text: Our Board of Directors has overall oversight responsibility for our enterprise risk management program and delegates cybersecurity risk management oversight to the Audit Committee of the Board of Directors. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Chief Information Officer with support from our cybersecurity team, updates the Audit Committee on at least a biannual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. The Audit Committee also regularly reports on discussions regarding cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Officer, who has three years of experience overseeing information technology and cyber functions and who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP) and GIAC Certified Incident Handler, as well as experienced information systems security professionals and information security managers. Additionally, our internal Information Security Committee, composed of leaders from key departments, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: Our cybersecurity risk management is an important part of our comprehensive business continuity program and internal risk management. Our information security team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness. We practice our response to potential cybersecurity incidents through regular tabletop exercises, threat hunting and red team exercises.

companyName: AAON, INC.

ticker: AAON

secItem: Item 1C


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our company or our business strategy, results of operations or financial condition.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: The Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: Energy Recovery, Inc.

ticker: ERII


text: We also maintain procedures designed to protect the security of personally identifiable information, and our Privacy Policy provides details regarding the collection, storage, usage, and destruction of data. We require all employees to engage in data-security training upon hire and receive ongoing training thereafter. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: Since July 2021, we have no knowledge of any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our third-party CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our current or future therapeutic candidates' development programs," and "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," for additional discussion about cybersecurity-related risks.

companyName: Transcode Therapeutics, Inc.

ticker: RNAZ


text: We rely on information technology (IT) and operational technology (OT) systems, including technology from third party vendors, to manufacture and ship our products, as well as to process, transmit and store electronic information in our day-to-day operations. We have established an enterprise cybersecurity program, which is administered by a cross-functional team of cybersecurity professionals that includes employees and third party contractors and vendors, that utilizes various tools, methodologies and processes to assess, identify and manage cybersecurity risks related to our IT and OT systems, as well as our products. Our cybersecurity program is designed to monitor and continually enhance our enterprise security posture, with the goal of preventing cybersecurity incidents to the extent feasible, including assessments to better understand our readiness for cybersecurity threats and the resilience of our critical business functions, with the goal of avoiding or reducing the impact if such an event were to occur. We have implemented cybersecurity policies mapped to industry and government standards and frameworks, such as U.S. National Institute of Standards and Technology (NIST) and International Standard of Organization, and our strategy is aligned to the NIST CyberSecurity Framework that provides us a structured approach to managing our cybersecurity risk through its five core functions. We regularly review our cybersecurity policies and require annual cybersecurity training for our employees. We also periodically conduct simulation exercises involving employees at various levels of the organization, as well as our Board of Directors, to prepare for cybersecurity incidents and response planning.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee and technology committee of our board of directors are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Our cybersecurity incident response procedures involve escalating specific incidents to certain members of management as needed, including the Vice President of Information Technology, Chief Operating and Financial Officer and the Chief Executive Officer. The Chief Operating and Financial Officer collaborates with our incident response team, which includes members of our in-house IT, facilities, human resources, regulatory, legal, and communications teams, to address and resolve reported cybersecurity incidents. Olema's incident response procedures mandate reporting certain types of cybersecurity incidents to the Audit Committee and other agencies as required by law.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: The Company's VP of Information Technology is the member of the Company's management who is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology works in coordination with senior leadership, which includes our Chief Executive Officer and President, Chief Financial Officer and General Counsel. The Company's VP of Information Technology has served in various roles in technology and is supported by a team of information technology and cybersecurity professionals with decades of relevant experience.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and relevant training and certifications, such as Certified Information Systems Security Professional certification, ISO 27001 certification, and other technical cybersecurity certifications from ISC2, the SANs Institute and OffSec as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: The Company also has a Risk Assessment Committee composed of selected members of senior management. Member(s) of the information security team are members of this Risk Assessment Committee (which occur at least quarterly) to address cybersecurity risks and discuss cybersecurity threats to the Company. Member(s) of the information security team have the opportunity to present at the Risk Assessment Committee meetings and raise issues and concerns regarding cybersecurity. The minutes of Risk Assessment Committee meetings are provided to the Board and the General Counsel discusses with the Board the matters addressed at the applicable Risk Assessment Committee meeting.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance obligations are identified and addressed through a multi-faceted approach, which involves independent third-party assessments and testing, internal audit, IT security, governance, risk and compliance reviews.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by Company management. The Chief Executive Officer, President and Chief Financial Officer discuss the cybersecurity programming. The Chief Financial Officer is responsible for the ongoing engagement of outside third parties to evaluate and update controls as recommended. Management is also responsible for working with appropriate third party vendors to evaluate the Company's risk profile and to update the controls for the Company's technology resources. Management is tasked with integrating cybersecurity considerations into the Company's overall risk management strategy, focus on appropriate priorities and approving related budgets, helping prepare for cybersecurity incidents, and soliciting and reviewing security assessments.

companyName: GTJ REIT, INC.


text: Director of Information Technology is responsible for leading the assessment and management of cybersecurity threats. We have implemented a governance program for our cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents.

companyName: Lightstone Value Plus REIT II, Inc.


text: As part of our overall risk management system, we monitor and test our safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies and educated about cybersecurity best practices through annual company-wide cybersecurity training, regular phishing simulations, and role-based training, as appropriate.

companyName: AppLovin Corp

ticker: APP


text: Third parties with which the Bank does business, which facilitate the Bank's business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Bank. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.

companyName: RBB Bancorp

ticker: RBB


text: Our management has also developed security policies and processes, including regular system updates and patches, employee training on cybersecurity and privacy requirements, incident reporting, and encryption to secure sensitive information. In addition, we also regularly perform phishing tests on our employees and update our training plan at least annually. We maintain business continuity and disaster recovery capabilities to mitigate interruptions to critical information systems and the loss of data and services from natural or artificial disasters' effects on our physical operations.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: The Chief Information Security Officer ("CISO") and the information security team that reports to the CISO help identify, assess and manage our cybersecurity and privacy threats and risks, including through the use of our external and internal risk assessments. The CISO and the information security team identify and assess risks from cybersecurity threats by monitoring and evaluating our networks, data and our risk profile using various methods including, among other things, manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the computer networks, internal and/or external audits (including compliance audits with respect to ISO (27001, 27017, 27018, and 27701), SOC 2, PCI DSS and HIPAA for our corporate and cloud based software solutions), conducting assessments for potential internal and external threats, third-party-conducted risk assessments, conducting vulnerability assessments, third-party-conducted red/blue team testing and tabletop incident response exercises and subscribing to reports and services providing cybersecurity threat intelligence.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: Our Chief Technology Officer has served in various roles in IT and information security for over 20 years. In addition, members of the IT department involved in Information Security have an average of 15 years of experience in cybersecurity as well as relevant educational experience.

