text: Material Cybersecurity Risks, Threats, and Incidents Due to the evolving nature of cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we are not aware of having experienced any material effects or reasonably likely material effects on our Company, its business strategy, results of operations, or financial condition resulting from cybersecurity threats or incidents to date, as a critical infrastructure provider, we may be a target of well-funded and sophisticated adverse actors. There can be no guarantee that we will not be the subject of future risks or incidents that have such an effect, or that we are not currently the subject of an undetected risk or incident that may have such an effect.

companyName: UNION PACIFIC CORP

ticker: UNP


text: In our industry, the continuous functioning of information systems is of the utmost importance. Leveraging information technology systems, we collect, process and safeguard sensitive data and utilize automated tools to operate our plants.

companyName: MIDDLESEX WATER CO

ticker: MSEX

secItem: Item 1C


text: Our cybersecurity program is designed to protect our information and operations from external and internal cyber threats while supporting business resiliency. We employ a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: The Company identifies, assesses, and manages cybersecurity risks as part of its risk management program. Our cybersecurity strategy aligns the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), applicable regulatory guidelines and other industry practices to secure critical information systems and sensitive data.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: At a management level, our cybersecurity risk management program is led by our Chief Information Officer, who reports to our Chief Executive Officer. Under our Chief Information Officer's leadership, the cybersecurity team implements and provides governance and functional oversight for cybersecurity controls and services. The team's credentials include Certified Information Security Manager and Certified Information Systems Security Professional.

companyName: TopBuild Corp

ticker: BLD


text: Our incident response plan provides clear communication protocols, including with respect to members of senior management, including the CEO, CFO and COO, internal and external counsel, our management disclosure committee and the Audit and Cyber Risk Committee and the Board of Trustees. With respect to our SEC reporting obligations related to a cybersecurity incident, as set forth in the incident response plan, the leaders of the incident response plan regularly brief the management disclosure committee on developments related to an incident. In addition, the COO and CTO/CISO engage with external legal counsel with respect to other regulatory reporting obligations related to an incident.

companyName: LXP Industrial Trust

ticker: LXP


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment; • individuals, including employees and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Cipher Digital Inc.

ticker: CIFR


text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding and we continue to reassess vendors using a risk-based approach. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. Our service providers are contractually required to notify us promptly of information security incidents occurring on their systems that may affect our systems or data, including personal information.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: Cyber Risk Management and Strategy Processes to identify, assess, and manage risks presented by cybersecurity threats are integrated into our overall ERM program and are informed by industry cybersecurity standards. Our CISO, with support from the information security team, leads a risk assessment process to regularly evaluate cybersecurity risks. This process is also supported by periodic security testing and monitoring.

companyName: Toast, Inc.

ticker: TOST


text: To date, Londax Corp. has not experienced any material cybersecurity incidents, and no specific threat has materially affected or is reasonably likely to materially affect the Company's business strategy, operations, or financial condition. However, the Company recognizes that its reliance on cloud infrastructure and digital communication tools poses an ongoing cybersecurity risk and will continue to assess and strengthen controls as operations scale. Management plans to formalize its cybersecurity policies and implement internal training protocols as the business grows.

companyName: Londax Corp.

ticker: LDXC


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including having a third-party independent qualified and accredited advisor review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: While we have experienced minor cybersecurity threats in the past, such as spear phishing or smishing (SMS phishing), to date no such threats have materially affected the Company or our financial position, results of operations and/or cash flows.

companyName: Legacy Education Inc.

ticker: LGCY


text: Our IT department and Company management work in close collaboration to check and improve our safeguards as part of our overall risk management program. This collaborative effort extends to our employees, whom we regularly train on these safeguards and keep informed of our cybersecurity policies through regular communications across the Company. This collective commitment to cybersecurity ensures that everyone in the organization is aware of their role in maintaining our security.

companyName: Global Clean Energy Holdings, Inc.


text: The Company's management, including through its oversight of the Company's policies and procedures regarding cybersecurity, is actively involved in the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting or with the potential to impact the Company. Management's oversight is augmented through the Company's Enterprise Risk Management Framework, which includes risk and control assessments related to the Company's cybersecurity program. Additionally, the Company's Internal Audit Group periodically audits aspects of the Company's cybersecurity program and reports the results of such audits to the Board's Audit Committee, and an external audit firm conducts an annual SOC 2 attestation of the Company's information security controls.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Incident Response Procedures We have in place a cyber incident response plan outlining procedures to follow in the event of a cybersecurity incident. Under the plan, we established a cross-functional critical response team (CRT) with expertise in various subject matter areas responsible for initiating and leading our incident response procedures. The CRT is under the direction of our Chief Information Officer and is comprised of our Director of Information Technology, Chief Accounting Officer, Assistant General Counsel and Chief Compliance Officer, Senior Manager of Risk and Insurance, and certain other members of management. The plan provides that our CRT will conduct an impact assessment in the event of a cybersecurity incident meeting pre-established criteria, or which may otherwise impact the operations or finances of the Company. If any such cybersecurity incident is determined by the CRT to have the potential to materially impact the Company, such event would be elevated for further review and assessment by a senior leadership team consisting of our Chief Executive Officer, Chief Financial Officer, General Counsel and other members of our executive leadership team. Under certain circumstances, such review and assessment would include reporting to and oversight of the Board.


