text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of the third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as any future clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."

companyName: Kronos Bio, Inc.


text: Third-party risk management is a critical component of our security strategy. We maintain oversight of service providers through a proactive monitoring approach, leveraging a cybersecurity questionnaire and security and privacy addenda to our contracts where applicable. We evaluate third party providers for maintenance of effective security management programs, compliance with information handling and asset management protocols, and require prompt notification of known or suspected cyber incidents.

companyName: JACOBS SOLUTIONS INC.

ticker: J

secItem: Item 1C


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems, and those that we offer to our residents are necessary for the operation of our business. We use these systems, among others, to manage our resident and vendor relationships, for internal communications, for accounting to operate record-keeping function, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: Under our Shared Services Agreement with D.R. Horton, D.R. Horton provides us with certain administrative and compliance services which includes information technology, i nternal audit and information technology risk services. Leveraging these services provided by D.R. Horton related to cybersecurity, we have processes in place for assessing, identifying, and managing risks from cybersecurity threats that may result in material adverse effects to the confidentiality, integrity and availability of our systems, operations and data. These processes are a part of our overall risk assessment process. Risks from cybersecurity threats include, among other things, unauthorized access, data theft, computer viruses, ransomware, malicious software and other disruptions. We have implemented systems and processes utilizing a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity threats. Each of these layers contain multiple levels of protection and leverage industry standard framework including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. At the management level, these systems and processes are overseen primarily by the D.R. Horton Chief Information Officer (CIO) and Cyber Security Risk Officer (CSRO).

companyName: Forestar Group Inc.

ticker: FOR


text: We also have processes in place to oversee and identify risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are subject to security risk assessments at the time of on-boarding, contract renewal, and upon detection of an increase in risk profile. We have similar processes in place to oversee and identify cybersecurity-related risks posed by our suppliers.

companyName: MKS INC

ticker: MKSI


text: The Company engages multiple vendors with subject matter and technological expertise in various aspects of cybersecurity management, including continuous threat detection and response coverage, endpoint detection, anti-malware, penetration testing and suspicious activity alerting, among others. When the Company engages third parties, management retains responsibility for the security and resiliency of its information assets. The Company maintains an incident response plan that includes escalation criteria and preliminary materiality assessments to guide business continuity and disclosure objectives.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL


text: The Company's cybersecurity risk management program is subject to periodic review and updates. The Company's Board of Directors is responsible for overseeing the Company's cybersecurity risk management program through the Audit Committee. The Board receives quarterly reports on the Company's cybersecurity risk profile and the effectiveness of the Company's cybersecurity risk management program.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Merlin, Inc.

ticker: MRLN


text: The management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO"), who reports directly to our CFO. Our CIO is responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy. Our CIO and Director of Cybersecurity have over 19 and 20 years, respectively, of cybersecurity oversight experience. Our CIO previously served as CIO for a New York Stock Exchange listed manufacturing company prior to joining the Company. Additionally, our Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Our data breach response designates an incident response team comprised of senior leaders within information technology, finance and compliance functions to ensure timely diagnosis and mitigation of cyber events. The incident response team is responsible for determining whether a cybersecurity incident is material and requires current reporting pursuant to SEC Form 8-K Item 1.05 (Material Cybersecurity Incidents). In conducting the assessment, the team considers factors including, but not limited to the probability of an adverse outcome; the potential significance of loss; the nature and extent of harm to individuals, customers, and vendors; the nature and extent of harm to our competitive position or reputation; and the possibility of litigation or regulatory investigations.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: Cyber Risk Management and Strategy We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the cybersecurity risks we face, see Item 1A, Risk Factors. To help manage these risks, we have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and treatment of cybersecurity risks. These assessments are aligned with industry standards and leading practices, and provide a comparison based on practices at comparable organizations and recommendations for management to consider. In addition to these external assessments, compliance readiness is assessed at a minimum annually by our CITO, in the form of penetration testing and vulnerability assessments. This program extends to a review of the cybersecurity measures in place at the properties that we own as well as our corporate headquarters, and selected senior managers also have participated in a tabletop exercise curated by our external security consultant to test and improve our incident response planning. We also maintain processes around third-party vendor risk management, such as the submission of vendor questionnaires to critical vendors and the inclusion of contractual security requirements as appropriate.

companyName: Paramount Group, Inc.

ticker: PGRE


text: Our Risk Committee assists our Board of Directors (the "Board") in its oversight of cybersecurity risk in accordance with its charter. The Risk Committee receives at least annually, and the Board receives periodically, reports from our CISO and other members of senior management, which include updates on the Company's cyber risks and threats, its Cybersecurity Program, the status of projects to augment our information security systems, assessments of the Security Program, and the emerging threat landscape.

companyName: Virtu Financial, Inc.

ticker: VIRT


text: Our Board of Directors plays a significant role in overseeing our cybersecurity risk management efforts. The Board receives periodic updates from the Chief Information Officer ("CIO") on our cybersecurity posture, encompassing reports on potential threats, vulnerabilities, and the efficacy of our risk mitigation measures. These updates are provided based on internal reports from the tools employed and managed by the IT organization and reports generated by a managed security service provider overseen by the Chief Information Security Officer ("CISO"). The Board is committed to ensuring that cybersecurity is a priority for the organization, providing the necessary resources and expertise to address evolving threats effectively.

companyName: URBAN ONE, INC.

ticker: UONE


text: The Company's Chief Technology Officer is principally responsible for day-to-day management of the Company's cybersecurity risk management program. The Chief Technology Officer reports directly to the Chief Executive Officer and works in coordination with the other members of the leadership team, which includes our General Counsel, Chief Operating Officer, and Chief Financial Officer. The Chief Technology Officer oversees a team of security professionals, which is led by the Senior Director of Security Engineering. The security team includes approximately 40 security professionals, 25 of whom are security engineers. Other members of the team oversee and manage identity, risk, compliance and audit functions.