companyName: MFA FINANCIAL, INC.

ticker: MFA


text: The Technology and Digital Engagement Committee of the Board has primary responsibility for oversight of the Company's cybersecurity risk. This Committee receives regular briefings from our Chief Operations Officer, Chief Technology Officer, Chief Information Security Officer, and outside experts on cybersecurity risks and cyber risk oversight. During these meetings, the Technology and Digital Engagement Committee and management discuss cybersecurity risks, risk management activities and efforts, best practices, the effectiveness of our security measures, and other related matters. The Technology and Digital Engagement Committee Chair reports on the committee's meetings, considerations, and actions to the Board at the next Board meeting following each committee meeting. The Audit Committee also discusses and receives updates on cybersecurity matters in connection with its oversight of enterprise risk management.

companyName: FOOT LOCKER, INC.


text: Our information technology ("IT") department helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using manual tools and conducting threat assessments designed to identity internal and external threats.

companyName: EMERSON RADIO CORP

ticker: MSN


text: The Risk Committee of the Board, consistent with its charter, reviews and discusses with management the strategies, processes and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The CISO typically provides quarterly updates regarding cybersecurity and cyber risk to executive management and the Risk Committee of the Company's Board of Directors.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Our cybersecurity risk management and strategy processes are led by our COO, assisted by our Vice President of Infrastructure and Operations. Together, they have over 20 years of combined professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and managing multiple industry and regulatory compliance environments.

companyName: Torrid Holdings Inc.

ticker: CURV


text: Our Chief Technology Officer's experience includes various roles in information technology, data analytics, and information security at both public and private companies. Members of the Cybersecurity Team each hold undergraduate and, in some cases, graduate degrees in their respective fields, and each have experience managing risk at the Company or at similar companies, and assessing cybersecurity threats.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Following these risk assessments, we evaluate whether and, if so, how to re-design, implement and maintain reasonable safeguards to minimize identified risks and reasonably address any identified gaps in existing safeguards. We also regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our chief architect, who reports to our co-chief executive officer, to manage the risk assessment and mitigation process.

companyName: Revolve Group, Inc.

ticker: RVLV


text: Multifactor Authentication (MFA): To ensure the security of user accounts, we implement MFA across our digital platforms. This approach adds an additional layer of security by requiring two or more verification factors, significantly reducing the risk of unauthorized access.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Management and Strategy have designed and implemented an information security program that is tailored to our operations and infrastructure, the nature of our products and services, and the sensitivity of data. Our information security program consists of processes that are designed to identify, assess, and manage material risks from cybersecurity threats.

companyName: Fintech Scion Ltd


text: As reported on Forms 8-K filed January 6, 2023 and February 10, 2023, the Company became aware of unauthorized access to the Company's systems on December 30, 2022. The Company's domestic operations were impacted by the Cyber Incident, which resulted in production delays and delayed shipments due to information access limitations. The Company immediately initiated response protocols and an investigation, engaging cyber security experts to assist with the assessment of the incident and to help determine what data was impacted. The Company has since completed data recovery and restoration from the cyber incident. See Note 12 — Commitments and Contingencies of the Notes to Consolidated Financial Statements.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Role and Management's Role in Managing Cybersecurity Risk Our Board has direct oversight responsibility for the Company's strategic risks. The Audit Committee has been made primarily responsible for the Board's oversight of cybersecurity risks, but the Board has discretion to delegate this oversight responsibility to any committee or sub-committee as it deems appropriate. The Audit Committee is composed of directors with diverse expertise including risk management, operations, technology and finance and accounting, equipping them to oversee cybersecurity risks effectively.

companyName: Integer Holdings Corp

ticker: ITGR


text: Our approach to addressing cybersecurity threat risks also includes mitigating risk associated with our use of third-party service providers. For example, when we enter into contracts with third-party collaborators or vendors pursuant to which sensitive business or personal data will be shared or accessible, we include provisions safeguarding the protection of confidential information. We also utilize a third-party service provider to maintain our information systems and assets and to employ technical safeguards that are designed to protect our information systems from cybersecurity threats.

companyName: PharmaCyte Biotech, Inc.

ticker: PMCB


text: Our Vice President of Information Technology and Security Officer, who reports to the Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Vice President of Information Technology and Security Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Information Technology and Security Officer's experience includes 15 years of experience across digital and cyber defense, and has most recently led the cyber function for the last six years at two emerging biotechnology companies.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: To help address cybersecurity threats, we have developed a strategy and implemented a program to identify, assess, and prioritize cybersecurity risks as part of our broader ERM program. We are committed to a risk-centric, layered information security approach to secure our data, systems, and services. We prioritize our data security initiatives and processes based on our assessment of known and anticipated threats to our data security. Utilizing the National Institute of Standards and Technology (NIST) Cybersecurity Framework, we strive for continuous improvement and utilize a metrics-based approach to identify and mitigate data security risks that could potentially impact our business operations or clients.

companyName: H&R BLOCK INC

ticker: HRB


text: The Chief Information Security Officer ("CISO"), the Chief Technology Officer ("CTO"), and General Counsel are key management roles responsible for assessing and managing material risks from cybersecurity threats. The CISO reports to the General Counsel and is responsible for implementing and maintaining our enterprise cybersecurity organization. Our CISO has served in both the private and public sectors developing extensive experience in cybersecurity operations, incident response, strategy, governance and compliance. The CISO provides periodic reports to our management risk committee on the mitigation of cybersecurity risks. The General Counsel provides executive oversight of the Cybersecurity Program, providing governance of cybersecurity capabilities and coordinating cybersecurity matters with senior management and the Board of Directors. Our experienced General Counsel has significant risk management, governance, litigation and regulatory experience. We believe these skills are needed in leadership of our Cybersecurity Program to ensure that risk management, legal, regulatory, disclosure and governance perspectives are considered in the design of our Cybersecurity Program and in evaluating and responding to potential cyber incidents. The CTO provides our Cybersecurity Program with the technical and functional resources to achieve its strategic goals and objectives. Our CTO has 30 years of experience with reliability and security of core systems, expertise important for establishing robust protocols and implementing best practices to safeguard against cyber threats and mitigate risks effectively. The General Counsel, CISO, and CTO meet regularly to evaluate the Company's Cybersecurity Program.

