text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Chief Technology Officer. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (i) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (ii) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (iii) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (iv) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.

companyName: SPDR GOLD TRUST

ticker: GLD


text: The audit committee also receives an annual review from the CISO regarding our cybersecurity strategies, including how changes in the threat landscape and changes to our risk posture and business and compliance requirements may affect our risk management strategies.

companyName: Informatica Inc.

ticker: INFA

secItem: Item 1C


text: Vulnerability Scanning and Automated Cyber Risk Management and Compliance – we conduct monthly proactive vulnerability scanning to detect and address security weaknesses within IT systems. We have partnered with a third-party solution to identify and provide visibility and insight into existing risks. The solution collects data from our vulnerability scanning process to identify and analyze risks, prioritize remediation based upon business goals, and provide robust reporting and visual dashboards.

companyName: Six Flags Entertainment Corp/OLD


text: We recognize the importance of developing, implementing and maintaining robust measures to safeguard our electronic information systems and we have established processes, described below, to assess, identify, manage and mitigate risks from cybersecurity threats and cybersecurity incidents. We believe our processes are reasonable for real estate companies of our size, complexity, and risk profile.

companyName: CubeSmart

ticker: CUBE


text: The Board of Directors recognizes the importance of the FFIEC for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cyber incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a preferred partner with expertise in cyber risks and incidents to advise on cybersecurity related matters. The Company's preferred partner is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also maintains a Security Awareness Program, which is designed, implemented, and maintained by the Company's Chief Information Security Officer. The Company's Security Awareness Program includes training that reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information, as well as how to respond to unauthorized access to or use of Company information. The Security Awareness Program training is mandatory for all employees globally at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles, such as application developers.

companyName: DraftKings Inc.

ticker: DKNG


text: The Company conducts annual reviews of third-party hosted applications where sensitive Company data is shared. The owners of such applications are required to document user access reviews at least annually and provide the Company with a System and Organization Controls (SOC) 1 report. The Company's assessment of risks associated with the use of third-party providers is part of its overall cybersecurity risk management strategy.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see "Item 1A. Risk Factors" under the captions "Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition" and "Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business."

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: The Company has implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology. These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training. The Company also maintains third party management processes to identify and manage the cybersecurity risks associated with third party service providers. The Company periodically evaluates its cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program. Such reviews and assessments may include penetration testing, maturity assessments as well as table-top and other exercises with subsequent remediation of key findings. Additionally, the Company has a Cybersecurity Task Force in place that is comprised of individuals across various departments within the organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance the Company's cybersecurity strategy.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: Enterprise Cybersecurity. Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology (NIST) standards. Our program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications to educate individuals on the latest threats.

companyName: RTX Corp

ticker: RTX


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: Changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our Cybersecurity Steering Committee ("CSC"), which is an executive management-level cross-functional group.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: The Company continues to review processes and procedures that identify and oversee cybersecurity risks presented by third parties, including service providers, vendors and other users of the Company's systems. In December 2024, the Company updated its indirect Purchase Order Terms and Conditions, effective January 1, 2025, to address (i) supplier cybersecurity incident notification requirements and (ii) the Company's right to audit supplier IT systems.

companyName: BORGWARNER INC

ticker: BWA


text: The ISO maintains risk assessments for critical IT systems, vendors, and processes. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are used annually to assess these risks. Third parties are assessed to address their risks according to service type, compliance risk, financial risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on that assessment.

companyName: ENB Financial Corp

ticker: ENBP


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that we will not experience any such event in the future. For more information about the cybersecurity risks we face in connection with our business, see the risk factor entitled "Data security breaches, cyberattacks, employee or other internal misconduct, malware, phishing or ransomware, physical security breaches, or other disruptions to our technology systems or a compromise of our data security could occur and would materially adversely impact our business and ability to protect the confidential information in our possession or control" in Item 1A of this Form 10-K, "Risk Factors."

companyName: Sezzle Inc.

ticker: SEZL


text: •"Table-top" simulation exercises involving the Company's management and its third-party consultants and advisors to simulate a cyber incident and the Company's response to that incident, pursuant to the Company's Incident Response Plan; and • Payment card industry ("PCI") audits to assess the Company's processing of credit card transactions pursuant to standards adopted by the PCI.

companyName: CARTERS INC

ticker: CRI


text: Cybersecurity risk is an important and continuously evolving focus for us, the Adviser, J.P. Morgan, and its affiliates. Significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology. The Adviser's security efforts are designed to protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " We face cyber security risks that could result in damage to our reputation and/or subject us to fines, payment of damages, lawsuits and restrictions on our use of data " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Meridian Holdings Inc./NV

ticker: MRDN


text: Our Board of Directors and Audit Committee jointly oversee management's implementation of our security organization, which is charged with assessing and taking steps to mitigate the data privacy and cybersecurity risks that we face as a software-as-a-service platform.

companyName: Commerce.com, Inc.

ticker: CMRC


text: Process and Team. We maintain an incident response process with defined roles, responsibilities and reporting protocols. This process focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the IT Security Team would escalate the issue to the Council for initial analysis and guidance. In the event of a serious IT incident, the crisis management team would be notified and the incident response team would typically be tasked with preparing an initial response. The incident response team, in consultation with others regarding impact and materiality, would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities.

companyName: EASTMAN KODAK CO

ticker: KODK


text: The Chief Technology Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Technology Officer and the Director of Privacy are also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Additionally, the Cybersecurity and Privacy Committee reviews and has oversight over these functions.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: We review our cybersecurity risk framework and related policies annually with senior management to help identify areas for continued focus and improvement. We also engage third party experts to review and assess our processes to ensure they are robust and consistent with the current security landscape. The data center where we host our critical data is SOC II complaint.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: Management Responsibilities The Incident Response Team that we have established as part of our cyber risk management program coordinates the Company's response to incidents and communicates with internal and external stakeholders. The team includes members of our Senior Leadership and draws upon additional staff, consultants, advisors and service providers as needed.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: Cybersecurity and Data Privacy Our commitment to cybersecurity risk management and sound governance of cybersecurity and other information security-related risks is reflected at the highest levels of our company. This commitment begins with our Board of Directors, which plays a key role in providing oversight of our business practices and related risks, while remaining informed as we evolve and new risks emerge over time.