companyName: Phreesia, Inc.

ticker: PHR


text: Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, cybersecurity attacks and incidents have occurred in the past, and may continue to occur in the future. For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A Risk Factors - "Risks Related to Information Technology and Data Security."

companyName: Capri Holdings Ltd

ticker: CPRI


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced non-material cybersecurity incidents, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future security and/or privacy breaches, cybersecurity incidents, acts of vandalism or terror, misplaced, corrupted, altered or lost data, programming, and/or human error or other similar events with respect to our information technology systems or processes or the information technology systems or, processes of third-parties that have been entrusted with our information, could have a material adverse effect on our business strategy, financial condition, results of operations or cash flows. Risks related to cybersecurity events are detailed in the section of this Annual Report titled "Risk Factors—Risks related to our business and industry—We may be subject to information technology systems failures, cybersecurity incidents, network disruptions and breaches of data security, which could compromise our information and expose us to liability."

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: The management team is actively promoting the Company's cybersecurity policies and procedures, and leading discussions and mitigations of cybersecurity risks in the areas of their responsibilities.

companyName: Unique Logistics International, Inc.


text: Threats of security incidents and the impact of actual security incidents are initially assessed and managed by the CSO and CIO as described above. CNA has further implemented response plans that provide the basis for appropriate response to an unauthorized occurrence from a technical perspective, as well as from disclosure and regulatory perspectives.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: Honda develops rules and procedures based on laws and regulations, formulate response flows, verify and implement measures for improvement through cybersecurity exercises, and develop human resources, among other things. Honda also utilizes solutions for managing cybersecurity information and monitoring malicious activities to monitor and analyze cybersecurity threats and vulnerabilities, and in the event of a security incident related to a cyberattack with a significant impact on Honda, a Global Emergency Headquarters will be established under the supervision and monitoring of Honda's Risk Management Officer, and the supervisory division in charge of risks from cybersecurity threats plays a central role in quickly ascertaining the actual situation and taking measures to minimize the impacts of cybersecurity incidents from a company-wide perspective.

companyName: AMERICAN HONDA FINANCE CORP


text: Our executive leadership team is responsible for designing and implementing our enterprise risk management program, with input from our Chief Information Officer, General Counsel and other security and privacy personnel regarding material risks from cybersecurity threats. The executive leadership team regularly discusses security threat trends; incident trends, including any significant incidents that may arise; risk mitigation; and overall security strategy as part of our enterprise security governance process. We consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent public accounting firm of any relevant developments.

companyName: COMSCORE, INC.

ticker: SCOR


text: Our Audit Committee, in connection with the Board of Directors, maintains oversight of our ERM framework, including oversight over our cybersecurity and information technology policies and programs.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: The IT management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has over 20 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution and holds a Certified Information Systems Security Professional certification.

companyName: Seer, Inc.

ticker: SEER


text: We have a comprehensive approach to identifying and managing cybersecurity risks that involves our information technology security personnel, senior management, Audit Committee and Board of Directors. Our cybersecurity risk management function is integrated into our overall risk management system and processes.

companyName: VECTOR GROUP LTD


text: Senior management, including the Company's Chief Executive Officer and Chief Financial Officer are responsible for assessing and managing cybersecurity risk, and providing briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to the Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.

companyName: BriaCell Therapeutics Corp.

ticker: BCTX


text: The Company's Vice President, Head of IT, Associate Director, IT Operations & Security, IT Steering Committee, Information Security Team, and third-party service providers (collectively, the "Information Security Function") help identify, assess, and manage the Company's cybersecurity threats and risks. The Information Security Function identifies and assesses risks from cybersecurity threats by monitoring and evaluating the Company's threat environment and risk profile using various methods and tools including, for example: subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and bad actors, conducting scans of the threat environment, and evaluating our industry's risk profile and threats reported to us. We also complete certain internal and external security audits, third party threat assessments, and vulnerability assessments.

companyName: Vor Biopharma Inc.

ticker: VOR


text: We have established a Security and Privacy Council (the "Council"), which as of the date of this Annual Report includes our CISO, Chief Legal Officer and other employees from our legal, engineering, information security, and information technology departments, which meets at least quarterly to review and evaluate information security and privacy risks and mitigations, information security resources and budget, audits, and monitoring programs. The Council includes certain members who have extensive experience assessing and managing risks from cybersecurity threats, including multiple decades of combined experience across information technology and information security positions; serving in leadership positions at other public companies; and having other significant experience in the areas of risk management, engineering, information technology, and information security.

companyName: Akili, Inc.


text: The Information Security and Information Technology teams support the business through early engagement in the Project Management Office routines and the Vendor Management Office's requirements, to ensure that new products, projects, and third-party vendors are onboarded with appropriate oversight.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Operational Risks" as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. However, because Southwest operates in the area of critical infrastructure, as defined under federal law and by the TSA, we have been and will continue to be the target of cybersecurity attacks from time to time.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Other Risk Factors Notwithstanding the breadth of the Company's information security program, the Company may be unsuccessful in preventing or mitigating a cybersecurity event that could have a material adverse impact. See "Item 1A – Risk Factors – Other Risks – Technology disruptions or cyberattacks could adversely impact the Company's operations."

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: The management Info Sec Steering Committee provides oversight and governance of the Information Security Program. This committee includes members of information security, risk, compliance, audit, human resources, legal, operations, banking, and wealth. The committee generally meets monthly to review and provide oversight of our risk management strategy; audit reports related to our cyber and information security processes; third-party risk assessments; periodic testing of systems and infrastructure; status of employee and customer training; and updates on security incidents. More frequent meetings may occur in accordance with the incident response plan to facilitate timely assessment, monitoring, and reporting.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: Our Chief Operating Officer and Head of IT Security provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and policy and procedures, and changes in applicable law or regulations concerning such subject matter. Our audit committee is charged with, and is able to pass resolutions relating to the application of information and communication technology by the Company, including risks relating to cybersecurity. Moreover, periodic briefings are also provided to the board of directors relating to our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and policy and procedures, and changes in applicable law or regulations concerning such subject matter.

companyName: Merus N.V.


text: Our overall risk management program includes a cybersecurity risk assessment process, that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee as part of their involvement in managing and overseeing cybersecurity risks.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by the REIT Manager's Chief Compliance Officer and Cyber Security Committee ("CSC").