companyName: OneMain Holdings, Inc.

ticker: OMF


text: •"—If we do not effectively implement our plans to migrate our technology infrastructure to the cloud, we could experience significant disruptions in our operations, which could have a material adverse effect on our results of operations and financial condition"

companyName: ADT Inc.

ticker: ADT


text: Our operational cybersecurity team is led by the CISO. The CISO has 31 years of experience in Information Technology and Security, with extensive experience designing, operating and protecting satellite and terrestrial telecommunications networks. The CISO also leads Viasat's engagement with the private sector and government security communities, which includes facilitating active information sharing with these partners. As part of the acquisition and continuing integration of Inmarsat, the legacy Inmarsat cybersecurity team joined the Viasat Security Engineering organization. The engineering and operational cybersecurity teams of both legacy organizations jointly participate in local and national cybersecurity organizations, teach classes on cybersecurity, maintain numerous relevant certifications, and participate in training relevant to their field of expertise.

companyName: VIASAT INC

ticker: VSAT


text: Dow contracts with external firms to assess Dow's cyber security controls relative to its peers using the NIST CSF. Dow also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, Dow maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.

companyName: UNION CARBIDE CORP /NEW/


text: The IT Engineer, in coordination with the Cybersecurity Council, which includes our Chief Executive Officer ("CEO"), CFO and Compliance Director works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the IT Engineer and the Cybersecurity Council monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Risk Management Committee when appropriate.

companyName: Emeren Group Ltd


text: We test for and resolve vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing and adversary emulation, also known as red teaming and hire a third party to do the same at least once a year. We maintain a vulnerability disclosure program to enhance discovery and remediation of external-facing vulnerabilities. We also undergo a third party maturity assessment of our information security program every two years and a third party enterprise penetration test annually. We leverage external resources to help define information security and technology standards for our environment.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: As noted above, the Company relies on our Manager's Information Systems in connection with the Company's day-to-day operations. The Company relies on the MSSP's processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: We continue to improve our cybersecurity risk assessment program and activities for assessing, identifying and managing cybersecurity risks through industry standard security frameworks and leading practices, including risk assessments and remediations, software and services, continuous systems monitoring, vendor risk management processes, incident response plans, phishing simulations, employee training, and communication programs, among other measures. We also employ processes designed to assess, identify, and manage the potential impact of a security incident at various customers and critical partners, including third-party vendors, service providers, or any cybersecurity incident otherwise impacting the third-party technology and systems we use.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: Our current Head of IT reports directly to our Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity matters, holds a Master of Science degree in Telecommunications and Computer Networks and is Project Management Professional, Certified Scrum Master and IT Infrastructure Library certified. He, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have identified and mitigated certain known cybersecurity threats, which we determined are not reasonably likely to materially affect us, and have strengthened our cybersecurity ecosystem. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks there is the potential for us to be adversely affected. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - Significant disruptions of information technology systems or breaches of data security could adversely affect our business."

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Threat and Vulnerability Management – Littelfuse uses an internationally recognized managed security services provider (MSSP) and technologies to collect security alert and audit logs on a 24/7 basis, monitor and assess latest threat intelligence, provide analysis on new identified potential vulnerabilities, and provide response and support services to rapidly reduce any identified vulnerabilities.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Kinetik has an established Risk Management Policy supported by underlying processes to execute and meet the Company's Risk Management objectives. This Policy is based on the NIST requirements.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and our Privacy Office and tested through cross-functional annual exercises in various geographical regions of the Company, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.

companyName: METLIFE INC

ticker: MET


text: The S&T Information Security Program utilizes a defense in depth strategy that leverages multiple security measures to protect the bank's assets. We encrypt and leverage data loss prevention technology for sensitive data and use advanced transport layer security encryption for our applications. S&T employees are required to undergo annual information security awareness training, which includes information regarding evolving threats such as phishing, malware and social engineering testing.

companyName: S&T BANCORP INC

ticker: STBA


text: The Company has an Enterprise Risk Management function that oversees the identification, prioritization and mitigation of the Company's enterprise risks, and cybersecurity is a risk category addressed by that function. The Company uses governance, risk and compliance tools designed to assess, identify and manage its cybersecurity risks.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Information Security Officer ("ISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Executive Officer.

companyName: Southern States Bancshares, Inc.


text: We are unaware of any material cybersecurity breaches during the year ended December 31, 2024, and given that we rely on relatively few and well known well capitalized larger third-party enterprises for certain of our data and information storage and communication needs, we do not believe that an overall material cybersecurity risk presently exists for our business. Our criteria for determining the materiality of cybersecurity incidents includes assessing potential or actual financial impacts, reputational damage, and operational disruptions.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: Risks from Cybersecurity Threats We have not experienced any material cybersecurity incidents and the expenses we have incurred from any security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. See "Risk Factors — Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business strategy and operating results." As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks.

companyName: electroCore, Inc.

ticker: ECOR


text: These programs establish policies (including vendor management), procedures, risk assessments, systems, monitoring, reporting, strategies, and training to effectively manage cybersecurity risks. Specifically, the Corporation deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. The Corporation also performs simulations and drills to further ensure our readiness and preparedness for potential threats. In addition, the Corporation employs a nationally recognized firm with information security experts to annually perform audits that extensively test our program and controls, which are reviewed by the Board Audit Committee. These programs and controls align with Federal Financial Institutions Examination Council guidelines and standards.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: We have a multilayered framework for detecting, and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology ("IT"), systems from cybersecurity threats, we use various tools that help prevent, detect, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would assess the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage technical safeguards intended to protect the Company's information systems from cybersecurity threats, including firewalls, threat monitoring, intrusion prevention and detection systems, anti-malware, access controls, privilege management, network segmentation, asset and end point management, and ongoing system security assessments. We oversee third-party service providers by conducting vendor diligence and reviews on a regular basis. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular network scans, system audits, and assessing intelligence feeds. The results of these assessments are used to improve our security posture through remediation efforts.