companyName: WORLD KINECT CORP

ticker: WKC


text: In the event of a cybersecurity incident, we have established protocols for management's response to incidents and we regularly test those protocols with appropriate management personnel. Such protocols include an incident response playbook with the assessment of cybersecurity risks and procedures and hierarchies for escalating and reporting incidents to executive management, the board of directors, investors, government agencies and the general public.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: Our information security and enterprise risk management function, led by the roles of Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO"), helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's information security risk register. The information security function helps to identify, assess, and mitigate risks from cybersecurity threats by monitoring and evaluating the relevant threat environment and the Company's security risk posture using various methods including, for example deploying manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, analyzing reports of certain cybersecurity threats and actors, conducting manual and automated scans of certain environments, evaluating our industry's risk profile, evaluating certain threats reported to us, coordinating with law enforcement concerning certain threats, conducting internal audits and threat assessments in certain environments and systems, conducting vulnerability assessments in certain environments and systems, and engaging third parties to assist with tabletop incident response exercises.

companyName: Sprinklr, Inc.

ticker: CXM


text: Cybersecurity is integrated with our overall risk management strategy and is an area of focus for our Board and management, with oversight at the executive level led by our Chief Financial Officer. The Audit Committee, and where applicable, other directors or the entire Board, are involved in overseeing cybersecurity risks. They receive quarterly and bi-annual updates, respectively, on our cybersecurity threat risk management and strategy processes, and may meet more frequently in response to specific threats or incidents. These updates, provided by our Chief Financial Officer and/or our global head of Information Technology, cover various cybersecurity topics, including data security posture, third-party assessment results, progress on risk mitigation goals, incident response plans, and select cybersecurity threat risks or incidents. The Board and Audit Committee also have discussions with our global head of Information Technology and engage in separate meetings to consider cybersecurity risks in the context of broader corporate matters.

companyName: ARTIVION, INC.

ticker: AORT


text: Our cybersecurity program focuses on the following areas: • Vigilance: Our threat operations help identify, prevent, and respond to cybersecurity incidents pursuant to our response and recovery plans. • Systems Safeguards: We use firewalls, intrusion systems, anti-malware, and access controls, and aim to continue to improve these safeguards through vulnerability assessments and threat intelligence. • Third-Party Risk Management: We manage risks from third-party vendors and service providers by conducting due diligence and periodic audits of key vendors. • Training: Mandatory periodic trainings for employees to reinforce our information security policies and practices. • Incident Response and Recovery Planning: We maintain and regularly test plans for responding to and recovering from cybersecurity incidents. • Communication, Coordination and Disclosure: Cross-functional teams, including the Board, address cybersecurity threats, with timely management decisions on incident disclosure and reporting.

companyName: Neurogene Inc.

ticker: NGNE


text: The Company's Chief Information Officer and Vice President of Information Security, in coordination with the Company's Cyber Security Committee, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Security Incident Response Plan. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Officer, the Vice President of Information Security, and the Company's Cyber Security Committee monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: The Company has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.

companyName: XCEL ENERGY INC

ticker: XEL


text: The Company's Senior Vice President of Finance ("SVPF") and Director of Information Technology ("IT") help identify, assess and manage cybersecurity risk, including input from employees, and devote resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. The SVPF and Director of IT identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example maintaining manual and automated tools, conducting scans of threats and actors, evaluating threats reported to us, completing internal and external audits, and completing third-party threat assessments.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Members of our management team, including our President of P&T, CDO, and the senior-most employee responsible for cybersecurity management, lead our cybersecurity assessment and management processes. Their responsibilities include hiring appropriate personnel, approving budgets, integrating cybersecurity considerations into our risk management strategy, overseeing security-related reports, communicating key priorities, and helping prepare for cybersecurity incidents.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We, like other companies in our industry, face cybersecurity risks in connection with our business. However, our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. For more information on our cybersecurity related risks, see "Risk Factors" under Part I, Item 1A of this Annual Report.

companyName: Climb Bio, Inc.

ticker: CLYM


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan ("IRP"). The purpose of the IRP is to provide a structured and systematic incident response process for all Information Security Incidents that affect any of our or our subsidiaries' information technology systems, network, or data, including data of ours and our subsidiaries held, or IT services provided by, third-party vendors or other service providers.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: Risk Management Strategy Our cybersecurity risk management strategy is comprised of several key elements and is overseen by our Global Information Security team ("GIS"), which is incorporated into our Enterprise Risk Management ("ERM") function. The oversight of our cybersecurity risk is integrated into our ERM processes and procedures. Our ERM framework integrates our information technology and data management systems and related policies and practices into the larger framework to help guide and prioritize our cybersecurity and information technology-related investments, activities, and risk management strategy. We leverage a variety of risk methodologies and technologies to mitigate the risk of cybersecurity threats and incidents. We have a multi-layer, in-depth approach to technology solutions, including employing applications and tool suites used for perimeter, network, end point and application security, as well as for data recovery, in each case tailored to our systems, data, risk profile and mitigation strategy. At least annually, we review cybersecurity risk as part of our ERM processes and integrate those findings into our overall cybersecurity strategy.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, including our cybersecurity safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments receive periodic trainings on cybersecurity best practices and threats. For example, we conduct e-mail phishing campaigns with our employees and contractors which send phishing-style e-mails, monitor user responses, and automatically assign further training, as needed, and also provide convenient solutions for our employees to report suspicious messages.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: We have implemented numerous policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless and personal devices for both Company business and personal matters while utilizing Company resources, among other relevant topics. These policies go through an internal review process on a periodic basis and are, if needed, updated and re-approved by the appropriate members of management.

companyName: ZeroStack Corp.