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: The Company is committed to protecting its information system and data from cyber threats. We utilize third party technical tools to control system access and filter, restrict and regulate content that may pose a material risk to the Company. Employees are required to use multi-factor authentication to access Company systems and undergo annual security training. Management is responsible for identifying, monitoring and mitigating the material risks facing the Company, including cybersecurity risks. Management provides regular reports to the Board at every meeting to review our top risks, identify trends and help manage risk.

companyName: Lovesac Co

ticker: LOVE


text: The CIO has been with the Company since 2011 and in the banking industry since 2002 holding various positions in operations, compliance and information technology. He has a background in software programming and hacking/intrusion and holds various certifications and designations such as Certified Information Systems Security Professional, Certified Data Privacy Solutions Engineer, Certified Regulatory Compliance Manager, Accredited ACH Professional and others in technology, security, risk, and compliance. The CIO has a Bachelor of Science in Electrical Engineering and a Master of Science in Cybersecurity and Information Assurance. Additionally, the CIO participates in Infragard (a partnership between the Federal Bureau of Investigation ("FBI") and the private sector and the American Banker's Association ("ABA") cyber forums. He also participated in the FBI Chief Information Security Officer ("CISO") Academy, Class 10.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Everest has aligned and operationalized its cybersecurity program and controls to the National Institute of Standards and Technology ("NIST") Cybersecurity Incident Response Framework to provide preventative, detective and responsive measures that are timely, comprehensive, systematic, and in alignment with industry standards, regulatory requirements, and the Company's risk management framework. As part of the Company's cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response. The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center ("SOC") as well as an Incident Response Team ("IRT"), to further escalate to senior management and the Board, as appropriate. While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of incidents to law enforcement and regulatory bodies, as appropriate.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: Effective incident response involves every part of our organization, including business operations, finance, as well as outside service providers for key business applications. Our Board of Directors oversees all business, property and affairs of the Company, including cybersecurity risks. Our management keep the members of the Board informed of our business through discussions at Board meetings and by providing them with reports and other materials throughout the year.

companyName: PARKS AMERICA, INC

ticker: PRKA


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings. Our Senior Vice President ("SVP"), Enterprise Risk Management presents to our Board of Directors and our Audit Committee at least once a year on our significant enterprise-wide risks as well as our enterprise-wide risk program. In addition, our Chief Information Security Officer ("CISO") meets regularly with the Audit Committee on risks related to cybersecurity and information security.

companyName: Edwards Lifesciences Corp

ticker: EW


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, client data and patient data, or, collectively, Information Systems and Data.

companyName: NeuroPace Inc

ticker: NPCE


text: Our Company recognizes the importance of maintaining the safety and security of our critical systems, information, and broader information technology environment. We have developed a comprehensive cyber, data governance, and privacy program intended to (i) protect the confidentiality, integrity, and availability of our information systems and data, and (ii) assess, identify, and manage materials risks associated with cybersecurity threats In order to protect the Company data - and any other data we manage or handle - we have adopted a number of safeguards and security measures. For example, we have implemented software-as-a-service firewalls, endpoint protection, detection and response solutions, intrusion detection systems, access controls including multi-factor authentication, vulnerability scanning, software static analysis, dynamic analysis, third-party independent business continuity testing, independent third-party control audits. In addition, we have implemented several policies and programs to improve compliance and reduce risk, ensure appropriate responses in the event of an incident, and reduce the cost and scope of an incident should it occur, including: • a robust Incident Response Plan ("IRP"), • an Information Technology and Information Security Policy ("IT&IS Policy"), • a data governance program to oversee our Records Retention Policy, • a Data Governance Working Group comprised of legal, finance, human resources ("HR"), and third-party privacy and data governance consultants to review policies, programs, and data governance, and make reports and recommendations to management and the Board of Directors, • mandatory cyber and information security training for all employees, and • cybersecurity insurance designed to reduce the risk of loss resulting from cybersecurity incidents Our IRP, in conjunction with the IT&IS Policy, is designed to equip our employees and managers with the necessary tools to detect, respond to, and ultimately prevent cybersecurity incidents. It contains detailed processes and procedures to assist employees in managing cybersecurity incidents when they happen, including techniques for detecting/identifying suspicious activity in our data environment, response and escalation protocols to defend against intrusions and contain any potential data leakage, data preservation measures to ensure data integrity going forward, and remediation steps to diagnose root causes and secure gaps to prevent future attacks.

companyName: ContextLogic Inc.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: The Trust engages various third parties to support its operations. The Trust relies on the Sponsor's expertise in risk management, legal, information technology, and compliance when managing risks from cybersecurity threats associated with these entities. Prior to engaging a key service provider, the Sponsor conducts a due diligence process.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: Our cybersecurity risk management strategy employs an in-depth, layered, and defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. As such, our cybersecurity risk management program includes but is not limited to regular employee cybersecurity training and communications; the use of preventative, detective, alerting, and defensive in-depth technologies; internal and third-party program oversight; policies and procedures regularly reviewed and designed with regulatory and industry guidance; an incident response plan to respond to cybersecurity incidents; and a threat intelligence program designed to assess the latest changes to the threat landscape. In addition, cybersecurity policies, procedures, and controls have been developed and implemented to protect against unauthorized access to consumer and customer information and to safeguard the information that is exchanged with third parties in accordance with applicable laws and regulations.

