine and address the highest priority cybersecurity risks. The Registrants conduct regular internal cybersecurity audits and vulnerability assessments and regularly engage with third-party cybersecurity experts for external assessments of their cybersecurity controls, including technical, physical and social aspects, to better comprehend the scope and magnitude of active threats to the industry and nation and their potential impact on our systems.

companyName: PPL ELECTRIC UTILITIES CORP


text: Our Cybersecurity Program ("Program") is designed from a risk- and compliance-based approach for resilience and protection across our operations and the appropriate access, use, and/or disclosure of PHI and PII. Our Program employs the National Institute of Standards Technology (NIST) cybersecurity framework and strategy to deliver multi-layered defenses and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources to inform our cybersecurity efforts and allocate resources.

companyName: InnovAge Holding Corp.

ticker: INNV


text: We proactively work to address cybersecurity risk through our Digital & IT Risk Management Program, which focuses on identifying, assessing, responding to, monitoring and remediating cybersecurity-related risks. Parker's dedicated Cyber Security team utilizes the National Institute of Standards and Technology ("NIST") Cyber Security Framework as its primary resource for identifying areas of risk and benchmarking and implementing continuous improvements. Our technical security configuration employs a centrally managed, layered approach, including hardened PCs, endpoint security detection software, email security, firewall appliances, and various network security protections. We employ enhanced security measures for operational technologies and secure account management, including a secondary anti-malware solution to our existing software to bolster our company-wide defenses. Additionally, we utilize third-party security monitoring services to further improve our 24/7 monitoring capabilities. We also maintain a third-party risk management program, which includes formally evaluating new vendors at onboarding and monitoring existing vendors on an ongoing basis, designed to oversee, identify, and reduce the potential impact to Parker and our customers of a security incident at a third-party vendor, supplier or other provider.

companyName: Parker-Hannifin Corp

ticker: PH


text: We have implemented a comprehensive cybersecurity risk management strategy to evaluate, detect, and mitigate significant risks posed by cybersecurity threats. The Information Security Risk component of our overall Risk Management Policy outlines our approach to manage processes, people and technology to address and meet the ever-changing challenges in the global IT security landscape. Our program aims to safeguard our systems, data, and operations against cyber threats, maintain business continuity, ensure compliance with relevant privacy and other regulations, and fulfill our commitments to members, customers, suppliers, employees, and other stakeholders.

companyName: CSP INC /MA/

ticker: CSPI


text: Our Director of Cybersecurity leads our information security operations, with a focus on identifying, evaluating, mitigating, and reporting on IT and cybersecurity risks that have the potential to threaten Sensata's enterprise information assets and systems. Our cybersecurity and global IT strategy is regularly aligned with business leaders across Sensata through our IT Excellence Committee meetings, conducted 10 times a year, to ensure cyber, IT, and business priorities are communicated and understood throughout the organization.

companyName: Sensata Technologies Holding plc

ticker: ST


text: Maintaining the integrity and availability of our IT systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. We plan to develop and implement information securities policies and incident response plans to evaluate, identify, and handle material risks associated with cybersecurity threats.

companyName: GD Culture Group Ltd

ticker: GDC


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the service delivery; however, potential vulnerabilities to known or unknown threats will still remain and we may not be able to prevent security incidents in the future. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: Information systems and other technologies, including those related to the Corporation's information and operational technology systems, and its technical and environmental data, are an important part of the Corporation's business activities. We must comply with certain elevated contractual requirements, including those related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DOD. We continue to implement cybersecurity processes designed to align with DOD requirements, instructions and guidance and work with the DOD as needed to assess cybersecurity risk and on policies and practices aimed at mitigating these risks. Accordingly, the Company maintains processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: In 2024, the Company did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, the Company cannot eliminate all risks from cybersecurity threats, or provide assurances that it has not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors – Risks Related to Data Privacy and Information Security in this Annual Report on Form 10-K.

companyName: TIMKEN CO

ticker: TKR


text: The Company is actively engaged in identifying and managing cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical. The Company has an enterprise-wide Information Security Program ("Security Program "), which is designed to protect the confidentiality, integrity and availability of customer non-public information. The Security Program was also designed to protect our operations and assets through a continuous and comprehensive cybersecurity detection, protection and prevention program. This program includes an information security governance structure and related policies and procedures, security controls, protocols governing data and systems, monitoring processes, and processes to ensure that the information security programs of third-party service providers are adequate. Our Security Program also continuously promotes cybersecurity awareness and culture across the organization.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: We have implemented a cybersecurity risk management program designed to identify, assess and manage material risks from cybersecurity threats based on relevant industry standards. The cybersecurity program is reviewed at least annually by the Audit and Finance Committee (as defined below) and organizational leaders, as well as whenever there is a material change in our business practices or a change in applicable law that may reasonably affect our response procedures. In addition, we regularly assess the design and operational effectiveness of the program's key processes and controls, including our preparedness to respond to cybersecurity incidents that may adversely affect the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: Seagate Technology Holdings plc