ticker: ZSTK


text: We also have a written Incident Response Plan and conduct tabletop exercises to enhance incident response preparedness. Business Continuity and Disaster Recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training when hired and annually.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Recognizing the complexity and evolving nature of cybersecurity threats, we use risk management systems developed and tested by external experts, including cybersecurity assessors, consultants, and auditors. These risk management systems enable us to leverage specialized knowledge and insights as part of our cybersecurity strategies and processes. These systems are assessed and maintained with the assistance of third-party service providers, including a Technology Consultant engaged by the Company.

companyName: Strive, Inc.

ticker: ASST


text: The Board is responsible for the oversight of risks, including from cybersecurity threats. At least annually, the Vista CIO provides the Board with an overview of Vista's cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and the Incident Response Plan, as well as the steps taken to respond to such risks. Material cybersecurity threat risks are also considered during Board meeting discussions of matters such as enterprise risk management, operational budgeting, business continuity planning, brand management and other relevant matters.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: We have a defined security policy that is reviewed on an annual basis. We have established response procedures for cyber-security incidents and test the procedures on a periodic basis. We provide robust computer-based cybersecurity and wire fraud / phishing awareness training to all new employees as well as training to existing employees on an annual basis. We have not experienced material information security incidents in the last three years nor have we incurred any material expenses related to penalties and/or settlements related to a material breach nor have we been materially affected or reasonably likely to have had a material adverse effect on us, our business strategy, results of operations, or financial condition. Nevertheless, we do carry a cybersecurity insurance policy.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: The Information Security department is responsible for implementing and maintaining the Company's cybersecurity risk management program. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Information Officer and the board of directors with dotted-line reporting to the Chief Risk Officer. The Company's CISO has over 20 years of experience in cybersecurity across the financial services industry as well as experience working in a leading managed security services provider. Prior to joining the Company, the Company's CISO served as leader of the Global Threat Management Center for a major global financial institution. The Information Risk department is led by the CSO, who reports directly to the Chief Risk Officer. The CSO is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the firm. Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the board of directors. The risk committees include the Operational and Information Technology Risk Management Committee, the Executive Risk Management Committee and the Risk Committee and Technology Committee of the board of directors. These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing cybersecurity risk.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: The results of these assessments are reported to our senior management. and our advisor's systems could potentially experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. Any significant disruption to our or our advisor's operations or access to our or our advisor's systems could adversely affect our business and results of operation. Further, a penetration of our or our advisor's systems or a third-party's systems or other misappropriation or misuse of personal information could subject our advisor or us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See " Risk Factors - Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses or limit our growth. "

companyName: Moody National REIT II, Inc.


text: We monitor and respond to a range of cyber threats, including any threats and incidents associated with the use of services provided by third-party providers. We utilize automation and artificial intelligence enabled tools to address threats. Our cybersecurity framework for handling cybersecurity threats and incidents includes steps for identifying the nature of a cybersecurity threat, assessing the severity of the threat (including advancing to key members of management where appropriate for determination of potential materiality) and implementing cybersecurity processes and procedures to address the threat.

companyName: Greenbacker Renewable Energy Co LLC


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.

companyName: Cohen & Co Inc.

ticker: COHN


text: - Overall enterprise information security risk management assessment, overseen by our Chief Information Security Officer, to determine any additional safeguards, both technology based and internal processes, for email spoofing and related cybersecurity risks; and - Established regular cybersecurity and information technology matters and related risk exposure reports and briefings of Audit Committee.

companyName: Value Exchange International, Inc.

ticker: VEII


text: Glen Burnie Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Senior Vice President, Director of Information Technology. In addition, the Internal Auditor and Compliance Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: Our board of directors oversees the management of our risks from cybersecurity threats. The board of directors has delegated the responsibility for the oversight of our cybersecurity risks program to the Audit Committee. The CISO provides cybersecurity updates to our Audit Committee as needed but at least on a quarterly basis covering cybersecurity matters, including a security scorecard, updates on policies, significant incidents or new developments in our cybersecurity risk profile. Our incident response process contemplates that management will notify the audit committee of a material cybersecurity incident.

companyName: LendingTree, Inc.

ticker: TREE


text: Related to Cybersecurity Risks Our Head of Information Technology, or IT, under the oversight of our Chief Legal Officer, is responsible for the administration and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who currently holds the title of Head of IT has more than 20 years of experience in information security and cybersecurity risk management.

companyName: Disc Medicine, Inc.

ticker: IRON


text: We face many cybersecurity risks in connection with our business. As of December 31, 2024, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, cash flows, financial condition or results of operations; however, future cybersecurity incidents or threats may materially affect us, including by affecting our business strategy, results of operations or financial conditions. See Part I, Item 1A. "Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: Elevance Health, Inc.

ticker: ELV


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.

companyName: Wenyuan Group Corp.

ticker: WYGC


text: Our cybersecurity program is designed to protect our information and operations from external and internal cyber threats while supporting business resiliency. We employ a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks. The cybersecurity program is part of our broader enterprise risk management program.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: Our Information Systems Representative, in coordination with senior management including our Chief Operating Officer works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout our company address cybersecurity threats and respond to and escalate certain cybersecurity incidents. Through ongoing communications with these teams, the Information Systems Representative and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Audit Committee when appropriate. The Information Systems Representative has served in various roles in information technology and information security for over 26 years, including serving as the Director of Information Technology of another public company. Our Chief Operating Officer has over 7 years of experience managing information technology, including cybersecurity and risk management.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: C ybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Effect of Risk We face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks, phishing, and other security incidents, including perpetration by hackers and unintentional damage or disruption to hardware and software systems, loss of data, phony invoices, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we, together with our contracted third-party cybersecurity advisors, maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring of internal and external threats to ensure the confidentiality and integrity of its information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by management.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: In addition, in the event of a significant cybersecurity incident, the Chief Operating Officer will promptly inform the Chief Executive Officer and General Counsel, who in turn will notify the Chair of the Audit Committee and the Board as appropriate.