companyName: PACIFIC PREMIER BANCORP INC


text: While the Company implements robust cybersecurity measures, it acknowledges the inherent risks associated with cyber threats. Potential risks include unauthorized access, cyberattacks, and data breaches, which could lead to financial loss, reputational damage, and regulatory penalties. The company continuously assesses and enhances its cybersecurity framework to mitigate these risks and protect stakeholders' interests. In summary, the Company prioritizes cybersecurity through comprehensive measures, regulatory compliance, and ongoing risk management to safeguard its operations and client data.

companyName: FDCTECH, INC.

ticker: FDCT


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Management along with the support of a third-party IT firm are responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Eiger BioPharmaceuticals, Inc.


text: We also have adopted a cybersecurity incident response and recovery plan to enable us to respond to cybersecurity incidents that may affect the function and security of the Company, our information technology assets, customer and employee data, information resources, and business operations. We have adopted cyber and data security policies, that address matters including user access, incident response, third-party compliance, personal devices, and data privacy. These policies are reviewed annually. We also maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: In the past three years, our Company has not experienced any material cybersecurity risks. To ensure robust protection against potential threats, we have implemented the following security measures: Regularly updating and changing critical passwords. modifying communication interfaces to enhance security. development tasks in a modular fashion to minimize exposure. dual-factor authentication for system access. tiered authorization levels for critical network operations. routine security training and awareness programs for employees.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate HCW personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigation.

companyName: HCW Biologics Inc.

ticker: HCWB


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: In fiscal 2024, and through the filing of this Annual Report on Form 10-K, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Contineum Therapeutics, Inc.

ticker: CTNM


text: The cybersecurity program is led by Crane Company's Chief Information Security Officer, who regularly reports to our executive team about our program, including a review of cyber threat trends, our information security organization and staffing, and the status of ongoing efforts and investments to strengthen our cybersecurity defenses.

companyName: Crane Co

ticker: CR


text: We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by our CISO and DPO and comprised of other members of management. This incident response team also conducts periodic table-top exercises with management to ensure adherence to our cybersecurity incident response plan.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct periodic incident response tabletop exercises to refine and update incident response processes. We have a management-level Breach Disclosure Committee, which is a subcommittee of our Disclosure Committee and includes our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") that is responsible for assessing and identifying material risk from cybersecurity threats. In the event of a cybersecurity incident, the Breach Disclosure Committee is responsible for making recommendations to the General Counsel regarding the materiality of the incident based on documented guidelines for assessing risk.

companyName: Vital Energy, Inc.

ticker: VTLE


text: Our cybersecurity team is composed of our Information Security Coordinator, who has several years of experience overseeing cybersecurity and other IT matters, our IT Coordinator and an outsourced cybersecurity partner, who employs various professionals with expertise in the field of cybersecurity. Our cybersecurity team oversees our internal information security policies and procedures and is responsible for the day-to-day implementation and monitoring of our security controls, including those developed as a result of the 2024 threat survey.

companyName: Odysight.ai Inc.

ticker: ODYS


text: The Company's enterprise-wide cybersecurity strategy is advanced and reinforced by policies, processes, procedures, standards, technologies and training designed to protect the Company's IT systems, operations and sensitive business data. The Company has deployed a multiple-layer defensive model, which includes a variety of detective and protective technologies and measures to monitor and protect our critical IT systems, which include among others, intrusion detection and protection, email security, endpoint security, 24/7 third party security monitoring and proactive security testing.

companyName: MASONITE INTERNATIONAL CORP


text: We also maintain insurance coverage for cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We describe the risks from cybersecurity threats that could affect our operations and financial results under the heading "Cyber-attacks or acts of cyber-terrorism could disrupt our business operations and information technology systems or result in the loss or exposure of confidential or sensitive employee or company information." included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Five Point Holdings, LLC

ticker: FPH


text: We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted substantial financial and personnel resources to implement and maintain security measures to meet regulatory requirements, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Our risk factors, which can found be found in Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. We have had no cybersecurity incidents to date, and can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Texas Pacific Land Corp

ticker: TPL


text: We maintain a layered security architecture as a key part of our infrastructure design and utilize our employees and managed third-party service providers to help ensure a secure environment and safeguard against a variety of threats including malware, systems intrusions, unauthorized access, data loss and other security risks. We have implemented various technology products and associated procedures, including, among others, the following: Firewall protection, operating system security patches, and multi-factor authentication; System security agent software, which includes encryption, malware protection, patches and virus definitions; Monitoring of computer systems for unauthorized use of or access to sensitive information; Web content filtering; Web and network vulnerability assessments and penetration testing; Monitoring emerging laws and regulations related to data protection and information security;

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: • IT managed services that includes help desk support and managed infrastructure (networks and servers support); and • a ransomware defense plan. • cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • third-party risk management and reporting process for service providers, suppliers and vendors.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Board of Directors The Company's Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives quarterly reports and presentations from members of the Company's team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer (CISO), Chief Information Officer (CIO), and members of the legal team, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The other members of the Board attend these quarterly reports and presentations to the Audit Committee by members of management. The Company has protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated to management and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: RemSleep Holdings Inc.

ticker: RMSL


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks and mitigate and remediate cybersecurity threats and incidents. Both management and the Audit Committee also report material cybersecurity risks to our full board of directors, based on management's assessment of risk.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Enterprise Cybersecurity The Company's Enterprise Cybersecurity Security Operation's Center ("SOC"), which is supervised by the CIO, is responsible for identifying, assessing and managing the Company's risks from cybersecurity threats, as well as for responding to cybersecurity incidents. The SOC management team carries a diverse array of applicable cybersecurity and information technology credentials and generally has over twenty years of experience in cybersecurity. When an infrastructure cybersecurity incident occurs, the SOC initiates communications to the appropriate groups within the Company, which may include various members of the Company's management, including the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Operating Officer.