companyName: TaoWeave, Inc.

ticker: TWAV


text: Our Board and Audit Committee oversee the Company's cybersecurity risk management. Management presents to, and discusses with, the Board the security of our systems and applications. Our Chief Digital Officer and our Information Security Director ("CDO"), provide strategic and technical leadership for the Company's cybersecurity program and lead teams across the Company that support the cybersecurity functions. Our CDO has 30 years of experience in IT, including being accountable for IT compliance and security, and previously served as Chief Information Officer for a publicly traded company for 5 years. Our Information Security Director has nearly 30 years of experience in software development and IT, and, for 17 of those years, was responsible for security, compliance and privacy. These executives regularly report to the Chief Executive Officer and Chief Financial Officer with regards to our cybersecurity program and readiness.

companyName: FARO TECHNOLOGIES INC


text: Our CISO has over 25 years of experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and is a member of the National Association of Corporate Directors ("NACD"). Our CISO works closely with our Vice President, Enterprise Risk, Compliance and Service Management to assess and manage the cybersecurity element of our ERM program. In the area of risk, the Vice President, Enterprise Risk, Compliance and Service Management focuses on risk management, business continuity planning, crisis management, operations management, and executive and Board reporting.

companyName: Dayforce, Inc.

ticker: DAY


text: We have engaged a third-party IT and cybersecurity firm to assist us in protecting us from cybersecurity threats. Our IT partner has been in business for over 33 years and has a national footprint of 175 offices nationwide. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: The Board receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of the third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to significant fines or other liability; regulatory investigations or actions; disruptions of our development programs or business operations; harms to our reputation, and other adverse consequences."

companyName: Vaxcyte, Inc.

ticker: PCVX


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. In partnership with our outsourced technology provider, we have implemented extensive processes and controls to assess, manage and protect against material risks from cybersecurity threats, including the following: • a managed detection and response platform that is monitored at all times by members of our third-party technology provider's Security Operations Center team; • periodic penetration testing and vulnerability scans; • quarterly cybersecurity training and phishing email exercises for all employees and officers; • vendor cybersecurity diligence; • cybersecurity insurance; and • an Incident Response Plan that includes procedures for responding to cybersecurity incidents.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: The full Board of Directors has overall responsibility for risk oversight, including cybersecurity matters. It is supported by the Audit Committee, which reports to the full Board of Directors. The Audit Committee receives updates from management, as necessary, on the cybersecurity landscape and cybersecurity risks impacting the Company. At least annually, the Board of Directors receives a cybersecurity update as part of our Company's risk management program. Such updates are designed to ensure that the Company's senior management team remain informed about and can monitor the prevention, detection, mitigation, and remediation of potential cybersecurity incidents.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates every quarter from senior management, including leaders from our Information Security, Product Security, Compliance, and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, the status of how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and the status of key information security initiatives.

companyName: Toughbuilt Industries, Inc


text: Third-Party Risk Management Engagement Prosper engages with a range of external experts, including external auditors, cybersecurity assessors and penetration testers as part of our InfoSec and cybersecurity programs. Our collaboration with these third-parties includes services such as external audits, threat assessments and guidance on key security initiatives. These partnerships allow us to leverage specialized knowledge and insights, consistent with our aim for industry-best practices.

companyName: PROSPER MARKETPLACE, INC


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner. See Item 1A: Risk Factors above for additional information on risk related to cyber attacks.

companyName: Comstock Inc.

ticker: LODE


text: Company has an internal management team that focuses on current and emerging cybersecurity matters. The Company's internal management team is led by the Chief Financial Officer. The internal management team is responsible for implementing cybersecurity policies, programs, procedures, and strategies. Our internal management team includes professionals with backgrounds in information security, risk management, and incident response. Our Chief Financial Officer has experience leading the information technology departments at another publicly-traded, upstream energy company for over four years and led enterprise risk management processes at publicly traded, upstream energy companies for approximately 10 years.

companyName: Prairie Operating Co.

ticker: PROP


text: The Audit Committee of our Board of Directors is responsible for overseeing our risk assessment and risk management activities, including cybersecurity risks. The Audit Committee is briefed by our Chief Digital Information Officer on cybersecurity risks at regular meetings and separately as circumstances warrant. Cybersecurity risks are also included in our enterprise risk management program which is reported separately to the Audit Committee. We maintain a dedicated cybersecurity team responsible for program implementation and operational security activities.

companyName: California Resources Corp

ticker: CRC


text: Triton's Board is responsible for oversight of information technology and cybersecurity-related matters and monitoring cybersecurity risk management, and the Board actively engages with senior management on the state of the Company's Information Security Program. The information security leadership team prepares briefings for the Board on the effectiveness of the Company's cyber risk management program, typically on a quarterly basis, which include a review of key performance indicators, training and test results and related remediation, and recent threats and how the Company is managing those threats.

companyName: Triton International Ltd

ticker: TRTN-PA


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our Senior Manager of Information Technology reports to our Chief Financial and Operating Officer and oversees the day-to-day implementation and management of our cybersecurity program. Our Senior Manager of Information Technology has approximately 20 years of experience in information technology and regularly reports to executive management, the company's disclosure committee, and the Audit Committee on cyber matters, as appropriate.

companyName: Upstream Bio, Inc.

ticker: UPB


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Our integration involves regular, systematic reviews and assessments conducted alongside other operational risks inspections. The findings from these reviews are communicated across relevant departments timely to inform decision-making. We have not engaged outside assessors, consultants, auditors or third parties in connection with such processes. We have processes to oversee and identify such risks from cybersecurity threats associated with our use of any third-party provider. Such processes include conducting due diligence assessments for all vendors, regularly reviewing vendor security practices, and including cybersecurity performance metrics in our vendor contracts to ensure that they comply with our security requirements.

companyName: Marwynn Holdings, Inc.

ticker: MWYN


text: We have a qualitative cybersecurity risk management program within our Enterprise Information Security function to promote a company-wide culture of cybersecurity risk management for our information technology and operational technology. This program supports cybersecurity considerations as part of our decision-making processes. Our Enterprise Information Security team works closely with our global information technology organization ("Global IT"), operational technology teams and business units to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We are aligned with the U.S. National Institute of Standards and Technology Cybersecurity Framework, against which we periodically assess our readiness.