companyName: FRANKLIN WIRELESS CORP

ticker: FKWL


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the primary oversight of risks from cybersecurity threats. Members of the Audit Committee receive quarterly updates from management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy officers.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our risk assessment process related to cybersecurity includes identifying threats and conducting vulnerability assessments, likelihood and impact assessments related to our own information and OT systems as well as our third-party service providers. The Partnership collaborates with third-party vendors to leverage managed security services, enhancing the Partnership's cybersecurity capabilities. The Partnership possesses monitoring capabilities for both its IT and OT infrastructure. To identify material cybersecurity risks, we use a combination of technical assessments, risk analysis, vulnerability scanning, incident and event monitoring, threat intelligence and third-party assessments along with ongoing monitoring and management.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: As of December 31, 2024, the Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology, employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act, the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool. Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits to regularly evaluate our cybersecurity posture in conjunction with obtaining cybersecurity insurance coverage to mitigate the potential financial impact of cybersecurity incidents.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Company's Board of Directors, through its Audit Committee (the "Committee"), provides oversight of risks from cybersecurity threats by monitoring incident-based reports from Tuearis as to the existence and severity of such risks. When risks are identified, the Committee works with the Company's Chief Financial Officer to develop appropriate responses, based on the recommendations of Tuearis. The Company does not have an employee with specific expertise in cybersecurity risk management but relies on Tuearis to provide that expertise. All material cybersecurity risks, incidents, and responses are reported to the Committee as a routine matter.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: The Security and Technology Risk Leadership Committee, led by our CTO, oversees our cybersecurity initiatives, and comprises technology leaders and members of various departments across the company. Similarly, our Privacy, Data Governance, and Artificial Intelligence Committee, under the guidance of our Chief Privacy Officer, oversees our privacy and data governance strategies.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Audit Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: HilleVax, Inc.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.

companyName: OOMA INC

ticker: OOMA


text: The Company's Chief Technology Officer reports to the Company's Executive Vice President and Chief Administrative Officer. In addition, as discussed in more detail below, any cybersecurity incident is reported to the Company's legal department. Although the Company's Executive Vice President and Chief Administrative Officer and the members of its legal department do not have a technology services background, we believe that the Company's Chief Technology Officer and technology services team possess the requisite background and experience to effectively manage the Company's cybersecurity needs. The Company's Chief Technology Officer has extensive information technology and program management experience from service in the government and private and public Fortune 100 companies. He has expanded the Company's cybersecurity program over the last several years resulting in a robust enterprise security posture focused on preventing cybersecurity incidents, while simultaneously increasing the Company's system resilience in an effort to minimize the business impact if an incident should occur.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: In addition, the rapid evolution and increased adoption of artificial intelligence ("AI") and similar machine learning technologies may intensify our cybersecurity risks. In 2024, we established an AI council comprised of a cross-functional group of employees with an objective to deliver value by providing education regarding the uses, benefits and risks of AI and similar technologies in our business, establishing a governance framework and principles for our use of AI, and enabling deliberate experimentation with new technologies employing AI. At this time, our use of AI is focused primarily on data analytics and improving product quality and asset reliability.

companyName: Metallus Inc.

ticker: MTUS


text: Our cybersecurity program is managed by a dedicated Chief Information Security Officer ("CISO"). Our CISO has formal education in information technology and extensive cybersecurity program management experience with over three decades of diverse experience in the chemicals and manufacturing industries and maintains various information security certifications. Our CISO is accountable for the enterprise-wide cybersecurity strategy for both information technology (IT) and operations technology (OT), including significant third-party risks. The cybersecurity team, led by our CISO, is responsible for policies, standards, architecture, tools, training and processes to keep Trinseo secure. Our CISO provides regular updates to our cross-functional committees on program objectives, effectiveness, emerging trends, and performance metrics.

companyName: Trinseo PLC

ticker: TSEOF


text: As part of its oversight role, the Audit Committee of our Board is responsible for overseeing cybersecurity risk exposure as well as management's actions to identify, assess, mitigate and remediate cybersecurity threats. The Audit Committee receives regular reports, on a quarterly basis, from our Chief Financial Officer and Senior Director of Information Technology regarding our cybersecurity risk programs. Our Chief Financial Officer also provides quarterly updates to the Board that include a summary of our cybersecurity risk programs to enable discussion of cybersecurity risk management at the Board level. The Audit Committee annually reviews and recommends our information security policy and program to the Board. The Audit Committee is composed of members with financial expertise as well as one member with a cybersecurity oversight certification.

companyName: Altimmune, Inc.

ticker: ALT


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage risks from cybersecurity threats to our Information Systems and Data, as applicable depending on the environment, including incident detection and response, disaster recovery/business continuity policies, network security controls and data segmentation, access controls, physical security, asset management and tracking, systems monitoring, and employee training.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: The board of directors is ultimately responsible for the oversight of the information security program. The status of the program is reported to the board throughout the year. Internally, the Bank's Chief Information Officer ("CIO") manages the status of the program and reports to the board. The CIO is a Certified Information Systems Security Professional (CISSP) since 2011 and has over 15 years of experience managing cybersecurity risks for financial institutions and healthcare organizations. The Technology Committee reviews and monitors the execution of the program. The Technology Committee consists of key stakeholders throughout the Bank, providing visibility into the risks posed to critical areas.

companyName: VWF Bancorp, Inc.

ticker: VWFB


text: Managing Material Risks & Integrated Overall Risk Management The Partnership has strategically integrated cybersecurity risk management into our broader risk management framework to promote an entity-wide culture of cybersecurity risk management. Our information technology department works closely with our internal audit, risk, and legal teams to continuously evaluate and address cybersecurity risks and ensure cybersecurity measures are in alignment with our business objectives and operational needs.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Our board of directors recognizes the critical importance of cybersecurity in safeguarding our company's assets, reputation, and customer trust. Our board of directors addresses our company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Moatable, Inc.

