text: Our management team, including our Vice President of Operations and Information Technology and Head of Information Technology, has 19+ years of experience in cybersecurity and data risk administration, governance and technical operations, information technology enterprise architecture, and information technology management. The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: Our Executive Security Council governs our overall cybersecurity function and is responsible for developing and implementing our information risk program and managing our response to threats in collaboration with our IT and Security team, subject to oversight by our board of directors. Our Executive Security Council meets regularly regarding the risks of any cybersecurity incidents which are reported pursuant to (i) criteria set forth in our information risk program, (ii) notification criteria set forth in our contracts with third-party service providers and (iii) reports prepared by consultants, auditors, and other third parties retained by us, if necessary, to investigate cybersecurity incidents. In addition to our in-house cybersecurity capabilities, at times we also engage third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of our IT and Security team, including the third-party security firms we utilize as part of our program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.

companyName: Cottonwood Communities, Inc.

secItem: Item 1C


text: ORIX USA maintains a Cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of Cyber Incidents. The plan and run books are tested annually through Cybersecurity tabletop simulations where incident response technical, and executive team members go through real-world scenarios focused on current Cyber threats. ORIX USA's Cybersecurity incident response plan provides for escalation of identified Cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of Cybersecurity threats and incidents, assessment of Cybersecurity risk profile or certain newly identified risks relevant to our company, and evaluation of the adequacy of our Cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when the notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including BFIM and the Principal Executive Officer and Principal Accounting and Financial Officer of the Assignor Limited Partner.

companyName: BCTC IV ASSIGNOR CORP


text: The information security team is led by the CISO who has 29 years of experience in business risk management and cybersecurity. The information security team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities, and strategies including tests of our information security program, tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. Incident response teams within the SOC utilize procedures that identify escalation paths when security events are identified. Incident priorities dictate escalation of events and how they are reported from an incident commander up to the executive leadership team within Wiley as well as to the Board.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: The Company has designed this Cybersecurity and Information Technology Incident Response Plan based in part on the National Institute of Standards and Technology Cybersecurity Framework ("NIST"). Use of the framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the NIST is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's Cybersecurity and Information Technology Response Plan is led by our Chief Operations Officer, ("COO") who is responsible for the oversight and implementation of such plan. Additionally, the COO and the Information Security Manager meet with the Information Technology Steering Committee ("IT Steering Committee") on a monthly basis or more frequently as necessary to discuss, among other things, cybersecurity matters.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: As of December 31, 2023, we have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors receive annual cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: MEDICINOVA INC

ticker: MNOV


text: At a management level, our Program is led by our CISO, who reports to the Company's Chief Digital and Technology Officer. Our CISO has expertise in cybersecurity risk management through, among other things, over 30 years of information security experience, prior CISO and security leadership positions at other public companies, and certain technology and information security matters certifications. Additionally, we have a formal data privacy management committee made up of privacy professionals, operational experts and specialist legal counsel which is overseen by our Chief Legal Officer.

companyName: YUM BRANDS INC

ticker: YUM


text: Consistent with our Information Security Policies and Standards, our cybersecurity program focuses on the following areas:

companyName: BOYD GAMING CORP

ticker: BYD


text: Our CISO is responsible for developing, implementing, and maintaining our information security strategy and program, as well as reporting various cybersecurity risk matters to our IT Steering Committee, and the Board's Innovation Committee. The Innovations Committee is a subset of the full Board of Directors which receive regular updates on our cybersecurity program.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: Both the Audit Committee and the ESG Committee report to the full Board regarding their activities, including those related to our cybersecurity risks and program. The full Board also receives briefings from management at least once a year on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics presented by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO").

companyName: NOVANTA INC

ticker: NOVT


text: The CISO assesses cyber risk and provides recommendations for management decision(s) by the ORC on a routine basis. The CISO briefs the Audit Committee on a quarterly basis. These updates include compliance with applicable regulations as well as current or planned changes to the regulations, an overview of the current cyber threats, risk management activities, and discussions of cyber incident investigations that warrant the attention of the Board. The CISO also provides an annual update to the entire Board of Directors on changes in cybersecurity, top threats facing the Company, key risks and mitigation efforts, and any potential material cybersecurity incidents. The Chair of the Audit Committee also provides a quarterly report to the Board on any information security topics presented to the Audit Committee by management.

companyName: GLOBE LIFE INC.

ticker: GL


text: The Incident Response Team (IRT) at our company is a specialized, multidisciplinary group empowered to act swiftly and effectively in managing and communicating cybersecurity incidents. The IRT operates under a comprehensive incident response plan, detailing the procedures for preparing, detecting, responding to, and recovering from cyber incidents. This includes triage, severity assessment, escalation, containment, investigation, and remediation processes, in addition to meeting legal requirements and minimizing damage to the brand and reputation. Regular tabletop exercises are conducted to simulate cyber incidents, enhancing our response strategies, plans, and technology.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: We utilize specialized third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external cybersecurity experts and vendors to augment our internal security team. Through these third-party services, our detection capabilities include, but are not limited, to, real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide real-time alerts, log aggregation, and threat intelligence feeds, which are integrated into our incident response platform.

companyName: NEWMARKET CORP

ticker: NEU


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. To mitigate the aforementioned consequences of cybersecurity incidents, we carry cyber attack insurance. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Apogee Therapeutics, Inc.

ticker: APGE


text: Our cybersecurity risk management program, which is part of our overall risk management function, comprises processes for assessing, identifying and managing material risks from cybersecurity threats, including the following:

companyName: Paylocity Holding Corp

ticker: PCTY


text: Our CISO heads the Information Security Team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business. The Information Security Team covers a wide range of cyber and information security responsibilities. Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks. In addition to our internal capabilities, we also engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks. Risk Management and Strategy.

companyName: GARTNER INC

ticker: IT


text: As part of our corporate governance process, the Board, along with the Audit Committee, oversee our risk management process, which includes cybersecurity and related risks. Our CISO periodically meets with the Board and Audit Committee to inform and update them on our cybersecurity program.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We cannot, however, eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the disclosure in Item 1A. Risk Factors under "Operational Risks—Failure, inadequacy, breach of, or unauthorized access to, our information technology systems or those of third-party service providers or customers could negatively affect our business and operations."