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: continuous monitoring for internal and external threats; regular evaluations of our cybersecurity program, including periodic external reviews; and industry benchmarking. We are implementing cybersecurity awareness trainings for all employees. Our program leverages standard industry frameworks to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: As part of the Company's broader information security program, the cybersecurity program includes a defense-in-depth model that utilizes a variety of techniques and tools for protecting against, detecting, responding to and recovering from cybersecurity incidents ("Incidents"). The Company's cybersecurity program is designed to prioritize detection, analysis and response to known and anticipated cyber threats and effectively manage cyber risks and resilience against Incidents. The Company's program aligns its program using portions of several industry and regulatory frameworks to measure its program and progress, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST 800-53, International Organization for Standardization Information Security Management Systems ("ISO 27001"), the CIS Critical Security Controls and the System and Organization Controls 2 Type 2 ("SOC2 Type 2").

companyName: ROBERT HALF INC.

ticker: RHI


text: The CCO, with input from the Information Security Team, meets regularly with and provides updates on cybersecurity developments to, members of the executive management team.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: The CIO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. The CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the ITSC and CRMC.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: Our employees are also an important part of protecting our digital and technical environment. A key area of the cybersecurity program is the education of employees regarding cybersecurity using security awareness training, security bulletins and phishing simulations to reinforce training on a quarterly basis. Security awareness training covers all network users. On an annual basis an Acceptable Use Policy ("AUP") is distributed to employees through our Learning Management System for understanding and acknowledgement. Additionally, all new employees are provided the AUP by Human Resources and receive initial security training upon being granted access to our network.

companyName: Primoris Services Corp

ticker: PRIM


text: In 2018, in recognition of the unique nature of cybersecurity threats and the desire to apply focused oversight of cybersecurity risk, the Company's Board of Directors formed a Cybersecurity Subcommittee (the "Subcommittee") providing oversight of the Company's cybersecurity posture and reporting to the Board's Audit Committee. The Subcommittee consists of three independent directors with experience and/or expertise in cybersecurity management and oversight. The Subcommittee meets regularly on at least a quarterly basis. The Subcommittee has full access to management and consultants engaged by management and receives regular reporting directly from the Company's chief information officer, head of cybersecurity, internal audit and the legal function, as well as third-party assessments of the Company's cybersecurity processes. In addition, the full Board of Directors receives a report on cybersecurity annually, or as necessary.

companyName: BELDEN INC.

ticker: BDC


text: Our Vulnerability Management Policy and Security Incident Response Plan are designed to escalate certain cybersecurity vulnerabilities and incidents, respectively, to members of management depending on the circumstances, including the Vice President, Director and other members of the Engineering Security team. Our Security Incident Response Plan also provides for escalations to our General Counsel and other members of the Legal team, as well as for notification of our Chief Technology Officer. The Engineering Security team and other members of management work with the incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.

companyName: YELP INC

ticker: YELP


text: CRH's operating subsidiaries and business units use a variety of tools and processes to identify and manage material cybersecurity risks. Across the Company, CRH utilizes multiple monitoring tools and practices to identify and detect unusual activities and/or potential cybersecurity incidents, including potential system breaches, and to verify the effectiveness of protective measures. CRH's operating subsidiaries and business units implement various risk mitigation strategies, including continuously strengthening security measures, improving incident response plans through post-incident evaluations and assessments, investing in security technologies, providing regular and focused employee training, and transferring risk through cybersecurity insurance.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: The Board's Enterprise Risk Committee oversees all of Comerica's risk management policies, procedures and practices, including those related to cybersecurity. Senior management generally reports quarterly, or more often as necessary, to the Enterprise Risk Committee on technology risks, including risks from cybersecurity threats. The Board's Audit Committee and the Board as a whole also receive such reports as part of their risk management oversight roles. Board members have direct access to senior management (and others, at their request) on matters related to cybersecurity threats and may direct questions to senior management and request further information as they see fit to fulfill their oversight responsibilities.

companyName: COMERICA INC

ticker: CMA


text: Our regular interactions with third party vendors and suppliers also pose a cybersecurity risk that could adversely impact our business or employees. We conduct information security assessments before onboarding and upon detection of an increase in risk profile. In addition, we require providers to meet appropriate security requirements, controls and responsibilities and include additional security and privacy addenda to our contracts where applicable. We also make available cybersecurity education and awareness materials to our suppliers.

companyName: BRUNSWICK CORP

ticker: BC


text: As new threats to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our IT Director.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: These efforts complement our current cybersecurity risk management program, which include a security team that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. We also conduct employee cybersecurity awareness training upon onboarding to the company. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: scPharmaceuticals Inc.


text: The underlying controls of our cybersecurity risk management program are based upon industry standards for cybersecurity and information technology. Our corporate information technology environment aligns with Center for Internet Security Critical Security Controls ("CIS CSC"). Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology's publication (NIST 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO") and, the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015). Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems and respond to cybersecurity incidents.

companyName: CONDUENT Inc

ticker: CNDT


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Audax Credit BDC Inc.


text: The IT Technician plays a pivotal role in informing the board of directors on cybersecurity risks. The IT Technician and members of senior management meet regularly and provide comprehensive briefings to the board of directors. These briefings encompass a broad range of topics, including: the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies;

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Our programs are regularly evaluated by external experts with the results of those reviews reported to the senior leadership team and the Board. We also actively engage with key vendors, industry participants, and intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Clearwater Paper Corp

ticker: CLW


text: Cybersecurity is acknowledged as an important enterprise risk at Adtalem. Our Audit and Finance Committee ("AFC"), comprised entirely of independent directors, is responsible for oversight of risks from cybersecurity threats. The Chair of our AFC has received a CERT certificate in Cybersecurity Oversight from Carnegie Mellon University in partnership with the National Association of Corporate Directors. Our CISO briefs the AFC on cybersecurity matters, including the evolving threat landscape and Adtalem's threat mitigation efforts, four times a year. At each quarterly meeting, the Chair of our AFC also briefs the full Board on cybersecurity matters discussed at AFC meetings. Cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of our annual enterprise risk management ("ERM") assessment. In February 2024, our full Board reviewed and discussed best practices for cybersecurity and cybersecurity disclosures with an external third party. The subsequent Board discussion included a focus on the cyber threat landscape, responses to cyberattacks, risks posed by third-party vendors, and best practices to address cyber risks.

companyName: Covista Inc.

ticker: CVSA


text: Our program is developed and informed by industry best practices such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and input from expert third-party consultants. It's important to note that our adoption of the NIST CSF serves as a blueprint to aid in the identification, assessment, and mitigation of cybersecurity risks pertinent to our operations, rather than as a certification of compliance with specific technical standards or requirements.

companyName: Erasca, Inc.