ticker: MTBLY


text: We engage a consultant to maintain our website, email, financial record keeping and related internet capabilities, including, as necessary, addressing any cybersecurity incidents. To date we have not experienced any material cybersecurity incidents. Given the nature of our operations (single location, minimal customer interface, no gathering of customer digital data, etc.), we do no t believe that we are reasonably likely to face any material cybersecurity risks.

companyName: Norris Industries, Inc.

ticker: NRIS


text: Our approach to managing cybersecurity risks includes implementing cybersecurity measures such as selective use of encryption, firewalls, data loss prevention, security monitoring, endpoint detection and response, anti-spam and anti-phishing email security, and intrusion detection systems to fortify our defenses. We conduct mandatory annual employee cybersecurity training programs and frequent simulated phishing campaigns to enhance cybersecurity knowledge and practices across the organization. Ambac maintains an incident response plan that is updated regularly to respond to changes in the organization, risks and laws. Ambac also conducts an annual test to restore business critical systems and data from back-ups. We have established reporting processes and escalation pathways for our business units and functions to identify, assess and manage potential cybersecurity incidents in a timely manner. Once an incident is identified, the Chief Information Security Officer ("CISO") (with the assistance of the IT team) will begin the investigation to determine the level of risk of the event and the appropriate response.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: Board of Directors The Board of Directors of StepStone Group Inc. ("STEP Board") oversees STEP's processes for assessing and managing risk. The STEP Board's Audit Committee is responsible for reviewing and discussing STEP's practices with respect to risk assessment and risk management, and risks related to matters, including information technology and cybersecurity. The STEP Board and Audit Committee regularly review the measures implemented by STEP to identify and mitigate risks from cybersecurity threats. As part of such reviews, the STEP Board and Audit Committee receive reports and presentations from those responsible for overseeing STEP's cybersecurity risk management, including the Managing Director, Head of Information Technology ("Head of IT") and STEP's Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to STEP's peers, industry participants, service providers and other third parties. The Head of IT also periodically presents to the STEP Board and its Audit Committee, including to describe STEP's information security infrastructure and improvements made, and to report on any significant developments in respect to STEP. From time to time, external legal advisers provide education to the STEP Board and/or Audit Committee in respect of information security related developments and to provide training in respect of directors' responsibilities.

companyName: Stepstone Private Credit Fund LLC


text: We periodically undertake cybersecurity audits, the results of which are reported to our Audit Committee. We have also implemented security monitoring programs designed to alert us of any suspicious activity and have developed an incident response program in the event of a security breach.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: From an external assessment and monitoring perspective, Littelfuse engages third parties to monitor and report on known exploitable vulnerabilities, within and external to Littelfuse's information technology ("IT") ecosystems. These third parties provide assessment and vulnerability scanning tools to detect exploitable unauthorized access into the Littelfuse environments.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled " Cyber security attacks, internal system or service failures, and misappropriation of data or other breaches of information security may adversely impact our business and operations " in Item 1A. Risk Factors.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: The CISO, in coordination with the Director of Engineering Security and Compliance and the information security managers, is responsible for leading the assessment and management of cybersecurity risks. The Company's information security team has extensive experience in information security and previous information security work experience in several industries, including defense, manufacturing, and financial services. The CISO reports to the board of directors, the audit committee, and senior management on cybersecurity threats.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: Our VP of IT and Facilities is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," including "Risk Factors—Risks Related to Our Business, Industry, and Operations: If we experience a security breach or incident affecting our customers' assets or data, our data or IoT devices, our Data Platform, or other systems, our Connected Operations Platform may be perceived as not being secure or safe, our reputation may be harmed, and our business could be materially and adversely affected." and elsewhere in this Annual Report on Form 10-K.

companyName: Samsara Inc.

ticker: IOT


text: We have implemented an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our primary objectives are to safeguard information assets, prevent their misuse or loss, and minimize business disruptions, through a comprehensive cybersecurity program intended to detect, analyze, contain and address cybersecurity risk exposures, threats and incidents. Our program utilizes various security tools to safeguard our information systems, aiding in prevention, identification, escalation, investigation, resolution, and recovery from vulnerabilities and security incidents. Examples of such security tools include internal reporting systems, monitoring and detection tools, third-party penetration testing and security assessments and a bug bounty program engaging security researchers. In addition, we have adopted a comprehensive incident response plan and process for detecting, mitigating, and investigating cybersecurity incidents, which employees, under the leadership of the Company's Chief Information Security Officer ("CISO"), regularly test through table-top exercises, testing of our security protocols through additional techniques such as penetration testing, debriefing after security incidents to improve our security and responses, and regular briefing to our directors and officers on our cybersecurity risks and preparedness.

companyName: Skillsoft Corp.

ticker: SKIL


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including " Risk Factors – If our information technology systems or data, or those of third parties upon whom we rely, are or were compromised, this could result in adverse consequences resulting from such compromise including but not limited to regulatory investigations or actions; litigation; fines and penalties; a material disruption of our drug development program; compromise sensitive information related to our business; harm our reputation; triggering our breach notification obligations; prevent us from accessing critical information; disruptions of our business operations; loss of revenue or profits; loss of customers or sales and expose us to liability or other adverse effects to our business. "

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Company's Chief Financial Officer, Chief Legal Officer, and Head of IT work collaboratively with other employees of the Company to ensure protection of the Company's Information Systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the board when appropriate. They have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, over their careers at the Company or other organizations.

companyName: SHF Holdings, Inc.

ticker: SHFS


text: As part of our overall risk management and assessment program, we design, implement, and maintain reasonable safeguards to minimize potential risks, including cybersecurity risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We also regularly provide cybersecurity awareness training to our employees at all levels and departments across the Company. The Company believes that we have allocated adequate resources to address the cybersecurity threats that may reasonably affect us.

companyName: Clarus Corp

ticker: CLAR


text: During the year ended December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: Dakota Gold Corp.

ticker: DC


text: Our Senior Vice President of Information Technology, a certified CISSP, who reports directly to the Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Information Technology. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Apogee Therapeutics, Inc.