companyName: Aptiv PLC

ticker: APTV


text: We employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. We currently carry cybersecurity insurance, however, we cannot assure you that we will be able to maintain such policies in the future or that they will be sufficient to cover all potential cybersecurity events or losses we incur in connection with such events.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Our cybersecurity teams, overseen by our CISO, are responsible for assessing and managing our risks from cybersecurity threats, including defining security policy and board reporting of security risk. The CISO approves all security policies and oversees the identification, assessment, and management of cybersecurity risks, which provides a proactive and comprehensive approach to safeguarding our information assets. The teams have primary responsibility for our overall Information Security Program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity teams' experience includes cybersecurity incident response, in-depth security assessments and security emulation exercises to evaluate security profile, security research, education and outreach, and security tool development.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: Reporting to Board of Directors The Chief Information Officer, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: Organizations are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. The Company maintains general cybersecurity policies and procedures to assess, identify, and manage cyber threats, and has designated personnel to implement and maintain these policies and procedures, subject to oversight by our management.

companyName: ScanTech AI Systems Inc.

ticker: STAI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of NeTTronix Technology Solutions. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: BONK, INC.

ticker: BNKK


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We devote appropriate resources and designate members of our management, including our Chief Technology Officer, to manage the risk assessment and mitigation process.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's annual risk assessment and relevant mitigations are presented to the Board of Directors.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: Airship's cybersecurity program is spearheaded by their cybersecurity department with approval from executive management. The stakeholders have been identified and know their roles within the cyber security process as well as having all roles be documented.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as those established by the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI") and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.

companyName: Blackstone Infrastructure Strategies L.P.


text: We have adopted the NIST Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory monthly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: We believe that we have a robust cybersecurity program that is aligned to industry-standard cybersecurity frameworks. To identify and assess material risks from cybersecurity threats, our corporate risk management team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process. To implement and maintain our cybersecurity program, we have a dedicated information security team that is managed by our Chief Information Security Officer. We believe our information security team is well positioned to identify risks from cybersecurity threats based on numerous job qualifications and on-going training.

companyName: HOPE BANCORP INC

ticker: HOPE


text: The Company has adopted a defense-in-depth philosophy that relies on multiple systems and processes to reasonably provide for the confidentiality, integrity and availability of our systems, networks and data. Features of our information security include: • Documentation: We have written policies and procedures that delineate the roles and responsibilities of the Company's Board of Directors, executive management and other employees, as well as outside parties, with respect to the various aspects of the information security program. This documentation helps to align the entire information security program with our efforts to maintain the integrity of the Company's cybersecurity. These policies and procedures are reviewed and updated at least annually. • Separation of duties: Separation of duties means that, where appropriate, a task is designed to ensure that more than one person or group is responsible for its completion. We believe that separation of duties helps to prevent fraud, misuse or other security compromise, and we apply this concept when we delegate administrative and oversight responsibilities to multiple groups for certain aspects of the information security program, including identity and access management, network management, system administration, policy oversight, monitoring and alerting. • The principle of least privilege: Access approval for the Company's employees is coordinated between an employee's manager, the Company's human resources department and the information systems administrator. The goal is to give an employee access rights to our data, applications and other information resources only to the extent necessary for the employee to perform the functions of the particular job. Any change in employment responsibilities that requires access changes is implemented using the same access approval procedures. Finally, all remote access into the Company's networks must include approval by the Chief Information Security Officer (which we refer to as the "CISO"). • Vulnerability and patch management: The Company's vulnerability management program includes internal and external scanning using third-party tools and services. Software patches are deployed based on criticality of vulnerability. Further, we track our performance in implementing patches, and if implementation timing falls below performance expectations, management will take steps to identify and remediate the root causes of implementation delays. • Risk assessments: At least annually, management conducts risk assessments to assess the existence, severity and trends of cybersecurity risks and other risks that the Company's information security program faces. The scope of an individual risk assessment can be the whole organization, parts of the organization, an individual information system, specific system components, or services. • Log management: System security logs are consolidated by the Company's Security Incident and Event Management system and are reviewed via both automatic and manual processes for anomalous behavior. • Incident response: The incident response process is designed to, among other things, promptly elevate a cybersecurity threat or incident to the parties responsible for leading our efforts to identify, contain and mitigate the threat or incident, notify impacted customers or other third parties and comply with applicable law, regulations and regulatory expectations.

companyName: RENASANT CORP

ticker: RNST


text: We also assess and manage cybersecurity risks associated with our third-party service providers. We require the implementation of security measures that align with our established security policies and protocols as well as compliance with applicable legal requirements.

companyName: CuriosityStream Inc.

ticker: CURI


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: In addition, the Company's Incident Response Plan ("IRP") provides an outline for the Company on how to identify and address a significant cybersecurity incident. The IRP includes certain steps to be taken by the Information Security team to, among other things, assess the severity of an incident, determine the appropriate escalation, and mitigate or remediate the incident. The IRP is intended to serve as a framework to aid the Information Security team and other corporate functions in coordinating the Company's response to an incident in order to minimize the impact on the Company's business and operations, as well as the affected parties.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Technology Officer, Chief Financial Officer and General Counsel. Our Senior Vice President of Information Technology and Infrastructure brings over 25 years of expertise in media, information security, technology risk management, spearheading our cybersecurity program. In close collaboration with the senior executive team, IT leadership is responsible for ensuring compliance, addressing identified risks, and driving comprehensive employee training initiatives. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.

companyName: Mediaco Holding Inc.

ticker: MDIA


text: Notwithstanding the Company's cybersecurity framework and preventative strategies, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.