companyName: CF Industries Holdings, Inc.

ticker: CF


text: Risk Management & Strategy. AVD has adopted a comprehensive set of controls and processes to encourage a high level of awareness of, and responsiveness to, cybersecurity threats. The foundational document outlining the program is embodied in Registrant's Enterprise Information Security Policy (the "REIS Policy"). The REIS Policy establishes a framework for the continuous monitoring of its computing resources, the maintenance and reporting of audit logs and the assessment of events that could form the basis of a threat. In addition, the REIS Policy sets forth requirements for employee awareness training, user authentication, software usage restrictions and boundary protection, among other things. The policy also establishes an incident response plan, including back-up hosting, alternate processing and system recovery, along with assignment of responsibility and resources for those activities. Within the exhibit of the REIS Policy, management either working alone or, in case of greater complexity, with consultants, will assess an incident or series of incidents for materiality, taking into account the nature of the incident, duration, the nature of data compromised, and the nature of damages (including with respect to reputational, third party, share price, and business interruption) and all within the context of the Company's financial performance during the affected reporting period(s).

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: We have endeavored to implement physical access controls to prevent access to endpoints that may leave Company data vulnerable to attack. We have also sought to implement systems to prevent encrypted information from bypassing certain Company-defined information control mechanisms and have also sought to purge or wipe information from certain Company-defined endpoints after consecutive, unsuccessful logon attempts or other indicators of unauthorized access.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: With respect to cybersecurity, the audit committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. In addition, TPG's chief information security officer briefs the audit committee on TPG's information security program and cybersecurity risks at least annually, and will brief the audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Annual briefings of the audit committee by TPG's chief information security officer typically include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: Furthermore, as part of our normal business activities, we collect and store common confidential information about customers, employees, vendors, and suppliers. This information is entitled to protection under a number of regulatory regimes.

companyName: Ispire Technology Inc.

ticker: ISPR


text: The CISO plays an important role in the prevention, detection, mitigation, and remediation of cybersecurity incidents and in informing management, the Risk Committee and the Board of Directors on cybersecurity risks and issues. The CISO provides quarterly briefings to the Risk Committee on any significant information security issues, relevant cybersecurity metrics and the status of the Company's security-related strategic initiatives. As discussed above, the CISO also provides mid-year and annual reports to the full Board of Directors regarding the state of the Company's information security program. The annual reports encompass a broad range of topics, including: Confidentiality of nonpublic information and the integrity and security of the Company's information systems; Cybersecurity policies and procedures; Material cybersecurity risks;

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: The CISO is responsible for management of cybersecurity risk and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has served in various information technology and security leadership roles for over 20 years, including serving as the Chief Information Security Officer at 8x8 Communications and Lam Research Corporation. He holds a B.S. degree in Information Technology from the University of the Pacific and an M.B.A. from the University of Southern California.

companyName: RingCentral, Inc.

ticker: RNG


text: Our audit committee has oversight over cybersecurity risks. With the input of the executive team, the Vice President provides annual presentations to the audit committee on our cybersecurity program, including updates on cybersecurity testing and assessments, cybersecurity risks, and related cybersecurity strategy as applicable. The management team will also update the full board of directors on matters related to cybersecurity as needed.

companyName: Korro Bio, Inc.

ticker: KRRO


text: To protect our technology systems from cybersecurity threats, we use various security tools that help prevent,identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors.

companyName: Smart Sand, Inc.

ticker: SND


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, external legal counsel, and dark web monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, which includes reviewing vendor security audits and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Vor Biopharma Inc.

ticker: VOR


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. In the event of an attack or other intrusion, we have a response team of internal and external resources engaged and prepared to respond. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues. We plan to continually invest in efforts to enhance data security in response to developments in the cybersecurity landscape.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: We periodically engage third parties to conduct risk assessments, including penetration testing, tabletops and other system vulnerability analyses. As a result of these assessments and testing, we have not identified any material cybersecurity risks and are constantly hardening our environment. Additionally, our program includes annual cybersecurity training for all employees. Our Board of Directors ("Board")

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks.

companyName: Greenwich LifeSciences, Inc.

ticker: GLSI


text: Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we face numerous and evolving cybersecurity threats in our business. For more information about the cybersecurity risks we face, see the risk factor entitled "We, our business partners or our third-party vendors could experience a material failure or breach of a key information technology system, network, process or site" in Item 1A. Risk Factors.

companyName: STRYKER CORP

ticker: SYK


text: Oversee Third-Party Risk We conduct security risk assessments on proposed software, hardware, and third-party technology solutions used by CenterPoint Energy, including a diligence review of enterprise and security architecture, vendor security, and a privacy impact assessment when deemed appropriate. These assessments evaluate these technologies prior to deployment in CenterPoint Energy's network environment. Further, we maintain a vendor risk management program, a component of which assesses the maturity of certain third parties and their cybersecurity and data privacy programs to help protect information shared with approved third parties. We also leverage third-party cybersecurity ratings of companies to inform our risk rating when conducting these assessments. Additionally, CenterPoint Energy imposes contractual obligations on vendors and other third-party business partners related to privacy, confidentiality, and data security based on their access to our data and systems and the nature and sensitivity of the data and systems. Such contractual provisions may specify the measures and safeguards that the parties must implement to protect our data from unauthorized access use, disclosure, modification, or destruction.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. These policies and processes are intended to protect the confidentiality, integrity, and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of IT systems, and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.

companyName: Sabine Pass Liquefaction, LLC


text: On behalf of the Board, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee regularly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities, and compliance with cybersecurity and privacy laws and regulations. The Company's Vice President, Information Security and Privacy, briefs the Audit Committee quarterly, and more often, if necessary, on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: Our information assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our IS and IT teams meet to ensure that risks are timely identified, patches and vulnerability requirements are monitored, and the necessary changes are implemented.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: Our cybersecurity function is overseen by our COO/ IT Manager who has over 9 years' experience managing such functions. IT functions are also managed through our IT Committee which is comprised of several senior level executive officers and other Company employees and chaired by our COO/ IT Manager. The IT Committee governs all IT functions at the Company and selects, monitors and manages our third-party IT service providers that implement and maintain our cybersecurity functions.