companyName: HUNTSMAN INTERNATIONAL LLC


text: Oversight for assessing and managing cybersecurity risk is performed by our IT cybersecurity team, with additional oversight performed by our Human Resources, Internal Audit and Legal Departments. Our executive management is briefed at least quarterly from these teams. Members of the Board of Directors, Audit Committee, and executive management are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: A10 Networks, Inc.

ticker: ATEN


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."

companyName: GMS Inc.


text: The same cybersecurity threats that predominate across most industries challenge Tyler and our clients as well. These threats range from crude phishing attempts to distributed denial-of-service disruptions to sophisticated malware and ransomware, among others. The evolving use of artificial intelligence increases the risk of cyberattacks and data breaches, which themselves can evolve more rapidly when artificial intelligence is used to facilitate the attack. We are acutely aware that these same threats exist for our acquisition targets, our suppliers, and our third-party business partners, and a cybersecurity incident or vulnerability experienced by any of these entities could also materially and/or adversely impact our business operations and/or performance, both operational and financial, and could harm our reputation and/or competitive position. In addition, vulnerabilities in our clients' on-premises infrastructure have in the past and may in the future be exploited by bad actors, with the resulting impacts being linked to or attributed to, correctly or incorrectly, our software or services, which could also harm our business, reputation, and future financial results, even if our software or services were not the cause of the exploitation. Given the criticality of a strong cybersecurity posture, we continuously and conscientiously invest in our security infrastructure, tooling, and related resources.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: We expect each of our employees to be responsible for the security and confidentiality of our client information and our computer systems. We communicate this responsibility to each employee upon beginning employment with us and regularly throughout their employment. We require new hires to complete training on cyber-crime, social engineering, and cybersecurity awareness, and we also require this training during each year of employment thereafter. Employees are tested on their understanding of these requirements and provide acknowledgement of their responsibilities.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as our contemplated use of artificial intelligence may further expose our computer systems to the risk of cybersecurity incidents.

companyName: Gogo Inc.

ticker: GOGO


text: Impact of Risks from Cybersecurity Threats While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future due to the increasing global cyberattack volume, frequency, and sophistication. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventive measures even with our various cybersecurity protection and resilience protocols.

companyName: NGL Energy Partners LP

ticker: NGL


text: The Company's digital systems are distributed across various architectures, including on-premises, hosted, Software-as-a-Service ("SaaS"), and other architectures operated by third-party service providers. If these architectures and third-party environments fail to operate as contracted, Astrana's systems could stop functioning for some time, placing Astrana's strategy, data, clients, and users at risk.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, particularly in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Management Policy, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the FFIEC guidelines for third-party risk management. The Vendor Management Policy is audited periodically in accordance with the Board of Directors approved Internal Audit plan.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: The Board is supported by and will receive reports from the Cybersecurity Risk Committee, a specialized group that includes senior executives and departmental representatives from information technology, legal, human resources, and operations. This committee is charged with the development of cybersecurity policies, evaluation of defense mechanisms, and oversight of the company's response to cyber incidents.

companyName: Urgent.ly Inc.

ticker: ULY


text: Under its charter, the audit committee is charged with discussing our major financial, information technology and cybersecurity risk exposures and the steps management has taken to monitor and control such exposures as well as the oversight of management's plans to address such risks. One member of our audit committee and board of directors has a strong background in information technology and cybersecurity risk management through service in related senior executive positions of other publicly traded companies meets regularly with our CISO to discuss our cybersecurity risk management processes.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Among the risks assessed is the risk of a cybersecurity incident at a third-party service provider. To evaluate and manage this risk, the cybersecurity team conducts due diligence in connection with onboarding new vendors and performs annual due diligence with our key third-party vendors. Our due diligence process includes inquiries regarding risk management, human resources security, physical and environmental security, compliance, business continuity and contractual obligations. We also seek to collect cybersecurity audit reports and other supporting documentation for review. In addition, we have processes in place to evaluate the potential impact to our IT networks and systems when we learn of a significant cybersecurity event, including contacting our key vendors to determine if they were impacted and if any Company data was compromised. In addition to the foregoing, the Company's Internal Audit team assesses the design and test the effectiveness of cyber controls, and annually, as part of its internal controls testing, performs a review of service auditor reports for in-scope application vendors.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: As of the date of this 2023 Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risk titled "Our business could be negatively affected by security threats. A cyberattack or similar incident could occur and result in information theft, data corruption, operational disruption, damage to our reputation or financial loss," the sophistication of cyberattacks continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. Accordingly, no matter how well the Company's controls are designed or implemented, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. In light of these risks, the Company has also developed cybersecurity detection and response protocols as described below to attempt to mitigate the impact in the event of a breach.

companyName: Callon Petroleum Co


text: Management is accountable for our day to day risk management activities. With the assistance of our third-party IT and cybersecurity team, we employ a range of tools and services, including a governance, risk and compliance platform, to inform our managements' risk identification and assessment relating to our technology program. With this platform, we map our cybersecurity and risk management program to the Center for Internet Security ("CIS") framework.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: Additionally, to best position Piedmont Lithium to avoid cybersecurity incidents, we, among other things, conduct employee trainings and, where appropriate, utilize a coordinated procurement process to bring consistency, compliance, and interoperability to the hardware, software, and services we obtain from vendors and other business partners. This coordinated procurement process includes, in addition to other safeguards, review by our information technology and legal departments to address any security concerns before any vendor or business partner is granted access to our information systems.

companyName: Piedmont Lithium Inc.