companyName: NUCOR CORP

ticker: NUE


text: Reporting to Board of Directors The Chief Information Security Officer, in his capacity as such, regularly reports to management and the Audit Committee on all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face. In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our VP of Security and Privacy Engineering on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: NETFLIX INC

ticker: NFLX


text: We further describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches or cybersecurity incidents could adversely affect our financial results and our ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation," included as part of our risk factor disclosures at Item 1A. of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: UTMD utilizes state-of-art cybersecurity devices and software to timely identify and prevent intrusion from external actors. The corporate information systems operations manager continuously monitors activity, and reports weekly to the CEO. Additional sources for assessing security effectiveness are annual outside audits of the information technology environment, risk and performance assessments provided by vendors of the routers and firewalls used by the Company and the news media.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: As part of its risk oversight function, the Audit Committee of the Company's Board of Directors is primarily responsible for overseeing and reviewing the Company's information security and technology risks, including cybersecurity. In this role, the Audit Committee monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the regular receipt of reports from management on the effectiveness of its cybersecurity programs. These reports include semi-annual cybersecurity updates from the Company's Chief Information Officer and quarterly reports from the Company's risk management personnel on the progress of the Company's broader Enterprise Risk Management ("ERM") risk mitigation activities. As part of the ERM process, the Audit Committee provides input on key risks for the Company to consider. The Board also provides quarterly input on its views regarding potential emerging risk areas for the Company. The Audit Committee then reports to the full Board on a quarterly basis regarding its oversight activities and the risk management activities of the Company. In addition, the full Board periodically participates in cybersecurity-related table-top exercises and receives incident reports from the SIRT (as defined herein) as significant matters may arise.

companyName: OMNICELL, INC.

ticker: OMCL


text: Currently, our risk management and compliance committee, comprised of our chief executive officer, chief operating officer, chief financial officer, and the executive vice president of member and external relations, assesses and monitors material risks from cybersecurity threats. Members of our risk management and compliance committee receive regular updates regarding the prevention, mitigation, and detection of cybersecurity incidents and would oversee the response and remediation of any material cybersecurity incident. Our risk management and compliance committee also ensures our board of directors is briefed on cybersecurity risks, makes materiality determinations with regards to cybersecurity risks and monitors the active management of cybersecurity risks by internal and external teams. For additional information regarding our board of directors' risk oversight activities, see "DIRECTORS, EXECUTIVE OFFICERS AND CORPORATE GOVERNANCE – Board of Directors' Role in Risk Oversight."

companyName: OGLETHORPE POWER CORP


text: Cybersecurity is a key category within our risk management efforts, and our cybersecurity risk management is intended to assist in assessing, identifying, and managing material risks from cybersecurity threats to the Company's information systems. Our cybersecurity risk management and strategy is based upon utilizing systems that are cloud based which require multifactor authentication to access. Due to our small size, we partner with a third-party service provider which utilizes multiple security operations centers. The security operations centers maintain, monitor, mitigate and alert on threats against the cloud systems that we utilize. If a risk is identified the security operations center has the ability to shut down access to any user in the organization.

companyName: ZyVersa Therapeutics, Inc.

ticker: ZVSA


text: The Company uses cost-effective controls that are commensurate with the risk and sensitivity of its specific information systems, control systems and enterprise data. The Company's cybersecurity program incorporates best practices and industry standards from multiple sources and includes, but is not limited to, risk assessment, policies and procedures, training and awareness, auditing, log collection and analysis, threat hunting and intelligence surveillance, compliance monitoring and testing, and incident response.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: The process includes: • Receipt of regular updates from the Audit Committee of the Board of Directors on the latest cybersecurity risk posture and overall effectiveness of the Company's cybersecurity program. • Independent reviews of the Company's cybersecurity program through the SOX audit process. • Regular discussions about cybersecurity risks at meetings of the board of directors.

companyName: Arcadium Lithium plc


text: Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. Our Information Technology Steering Committee of the Board of Directors of the Bank, which then reports to the entire Board, is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Information Technology Steering Committee receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Information Technology Steering Committee generally receives materials, including materials indicating current and emerging material cybersecurity threat risks and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer, Information Security Officer, and other staff as needed.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to "—Risks Related to Data Privacy and Cybersecurity" in "Item 1A. Risk Factors" of this Annual Report for additional information about the risks we face associated with cybersecurity threats.

companyName: GUESS INC

ticker: GES


text: Our Board, through its Audit Committee, oversees the management of our cybersecurity program led by our CISO. The Audit Committee receives regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, including material security risks and information security vulnerabilities. Specifically, the Audit Committee receives regular updates from our CISO on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, and any relevant internal and industry cybersecurity incidents.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: We maintain a security awareness training program for employees, which is provided during onboarding. We also provide additional mandatory trainings, including phishing training, throughout the year.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Further, although we have not experienced any recent material cybersecurity incidents, we face a number of cybersecurity risks in connection with our business. Other casino companies have reported large-scale cybersecurity incidents. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. See Part I, Item 1A. " Risk Factors – Risks Related to Technology " for additional discussion.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: Our Vice President, IT – Technical Services reports to our Chief Technology Officer and is the head of our cybersecurity team. He is responsible for assessing and managing our cybersecurity management program, informs our Chief Technology Officer regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervises and monitors such efforts. Our Chief Technology Officer has more than 20 years of experience in cybersecurity and information systems management, and our Vice President, IT – Technical Services has nearly three decades of experience managing information systems, network infrastructure, and cybersecurity in the public and private sectors. This combined in-depth knowledge and experience has been critical in developing and implementing our cybersecurity programs. In addition to quarterly reports to the Audit Committee, as an Executive Vice President and member of the Executive Committee, our Chief Technology Officer regularly briefs the Executive Committee on the threat landscape, the Company's cybersecurity programs and risks, so that the highest level of management is regularly informed of cybersecurity issues for decision-making and guidance.

companyName: QXO BUILDING PRODUCTS, INC.


text: Company relies on the Investment Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Investment Adviser's risk management program and processes, which include cyber risk assessments.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: The Board Risk and Compliance Committee ("BRCC") is central to the Board's oversight of cybersecurity risks. The BRCC currently oversees various risk areas such as regulatory compliance, CRA, BSA/AMLA, enterprise risk management, cybersecurity, technology, and third-party risk management. The committee ensures that the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The BRCC reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include risk assessments of cybersecurity and related risks, as well as the company's vulnerability to those risks. The BRCC reviews an annual evaluation of the company's cybersecurity posture and the effectiveness of its risk management strategies, identifying areas for improvement and ensuring the cybersecurity efforts are integrated with the overall risk management framework.