companyName: Bank7 Corp.

ticker: BSVN


text: Our Information Security team has deployed a structured and measured vulnerability management program that proactively identifies vulnerabilities across our platforms and processes. The program is composed of the following: • Internal persistent scans and external monthly scans; • Static and dynamic software custom code to develop scans for secure code development; • Periodic third-party executed penetration tests and risk assessments; and • A model to comply with SOC 2 Type II standards or other industry certifications at certain offices based on an office's contractual agreements with carrier partners or other third parties.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: Alignment's cybersecurity organization is led by David MacLeod, our Chief Information Security Officer, who is responsible for the prevention, detection, mitigation, and remediation of cybersecurity incidents and reports to Robert Scavo, our Chief Information Officer, as well as to the Audit Committee. Mr. MacLeod has served as our CISO since December 2022, has over 25 years of diverse leadership experience in the healthcare information space (including over 20 years as a certified information systems security professional and chief information security officer) and holds advanced degrees in information technology management and computer science.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: Report. Following the conclusion of a security investigation, the SIRT prepares a report for the Information Security Governance Committee, as appropriate. The report includes information about the incident, details about the response and includes recommendations to prevent similar security events from occurring in the future. Additionally, the Information Security Team provides the Audit Committee and the Board with regular updates on cybersecurity matters, including recent cybersecurity threats and incidents and ongoing efforts to prevent, detects and respond to internal and external cybersecurity threats.

companyName: Cars.com Inc.

ticker: CARS


text: We have an information technology cybersecurity incident response plan to manage cybersecurity incidents. The plan provides guidelines for actions in response to cyber security incidents that may occur at or otherwise affect Atmos Energy. These guidelines include notification to a cross-functional management team to assess incident materiality and an escalation process to members of our senior management team and our Board of Directors. This plan, which is periodically reviewed and tested, is supported by third parties to provide guidance and support to our cybersecurity management team.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: Our Chief Risk Officer ("CRO") periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CRO on our cybersecurity risks, including briefings on our cyber risk management program. A potentially material cybersecurity incident would be immediately reported to the Audit Committee and management would continue to brief the Audit Committee on management's response to the cybersecurity incident. Audit Committee members also receive periodic presentations on cybersecurity topics from our CRO, supported by our information technology staff, or external experts as part of the Board's continuing education on topics that may affect public companies.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: Our Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense program. This endpoint program is monitored 24/7 and would notify IT staff of an incident. Most incidents would be mitigated by monitoring staff of the endpoint program, but IT staff would have to be involved in more severe incidents. This mitigation is resolved from an always updating database. In severe cases, the device that triggers the incident would be locked down and a plan of action would be put in place. The second line of defense is a monitored firewall. This would also notify IT staff of an incident. Last line of defense is IT Staff. The department is augmented by an information security specialist that is on a monthly retainer. Individuals within the department are generally subject to professional education requirements.

companyName: Southern States Bancshares, Inc.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: MP Materials Corp. / DE

ticker: MP


text: We deploy advanced firewalls, endpoint protection, and intrusion detection systems to secure our network infrastructure. Multi-factor authentication and encryption are enforced across critical systems and data repositories. IT manager. Response: We maintain an incident response plan that outlines procedures for containment, eradication, and recovery from cybersecurity incidents.

companyName: Quality Industrial Corp.

ticker: QIND


text: Helios' Global Head of Information technology is an active member of InfraGard and has formal education in information technology with over 25-years' experience in roles involving management of cybersecurity functions, cyber strategy, and leading and collaborating on information systems and related technologies. The Global Head of Information Technology receives regular updates on cybersecurity developments, results of mitigation efforts and cybersecurity incident response and remediation.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Our board of directors is responsible for risk oversight, including cybersecurity risks, which occurs at the board of directors level and through the audit committee's (the "Audit Committee") oversight of cybersecurity and other information technology risks. Additionally, we have a Cybersecurity Disclosure Committee ("CDC"), which includes representation from our Information Technology, Legal, Internal Audit, and Accounting and Reporting teams. The CDC is responsible for assessing the materiality of cybersecurity incidents based on quantitative and qualitative materiality factors, and for providing recommendations on public disclosures of cybersecurity incidents to the Audit Committee if an incident is identified to be possibly material. The CDC also provides input and consideration into internal controls surrounding cybersecurity along with reviewing cybersecurity risks, mitigation strategies, and ensuring the cybersecurity strategy is in alignment with business objectives.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: Our Board of Directors has ultimate oversight of cybersecurity risk as part of its risk management oversight responsibilities, including with respect to cybersecurity risk priorities, resource allocation and oversight structures. The Board of Directors receives an update on our cybersecurity program on an annual basis, or more frequently as determined to be necessary or advisable. The Board of Directors has delegated risk management oversight responsibility for information security and data protection to the Audit & Finance Committee, which regularly reviews our cybersecurity program and related matters with management and reports to the Board of Directors. Topics discussed at the board level include our approach to cybersecurity risk management, key initiatives, the threat landscape and recent developments and trends. The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.

companyName: NIKE, Inc.

ticker: NKE


text: Our management team stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Atai Beckley N.V.

ticker: ATAI


text: Despite our efforts with respect to information technology operations, cybersecurity and data privacy, we have been, and may continue to be, impacted by breaches in data security and lapses in data privacy, which occur from time to time. During fiscal year 2024, the Company did not experience any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: RBC Bearings INC

ticker: RBC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Cybersecurity and Privacy— If we or our third-party providers sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences. "

companyName: Vroom, Inc.

ticker: VRM


text: Our Vice President, Technology and Digital Health, serves as our Head of Cybersecurity and is responsible for developing and executing our cybersecurity strategy and program. We also maintain a team of cybersecurity professionals who are responsible for security operations and report to the Head of Cybersecurity, who has more than 20 years' experience in cybersecurity and information technology infrastructure and operations.