text: The audit committee has formal oversight responsibility for cybersecurity, as delegated by our board of directors, and is responsible for reviewing our policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, our Chief Administrative Officer, Chief Technology Officer ("CTO"), and/or Chief Information Security Officer ("CISO") provide semi-annual updates to the audit committee with respect to cybersecurity incidents, mitigation, threats, risks, and management, which are also communicated to the full board.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats which have been integrated into the Company's overall risk management strategy and processes. The Company seeks to address cybersecurity risks through a comprehensive approach that is focused on implementing robust protective measures, promoting user awareness and education, continuously monitoring for potential threats, and swiftly responding to any security incidents to ensure the confidentiality, integrity, and availability of sensitive information.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: As part of our business operations, Western Digital engages with a number of third parties, including but not limited to, online software service providers, vendors, consultants, and partners. Each of these third-parties must be cleared through a formal cybersecurity risk assessment process before being allowed to integrate with Western Digital's information systems, access confidential data, or provide electronic services to members of our workforce. Additionally, further scrutiny is applied during the post-assessment onboarding process in order to fine-tune access rights to limit privileges to those necessary to enable the related service, resulting in a least-privilege level of access.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Management Leadership Team, with oversight from the Board of Directors, plans to implement a comprehensive cybersecurity program, including incident response process, aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and NIST Computer Security Incident Handling Guide (NIST SP 800-61) to assess, identify, address and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: Director of SNM and Chief Financial Officer report material cybersecurity risks to our board of directors based on their and the ISS Committee's assessment of risk.

companyName: Powerfleet, Inc.

ticker: AIOT


text: Our management team has implemented a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Passage BIO, Inc.

ticker: PASG


text: The Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives quarterly updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Apellis Pharmaceuticals, Inc.

ticker: APLS


text: Joshua Kobza. Mr. Kobza, age 38, was appointed Chief Executive Officer of RBI effective March 1, 2023. Prior to that, Mr. Kobza served as Chief Operating Officer of RBI from January 2019 to March 2023, as Chief Technology and Development Officer of RBI from January 2018 to January 2019, and as Chief Financial Officer of RBI from December 2014 to January 2018. From April 2013 to December 2014, Mr. Kobza served as Executive Vice President and Chief Financial Officer of Burger King Worldwide. Mr. Kobza joined Burger King Worldwide in June 2012 as Director, Investor Relations, and was promoted to Senior Vice President, Global Finance in December 2012.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: The Board of Directors (the "Board") recognizes the need for continually monitoring our information security risks and cybersecurity initiatives. The Audit Committee of our Board undertakes the primary oversight responsibility over our cybersecurity risks and information security controls. Management briefs the Audit Committee on information security matters at each quarterly meeting of the Audit Committee. In addition, management updates the Audit Committee regarding any potentially material cybersecurity incidents, if any, as well as any incidents with lesser potential impact. In addition to the role the Audit Committee plays in overseeing enterprise and cybersecurity risks, the Environmental, Social and Governance ("ESG") Committee reviews and oversees our overall cybersecurity program, including its strategy and processes, and is updated by management on the status and development of the cybersecurity programs at each of the ESG Committee's meetings.

companyName: NOVANTA INC

ticker: NOVT


text: While we take cybersecurity seriously, we mitigate the common cybersecurity risks that many companies face by greatly limiting the accessibility of and our reliance on our cyber profile and web-based activities. Of our seven employees (four full-time, three part-time), a total of three employees plus one third-party information-technology consultant (our "IT Consultant") that we contract with have access to our cyber system. No vendors or customers have access to our system, which to some extent minimizes the risk of unauthorized access. No part of our business entails third-party members of the public accessing our accounts, making purchases, or ordering products or services, which also potentially reduces our risks of cyber-attack and minimizes the potential consequences if such an attack were to occur. In addition, although we do have a website, it is maintained offsite and is not connected to our file server, which is maintained separately in our office rather than being connected to the internet or linked to any third-party cloud storage system.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: Our Board, in coordination with the Audit Committee, oversees our risk management approach, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent expert reviews, the threat environment, technological trends, and any material risks identified with our third parties. The Audit Committee also receives prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents until they have been remediated. Our HIT, Audit Committee and Board review and discuss our approach to cybersecurity risk on an annual basis.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Partnership management considers risks from cybersecurity threats as a component of its entity-wide risk assessment that includes various processes and procedures to assess, identify, and manage material risks. The Partnership uses a variety of information technology solutions in the operation of its business, all of which are maintained by reputable third-party providers, including an information technology managed services system provider that is an affiliate of Greystone.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S. in Computer Science from University of Washington and has over 18 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: In an ever-evolving cybersecurity landscape, Adient has established a dynamic and comprehensive security posture. Adient implements a variety of technical, physical, and organizational measures to mitigate the risks associated with cyber threats. Adient's strategy encompasses an incident response policy with scenario-based playbooks, a detection and response program, and a vulnerability management program. Additionally, Adient maintains disaster recovery and business continuity plans, and conducts regular risk assessments. Systems monitoring and employee awareness training further fortify Adient's defenses. To underscore Adient's commitment to information security, Adient has secured Trusted Information Security Assessment Exchange ("TISAX") certification at multiple international locations, ensuring Adient meets industry recognized benchmarks for protecting data.

companyName: Adient plc

ticker: ADNT


text: One of the functions of our Audit Committee is to identify principal risks related to our company and ensure implementation of appropriate systems to manage these risks, including risks from cybersecurity threats.

companyName: RenovoRx, Inc.

ticker: RNXT


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.

companyName: SeaStar Medical Holding Corp

ticker: ICU


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including but not limited to secure web gateways, secure e-mail gateways, multi-factor authentication, endpoint detection and response, cloud security posture management, privileged access management, firewalls, intrusion detection/prevention systems, and web application firewalls.

companyName: LKQ CORP

ticker: LKQ


text: As part of our incident detection and response processes, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within First Advantage (including the interim CISO, Chief Financial Officer, and General Counsel) and to the Audit Committee and Board of Directors based on incident materiality. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our interim CISO, our Chief Global Compliance Officer, and our General Counsel.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Our information security program is managed by a senior director who reports to the Chief Information Officer (CIO), providing routine security program updates and briefings. The current senior director has more than 25 years of experience in cybersecurity, federal law enforcement, and cyber investigations, while possessing the required subject matter expertise, skills, experience, and industry certifications expected of an individual assigned to these duties. Our information security team, which includes the CIO and senior director, as well as additional professionals, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. Our CIO provides regular updates to our Chief Executive Officer and other members of management. The Audit Committee of the Board of Directors is responsible for oversight of the Company's cybersecurity risk exposure and the CIO provides reports to the Audit Committee, as well as the full Board of Directors, at least annually. The reports to management and our Board include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. For the year ended December 31, 2024, we are not aware of any material cybersecurity incidents.