ticker: ERAS


text: Please see Item 1A. Risk Factors in this Form 10-K for more information regarding cybersecurity-related risks that could materially affect our business strategy, results of operations, or financial condition, including under the heading "Our business may be adversely affected by information technology disruptions".

companyName: Enpro Inc.

ticker: NPO


text: Our Board engages in risk oversight on a broad range of matters related to cybersecurity. They demonstrate independence from management and exercise oversight for the development and performance of our internal information security controls. Our CISO provides quarterly updates to the Audit Committee and meets regularly with our Chief Executive Officer and other senior management members to discuss cybersecurity matters. Our Audit Committee regularly reviews metrics and updates related to Cybersecurity Threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape. Additionally, we consider director and Audit Committee member Alissa Abdullah to be a cybersecurity expert because of her background and experience, with a Ph. D. in information technology management, current service as Mastercard Incorporated's deputy chief security officer, and prior service in high level information and technology management roles.

companyName: SMARTSHEET INC


text: The Company has implemented the following processes to assess, identify, and manage material risks from cybersecurity threats: • Annual assessments, by an independent third party, of the Company's cybersecurity framework under the National Institute for Standards and Technology ("NIST") cybersecurity framework; • Penetration tests conducted by a third-party; • Simulation of attacks on the Company's systems by third-parties to test the Company's systems and protections;

companyName: CARTERS INC

ticker: CRI


text: Monitor Cybersecurity Incidents The Executive Director of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In cooperation with the Executive Director of IT, the Associate Director of IT Infrastructure and Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Executive Director of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our cybersecurity department, led by our CISO, has primary responsibility for our enterprise-wide information security program and our risk management team works closely with our cybersecurity department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs on an ongoing basis. Our current CISO has been in that position since October 2022 and has broad information technology experience as a result of that role and past work experience. Our CISO manages a team with broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats, business continuity and disaster recovery, and regulatory compliance. The cybersecurity department receives support to maintain the information security program from other functions, such as information technology, corporate security, internal audit and legal. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from the internal team. We also engage and rely on third parties to support our information security program, such as assessors, consultants, contractors, auditors and other third-party service providers. In addition, we maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and based on the information and information systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: NEW YORK TIMES CO

ticker: NYT


text: The Director's presentation at the Company's monthly senior leadership meeting, led by the CEO, includes the results of the most recent scans and routine testing. Should a cybersecurity incident occur, the Director would immediately report it to the CEO, who would report any material cybersecurity breach promptly to the Company's Board of Directors.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: As of and for the year ended December 30, 2023, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.

companyName: GlobalTech Corp

ticker: GLTK


text: In an effort to detect and defend against cyber threats, the Company annually provides its employees with various cybersecurity and data protection training programs. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents promptly to the Company's centrally managed cyber defense and security operations.

companyName: COCA COLA CO

ticker: KO


text: Oversight and Governance Our cybersecurity risk management program is a significant part of our overall risk management program, which has been delegated by our Board of Directors to the Audit Committee of the Board of Directors ("Audit Committee"). As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing, assessing, and considering, in consultation with management and the Board, as appropriate, the overall risk management policies and procedures of the Company, including our major risk exposures such as cybersecurity.

companyName: Prime Medicine, Inc.

ticker: PRME


text: To assess and manage cybersecurity threats, the Company maintains an Incident Response Team comprised of members from the major business areas in the Company to ensure appropriate subject matter specialists are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Company's business strategy, results of operations or financial condition by following implemented processes. The Company has not identified any cybersecurity threats that have materially affected operations or financial position.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: Medallion Financial Corp. employs a Director of Information Security, and our main operating subsidiaries have similar functions and/or roles conducted by various individuals. Such information security leadership are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These individuals' expertise in information security and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams and third-party vendors about, and monitor, the prevention, detection, mitigation and remediation efforts relating to any cybersecurity incidents as part of the cybersecurity programs described above.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: Our cybersecurity framework incorporates a robust third-party information technology ("IT") risk management program to ensure our vendors meet our high security standards. We leverage industry best practices like Standardized Information Gathering ("SIG") and recognized security certifications, including SOC 2, ISO 27001, and PCI-DSS, to assess our vendors. We also conduct thorough penetration testing and require vendors to adopt appropriate security controls through contractual agreements.

companyName: RALPH LAUREN CORP

ticker: RL


text: Our Internal Audit department regularly assesses and reports to the Audit Committee on the effectiveness of our cybersecurity and information technology controls. Our Audit Committee reviews the Company's cybersecurity risk profile and risk management strategies at regular intervals. Management reviews with the Audit Committee categories of risk the Company faces, including cybersecurity risks, as well as the likelihood of the occurrence of cybersecurity risks, the potential impact of those risks and the steps management has taken to monitor, mitigate and control such risks. In addition, our CISO reports at least annually to the Board, and at least quarterly to the Board's Audit Committee, with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of Lazard's cybersecurity program. Updates on cybersecurity risks are reviewed at regular meetings of the Audit Committee and reported to the full Board.

companyName: Lazard, Inc.

ticker: LAZ


text: As detailed elsewhere in this Report, we also rely on information technology and other third-party vendors and strategic joint venture partners to support our business and operations, including our secure processing of personal, confidential, financial, sensitive, proprietary and other types of information, and to enable our connected product and service offerings. Despite ongoing efforts to improve our and third parties' ability to protect against cyber threats, we may not be able to protect all information systems or connected products and services. Cybersecurity incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. For a more detailed discussion of these risks see the discussion set forth under "Item 1A. Risk Factors" in this Report.

companyName: Xylem Inc.

ticker: XYL


text: Our Enterprise Risk Management Committee receives reports on the Company's cybersecurity program and developments from our Vice President of Information Technology. Our Enterprise Risk Management Committee and our Vice President of Information Technology report to the Company's Board of Directors at each of the regularly scheduled quarterly meetings. These reports include analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status;

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: In fiscal 2025, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors— Risks Related to Our Business and Industry" in this annual report on Form 10-K.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Nominating and Governance committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Nominating and Governance committee consists of members with years of experience in cybersecurity oversight.