companyName: Alector, Inc.

ticker: ALEC


text: The Director of IT and General Counsel are responsible for helping to identify, assess and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our and our industry's risk profile, and subscribing to reports and services that identify cybersecurity threats.

companyName: Origin Materials, Inc.

ticker: ORGN


text: Moreover, our commitment to robust risk management extends to the maintenance of a comprehensive Security Incident Response Plan ("SIRP"). This SIRP serves as a framework for effectively addressing and mitigating security incidents. Within this plan, we integrate accessible resources to fortify our response capabilities. This includes establishing collaborative partnerships with insurance providers, regulatory agencies, and law enforcement agencies, ensuring a seamless and coordinated approach in the event of a security incident. Recognizing the interdependence of our practices with service providers and vendors, we actively engage with our partners during the notification and investigation processes following a security incident. This collaborative effort is designed to foster complete visibility into the nature and scope of security risks and events, enabling a unified and effective response.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: Our Board is ultimately responsible for the oversight of risk management strategy, business plan and management of financial resources. As part of these responsibilities, the Board is apprised, annually and as needed, of developments in the external environment and business strategies that present increased cyber risk exposure to the Company. On a weekly basis, The Vice President of Management Information Services ("VP of MIS") meets with the Chairman of the Board of Directors, President and Chief Executive Officer ("Chairman, President and CEO"), to discuss developments with the Company's IT environment, including its cybersecurity program. The Chairman, President and CEO would then inform the Board of those developments, as needed. The Board has delegated oversight of cybersecurity risk management to the Audit Committee of the Board of Directors.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: Our audit committee has oversight over cybersecurity risks. With the input of the executive team, the Executive Director provides annual presentations to the audit committee on our cyber program, including updates on security testing and assessments, cyber risks, and related cyber strategy as applicable. The management team will also update the full board of directors on matters related to cybersecurity as needed.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: Cybersecurity Procedures The Sponsor has adopted procedures to implement the cybersecurity policy applicable to the Trust, which include the following:

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: One of the tools used by management and our Board of Directors in managing business risks is an annual enterprise risk management (ERM) assessment to identify and manage key existing and emerging risks our company faces. Our ERM process is designed to identify significant risks relevant to the company and assess the characteristics and circumstances of the risks to identify both the potential impacts to our company of a particular risk and the velocity with which the risk may manifest. Cybersecurity is among the risks identified in our ERM assessment and has been embedded in the Company's operating procedures, internal controls and information systems. In addition to our overall ERM process, we have developed and implemented a cybersecurity risk management program and processes intended to detect, assess, manage, and develop resiliency against material risks from cybersecurity threats. Our cybersecurity program utilizes a risk-based approach and includes written cybersecurity and information technology processes and procedures, including a cybersecurity incident response plan that involves procedures for responding to cybersecurity incidents. We design and assess our program informed by various cybersecurity frameworks, such as the National Institute of Standards and Technology (NIST) and leverage a widely-adopted risk assessment model to identify, measure and prioritize cybersecurity and technology risks. The goal of our program is to prevent, identify, escalate, investigate, resolve and recover from identified incidents and security incidents in a timely manner.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Monitor Cybersecurity Incidents The Vice President of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In cooperation with the Vice President of IT, the Director of IT Infrastructure and Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we plan to implement a process to review risks to our Company in connection with certain third-party providers and vendors, which we expect will involve assessments through vendor questionnaires, as appropriate.

companyName: enGene Holdings Inc.

ticker: ENGN


text: The Company's Board of Directors (the "Board"), in coordination with its Audit Committee, oversees the Company's overall ERM process, and has delegated the management of risks arising from cybersecurity threats to the Security & Technology Committee, which regularly interacts with the Company's Chief Security Officer ("CSO"), Chief Information Officer ("CIO"), the Chief Privacy and Regulatory Compliance Officer, Chief Legal & Risk Officer, and other members of management. The Security & Technology Committee receives regular reports on the Company's cybersecurity risks, vulnerability assessments, third-party and independent reviews, among other relevant information.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Use of Consultants and Advisors In addition to our in-house capabilities, we engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information. We partner with a third-party provider specializing in endpoint security and monitoring. This partnership enhances our overall security posture by providing advanced incident response capabilities. This collaboration ensures that any potential threats are quickly identified and managed, adding an extra layer of security to our existing infrastructure.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Cybersecurity risk is an important and evolving focus for the Company, due to its small size and limited resources, the Company is unable to devote any internal resources to cybersecurity and relies entirely on its vendors, for email, e-commerce, order management, purchasing/direct shipping, financials, inventory, warranty and returns and remote access, for assessing, identifying and managing material risks from cybersecurity threats whose collective security efforts are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage. Company's vendors have implemented measures and controls reasonably designed to address cyber attacks, including enhanced threat monitoring.

companyName: AIRWA INC.

ticker: YYAI


text: Our head of the ITS Department oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. We have set up processes by which our executive management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: Our business operations depend significantly on third party service providers. We have processes in place to evaluate the operational and cybersecurity risks posed to us by third parties on whom we are reliant for these services at the inception of our engagement, and we continuously monitor third-party firms that pose the greatest risks to our business and operations from cybersecurity threats. Nonetheless, we rely on the third parties we use to implement security programs commensurate with their own risk, and we cannot ensure that their efforts will be successful.

companyName: AGNC Investment Corp.

ticker: AGNC


text: Board of Directors and Audit Committee receive regular reports from the Company's Cybersecurity Risk Management Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Board of Directors and Audit Committee also receive various reports, summaries and presentations related to cybersecurity threats, risk and mitigation.

companyName: GENELUX Corp

ticker: GNLX


text: While we are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this Annual Report on Form 10-K. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services and loss of investor confidence.

companyName: CorMedix Inc.

ticker: CRMD


text: Our Board of Trustees is responsible for understanding the primary risks to our business. The audit committee of our Board of Trustees is responsible for reviewing the Adviser's IT security controls with management and evaluating the adequacy of our and the Adviser's IT security program, compliance and controls with management.