companyName: INSMED Inc

ticker: INSM


text: Exelon maintains a single, centralized cybersecurity incident response program and plan that aligns with NIST CSF by integrating the identify, determine/classify, escalate and respond functions (which track the lifecycle of an event or incident). Security threats and incidents are identified and assessed to determine potential impact and escalated to senior cybersecurity management and the CISO. The CISO directs the security incident response team to contain, eradicate, and recover from an active threat. Exelon leverages the expertise of dedicated incident response vendors that can provide timely and specialized support to respond and recover from an event. The CISO and a cross-functional team convene as needed to evaluate cybersecurity events, including third-party events. The legal and compliance departments provide incident response support to the CISO, manage cybersecurity-related legal and compliance issues, and direct materiality evaluations using both qualitative and quantitative factors for each Registrant.

companyName: EXELON CORP

ticker: EXC


text: The Principal Privacy Officer is responsible for overseeing the determination of whether a breach occurred, coordinating with third parties handling protected information, and ensuring compliance with legal obligations. Forensic investigators, provided through AudioEye's cyber insurance or as deemed necessary by the Principal Privacy Officer, will analyze the breach to understand its cause and extent. A communication plan will be developed by Marketing, Legal, and Human Resources to inform internal employees, the public, those directly affected, and regulatory authorities, as necessary to help ensure all notifications comply with relevant laws and regulations.

companyName: AUDIOEYE INC

ticker: AEYE


text: Each of the Board and regional and country leadership boards may receive periodic presentations and reports on cybersecurity risks. In the event of a material cybersecurity incident, the Board will receive prompt information and ongoing updates about the incident. The Company has an established issue escalation protocol for technology incidents, including cyber related incidents. The Company's technology incidents and risks are tracked and rated. Items that are rated as "critical" are discussed in the TRCC, and escalated to the GRC as appropriate. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's Global Chief Information Security Officer. The CISO and regional/country information security officers regularly present to the Company's regional and country leadership boards on material cyber risks and the Company's information security posture and strategy.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: Our Incident Response Plan provides a framework for responding to cybersecurity incidents. The plan governs activities such as preparation, detection, coordination, eradication, and recovery, as well as appropriate escalations to the Company's senior management and Board and disclosure under applicable rules and regulations. The Incident Response Plan is routinely reviewed and updated as appropriate by our Vice President – Information Technology and other senior management members.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Our Board of Directors has responsibility for oversight of management's cybersecurity risk program and receives regular updates from our CIO. These updates, provided on a semi-annual basis, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and progress in enhancing the Company's cybersecurity posture.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: The CISO provides quarterly updates about the Company's cybersecurity program to the BTTC. Updates may include topics such as management's efforts to identify and monitor risks, investments to improve the Company's detection and response systems, the results of risk assessments, compliance with controls, vendor oversight, strategic technology planning, and if necessary, the status of any new, ongoing, or prior cybersecurity incident. The CISO also periodically attends the BTTC meetings; the CIO regularly attends the meetings.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: Our information security team and our third-party security service providers actively monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, ensuring timely response and resolution. Processes are in place to inform relevant management positions and committees about emerging threats and incident response activities. The Director of Information Security provides regular updates on cybersecurity risks and incidents to the Board of Directors, the SPMC, and IT leadership.

companyName: EXPONENT INC

ticker: EXPO


text: Our cybersecurity incident management plan includes the following, among other things: • The SVP-IT leads the team in the development, documentation, review and testing of security procedures and incident response procedures. Beyond initial creation, procedures are continually re-assessed, augmented, updated, and tested on an ongoing basis; • The SVP-IT works with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The SVP-IT is responsible for launching the Cybersecurity Incident Response Team (CIRT) if necessary, and for notification to the Chief Executive Officer, who in turn will contact the Board of Directors and Government Security Committee in order to validate the response is being addressed appropriately. • The CIRT team, in consultation with outside experts if needed, is responsible for the following: o Initial containment; o Analysis to establish root cause of incidents, identification and evidence collection;

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Training efforts now include quarterly updates on emerging threats such as AI-enabled phishing and ransomware attacks. Our ongoing business continuity and disaster recovery plans complement these measures.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: The Company has adopted a defense-in-depth philosophy that relies on multiple systems and processes to reasonably provide for the confidentiality, integrity and availability of our systems, networks and data. Features of our information security include: • Documentation: We have written policies and procedures that delineate the roles and responsibilities of the Company's Board of Directors, executive management and other employees, as well as outside parties, with respect to the various aspects of the information security program. This documentation helps to align the entire information security program with our efforts to maintain the integrity of the Company's cybersecurity. These policies and procedures are reviewed and updated at least annually. • Separation of duties: Separation of duties means that, where appropriate, a task is designed to ensure that more than one person or group is responsible for its completion. We believe that separation of duties helps to prevent fraud, misuse or other security compromise, and we apply this concept when we delegate administrative and oversight responsibilities to multiple groups for certain aspects of the information security program, including identity and access management, network management, system administration, policy oversight, monitoring and alerting. • The principle of least privilege: Access approval for the Company's employees is coordinated between an employee's manager, the Company's human resources department and the information systems administrator. The goal is to give an employee access rights to our data, applications and other information resources only to the extent necessary for the employee to perform the functions of the particular job. Any change in employment responsibilities that requires access changes is implemented using the same access approval procedures. Finally, all remote access into the Company's networks must be approved by the Chief Information Security Officer (which we refer to as the "CISO"). • Vulnerability and patch management: The Company's vulnerability management program includes internal and external scanning using third-party tools and services. Software patches are deployed based on criticality of vulnerability. Further, we track our performance in implementing patches, and if implementation timing falls below performance expectations, management will take steps to identify and remediate the root causes of implementation delays. • Risk assessments: At least annually, management conducts risk assessments to assess the existence, severity and trends of cybersecurity risks and other risks that the Company's information security program faces. The scope of an individual risk assessment can be the whole organization, parts of the organization, an individual information system, specific system components, or services. • Log management: System security logs are consolidated by the Company's Security Incident and Event Management system and are reviewed via both automatic and manual processes for anomalous behavior. • Incident response: The incident response process is designed to, among other things, promptly elevate a cybersecurity threat or incident to the parties responsible for leading our efforts to identify, contain and mitigate the threat or incident, notify impacted customers or other third parties and comply with applicable law, regulations and regulatory expectations.

companyName: RENASANT CORP

ticker: RNST


text: Our goal is to safeguard our information systems and protect the confidentiality, integrity, and availability of both our and our customers' data. This includes measures related to cybersecurity incidents, risk management, management roles, and governance.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company to date, including our business strategy, results of operation or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Data breaches and cyber-attacks could compromise our intellectual property or other sensitive information and cause significant damage to our business, reputational harm and financial loss."