ticker: APGE


text: Overview of Cybersecurity Risk Management and Strategy Our cybersecurity risk identification, assessment and management process is a critical part of our overall enterprise risk management ("ERM") system. Within our ERM system, we adhere to our Information Security Management Policy ("ISM Policy") which is aimed at providing guidelines to monitor, review and continually improve our Information Security Management System ("ISMS"). Our ISMS is informed by ISO/IEC 27001:2013 standards and is operated based on an action model that identifies information security missions and objectives, including improvement measures to achieve continuous optimization. Our Cybersecurity Incident Response Plan ("CIRP") is a critical component of our cybersecurity risk identification and management process, which, along with our incident response team, is designed to guide our response to potential cybersecurity incidents effectively and efficiently. Our ISM Policy, ISMS and CIRP are all internal tools we use to assess, identify and manage material risks from cybersecurity threats.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Our board of directors has delegated oversight of all risk assessment and risk management activities to the audit committee. The audit committee provides strategic oversight of management's risk management practices, including cybersecurity. Regular and ad hoc reporting from management, such as the executive risk committee (as described below), to the audit committee may include information about the prevention, detection, mitigation and remediation of material cybersecurity incidents, if any.

companyName: Trade Desk, Inc.

ticker: TTD


text: Measures Taken to Mitigate Cybersecurity Risks To mitigate the risk of cyber threats, we have implemented a comprehensive set of technical, organizational, and procedural safeguards that are designed utilizing the Cybersecurity Framework of the National Institute and Standards and Technology (U.S. Department of Commerce), industry standards and regulatory guidance that include the following:

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: Our third-party vendor, alongside our senior management leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. As a smaller-reporting Company we do not have an employee who has significant and demonstrated professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. The audit committee of the board of directors intends to provide oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. Additionally, the board of directors intends to review our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.

companyName: Envoy Medical, Inc.

ticker: COCH


text: In the ordinary course of our business, we collect and store sensitive data, including legally protected personal information, such as test results and other patient health information, credit card and other financial information, insurance information, and personally identifiable information, as well as sensitive intellectual property and other proprietary business information, including that of our customers, payers and collaboration partners. We are highly dependent on information technology networks and systems – our own as well as those of third-party vendors and their subcontractors – to securely process, transmit, and store this sensitive data and business critical information.

companyName: Natera, Inc.

ticker: NTRA


text: The GIS Program includes a Cyber Defense team, which manages the Incident Response Plan (IRP). This Cyber Defense team consists of subject matter experts from GIS and Information Governance, who work together to monitor and respond to cybersecurity incidents. The IRP outlines our cyber and incident response policies and governs our incident response lifecycle, which divides overall incident response into serial phases. The Crisis Management Team (CMT) is responsible for oversight during an incident, in conjunction with the Cyber Coordination Team (CCT). The CCT manages responses to cybersecurity and compliance incidents, collaborating with subject matter experts (SMEs) from various departments in response to specific incidents. When an incident reaches a certain threshold of severity, our CISO and CIO escalate the matter to our Chief Operating Officer, who is another member of our Management Team, to determine next steps, as well as possible customer and external communication. Throughout the incident response process, the Legal team is engaged, as appropriate, and helps consider whether disclosure is required once a determination is made in connection with the company's leadership and the CMT.

companyName: CME GROUP INC.

ticker: CME


text: Additionally, members of our internal cybersecurity team have experience in cybersecurity risk management, threat monitoring, threat emulation, penetration testing, cyber incident response management, and data protection. Team members have both individual responsibilities and a team focus, and manage both internal and third-party cybersecurity risk mitigation, covering areas such as network, endpoint device, and e-mail security as well as operations and threat management, monitoring, and response. Our CISO, CIO and CFO are responsible for determining that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the SLT and Board of Directors.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Related to Cybersecurity Risks Our Board holds oversight responsibility over our strategy and risk management, including risks related to cybersecurity threats. Under the oversight of the Audit Committee, we have implemented an ERM framework that includes processes for identifying, assessing, and responding to cyber risk exposures. The enterprise risk management process is led by our chief compliance officer, where team members are responsible for working with cross-functional leadership at our Company to assess risks across designated verticals, including cybersecurity. The chief compliance officer reports on the ERM process to the Audit Committee of our Board regularly. In addition, we have established a management committee, or our Enterprise Risk and Compliance Committee, that meets regularly to review and report on the ERM framework to senior leadership.

companyName: Toast, Inc.

ticker: TOST


text: As part of our enterprise risk assessment function, which is led by our Senior Vice President and head of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing us, including from cyber threats. Our enterprise risk assessment function is part of our overall risk management processes. Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology. We believe that our processes provide us with a reasonable and comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: The Audit Committee of our Board of Directors oversees cybersecurity risk and receives regular updates from our Vice President and Chief Security and Privacy Officer on these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters. Our Vice President and Chief Security and Privacy Officer, who reports to our Chief Technology Officer, leads our central security and privacy team, which works in partnership with each of our businesses and the corporate center to measure security maturity and risk and provides managed security services in a way that allows each business to address their unique challenges and become more efficient in using their resources. We have processes and policies for the escalation of cybersecurity incidents to the central security team, evaluation of the materiality of the incidents, and coordination of our response as needed across businesses and operations. Our Chief Security and Privacy Officer has more than 20 years of privacy and data security experience, including a series of roles in Cimpress over the last 15 years, the last three and a half years of which have been spent leading the central security and privacy team.