companyName: New Mountain Net Lease Trust


text: Additional information about our risk management governance and structure, including enterprise risk management, as well as information technology specific risk management and governance, is provided under the "Governance and Structure" and "Information Technology Risk Management" sections of Risk Management included in Item 7, Management's Discussion and Analysis in this Form 10-K.

companyName: STATE STREET CORP

ticker: STT


text: monitoring internal and cloud-based systems for threats; email filters; cybersecurity awareness training; limitation on the use of third-party devices; conditional access rules; and regular evaluations of our cybersecurity program.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: Dominion Energy's Board of Directors, including its operations committee (effective in July 2024, previously its finance and risk oversight committee), provides oversight of risks from cybersecurity threats to all Dominion Energy operations, including DESC. Dominion Energy's Board of Directors as well as its operations committee (effective in July 2024, previously its finance and risk oversight committee) receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity (CISO) and chief information officer. These presentations and reports address a broad range of topics, including Dominion Energy's cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2024 of its third practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including assessments by independent consulting firms and legal counsel of the Company's readiness and resilience.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Technology, Compliance, and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Cyber Risk Management Personnel The IT Technician directly reports to senior management. The IT Technician regularly meets with senior management to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the board of directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, information related to our clinical trials, and information of our employees, or Information Systems and Data.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: Our Board of Directors provides oversight of our enterprise-wide risk management, which includes cybersecurity risk-management, and the Audit Committee assists the Board with oversight of cybersecurity matters. The VP IT reports on cybersecurity matters to senior management on a regular basis and to the Audit Committee at least annually, and more often if needed. The Audit Committee, in turn, makes periodic reports to the Board on relevant cybersecurity matters.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.

companyName: MAIA Biotechnology, Inc.

ticker: MAIA


text: We purchase insurance to mitigate the potential financial consequences of cybersecurity incidents. We regularly review our cyber insurance program, assessing our coverage and policy terms.

companyName: Aramark

ticker: ARMK


text: While we have not, as of the date of this 2024 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See "Risk Factors" for more information on our cybersecurity risks.

companyName: CROWN CASTLE INC.

ticker: CCI


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures, processes, standards, and policies designed to manage and mitigate such risks and potential material impacts to our Information Assets. The various risk management and reduction measures we implement for certain areas of our environment and systems include: maintaining policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; conducting internal and external audits designed to assess our exposure to certain cybersecurity threats, compliance with internal risk mitigation procedures, and effectiveness of relevant controls; conducting background checks on certain of our and our third parties' personnel; adopting network security controls in certain environments and systems; segregating certain data; adopting physical and electronic access controls and; asset management procedures monitoring certain systems; implementing a vendor risk management program; training employees on security; conducting red/blue team exercises; maintaining cyber insurance; maintaining a dedicated information security staff; and using a third-party managed security operations center. We seek to prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as exposure of customer data, interruption of services, ransomware, intrusion of networks, and data exfiltration or exposure.

companyName: Grindr Inc.

ticker: GRND


text: Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Infrastructure Co LLC


text: We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO and General Counsel, Audit Committee and the Board. Our Incident Disclosure Committee has defined processes to determine whether a cybersecurity incident is material and may require disclosure in SEC filings.

companyName: CINTAS CORP

ticker: CTAS


text: We design and assess our program using several industry-leading frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI-DSS'), and SOC2. With regards to the NIST CSF, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Eventbrite, Inc.

ticker: EB


text: T he full Board, at least annually, and the Audit Committee of the Board, generally quarterly, receive reports on our cybersecurity program and developments. These reports include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity. It is anticipated that Audit Committee oversight will include review of periodic tabletop exercises to test cybersecurity infrastructure and incident response measures.

companyName: Rimini Street, Inc.

ticker: RMNI


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. Our security efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cybersecurity threat landscape.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: Information Asset Protection Our Information Asset protection policy and procedures enables the management, control, and protection of Information Assets from unauthorized disclosure, theft, loss, destruction, unauthorized alteration, unauthorized access, and the denial of availability, all of which could have a direct and significant impact on the future success of the Company. Protection of Information Asset supports the efficient and effective management, control, and protection of our business information and the business information entrusted to us by our customers and external business partners. All Information Asset protection policies and procedures must also be viewed in the context of our obligations to comply with government requirements, such as those related to the protection of personal data, and compliance with our contractual obligations.

companyName: Clene Inc.

ticker: CLNN


text: Management of risks, including risks of cybersecurity threats, is delegated to the Company's Head of Information Security, who reports administratively to the Chief Information Officer and has informal reporting relationships with the General Counsel and Chief Audit Executive. The Head of Information Security has over 30 years of information technology and security experience with assessing and managing cybersecurity threats and is responsible for the day-to-day information security program objectives. The Head of Information Security is also responsible for attending quarterly Audit Committee meetings and reporting results of the cybersecurity program to the Audit Committee, including results of preventative activities (e.g. endpoint protection, security training), ongoing monitoring activities (e.g., vulnerability testing), and remediation activities (e.g., issues identified through audits and assessment activities).

companyName: NeueHealth, Inc.

ticker: NEUE


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our information systems and data.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: We use third -party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. Our board of directors addresses our cybersecurity risk management as part of its general oversight function.

companyName: BOSTON OMAHA Corp

ticker: BOC


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity, to the extent material. The full board of directors may also receive briefings from our management team directly on our cybersecurity risk management program, such as presentations on such cybersecurity topics that impact public companies from our Chief Technology Officer and internal security staff.

companyName: GigaCloud Technology Inc

ticker: GCT


text: Our Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, oversees the proper functioning of our cybersecurity risk management program and ensures strategic alignment and governance of our cybersecurity efforts at the highest level. Our Board of Directors receives periodic briefings on the outcome of our cybersecurity risk management program, including steps that we are taking to mitigate risks that the program identifies, and each quarter, the Audit Committee reviews cybersecurity incidents, metrics and the state of the program.