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX


text: As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: Our board of directors has oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the board, as appropriate.

companyName: Rain Enhancement Technologies Holdco, Inc.

ticker: RAIN


text: To help identify and assess risks, we and our Manager engage third-party advisors, leveraging standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.

companyName: FTAI Aviation Ltd.

ticker: FTAI


text: At the management level, our CISO leads our enterprise-wide cybersecurity program in partnership with other business leaders, including our General Counsel and Chief Operating Officer. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above. Our CISO has over 25 years of experience in techn ology and information security operations across a diverse range of business sectors. In addition, on October 15, 2025 Michael Montoya, a former member of our Board of Directors, was appointed as the Company's Chief Technology Operations Officer. In his role, Mr. Montoya will lead the enterprise-wide strategy and execution of our enterprise-wide cybersecurity program with our CISO, and in partnership with other business leaders, including our General Counsel and Chief Operating Officer to further embed security into every aspect of how F5 operates.

companyName: F5, INC.

ticker: FFIV


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Company's Chief Information Officer, other members of Management and a dedicated Cybersecurity team. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, logical access controls, and endpoint protection, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are regularly evaluated and updated. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Network Penetration Testing: The Company performs an internal and external network penetration test led by its Internal Audit team and addresses any findings in a timely manner.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: Our information security team is led by our Senior Vice President of Engineering and our Head of Information Security, who together have over 35 years of technology industry experience and expertise in information security, cybersecurity, and distributed systems. This team is responsible for our information security program and protocols, including managing and coordinating efforts to prevent, mitigate, detect, and remediate cybersecurity incidents, and escalating significant security risks or incidents to executive management.

companyName: Coursera, Inc.

ticker: COUR


text: Our IT polices are designed to address and manage all aspects of our IT environment, including cybersecurity, and we review and update our policies regularly as part of our risk management processes. We deploy both an internal Protection of Personal Identifiable Information Policy and a publicly available Privacy Notice to help us understand and respect the privacy of the individuals whose data we have custody over. We monitor our data collection practices, policies and notices in an effort to comply with the evolving nature of applicable data privacy and security laws.

companyName: Antero Midstream Corp

ticker: AM


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents to date.

companyName: Saxon Capital Group, Inc./DE


text: Daily risk management and oversight of the Company's cybersecurity posture is the responsibility of the Director of IT and Security, who directly reports to the CTO, and the cybersecurity professionals on his team. All of these team members have extensive experience in networking, cloud and on-premise infrastructure, software development, corporate IT, intelligence, Linux system administration, and data center operations. These individuals are responsible for approving and implementing security operations, security program development, and governance, risk and compliance related to cyber matters.

companyName: Spire Global, Inc.

ticker: SPIR


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: Operations (Detect and Respond): In the event of a cybersecurity incident, the Elanco Information Security Incident Response Plan (ISIRP) defines the roles, responsibilities, procedures and reporting processes required to respond effectively to cybersecurity incidents. Responses to information security incidents are led by two teams: 1) the Security Operations Center (SOC) team, which conducts the initial technical triage and analysis, and 2) a cross-functional team of leaders from the IT, Legal, Human Resources and Finance functions (the Cyber Lead team), which is engaged by the CISO on an as needed basis, based on incident severity. The Cyber Lead team is tasked with confirming the severity of a cybersecurity incident and bringing together the proper resources to lead the corporate-wide response to such incidents, including engaging the Company's Disclosure Committee, in the event an incident may rise to a level deemed material to us. In the event an incident is escalated by the Cyber Lead team, the Disclosure Committee, led by our Chief Financial Officer and General Counsel, would evaluate all estimable quantitative and qualitative factors, to determine if a Current Report on Form 8-K would be required under Item 1.05, "Material Cybersecurity Incidents."

companyName: Elanco Animal Health Inc

ticker: ELAN


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management team. We have established a cybersecurity governance framework that encompasses policies, procedures, and controls designed to support cybersecurity risk management practices. Our Senior Information Systems Manager is responsible for assessing and managing material risks from cybersecurity threats. This position reports directly to our Senior Vice President of Strategy and Information Technology. In addition, we have retained Virtual Chief Information Security Officer services to support our cybersecurity risk management and governance practices. Such individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our Managed Security Services Provider and our Board of Directors on any appropriate items. Our Board of Directors oversees the cybersecurity program and receives program metrics as well as information related to identified cyber-related risks when meeting with the company's management.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: Certain representatives of Angel Oak Capital, including our Manager, regularly report (not less frequently than annually) to the Audit Committee as well as to our full Board of Directors, as appropriate, on cybersecurity matters, primarily through presentations by the Head of IT. Such reporting includes updates on the Cybersecurity Program as it impacts us, the reports and services provided by the IT Service Provider, the external threat environment, risk management strategies and any cybersecurity threats or incidents. Presentations to the Audit Committee or our full Board of Directors may also be provided from time to time by the IT Service Provider or another third party firm providing cybersecurity-related services for us or Angel Oak Capital, including our Manager, as deemed necessary or appropriate. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our ISO. The ISO's experience includes prior leadership roles within the Company, where they developed an expert level of understanding of the intersection between financial regulations and cloud-based technologies.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks as well as management's implementation of our cybersecurity risk management program. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: Our Chief Information & Security Officer has over 30 years of experience in the cybersecurity industry, including, prior to joining Alight in 2021, as the SVP, Chief Information Security Officer at a multinational health insurance and health services company in the Fortune 100, and as head of cybersecurity for a U.S.-based financial services company in the Fortune 500, as well as for a federal banking institution and for a professional services company in the Fortune 500 specializing in information technology services. Our Chief Information & Security Officer reports directly to the Chief Technology and Delivery Officer and meets regularly with other members of senior management and the Audit Committee.

companyName: Alight, Inc. / Delaware

ticker: ALIT