companyName: Enovix Corp

ticker: ENVX


text: 4. Third Party and Vendor Management – The Company's Information Security team has established policies and processes to identify and oversee cybersecurity risks associated with using third party service providers and vendors. These include the following elements: • Access Control: The principle of least privilege is applied to manage user's access of Company's resources. User access is reviewed at least quarterly. • Vendor Management: One of the Company's Information Security policies is its Vendor Management Policy. This policy includes conditions for vendor evaluation, how the Company performs its evaluation, and steps for monitoring thereafter. • Privacy Impact Assessments: The Company's employees are trained to submit a Privacy Impact Assessment for review when there may be new access by a third-party to certain data or the Company may share information in a new way. The Privacy Impact Assessment is reviewed by the Information Security team to assess whether the proposed practices are manageable within the Company's cybersecurity environment.

companyName: QUINSTREET, INC

ticker: QNST


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management system and processes, and includes: • a team of professionals within our Global Technology Organization who are responsible for identifying and mitigating cybersecurity risks and managing our security controls and response activities; • risk assessment processes designed to identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • an annual tabletop exercise to simulate a response to a cybersecurity incident; and • mandatory training annually and upon hiring for all employees and contractors on data privacy and cybersecurity topics.

companyName: Broadcom Inc.

ticker: AVGO


text: The Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Periodic reports are given by senior management to the Audit Committee about material cyber events and our risk mitigation efforts.

companyName: Talen Energy Corp

ticker: TLN


text: Management's Assessment and Management of Cybersecurity Threats Members of the executive management team, along with others from senior management and others with varying areas of expertise, are engaged as part of our Cyber Risk Program: • Executive Vice President, Product Development & Infrastructure R&D: Direct management of our Cyber Risk Program falls within our Product Development and Infrastructure Research and Development team. The Executive Vice President (EVP) in charge of this team has extensive experience regarding cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as E2open. The EVP is a member of our Cybersecurity Subcommittee of our Disclosure Committee, which is responsible for helping to determine whether a Cybersecurity Incident is "material" for purposes of publicly reporting cybersecurity incidents. Our EVP chairs our management Cybersecurity Subcommittee. • General Counsel: Our General Counsel has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims and loss mitigation. Our General Counsel is a member of our Cybersecurity Subcommittee of our Disclosure Committee. • Senior Vice President, Information Security and Compliance: Our Senior Vice President (SVP) has direct management of our Cyber Risk Program. He manages the day-to-day operations, oversees our security analysts and engineers and participates in our Cybersecurity Subcommittee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Subcommittee: We have created a Cybersecurity Subcommittee of our management Disclosure Committee which includes, in addition to the EVP and General Counsel, the Chief Accounting Officer. The Cybersecurity Subcommittee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts and make recommendations to leadership. Additionally, the Chair of the Subcommittee shall convene a meeting when either: (a) he believes a reported incident or the occurrence of a series of related incidents, requires the analysis and discussion of the Subcommittee; or (b) when any member of the Subcommittee believes that such a discussion would be appropriate. Such meeting shall be convened within 48 hours of the incident, or sooner if reasonably practicable, to expedite a materiality determination for public company reporting purposes.

companyName: E2open Parent Holdings, Inc.


text: We have also instituted a separate process for communicating with the Audit Committee regarding any risks from an actual cybersecurity threat in the event we are the target of a specific cybersecurity incident. As part of our response to such an incident, members of the Incident Response Team would provide an initial awareness communication of the incident to our Chief Financial Officer then to the Chief Executive Officer who would in turn inform the Chairman of our Board of Directors ("Board Chair") and the Chair of the Audit Committee ("Audit Committee Chair"). Following an initial assessment of the incident by senior management and IT Systems personnel, we would provide a follow-up communication to the Board Chair and Audit Committee Chair and determine whether further escalation to the full Board of Directors is warranted.

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: The Company's Audit Committee and Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the policies, processes, procedures and controls pertaining to the management of the Company's information technology operations, including cyber risks and cybersecurity. The Company's Chief Information Officer ("CIO") provides quarterly reports to the Board of Directors regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company's policies, processes, procedures and controls for managing these risks.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: Management is responsible for the day-to-day handling of risks facing our Company. Our Board of Directors as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated risk management responsibilities with respects to cybersecurity to our Audit Committee. Specifically, the Audit Committee periodically reviews our cybersecurity policies, data security programs and plans that management has established to monitor compliance and assess preparedness. Our cybersecurity team is led by our CISO, who has over 20 years of experience in the cybersecurity space and is a Certified Information Security Manager (CISM). On an annual basis, at a minimum, our CISO or Chief Information Officer (CIO) present necessary updates on our cybersecurity risks and any material cybersecurity incidents. These updates include the following: (i) current cybersecurity threats, (ii) an overview of third-party risks, (iii) our cybersecurity roadmap, (iv) the maturity of our cybersecurity programs and/or (v) ongoing regulatory compliance.

companyName: Surgery Partners, Inc.

ticker: SGRY


text: Our information security program aligns with recommended practices in security standards issued by ISO, American Institute of Certified Public Accountants (SSAE18), National Institute of Standards and Technology ("NIST") and other industry sources. Specifically, we maintain several ISO certifications (ISO 27001, 27701, 27017, 27018, 27036), NIST 800-171 compliance, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. We have invested in our data security team, information security program, and security environment in an effort to identify, prevent, and mitigate cybersecurity threats and promptly identify and respond to cybersecurity incidents when they occur. Maintaining, monitoring, and updating our information security program to ensure that it remains reasonable and appropriate with respect to changes in the security threat landscape, available technology, security vulnerabilities, and legal and contractual requirements applicable to us, is a continuous effort.

companyName: Dayforce, Inc.

ticker: DAY


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Information Technology or IT department assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program.

companyName: Semler Scientific, Inc.