companyName: CIMPRESS plc

ticker: CMPR


text: We assess, identify and manage risks from cybersecurity threats through our Global Cybersecurity and Compliance Program (Cybersecurity Program), which is part of our larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee and Quality, Compliance and Technology Committee (QCT Committee) of the Board of Directors and is managed by a dedicated Chief Information Security Officer (CISO), whose organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network, information assets and medical device technologies. Our current CISO has over 20 years of experience in cybersecurity and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at another healthcare company. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are regularly updated to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. In addition, from time to time, we also utilize external auditors and assessors to help evaluate our Cybersecurity Program, including our control measures, and to assist in conducting risk and maturity assessments. We also actively engage with industry experts, regulatory agencies, advocacy groups, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our Cybersecurity Program.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: The Interim Chief Technology Officer of the Manager has served in various roles in information technology and information security over the previous 30 years, holding company officer roles for both private and publicly traded companies including Chief Information Officer, Chief Security Officer, Chief Information Security Officer and Chief Technology Officer. The Chief Technology Officer of the Manager holds numerous security and technology credentials maintained in good standing including Certified Information Systems Security Professional (CISSP), as well as holding in good standing specialized security operations and data privacy credentials including ISACA Certified Information Security Manager (CISM) and IAPP Certified Information Privacy Manager (IAPP CIPM).

companyName: VINEBROOK HOMES TRUST, INC.


text: Board Committee Oversight The Company's Risk and IT Board Committees provide oversight of the cyber program. Each committee consists of Board members, chaired by an independent director. Committee members have extensive expertise in various disciplines, including risk management, communications, information technology, litigation, banking and transactional matters, regulatory compliance, and cybersecurity. Board Committees receive regular reports informing on the effectiveness of the overall cybersecurity program and the detection, response, and recovery from significant cyber incidents. Cybersecurity metrics are reported quarterly to both committees and Key Risk Indicators are reported to the Risk Committee.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our customers, suppliers and subcontractors face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors — Our internal information technology systems, or those of our third-party contract research organizations ("CROs") or other contractors or consultants, may fail or suffer cybersecurity threats or breaches, loss or leakage of data and other disruptions, which could result in a material disruption of certain parts of our business, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business.

companyName: ALIMERA SCIENCES INC


text: We work with third parties from time to time that assist us from time to time to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: We have integrated cybersecurity risk management into our overall risk management and internal control framework and have established policies and controls that we believe are appropriate in light of the risks of damage to our reputation and financial condition from unauthorized access to our key digital assets and systems.

companyName: FTC Solar, Inc.

ticker: FTCI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by leaders from our IT, finance and legal teams, including our Executive Director who serves as the Head of IT and Cybersecurity, who has twenty years of experience in various roles involving information technology and cybersecurity. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our audit committee on any appropriate items.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: The Company has policies, controls, and procedures in place for assessing, identifying, and managing material risks from cybersecurity threats, including, but not limited to: • Reviewing financial reporting systems and subsystems to ensure that access is limited to approved users; • Reviewing data recorded, processed, and reported to ensure that the data remains complete, accurate, and valid; • Conducting regular network and endpoint monitoring and vulnerability assessments to improve our information systems; • Reviewing system changes of financial reporting significance to ensure that they have been authorized and appropriately tested before being moved to production; • Monitoring and identifying cybersecurity threats in connection with the use of third-party providers; • Responding to and remediating any incident of damage or interruption to our information technology systems, including cyberattacks, internally and through the use of third-party providers as necessary; • Carrying information security risk insurance that provides protection against potential losses arising from a cybersecurity incident; and • Requiring regular cybersecurity training programs for employees, management, and directors. These approaches vary in maturity across our business, and we work to continually improve them.

companyName: WILLIS LEASE FINANCE CORP

ticker: WLFC


text: Kroger Cyber Risk Management Program The CRM was developed in collaboration with third-party consultants and is aligned with the National Institute of Standards and Technology ("NIST"), Risk Management Framework ("RMF"), Cybersecurity Framework ("CSF") and the International Organization for Standardization 27001 ("ISO 27001"). The program includes security and privacy, risk-based controls, and incorporates lessons learned from cybersecurity incidents. Under Kroger's CRM, cyber risks, including cyber threats and cyber events/incidents, are assessed, treated, and monitored on a continuous basis. We integrate lessons learned from incident response and cyber risk mitigation into our cyber risk management strategy, in an effort to improve overall cybersecurity on an ongoing basis. Kroger's CRM program is spearheaded by specific management positions, chosen for their expertise in the field as further discussed below.

companyName: KROGER CO

ticker: KR


text: Our cybersecurity program includes: • ongoing employee cybersecurity awareness and training activities, which include frequent phishing testing; • access management and access controls intended to implement Principle of Least Privilege (PoLP) access; • protection of certain data through encryption at rest and in transit; • monitoring and protection software; • a vulnerability management program that includes managing the risk of third-party software; • a cyber incident response plan that provides controls and procedures to support appropriate containment, response, investigation, reporting and recovery of cybersecurity incidents; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provisions into various contracts.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: To date, risks from cybersecurity threats have not materially affected the Company, and we do not believe these threats are reasonably likely to materially affect the Company, including its business strategy, financial condition or results of operations. However, the risks from cybersecurity threats and incidents continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect our systems against all such threats and incidents. Refer to Item 1A – Risk Factors under the heading "Our business operations may be adversely affected by information technology systems interruptions or intrusion" for additional information.

companyName: COLUMBUS MCKINNON CORP

ticker: CMCO


text: NetApp's Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the Board of Directors oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframes. The Company's CISO regularly updates each of the Board of Directors and the Audit Committee at least twice a year. Such updates include a review of cybersecurity risks affecting the Company, related metrics, and any incidents or issues that require attention from the Board of Directors.

companyName: NetApp, Inc.

ticker: NTAP


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's operations and are based on recognized frameworks established by the International Organization for Standardization, the National Institute of Standards and Technology and other industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores and maintaining access to critical systems by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: LKQ CORP

ticker: LKQ


text: The Audit Committee receives reports on cybersecurity and data privacy matters and related risk exposures from management, including our chief information security officer ("CISO"), at least twice a year and more frequently as applicable. In addition, the Audit Committee's quarterly enterprise risk management updates include developments regarding IT security and data protection. Recent topics included evolving generative AI threats, social engineering resistance and deepfake readiness. The Audit Committee regularly updates the Board on such matters and the Board also periodically receives reports from management directly. We have protocols by which cybersecurity incidents that meet established reporting thresholds are escalated within the company and, where appropriate, reported promptly to the Board.