companyName: OP Bancorp

ticker: OPBK


text: Our board of directors monitors and assesses strategic risk exposure, and our executive officers manage the material risks we face.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: Our board of directors has approved management committees, including the OTC, to provide operational risk oversight for information security risks. The IT Director is the chair of the OTC, and the ISO is a member of the OTC. The OTC generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, and mitigation and prevention efforts employed to manage security risks. It also ensures that our internal control infrastructure is appropriate and commensurate with the growth of, or changes to, our information systems and processes. More frequent meetings may occur as needed to facilitate timely communication and monitoring efforts.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: Our Board considers cybersecurity risk as part of its risk management oversight function. The Audit Committee assists the Board in its oversight of cybersecurity risks and receives regular updates from the CIO and other Company management on cybersecurity matters at least annually. The Audit Committee reports findings and recommendations, as appropriate, to the full Board for consideration. The Audit Committee also receives information about cybersecurity risks as part of the Company's ERM program and reporting. In addition, any cybersecurity incident assessed as being, or potentially becoming, material is escalated for further assessment and then reported to designated members of our senior management and, if necessary, the Audit Committee.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: We face a number of cybersecurity risks and threats in connection with our business. Although we have numerous controls to protect against common attacks, some attacks may still be effective. Our controls are designed to detect, triage and eradicate these attacks. While we carry a cyber insurance policy to help cover investigation and mitigation expenses, it may be subject to limitations and be insufficient to cover all expenses that may result from a cybersecurity incident. Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. For more information about the cybersecurity risks and other information technology and data privacy risks we face, see Item 1A. Risk Factors and the subsection titled Risks Related to Information Technology, Cybersecurity and Data Privacy.

companyName: Pacira BioSciences, Inc.

ticker: PCRX


text: The Company has in the past experienced cyberattacks on its computer networks and, although none to date have been material, the Company expects that additional cyberattacks will occur in the future. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Farmland Partners Inc.

ticker: FPI


text: Charter, an equity method affiliate, as a separate publicly traded company from Liberty Broadband, operates its own cybersecurity function. Oversight for Charter's cybersecurity functions rests with its board of directors and Audit Committee of which our Chief Executive Officer is a member.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: We believe that cybersecurity and the protection of data and customer information in our possession, custody or control is of paramount importance to our business. The Company's information security program is designed to protect the confidentiality, integrity, and availability of our critical systems and information, including customer information. The program is comprised of policies, procedures, and programs, and is informed by and intended to align with the interagency guidance issued by banking regulators as well as the FFIEC Information Security Booklet and Cybersecurity Assessment Tool (the "Information Security Program"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the guidance to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: First Internet Bancorp

ticker: INBK


text: As an oil and gas producer, the Company is dependent on digital technology in many areas of its business and operations. Additionally, the Company gathers and safeguards sensitive information in its regular business activities. The Company continually evaluates and integrates new processes, systems and resources to enhance its defenses against cybersecurity threats. The Company has implemented and maintains the following processes to assess, identify and manage cybersecurity risks:

companyName: PIONEER NATURAL RESOURCES CO


text: FactSet's information security and governance framework is guided by International Organization for Standardization ("ISO") 27001 and System and Organization Control ("SOC") 2 Trust Service Criteria and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. To support data security, we have established an integrated risk management framework with practices that are derived from industry standards, including ISO 27001, HITRUST Common Security Framework (CSF) 11.2 certification, the NIST Cybersecurity Framework, and data privacy regulations, including HIPAA and the General Data Protection Regulation. The data security controls from these standards and regulations are evaluated for our risk management framework based on the needs of our business and our clients, the nature of our industry, and applicable regulations.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: A primary element of our cybersecurity program is the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including to monitor compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Role of Management Management is directly involved in steering the company's cybersecurity program employing a multi-disciplinary approach that operates through a "three lines of defense" model. Management's approach helps ensure the organization works collaboratively to monitor, assess and respond to cybersecurity incidents at all levels and functions consistent with our incident response procedures and corporate practices.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program described above.

companyName: TXO Partners, L.P.

ticker: TXO


text: We maintain our Program with physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and respond to cybersecurity incidents. Elements of our Program include: (i) required training for our employees (including onboarding and annual training), exercises (including advanced phishing exercises), and awareness for our employees to promote vigilance of cybersecurity risks, including those that may be exacerbated by artificial intelligence, and (ii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually. In addition, we engage various third-party consultants to assist us in assessing, enhancing, implementing and monitoring our Program and responding to incidents.

companyName: InnovAge Holding Corp.

ticker: INNV


text: The Company's enterprise-wide cybersecurity program is embedded within and integrated with the enterprise risk management function. The Chief Security Officer is part of our senior leadership team and reports to the Chief Risk Officer. Our Chief Security Officer has over thirty years of cybersecurity, technology, and leadership experience both as a career active-duty military cyber operations officer and in the private sector. The cybersecurity team is organized into three departments: Protective Operations, Posture Management, and Governance, Risk, and Compliance. Each of the three departments identifies, assesses, and manages material cybersecurity threats through specific approaches as further described below.

companyName: NELNET INC

ticker: NNI


text: Service Providers: The Fund engages with various third-party service providers for critical operations and services. The Sponsors conducts rigorous cybersecurity risk assessments of all vendors and business partners with access to our networks or sensitive information. These assessments ensure that third-party cybersecurity policies are robust and align with our cybersecurity standards.

companyName: Dynamic Shares Trust


text: We have established policies and processes for assessing, identifying and managing material risk from cybersecurity threats. These policies and processes are intended to protect the confidentiality, integrity and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: As a company committed to safeguarding our operations, assets and stakeholders against cyber threats, we recognize the critical importance of the need for cybersecurity risk management and strategy. In today's digital landscape, where cyber threats continue to evolve and proliferate, it is imperative that we remain vigilant and proactive in our approach to cybersecurity.