ticker: STX


text: Company has designed and implemented processes to identify, address and mitigate risks from cybersecurity threats. Our current processes, which are subject to change as best practices evolve, include: maintenance of cyber security certifications (such as Cyber Essential Plus). The Cyber essential scheme is a certification scheme designed to show that an organization has a minimum level of protection in cyber security through annual assessments to maintain the certification.

companyName: Coda Octopus Group, Inc.

ticker: CODA


text: The Company's CISO is primarily responsible for management of the Company's information security program. The Company's current CISO has significant experience in information security, as do members of the information security team. The Company participates in certain industry cybersecurity intelligence and risk sharing organizations, such as FS-ISAC and the Domestic Security Alliance Council.

companyName: KEMPER Corp

ticker: KMPR


text: At least twice each calendar year, the VPIT & CISO will report on the health and status of our information security program to our Board of Directors, or a committee thereof, as well as to our Chief Executive Officer and other members of our senior management as appropriate. These reports typically include a high-level overview of current and emerging cybersecurity risks; an assessment of the organization's overall security posture; incident reports; an update on our compliance with relevant cybersecurity laws, regulations, and standards; an overview of ongoing and planned initiatives to strengthen the organization's cybersecurity defenses; and strategic recommendations.

companyName: PSYCHEMEDICS CORP

ticker: PMDI


text: The Company's board of directors is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the board of directors has delegated primary oversight responsibility (i) of the Company's general risk management framework to the Risk Committee of the board of directors and (ii) of the Company's information technology, cybersecurity risk and cybersecurity risk management to the Technology Committee of the board of directors, which was formed in the first quarter of 2025. At least one member of the Risk Committee also serves as a member of the Technology Committee. The Risk Committee previously has received, and the Technology Committee will receive on an ongoing basis, regular updates on the Company's cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Security Officer ("CISO") and the Chief Security Officer ("CSO"). The Risk Committee previously has provided, and the Technology Committee will provide on an ongoing basis, updates regarding cybersecurity risks and the cybersecurity program to the full board of directors. Additionally, awareness and training on cybersecurity topics is provided to the board of directors on an annual basis.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: The Director of Information Security provides information security updates to the IT Steering Committee and the Risk Committee. Cybersecurity metrics are reported to the IT Steering Committee monthly and to the Risk Committee on a quarterly basis. Security training is provided to all staff through targeted training overseen by the Director of Information Security. All Board members receive cybersecurity training annually.

companyName: FIRST OF LONG ISLAND CORP


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant.

companyName: Traeger, Inc.

ticker: COOK


text: As part of their oversight of our cybersecurity program, our CIO and our CISO oversee a team of cybersecurity professionals and are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO and CISO are trained information technology professionals, each of whom has earned degrees in information systems and business administration and has many years of experience in or managing global enterprise information technology at various organizations.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: The CIO chairs the SSC and oversees Primoris' cybersecurity risk management program. The CIO is supported by the head of cybersecurity, who is a direct report to the CIO. The training and experience of the head of cybersecurity includes a Harvard MBA along with professional experiences involving Forensics and Investigation, NIST controls assessments and implementation, ISO 27001 assessments and implementation, Payment Card Industry Certification, and HITRUST implementation and certification. The head of cybersecurity and the security team are responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and work across the organization to assess and prepare Primoris to address cybersecurity risks. Our head of cybersecurity and the security team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to our Incident Response Plan.

companyName: Primoris Services Corp

ticker: PRIM


text: Collaborative Approach We have implemented a comprehensive cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: The Board of Directors' Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings.

companyName: FIRST BANCSHARES INC /MS/


text: Our management team is responsible for the day-to-day management of risks we face, including our current Chief Operating Officer and Chief Security Officer. These officers are both experienced Certified Information Systems Security Professionals (CISSPs) who have more than 10 years of relevant experience in technology, security, and risk management across multiple industries, including finance and banking.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Our information security function, led by our Vice President of Information Technology ("VP of IT"), helps to identify, assess and manage the Company's cybersecurity threats and risks. This function helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of the Company's threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the information technology department, security and compliance team and product development department work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and our senior management, such as our chief executive officer, evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our board of directors, which evaluates our overall enterprise risk.

companyName: Moatable, Inc.

ticker: MTBLY