companyName: Accenture plc

ticker: ACN


text: Despite ongoing efforts to continually improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions and statutory penalties, among other consequences. Based on the information available as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, there can be no guarantee that we will not be the subject of future cybersecurity attacks, threats or incidents that may materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Information Technology."

companyName: DocGo Inc.

ticker: DCGO


text: The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with Company management to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks.

companyName: FTAI Infrastructure Inc.

ticker: FIP


text: a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board. Our dedicated CEO has over 10 years of experience in managing and monitoring cybersecurity.

companyName: YOUNEEQAI TECHNICAL SERVICES, INC.

ticker: YQAI


text: As part of the Company's cybersecurity risk management program, we follow the NIST Cybersecurity Framework ("CSF") to assess, identify and manage risks that arise from cybersecurity threats. The CSF is closely tied to the Company's enterprise risk management processes to identify and document cybersecurity threats and prioritize responses. Included in the CSF process is the identification and assessment of cybersecurity risks to systems, assets, data and resources. The Company also has a vulnerability management process in place. This vulnerability management process helps us to detect and identify threats and vulnerabilities and once identified, to remediate, respond and recover. In addition, our cybersecurity team subscribes to expert and industry standard security feeds and reports, which we use to identify new risks and new vulnerabilities in different systems and infrastructures. Our cybersecurity risk management program also includes cybersecurity awareness training for our associates and an incident response team ("IRT").

companyName: HELEN OF TROY LTD

ticker: HELE


text: These processes are supported by a multidisciplinary team, including our legal department, management and third-party information security service providers, as described further below. We leverage internal and external resources to monitor and evaluate our threat environment, including the use of our third-party managed service provider, manual and automated tools, threat intelligence reporting and analysis services, security scans and testing and internal and external audits. In addition, as part of our ongoing cybersecurity efforts, we have implemented a process for mandatory cybersecurity awareness training for new employees during onboarding and at least annually thereafter. We also conduct ongoing phishing simulations in an effort to raise awareness and support our training efforts.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: As part of its overall enterprise risk management framework, the Company maintains both a Cyber Incident Evaluation Committee ("CIEC") and an Incident Response Plan ("IRP"). The Company's CIEC is managed by its Chief Information Officer (the "CIO") whose team (the Incident Response Team, or "IRT") is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The purpose of the IRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific cybersecurity incident. These objectives are designed to maximize the effectiveness of the Company's response through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: Board of Directors holds oversight over the Company's cyber security risk management strategy and protocols and has amongst its composition an expert on this subject who has been appointed as having the lead in this area. The Company's internal CSMC works closely with the Board's expert appointee. All ITI changes, proposed through the CSMC, are routed through approval processes, and testing before implementation.

companyName: Coda Octopus Group, Inc.

ticker: CODA


text: The Company has not been impacted by any previous cybersecurity incidents that would materially affect business operations or financial conditions.

companyName: KOSS CORP

ticker: KOSS


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, leveraging a "three lines of defense" model to manage risk within the organization. Technology risk (including cybersecurity risk) is considered to be a key risk area for the Company, with Management measuring inherent risk, mitigating controls, and residual risk on a quarterly basis.

companyName: BANNER CORP

ticker: BANR


text: DFIN's initiatives and internal goals incorporate cybersecurity, including cyber risk requirements and cyber risk analysis. To deliver upon regulatory, client and Company cybersecurity objectives, the Company made investments to support processes, architectures and system operations models which specifically address cyber risk, including but not limited to threat detection and response capabilities, end point detection, incident response partnerships and other services provided by managed security service providers. The Company leverages cybersecurity technologies designed to ensure security of client, employee and business confidential data. Minimization of cybersecurity risk is also a part of DFIN's overall business strategy and is further evidenced by programmatic endeavors such as adopting a Zero Trust Architecture wherein all users, systems, applications and networks are deemed untrusted and must be verified. Separately, part of DFIN's corporate strategy includes maintaining adequate cybersecurity insurance. During the renewal process underwriters evaluate all aspects of DFIN's cybersecurity posture, providing another annual evaluation of the Company's cyber risk management.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: Our management team, including other internal staff such as the Head of IT and Senior Vice President of Operations, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's and their delegates' collective experience include over ten years of cybersecurity, incident response, and the safeguarding of organizational assets expertise.

companyName: Atai Beckley N.V.

ticker: ATAI


text: We utilize certain third-party service providers to perform a variety of functions relating to the acquisition, development and management of our properties. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include a review of the cybersecurity practices of such provider, including through security questionnaires and applicable security certifications or reports, as appropriate.


text: The Bancorp recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions. As such, the Bancorp has adopted proactive and defensive safeguards intended to better protect the Bancorp's information assets and supporting infrastructures from technology-related attacks. The Bancorp's Board of Directors and management oversee its information security and cybersecurity risk management programs. As further discussed below, the Bancorp has established various programs, policies and procedures which are designed to proactively protect information assets. However, not all incidents can be prevented. As a result, the Bancorp has also established various policies and procedures governing how to respond to security incidents, with the objective of minimizing any potential impacts. As of December 31, 2023, the Bancorp is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Fifth Third, including its business strategies, results of operations or financial condition.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business, results of operations, or financial condition.

companyName: ALEXANDERS INC

ticker: ALX


text: Western Digital's Information Security organization addresses cybersecurity risks with a broad spectrum of technologies, controls, and processes that focus on mitigating these risks. Our cybersecurity strategy is designed to be dynamic and adaptive to combat the rapidly-evolving cybersecurity threat landscape and is influenced by commonly leveraged frameworks such as the NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). Our program includes, but is not limited to, advanced systems and network security protocols, electronic communications protections, vulnerability management programs, least-privilege access controls, third-party risk management procedures, workforce education and training exercises, and compliance programs.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: To date, we have not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company and we are not aware of any cybersecurity threats that are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Risk Factors—General Risk Factors—We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: Advanced Flower Capital Inc.

ticker: AFCG