companyName: ACCURAY INC

ticker: ARAY


text: Board Roles and Responsibilities The Audit Committee of the Board of Directors oversees the Company's cyber risk management program. The Chief Information Officer (CIO) presents frequent updates to the Audit Committee and, as necessary, to the full Board of Directors. These regular reports include detailed updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. In addition, we have established processes to notify the Audit Committee of active incidents, as deemed necessary. The Company's program is periodically evaluated by third-party experts, and the results of those reviews are reported to the Board of Directors.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: The ALLETE board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which assists the Board in fulfilling its oversight responsibilities regarding the Company's policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing the Company's information security policies and internal controls regarding information security; and reviewing the Company's annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the Company's cybersecurity program and receives quarterly updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends.

companyName: ALLETE INC

ticker: ALE


text: The Audit Committee receives regular briefings from the CIO regarding the Company's cybersecurity program, cyber threats, and the results of exercises and response readiness assessments performed by outside advisors that assess our cybersecurity program and internal response preparedness, and to receive periodic briefings on cyber threats and our cybersecurity program. The full Board meets with the CIO at least annually to review the Company's cybersecurity program.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: The cybersecurity program and related risks are also discussed with the full Board of Directors as part of the review and discussions around the topic of risk management and the risk oversight framework that generally take place at the 3rd quarter Board of Directors meeting.

companyName: Zumiez Inc

ticker: ZUMZ


text: We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory yearly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. As noted above, our RSC also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The RSC escalates events, including the Interim Chief Operating Officer and Board of Directors, as relevant, according to pre-defined criteria.

companyName: HARTE HANKS INC

ticker: HHS


text: Impact of Material Risk We have not experienced a material cybersecurity incident; however, financial institutions face risks from threat actors that focus on attacks of critical information systems infrastructure assets, disruption to operations, and ransomware groups that steal data, encrypt systems, and demand a payment. The Company relies on third-party software, third-party hardware, and third-party vendors to manage critical aspects of our operations which may be at risk of cybersecurity threats. Although the Company has implemented cybersecurity policies, procedures and controls intended to mitigate these risks and the likelihood of these risks occurring may not be high, if these risks are realized the impact could be material, such as in the event of a material cybersecurity incident.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: Our information security program is enterprise-wide and includes cross-functional coordination between various departments across the Company including Information Security, Technology, Privacy, Enterprise Risk Management, and Internal Audit. The structure of our information security program is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework to organize processes and tools to identify, protect, detect, respond, and recover from threats and events.

companyName: NCR Voyix Corp

ticker: VYX


text: Board's Roles and Responsibilities The governance of cybersecurity within our is structured to ensure a clear delineation of oversight responsibilities. The Board of Directors, particularly through its Audit Committee, plays a crucial role in supervising our cybersecurity posture. The Audit Committee is composed of individuals with deep expertise in risk management, finance, and technology, enabling it to provide informed oversight of cybersecurity risks. Periodic briefings that are held ensures that the Board of Directors remains actively engaged in guiding and evaluating our cybersecurity strategy.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: We view cybersecurity as a shared responsibility. Our employees are trained through annual security training, regular phishing simulations, and frequent communications about cybersecurity threats.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: The Company engages external independent parties to perform independent audit engagements, as well as other assessments of the Company's information security and third-party risk management program and information systems. Material findings and recommendations arising from these assessments are reported to the Audit Committee of the Board of Directors.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Our Audit Committee is actively involved in our cybersecurity oversight and under our new Cybersecurity Policy adopted on March 11, 2024, will receive detailed briefings from our external cybersecurity expert.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: The CIO and VP of Information Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include but are not limited to risk assessments, including with the support of external advisors, briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: As of the date hereof, the Company and our service providers have not experienced cybersecurity incidents, and we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to our business. These measures cannot provide absolute security. No security measure is infallible. See " Risk Factors - Unauthorized disclosure, destruction or modification of data, including personal information, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted and costly litigation and damage our reputation." for additional information about the risks to our business associated with a breach or compromise to our systems.

companyName: STRATEGIC ACQUISITIONS INC /NV/

ticker: STQN


text: Our operations rely on the secure processing, storage, and transmission of personal, confidential, and other information. Our business, including our ability to adequately price products and services, establish reserves, provide an effective and secure service to our customers and report our financial results in a timely and accurate manner, depends significantly on the integrity, availability, and timeliness of the data we maintain, as well as the data held by third party service providers. The Company manages cybersecurity risk via expectations set by its Information Security and related policies, real-time monitoring of threats, and recovery where needed through incident response plans.

companyName: Employers Holdings, Inc.

ticker: EIG


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Flywire engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments and consultation on security enhancements.

companyName: Flywire Corp

ticker: FLYW


text: Two key enabling bodies, ASGN's Enterprise Security Council and the Security Operations Center ("SOC"), have primary responsibility for our overall cybersecurity risk management program and provide the structure necessary to set policy and direction as well as operationalize our required security posture.

companyName: ASGN Inc

ticker: ASGN


text: The Risk and Compliance Oversight Committee of our Board of Directors (the "RCOC") is responsible for overseeing and reviewing AppFolio's cybersecurity program and cybersecurity risk exposure and the steps taken to monitor and mitigate such exposure. The RCOC updates the full Board of Directors on cybersecurity matters as appropriate.

companyName: APPFOLIO INC

ticker: APPF


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and a dedicated "Grid University" training department. Personnel at all levels and departments are made aware of our cybersecurity policies through multiple channels of communication and training.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party computer support firm to assist with network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.

companyName: Transcode Therapeutics, Inc.