text: We are committed to appropriate cybersecurity governance and oversight. Our technology and cybersecurity program is the principal responsibility of our Chief Information Officer and CISO, each of whom have over 20 years of experience in information systems, including cybersecurity training and experience. Additionally, we have a Cybersecurity steering committee that includes senior representatives from our Legal, Finance and IT departments, which meets regularly to discuss cybersecurity matters.

companyName: BIOGEN INC.

ticker: BIIB


text: The use of multi-factor authentication for all remote users when they connect to the corporate network and the corporate email platform.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: Integrated Risk Management Our cybersecurity risk management program is an important component of, and is integrated into, our overall risk management process. Our Board, acting primarily through the Audit Committee, actively oversees the strategic direction, objectives and effectiveness of our risk management practices, including cybersecurity risk management, while management is responsible for the day-to-day management of the Company's risk exposure, subject to the direction and objectives established by our Board. As an important component of our risk management process, management reviews risks from cybersecurity threats and our programs for evaluating, mitigating and educating its employees regarding cybersecurity risks. The program includes a comprehensive set of security policies and procedures, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessments and penetration testing, to update our ongoing cybersecurity risk identification and mitigation efforts.

companyName: Liquidia Corp

ticker: LQDA


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, cybersecurity software providers, and certain testing firms.

companyName: Sonos Inc

ticker: SONO


text: The Audit Committee receives quarterly updates from the ciso or other members of the ciso's team with responsibility for oversight of our key cybersecurity program components. These updates include, as appropriate, ongoing changes in our external and internal cybersecurity threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cybersecurity and technology-related risks, cybersecurity incidents and our response to them, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness. The Impact Committee receives annual updates from our vice president, data privacy, on our data privacy practices, emerging risks, and evolving global privacy laws and regulations.

companyName: STARBUCKS CORP

ticker: SBUX


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Interruptions in or other compromises of our information technology systems or data or that of third parties upon whom we rely could adversely affect our business."

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Impact of Cybersecurity Threats As previously disclosed, we have experienced significant cyber incidents in the past, including in April 2023, that have impacted our operations and financial results. The related expense is reflected in "Acquisition, cyber incident, and other, net" on the Consolidated Statements of Operations for the year ended December 31, 2023, and any reserve balance is included in "Accounts payable and accrued expenses" in our Consolidated Balance Sheets as of December 31, 2024, and 2023. For additional information regarding such risks and the affects thereof on our business strategy, operations and financial condition, see Part I, Item 1A, Risk Factors – "We depend on information technology systems to operate our business. A failure of our information technology systems, cybersecurity attacks or a breach of our information security systems, networks or processes could cause business disruptions and the loss of confidential information and may materially adversely affect our business."

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure - Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."

companyName: Apollo Debt Solutions BDC


text: Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. Both the Board and the Audit Committee periodically review the measures we have implemented to identify and mitigate data protection and cybersecurity risks.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. As of the date of this Annual Report on Form 10-K, we are not aware of any material incidents or risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations, or financial condition. For a discussion of how material risks from cybersecurity threats could materially affect us, see "Risk Factors—Risks Related to Privacy, Cybersecurity, and Infrastructure—If sensitive information about our sellers and buyers or other third parties with whom we transact business is disclosed, or if we or our third-party providers are subject to cyber-attacks, use of our online marketplace could be curtailed, we may be exposed to liability, and our reputation would suffer."

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, external legal counsel, and dark web monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, which includes reviewing vendor security audits and reports.

companyName: Vor Biopharma Inc.

ticker: VOR


text: Maintaining disaster recovery and business continuity plans; and Emphasizing compliance with applicable laws, regulations and contractual obligations regarding the management of information security.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information about cybersecurity risks relating to our business, refer to Item 1A: Risk Factors included elsewhere in this Report.

companyName: Sensata Technologies Holding plc

ticker: ST


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems or sensitive data, or those of our third-party CROs or other contractors or consultants, or third parties with whom we work, may fail or suffer security incidents, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive data related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: Members of our Board each have a practical understanding of information systems, and the technology used in our business operations, as well as a recognition of the risk management aspect of cyber risks and cybersecurity; members of the Board are encouraged to review materials on these issues or attend informational sessions. The HSE & Technical Committee and/or the full Board receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.

companyName: UR-ENERGY INC

ticker: URG


text: As one of the critical elements of the Company's overall risk management approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading below titled, "Governance", the Board's oversight of cybersecurity risk management is supported by the audit committee's regular interactions with the Company's Head of Information Technology, and other members of management or a subcommittee thereof. • Collaborative Approach: The Company has developed a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also developing tools and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity managed detection and response. • Incident Response and Recovery Planning: The Company has developed a comprehensive incident response and recovery plan that addresses the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company has various controls relating to cybersecurity threats originating from third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with tools to address cybersecurity threats, and to communicate the Company's information technology policies, standards, processes, and practices.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: Cybersecurity risk management is a core tenet of our information technology security program. We have implemented various cybersecurity technologies, controls, and processes to ensure the integrity and availability of our infrastructure, data, and operations. We periodically review and modify these technologies and processes to align with the latest in industry best practices and an ever-changing threat landscape. risk assessment is performed on all new products and product updates; internal staff with security certifications, and we work with third parties to perform security vulnerability testing; to data protection laws are closely monitored and necessary changes are implemented; routine security training to employees and communicate any emerging threats; Review the security posture of all third parties that we engage; a comprehensive incident response plan; cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.

companyName: GAXOS.AI INC.

ticker: GXAI


text: Our parallel import vehicle business depended on the continuous functioning of our OA System, which tracked order status and monitored business workflows. Similarly, our logistics and warehousing business relies on the functioning of our freight forwarding software, GoFreight. The secure handling of information is crucial, particularly for tracking automobile orders. We have implemented various measures, such as access controls, data encryption, and vulnerability assessments, to prevent and mitigate cybersecurity risks and incidents. In particular, we have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, which is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. We have developed a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also developing tools and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including Squarespace and Google Workspace, which assist us with information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. We engage in the assessment and testing of our cybersecurity risk management program, policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate. However, cybersecurity incidents, if they occur, depending on their nature, could lead to the loss, destruction, or unavailability of critical and confidential data, impacting our operations and potentially harming our reputation. This could result in customer distrust, termination of partnerships, significant remediation costs, and legal liabilities.