companyName: ESCALADE INC

ticker: ESCA


text: Emerson's Chief Information Security Officer, who has over twenty-five years' experience in information technology within the engineering and technology industries, with the last fourteen years dedicated to cybersecurity, oversees the Company's enterprise cybersecurity risk management program. The Chief Information Security Officer leads the global enterprise security team responsible for leading enterprise-wide information security strategy, architecture, processes, as well as assessing, identifying, and managing cybersecurity risks, which is an integrated aspect of our overall enterprise risk management program. The Chief Information Security Officer provides regular updates to senior management on key security performance indicators of our enterprise cybersecurity program. The Chief Information Security Officer also provides quarterly briefings on cybersecurity to the Audit Committee.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: We have established a set of policies and procedures to assess, identify, and manage material risks from cybersecurity threats, codified in the Bausch Health Cybersecurity Program (the "Program"). The purpose of the Program is to establish a comprehensive framework intended to identify, manage, and where possible mitigate risks; prevent or identify and manage security incidents; protect our information assets, systems, and networks from potential threats; and enable a prompt response and recovery from cyber-attacks.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: Third parties are assessed and categorized according to service type, compliance risk, financial risk, operational risk, and security risk. The level of due diligence and ongoing monitoring that is performed is based on inherent risk as well as specifics such as if the vendor hosts data in the cloud or has access to consumer information.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: We recognize the importance of managing cyber risks that we face and have established processes as part of our enterprise risk management, or ERM, program to identify, assess, and manage risks associated with cybersecurity. Our Board retains oversight of our cybersecurity risk management. Our cybersecurity program is informed by industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security and availability of the information that we collect and store.

companyName: Toast, Inc.

ticker: TOST


text: Our Board and Audit Committee are actively engaged in the oversight of our risk management, including cybersecurity risk. The Audit Committee receives quarterly reports on information security from our SVP IT Infrastructure & Security. Additionally, Executive Leadership is briefed on information security at least quarterly by members of our IT security, compliance, governance, and audit teams. The Audit Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures.

companyName: FASTENAL CO

ticker: FAST


text: The Board of Directors has delegated to the Audit Committee to assist the Board of Directors in fulfilling its oversight responsibilities on cybersecurity matters. The Audit Committee oversees a number of the Company's risk management practices, including those relating to cybersecurity risks. Our CDO provides updates on cybersecurity risks, threats, key developments in Company policies and practices, and related risk exposures to the Audit Committee regularly. A member of the Audit Committee will then brief the full Board of Directors on items discussed within the Audit Committee, including cybersecurity risks and related matters. Additionally, management provides an update to the full Board of Directors on cybersecurity matters at least once a year, and more often as needed. The Board of Directors annually reviews and approves the capital and operating budgets, ultimately reviewing and approving the amount spent by the Company on cybersecurity measures.

companyName: COLUMBUS MCKINNON CORP

ticker: CMCO


text: The Audit Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, including controls and procedures related to managing material risks from cybersecurity threats, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Company's board of directors, as appropriate, to allow for timely decisions regarding such disclosures.

companyName: Sow Good Inc.

ticker: SOWG


text: For additional information regarding cybersecurity threats that may materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "If we experience a significant disruption in our information technology systems, including security breaches, or if we fail to implement new systems and software successfully, our business operations and financial condition could be adversely affected."

companyName: Danimer Scientific, Inc.


text: Securing Kroger's business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our businesses, meeting applicable regulatory requirements and maintaining the trust of our stakeholders. We have adopted enterprise cybersecurity risk mitigation and governance processes, which are set forth in the Kroger Cybersecurity Risk Management program ("CRM"), the Kroger Third-Party Cybersecurity Risk Management program ("TPCRM"), and the Kroger Cyber Incident Response Plan ("IR Plan"). Our approach is guided by the principles of the CRM, which includes monitoring threats and vulnerabilities and assessing and monitoring related controls, supporting the Corporate Information Security function, the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"). Kroger's cybersecurity policies, standards, processes, and practices are integrated into our overarching risk management system in an effort to enhance our ability to safeguard our operations and information, which includes quarterly cybersecurity reporting to the Board, delivered by senior leadership.

companyName: KROGER CO

ticker: KR


text: Although we utilize various procedures and controls to mitigate our exposure to such risk, cybersecurity attacks and other cyber events are evolving and unpredictable. Moreover, we have no control over the information technology systems of our customers, suppliers, and others with which our systems may connect and communicate. As a result, the occurrence of a cyber incident could go unnoticed for a period of time.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: Due to the importance of cybersecurity to the Company, the full Board is charged with oversight responsibility for our risk management and security strategy and policy. The Board is composed of members with diverse expertise including, risk management, information technology, engineering, manufacturing, innovation and finance, equipping them to oversee cybersecurity risks effectively. The Board receives updates from the CISO and management at least quarterly at board meetings, which updates cover the Company's cybersecurity strategy, current cybersecurity risk assessment, key risk areas, current cyber trends, and any significant cyber incidents that have occurred or are reasonably likely to occur.

companyName: Allegion plc

ticker: ALLE


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer, or CSO, and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations, or BXTI, and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: End Point Security: We allow access to all information assets only from authorized and standard devices (endpoints). All endpoints have a next-generation anti-virus tool installed that uses a combination of artificial intelligence, behavioral detection, and machine learning algorithms to anticipate and prevent known and unknown threats. All endpoints also have an extended detection and response ("XDR") tool installed that provides a proactive approach to threat detection and response by collecting and correlating data across multiple security layers. Alerts from all these tools are actively monitored and appropriate alerts/escalations are issued. International Seaways, Inc.

companyName: International Seaways, Inc.

ticker: INSW


text: Our Board of Directors and certain members of our senior management team have specific oversight responsibilities with respect to cybersecurity risk.

companyName: Greenbacker Renewable Energy Co LLC