ticker: RNAZ


text: Role of the Board Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. In general, our Audit and Finance Committee of our Board of Directors has primary responsibility for and oversight over cybersecurity threats and our information security management program and considers specific risks, including, for example, risk associated with our strategic plan and business operations. The Audit and Finance Committee receives regular reports from our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering, on, among other things, material cybersecurity threat risks or incidents and developments, assessments of our security program and overall security posture, our incident response plan, and initiatives to strengthen our information security systems and mitigate cybersecurity risks. The Audit and Finance Committee, including Rashmi Kumar, provides insights and guidance to management on cybersecurity related matters. Ms. Kumar, who currently serves as Senior Vice President, Chief Information Officer, of Medtronic plc, is a seasoned technology leader with extensive experience in cybersecurity and information technology matters. Management, along with the chair of the Audit and Finance Committee and Ms. Kumar, regularly report to the Board of Directors on cybersecurity risks and other related matters reviewed by the Audit and Finance Committee.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: We utilize dedicated internal and external cybersecurity personnel to focus on assessing, detecting, identifying, managing, preventing and responding to cybersecurity threats and incidents. Our approach to cybersecurity incorporates a layered portfolio of technology controls, including strategic partnerships for our cybersecurity platforms, documented policies and procedures, end user training and dedicated resources to manage and monitor the evolving threat landscape, including through the gathering of actionable threat intelligence. We maintain and periodically evaluate and, as needed, update our information security policy and an incident response plan, which describes the processes we use to prepare for, detect, respond to and recover from a cybersecurity incident, including processes to assess severity, escalate, contain, investigate and remediate an incident, as well as to comply with potentially applicable legal obligations.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage or security breach.

companyName: Disc Medicine, Inc.

ticker: IRON


text: SEC mandates through Item 106 of Regulation S-K that public companies, such as Blue Chip Capital Group, Inc. must acknowledge the financial implications of cybersecurity risks in their disclosures. This requirement stems from the understanding that cyber incidents can lead to significant material costs, affecting a company's financial condition and, consequently, its investors. The Company believes that at this stage of its development, with no active operations being conducted other than start-up activities principally related to the Raisewise subsidiaries' initial compliance with registration and regulatory protocols, it is not exposed to cybersecurity risks.

companyName: Blue Chip Capital Group Inc.


text: We periodically engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design, implement or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: All employees and contractors play an important role in protecting the organization from cyber threats. We have implemented a formal cybersecurity training and awareness program that includes mandatory annual information security training and continuous education through various enterprise collaboration platforms. Our Cyber Defense team plays an important role in implementing our protection, detection, and response capabilities. Security incidents are evaluated, ranked by severity and prioritized for response and remediation. Our incident response process outlines actions required to triage, analyze, contain, remediate, and safely recover from cybersecurity incidents. Our incident response program ensures management is informed and involved in monitoring and addressing security and privacy incidents. The program uses a coordinated escalation model to engage relevant management and Board members as needed. It includes regular training and simulations for preparedness, with periodic updates to the Board on the program's status and significant incidents, ensuring robust oversight and governance. Security incidents are evaluated to determine materiality as well as operational and business impacts and are reviewed for privacy impacts.

companyName: XEROX CORP


text: The CITSO, who reports directly to the CEO, is responsible for the oversight of the Corporation's IT operation, including the cybersecurity program, and holds a Bachelor of Science degree in Information Technology and Security and a Master of Science in Information Security and Assurance. He also holds 20 industry recognized Technology and Security certifications. The VP of Information Security reports directly to the CITSO and has responsibility for leadership of the Bank's cybersecurity program. He holds a bachelor's degree in mathematics and computer science, as well as several industry recognized information security certifications. The VP of Information Technology reports directly to the CITSO and has responsibility for leadership of the Bank's Information Technology program. He holds a bachelor's degree in information technology and has worked in the technology field for 29 years with 17 of those years in a financial institution in various technology management, security, and audit roles.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: DTE Energy has an enterprise risk management program to reduce overall risk, including risks related to cybersecurity, through comprehensive risk assessments and execution of corresponding mitigation plans. Risks are reported and managed through various internal committees, which meet regularly and report at least annually to the Board of Directors. These committees include: • The Risk Management Committee (RMC) is chaired by the Chief Executive Officer and comprised of the Chief Financial Officer, Chief Legal Officer, General Auditor, and other senior officers. The RMC directs the development and maintenance of comprehensive risk management policies and procedures. The RMC also sets, reviews, and monitors risk limits for enterprise-level risk and other exposures • The Operational Risk and Resilience (ORR) Committee is chaired by the President and Chief Operating Officer and comprised of operational leaders in DTE Energy's business units. The ORR is responsible for managing operational risks including safety, reliability, and cybersecurity at DTE Energy's generation plants, substations, and other operating sites • The Technology Cybersecurity Committee (TCC) is a sub-committee of the ORR that focuses on information and operational technology risks related to cybersecurity, chaired by operational leaders in DTE Energy's business units and includes the Chief Information Officer Members of the Board of Directors serve roles on various committees responsible for their respective oversight and risk management. The Audit Committee of the Board of Directors, comprised solely of independent directors, is responsible for reviewing DTE Energy's cybersecurity risks, the results of any cybersecurity risk assessments and audits, and reports of investigations into significant events presented by DTE Energy's IT department. The Audit Committee reports to the Board of Directors and may include any significant matters involving cybersecurity within its reporting. All members of the Board of Directors, including the Audit Committee, have either managerial knowledge or working knowledge of technology and cybersecurity matters.

companyName: DTE Electric Co


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced threats relating to our and our third-party vendors’ information systems. For more information, please see “Item 1A, Risk Factors.”

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: Monitor Cybersecurity Risks The cybersecurity team actively monitors for cybersecurity risks by employing the use of endpoint detection and response solutions with immediate alert notifications, vulnerability scanning solutions that proactively identify risks, and by monitoring the logs of network devices.

companyName: YORK WATER CO

ticker: YORW


text: To implement our cybersecurity strategy, we maintain various safeguards to secure the data we hold, including encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system, regularly assessing product features for security vulnerabilities, periodically conducting internal penetration tests, and providing our customers with multi-factor authentication options to help them effectively protect their information. We also have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to ensure the availability of critical data and systems. We have processes in place to assess and manage vendor cybersecurity risks, which include initial and periodic security program reviews and, in cases where personal information is shared, ongoing cybersecurity and privacy obligations that are documented in data processing agreements. We engage independent third parties to audit our adherence to our cybersecurity policies and conduct infrastructure and application security assessments and penetration testing. These third parties help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.