companyName: CHEETAH NET SUPPLY CHAIN SERVICE INC.

ticker: CTNT


text: Security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank's and customers' information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: Program Adjustments. The CIO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The executives in charge of each physical office location are responsible for assessing and managing cybersecurity risks for their locations, and the Company's chief executive officer is responsible for assessing and managing cybersecurity risks to the Company as a whole. Because none of these individuals has specific training or experience in managing cybersecurity risks, MSPs that have expertise and experience in doing so are retained and relied upon. Our chief executive officer is responsible for escalating any cybersecurity matters as appropriate, in consultation with our legal counsel. Our board of directors is ultimately responsible for oversight of cybersecurity risk management and receives regular reports from Company management.

companyName: BIOLARGO, INC.

ticker: BLGO


text: Our cybersecurity risk management efforts are informed by a cyber risk assessment, a continuous evaluation of our risks and vulnerabilities and risk tolerances. Our processes for assessing, identifying and managing cybersecurity risks are led by our Vice President – Information Technology and Chief Information Officer (our "CIO"), a management-level position reporting directly to our Executive Vice President and Chief Financial Officer (our "CFO"). Our CIO, a Certified Information Systems Security Professional ("CISSP") with over 20 years of information systems and information security leadership experience, leads our information technology team ("IT team") members, many of whom have USG security clearances (including our CIO) and include one additional CISSP team member, in supporting our cybersecurity risk management efforts. This team's efforts are further informed through their participation in external cybersecurity-related panels, industry presentations and advisory boards, tabletop exercises and information-sharing collaborations and partnerships.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: During the period covered by this report, the Trust has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Trust, including its results of operations or financial condition. For further discussion of risks related to cybersecurity, see "Risk Factors —The Custodian or any of its vendors may fail to protect the confidentiality and integrity of data, including Beneficiary confidential information, as a result of a failure in any of their respective cybersecurity or other information security systems, or disaster recovery plans, and any such failure may also adversely affect the Trust's operations."

companyName: METLIFE POLICYHOLDER TRUST


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management. The Company has a dedicated role in the Director of Cybersecurity and IT Compliance, who reports to our Chief Information Officer ("CIO"). Our current interim CIO has significant experience in information technology across a variety of industries, including consumer goods, automotive, manufacturing and outsourcing. Our current interim CIO and Director of Cybersecurity and IT Compliance also have experience in cybersecurity, information security, policy, architecture, engineering and incident response. The CIO works with other functions within the Company to implement controls, procedures and practices to help minimize the Company's risks, as well as to introduce security by design. Our CIO provides regular updates on cybersecurity matters to our senior management.

companyName: HELEN OF TROY LTD

ticker: HELE


text: This information security program is a key part of our overall risk management system. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.

companyName: LAKELAND FINANCIAL CORP

ticker: LKFN


text: The risk factors discussed in this document should be considered together with information included elsewhere in the Annual Report on Form 10–K and should not be considered as the only risks to which the Company is exposed.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: For an additional description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Item 1A, Risk Factors, in this Annual Report on Form 10-K, including the risk factor titled " We are dependent on data as well as information technology systems and infrastructure, which exposes us to data protection risks."

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Consequence Mitigation We also test the Company's InfoSec's Incident Response control effectiveness through tabletop exercises facilitated by a third party. These exercises test the Company's ability to detect and respond to cybersecurity incidents in a timely manner with a goal to reduce the impact of the cybersecurity incidents. Our InfoSec policies, processes and procedures are tested for completion and accuracy through these exercises. We use the results of these exercises to identify, evaluate, and prioritize potential areas of improvement identified through the InfoSec Roadmap.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: The Chief Risk Officer stays informed through multiple sources: technology and cybersecurity news, bulletins from the federal Cybersecurity and Infrastructure Security Agency, Information Sharing and Analysis Center feeds, and threat intelligence feeds from multiple sources. We also utilize a security operations center that acts as a centralized hub dedicated to monitoring, detecting, and responding to cybersecurity threats.

companyName: AMERISAFE INC

ticker: AMSF


text: The audit committee receives quarterly reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Definitive Healthcare Corp.

ticker: DH


text: The CISO is responsible for leading the assessment and management of cybersecurity risks. The CISO provides reports to the Board of Directors as part of the updates discussed above and regularly communicates with other members of senior management regarding information security risks.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: The Company has a written Emergency Action Plan that includes the handling of material cybersecurity incidents and business continuity if there is a disruption in operations. The Company utilizes a third-party cybersecurity partner to assist in monitoring our systems 24 hours a day, and to structure the technical handling of cybersecurity threats and incidents. In addition, the partner is utilized to regularly conduct formal penetration testing and tabletop exercises used to further prepare the organization. This partner also provides ongoing insights and advisory services in order to better align our program with current best practices. The Company uses a variety of processes to address risk associated with the use of third-party service providers. All employees, including anyone with access to Company-provided email accounts, must engage in quarterly cybersecurity awareness training and are tested internally on a regular basis. Additionally, we maintain cyber insurance coverage, including protection to further mitigate potential financial losses from cybersecurity incidents.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: Executive Officer and Vice President of Technology provide periodic briefings to the Board of Directors regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Based on our assessment process and depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets, including, for example: policies and procedures designed to address cybersecurity threats, including an incident response plan, disaster recovery and business continuity plans; incident detection and response; internal and/or external audits to assess our exposure to cybersecurity threats, compliance with risk mitigation procedures and effectiveness of relevant controls; documented risk assessments; background checks on our personnel; encryption of data; network security controls; access controls; physical security; asset management; systems monitoring; employee training; penetration testing; and cyber insurance. We prioritize our efforts based on the threats that we believe are more likely to lead to a material impact to our business, such as ransomware, theft of intellectual property and interruption of services and processes on which we rely.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Our incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CIO, Chief Accounting Office, Chief Compliance Office, Vice President of People and Performance, and Director of Information Security. This team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: The second line of defense is provided by the Enterprise Risk Management department, which is led by the Company's CRO/CISO. The department seeks to identify, assesses, and monitors cyber risk, in collaboration with our first line, while maintaining independent oversight of our information security program. The CRO/CISO is independent of management and reports to the Board Risk Committee Chair.

companyName: Capital Bancorp Inc

ticker: CBNK


text: As we have previously described in Item 1A, Risk Factors, there have been significant and increasing instances of data and security breaches, malicious interference with technology systems and industrial espionage involving companies in numerous industries, including cloud providers, and cybersecurity threats are becoming more complex. In addition, at times a large percentage of our workforce may be working remotely, which may heighten these risks. While we have taken steps to maintain and enhance our cybersecurity by implementing additional security technologies, internal controls, network and data center resiliency, redundancy and disaster recovery processes and backup systems, upgrading our remote work environment and by obtaining insurance coverage, these measures may be inadequate and our technology systems could be vulnerable to disability, failures, or unauthorized access. As a result, any inability by us to successfully manage our information systems, or respond effectively to any attack on or interference with our systems, including matters related to system and data security, privacy, reliability, compliance, performance and access, problems related to our systems caused by natural disasters, security breaches or malicious attacks, misuse of artificial intelligence tools, and any inability of these systems to fulfill their intended business purpose, could impede our ability to record or process orders, manufacture and ship in a timely manner, account for and collect receivables, protect sensitive data of the Company, our customers, our employees, our suppliers and other business partners, comply with our third party obligations of confidentiality and care, or otherwise carry on business in the normal course. Any such events could require costly remediation beyond levels covered by insurance and could cause us to lose customers and/or revenue, including as a result of legal or regulatory claims or proceedings, or damage our reputation, any of which could have a material adverse effect on our business and operating results. We are also subject to an increasing number of evolving data privacy and security laws and regulations that impose requirements on us. We collect, store, access and otherwise process various types of confidential or sensitive data, including proprietary business information, personal data and other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Failure to comply with such laws and regulations could result in the imposition of fines, penalties and other costs.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT and security teams; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: The Board of Directors and the Audit Committee oversees the cyber governance process. Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices. In addition, senior management provides briefings as needed to the Audit Committee Chair, the Audit Committee, and, as appropriate, the full Board, on cybersecurity issues and incidents of potential interest.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board of Directors has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 on a Current Report on Form 8-K and shall oversee the Company's response to such matter.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our current IT consultants and IT MSP, who report to our Chief Development Officer.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: The CISO, CTO, and CEO work together to assess and manage cybersecurity-related risks. The CISO is responsible for day-to-day operations working with an enterprise-wide cybersecurity team that provides 24/7/365 support. The CISO regularly confers with the CTO and CEO on cybersecurity matters, including providing notice of cybersecurity threats and incidents, including those that have the potential to have material effects. The CISO also provides written monthly and quarterly reports on the state of the company's cybersecurity program and cybersecurity risks to the CTO, CEO, and other key executives. As noted above, the CISO and CTO also provide regular reports to the Audit Committee and the Board.

companyName: GoDaddy Inc.

ticker: GDDY


text: The Information Services Division of the Bank is primarily responsible for identifying, assessing and managing material risks from cyber/information security threats. Information security management is conducted by the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) of the Bank. The CIO has ten years' experience with the Bank, including information security technology deployment and previous information technology audit experience. The CISO has more than 15 years of experience with the Bank, with expertise in large-scale systems information security and customer data privacy management.

companyName: BankFinancial CORP


text: The information security team is responsible for monitoring, managing, assessing and mitigating cybersecurity risks and threats on a day-to-day basis and is responsible for improving and strengthening our cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Financial Officer and a member of our Board who serves as the Board's primary contact on cybersecurity matters as a part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including to determine whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.

companyName: Simply Good Foods Co

ticker: SMPL


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: Mr. Brown reports to the VP of IT, Mr. Daniel Casper. With over 20 years of experience in IT leadership roles in biopharma and industry services, Mr. Casper brings expertise in leading the effective business use of technology solutions and services to our industry. Our VP of IT has overall responsibility for the Company's IT department and operations, including oversight over the CISO and cybersecurity team to ensure efforts to contain and remediate security incidents are sufficient and effective.

companyName: CYTOKINETICS INC

ticker: CYTK


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to Morgan Stanley and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.

companyName: North Haven Net REIT


text: Oklo has not experienced any material cybersecurity incidents to date, and we are not aware of any threats, current or ongoing, that would materially affect or be reasonably likely to materially affect our results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – If we or our third-party providers fail to protect confidential information and experience data security incidents, we may experience adverse effects, including regulatory enforcement consequences, on our business and results of operations."

companyName: Oklo Inc.

ticker: OKLO


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize using tools such as a SIEM (Network and Cloud Platform Log Collector), Network Vulnerability Scanner, and other utilities for monitoring all Company assets. We conduct these risk assessments directly and also engage security product platform support teams as needed.

companyName: Identiv, Inc.

ticker: INVE


text: Our cybersecurity-related risks are managed using a combination of documented policies and procedures, management oversight and security systems and hardware. Relevant policies are developed with the assistance of appropriate subject matter experts and are reviewed at least annually. As part of these policies and procedures, we maintain a Security Incident Response Plan (the "SIRP") that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business. During the past year, we conducted a tabletop exercise with our executive management team that simulated a cybersecurity incident to evaluate the effectiveness of our SIRP, identify potential improvements and enhance our incident response readiness.

companyName: Repay Holdings Corp

ticker: RPAY


text: Cybersecurity risk is a key operational risk that we face; therefore, managing cybersecurity risk is an inherent part of our business activities. We describe the material cybersecurity risks we face in " Risk Factors — Operational and Model Risk."