text: We place the utmost importance on the security of our systems and the data we handle. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: PIXELWORKS, INC

ticker: PXLW


text: Independent Oversight: The Audit Committee, composed entirely of independent directors under SEC and NYSE rules, oversees our cyber risk exposure and evaluates our risk mitigation strategies. The committee was briefed by our VP, IT Services in depth, and in turn briefs the Board of Directors on any material cyber risks and events.

companyName: SES AI Corp

ticker: SES


text: To support our preparedness, the Company has a written incident response preparedness plan that we update as business needs and the security landscape change. In the event of a cybersecurity incident, our incident response team refers to the plan, and the Company conducts tabletop exercises to enhance incident response preparedness. The plan sets out clear response procedures on how to define roles, categorize incidents, determine materiality, record responses, comply with regulatory standards, assist in public disclosure, and defines the process for assessing impact for materiality purposes. It is designed to enable a prompt, uniform, and efficient strategy to reduce the financial, operational, legal, and reputational risks associated with cybersecurity incidents. Business continuity and disaster recovery plans are used to prepare for the potential disruption of technology we rely on. The Company has implemented a user awareness program to enhance cybersecurity measures. These include phishing, malware, data handling, device security, cybersecurity education, password security, internet browsing and defenses to physical threats. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.

companyName: WK Kellogg Co


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential, and personal information that resides on or is transmitted through them, are subject to the risk of a security incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party providers. For a discussion of these risks, see "Item 1A–Risk Factors– Cyber risk and the failure to maintain the integrity of internal or guest data could harm our reputation and result in a loss of business and/or subject us to costs, fines, investigations, enforcement actions or lawsuits."

companyName: Playa Hotels & Resorts N.V.


text: Our employees are also an important part of protecting our digital and technical environment. A key area of the cybersecurity program is the education of employees regarding cybersecurity using security awareness training, security bulletins and phishing simulations to reinforce training on a quarterly basis. Security awareness training covers all network users. On an annual basis an Acceptable Use Policy ("AUP") is distributed to employees through our Security Awareness Training System for understanding and acknowledgement. Additionally, all new employees are provided the AUP through the Security Awareness System included with initial security training upon being granted access to our network. Additionally, all new employees are provided the AUP by Human Resources and receive initial security training upon being granted access to our network.

companyName: Primoris Services Corp

ticker: PRIM


text: Our Cyber Incident Response Team is responsible for identifying, triaging, and containing cybersecurity threats and incidents, including, to the extent possible, those experienced by third-party service providers. Incidents with potential for higher impacts are routed to an enterprise response function that coordinates the response activities across impacted resource groups and business stakeholders. Through this structure, Truist manages its cyber, business, and legal obligations, including escalation to executive management and the Board, as appropriate, client and regulatory notifications, and remediation activities.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: While general risk assessment and management oversight resides with the Company's Audit Committee, oversight of risks from cybersecurity threats resides with our Board of Directors. The Company's Audit Committee is in charge of reviewing the Company's information security disclosures and incident reporting related to cybersecurity. The Company's Board of Directors is in charge of reviewing the Company's information security procedures and evaluating management's assessment of materiality for cyber incidents. The Board of Directors is formally updated on cybersecurity risks by the VP of Information Technology no less than annually. Management is responsible for assessing and managing material risks from cybersecurity threats. This responsibility primarily resides with the VP of Information Technology and his qualified team, including dedicated cyber security personnel. The qualifications of the Information Technology team include a combination of formal education (e.g. degrees in Information Assurance, Computer Information Systems, Computer Networking, and current enrollment in a Cyber Security degree program); current trainings and certifications in systems, network and cybersecurity; and, over 100 years of combined Information Technology experience. Management's process for monitoring prevention, detection, mitigation, and remediation of cybersecurity incidents is summarized above in the Risk management and strategy section.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: Our CISO and Chief Digital and Technology Officer advise the Audit Committee at least four times a year, and the Board of Directors regularly, on our management and oversight of information security risks and data protection risks. The Audit Committee also receives periodic updates on data privacy from members of management within our data privacy group in addition to the regular updates from our CISO. The Audit Committee provides a summary to the full Board at each regular Board meeting of the information security risk review together with any other risk related subjects discussed at the Audit Committee meeting.

companyName: YUM BRANDS INC

ticker: YUM


text: We identify and address cybersecurity threats and risks related to our business with an approach that includes assessments by our management and use of an outside consultant to manage our information technology. In addition, we rely on operating systems and software from established and reliable third-party service providers to provide security. We have employee policies in place designed to reduce risk of cyber-attacks and educate employees on protocol in the event of a potential cybersecurity incident.

companyName: Sonoma Pharmaceuticals, Inc.

ticker: SNOA


text: • CIDO—The CIDO has had the overall responsibility for PSEG's cybersecurity since September 2022, including the assessment and management of materials risks to PSEG from cybersecurity threats. The CIDO has served in that position since August 2020 and is a direct report of the CEO. The CIDO has over 25 years of energy experience inclusive of leading technology compliance with cybersecurity regulations for nuclear, transmission, gas and corporate assets. Our CIDO's experience includes leading the secure technology design, development, and deployment strategy for grid modernization efforts, including digital customer engagement platforms, advanced metering, enterprise asset management and distribution automation functionality.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: The Company periodically conducts cybersecurity "tabletop" exercises administered by an independent third party with respect to breach and other problematic information security scenarios. The administrator poses questions to participants and advises on typical responses to similar situations. Participants include various executives and other officers of the Company as well as the ISO, other information systems and security personnel, and relevant third-party vendors.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: ORIX USA employs a 'defense in depth' cybersecurity strategy and program based on the NIST CSF, which includes multiple layers of security policies, protections, and controls designed to safeguard the confidentiality, integrity, and availability of infrastructure, network and information assets from malware and threats. This includes the deployment of next generation firewalls, web application firewalls, email protection technologies, DLP technologies, internet proxy, and next generation antivirus and endpoint detection and response ("EDR") systems.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: Over the past fiscal year, we have no t identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate.

companyName: Jet.AI Inc.

ticker: JTAI