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have a Technology Committee, which reviews and discusses all technology-related methodologies and initiatives related to information/cybersecurity, among other topics. The Technology Committee is a management committee and reports to the Strategic Operations Management Committee (SOMC). We also have an Operations Risk Committee (ORC), which is a management committee, and is the secondary venue for reviewing enterprise security initiatives. The ORC also serves as the primary governance venue for the Business Resiliency Management Program and escalates business resiliency concerns and risk issues, among other matters, to the Strategic Risk Management Committee (SRMC). The ORC, is responsible for annually reviewing and providing recommendations on FHLBank's Security Incident Response Plan and receives monthly updates on the Enterprise Security Program. The ISO is a required member of both the Technology Committee and the ORC.

companyName: Federal Home Loan Bank of Topeka


text: Our cybersecurity risk management program has recently undergone an effort to expand and mature our security controls and documentation. These efforts include: • A security risk assessment conducted by an external supplier to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. This assessment was completed in the fourth quarter of 2024. • The implementation of revised information security program documentation and policies in the first quarter of 2024, including: o revision and implementation of a revised information security policy; o implementation of a revised incident response plan and policy; o implementation of a third-party risk management program that includes update procedures for third party vendor due diligence; o implementation of additional periodic cybersecurity and awareness training for all of our employees, including unannounced phishing simulations;

companyName: scPharmaceuticals Inc.


text: Estrella's IT infrastructure is limited due to its size and scope, and it has not conducted a formal standalone IT risk assessment.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: We face a number of cybersecurity risks in connection with our business. Although such risks have no t materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to, and breaches of, our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled, "Cyberattacks, security, privacy, or data breaches or other security incidents that affect our networks or systems, or those of our service providers, involving our or our customers' sensitive, personal, classified or confidential information could expose us to liability under various laws and regulations across jurisdictions, decrease trust in us and our products and services, increase the risk of litigation and governmental investigation, and harm to our reputation, business, and financial condition" in Item 1A- Risk Factors - "Information Technology and Data Risks."

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security and technical personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our technical environment.

companyName: Okta, Inc.

ticker: OKTA


text: As of the date hereof, the Company is not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations, or financial condition. Nevertheless, there is no guaranty that the Company will not experience a cybersecurity threat or that the Company will successfully address an incident in the future. Also, notwithstanding the Company's vigilance, a cybersecurity incident at one of its suppliers or customers could materially adversely impact the Company. See Item 1A "Risk Factors – Technology Risks" for a discussion of cybersecurity risks.

companyName: SIGMATRON INTERNATIONAL INC


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to the our cybersecurity policies, standards, processes and practices, which are integrated into our overall risk management system.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: 2.Product security: Our development teams take part in regular training and use industry best practices to build security into our solutions.

companyName: BLACKBAUD INC

ticker: BLKB


text: We also have vendor assessment processes to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our agreements with third parties may include various compliance requirements, data protection terms, audit or monitoring rights, and notification requirements in the event the third party experiences its own cybersecurity event.

companyName: CORVEL CORP

ticker: CRVL


text: Cybersecurity Governance BlackRock's Board of Directors is actively engaged in the oversight of BlackRock's risk management program. The Risk Committee assists the Board with its oversight of the Company's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. The Risk Committee receives regular reports on the Company's cybersecurity program, technology resilience risk management and related developments from members of the Company's information security team, including the CISO. The Board and the Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of the Board's Risk and Audit Committees.

companyName: BlackRock Finance, Inc.


text: We use, store and process data for and about our customers, employees, partners, and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Laser Photonics Corp

ticker: LASE


text: Third Party Engagement and Oversight. We engage third-party service providers, including consultants and auditors, to monitor and protect critical assets from cyber-attacks and to enhance certain components of our Information Security Program, including to assist us with annual security assessments, penetration and vulnerability testing, email and web filtering, endpoint protection, and consultation on certain cybersecurity enhancements. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current. To oversee and identify cybersecurity threats associated with our use of third-party service providers, we periodically audit and review certain information security practices of critical vendors in possession of sensitive information, including through seeking responses to cybersecurity questionnaires. In the ordinary course of business, we also rely on contractual obligations from certain third-party service providers to meet certain information security standards and to notify and cooperate with us in the event of qualifying cybersecurity incidents.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: Management Oversight While the Audit Committee reviews and oversees the Company's information security efforts, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Legal department and our Internal Audit department, working with our IT department. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: GLAUKOS Corp

ticker: GKOS


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;

companyName: SERVOTRONICS INC /DE/


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Part of our Enterprise Risk Management program involves understanding risks that third parties, including our supply chain partners, introduce to our organization. Our GIS organization has a formal risk assessment process that evaluates the cybersecurity risk of third party "as-a-service" providers, particularly in situations where we share confidential or sensitive information, or in situations where our compliance status or operations may be impacted through a cybersecurity incident.

companyName: Spirit AeroSystems Holdings, Inc.


text: Our executive leadership team is responsible for CRH's strategy and governance, including implementation and review of our ERM framework, which has identified cybersecurity as a core risk for CRH. CRH has established the role of CISO to provide technical leadership on a day-to-day basis in assessing and managing the Company's material cybersecurity risks and liaising with the chief information officers of CRH's Divisions. Our CISO has 25 years of experience working in IT, including more than a decade spent in prior technical and senior management roles related to cybersecurity. The divisional chief information officers have in excess of 10 years of experience, on average, in IT-related and cybersecurity-related roles and, together with the CISO, hold a variety of recognized and specialized credentials related to cybersecurity and IT.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Nordstrom understands that establishing, executing and sustaining effective cybersecurity measures to secure our information systems and preserve the confidentiality, integrity and availability of our data is critical to the success of the business.

companyName: NORDSTROM INC


text: During 2022, the Company detected a cyber-security incident which impacted the Company's network. The Company promptly activated incident response protocols and completed a thorough investigation. The incidents did not have a material impact on our business, operations or financial results.

companyName: WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORP

ticker: WAB


text: We have implemented a Cybersecurity Committee which met three times last year and is now responsible for the day-to-day management of cybersecurity risks, and the review our practices related to cyber events and risk management. The Committee is composed of the Chief Financial Officer, Chief Legal Officer, Controller, and Head of Human Resources.

companyName: Ispire Technology Inc.

ticker: ISPR