text: We have established a risk-based information/cybersecurity program dedicated to safeguarding our data and solutions. Our privacy policies, along with associated controls and procedures, provide a comprehensive framework to guide the handling of data. We employ a defense-in-depth strategy, utilizing multiple security layers and the CIA (confidential, integrity, and availability) triad model. Our information security program is led by our Chief Information Security Officer (CISO) and the Information Security department, which sets the policies, standards, and strategies to manage security risk. The CISO has over two decades of experience with global technology organizations across various industries. We allocate significant resources to addressing security vulnerabilities by enhancing security and reliability features in our products and services, providing employee security training, monitoring our operations 24/7, reviewing and auditing our systems against independent security control frameworks, and conducting security maturity assessments. We may also engage third-party consultants, legal advisors, or audit firms to evaluate and test our risk management systems and assess and remediate potential cybersecurity incidents. These assessments inform our annual and multi-year cybersecurity strategies and our product security plans. In addition, our operations rely on several third parties, including vendors, developers, and partners, who are critical to our business and may have access to our confidential data regarding consumers, employees, contractors, suppliers, and other business partners. We conduct due diligence on these third parties regarding their security and business controls and have established monitoring procedures to mitigate risks related to data breaches or other security incidents originating from these third parties.

companyName: DELUXE CORP

ticker: DLX


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our Enterprise Risk Management ("ERM") process. The Risk Management team meets at least annually with cybersecurity leadership to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk. Through the ERM process, cybersecurity risks are presented to the executive leadership team, including the CEO and CFO, as well as reported to the AFC.

companyName: EXACT SCIENCES CORP

ticker: EXAS

secItem: Item 1C


text: Our board of directors has ultimate oversight of our risk management policies and strategies. Our executive leadership team, which is responsible for our day-to-day overall risk management practices, presents to the board of directors on the various material risks to our Company, including risks related to information technology and cybersecurity.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: To protect our information systems from cybersecurity threats, we utilize various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a reasonably timely manner. These include, but are not limited to, internal reporting and tools for monitoring and detecting cybersecurity threats.

companyName: Global Interactive Technologies, Inc.

ticker: GITS


text: As part of the Company's risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company's risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company's cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. Additionally, the Company's Information Security Awareness and Training Program educates employees and contractors on information security policies, standards, and practices to protect U.S. Bancorp's information, information systems, and processes. The Company's cybersecurity risk program is integrated into the Company's overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.

companyName: US BANCORP \DE\

ticker: USB


text: We have not experienced any material cybersecurity threats that have impacted PNC's business strategy, results of operations, or financial condition to date. Notwithstanding our well-established approach regarding cybersecurity, we may not be successful in preventing or mitigating the impact of a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. See Item 1A Risk Factors of this Report for a discussion of cybersecurity risks.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security controls and regular system audits to identify potential risks. In the event of a cybersecurity incident, the CISO is equipped with an incident response plan. This plan includes actions to mitigate the impact of any current cybersecurity incidents and long-term strategies for remediation and prevention of future incidents. Our CISO and other dedicated cybersecurity personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications, including Certified Information Systems Security Professional; Offensive Security Certified Professional; Global Information Assurance Certification; Security Strategic Planning, Policy, and Leadership; and Certified Information Security Manager, among others.

companyName: WORKIVA INC

ticker: WK


text: Management and the Company's third-party information security officer discuss information technology needs and activity and assess and manage material cybersecurity risks and the Company's practices for the prevention, detection, mitigation, and remediation of cybersecurity incidents, as necessary and appropriate. Our third-party information security officer has 30 years of experience in the IT management field and has consulted with large and mid-size corporations on proper IT processes and security. Our CEO and CFO have managed information technology departments during their careers. Our CFO was trained as an auditor and an information technology auditor at the public accounting firm of Ernst & Young LLP and audited the internal controls, including IT controls, of public companies, information technology departments, and third-party information technology service providers for 12 years.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: infrastructure. Our cybersecurity program will consist of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and will be based on a cybersecurity framework, such as the National Institute of Standards and Technology ("NIST") Cybersecurity framework.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: We have been subject to cybersecurity incidents in the past, including the publicly disclosed July 2024 security incident. Although we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected us, our business strategy, results of operations or financial condition, there is no guarantee that past security incidents and any future incidents will not have a material impact on our business strategy, results of operations, or financial condition in the future. See Item 1A, "Risk Factors," to this report for more information.

companyName: REPLIGEN CORP

ticker: RGEN


text: Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a company operating in the technology and software sectors, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to more advanced attacks. Our customers, suppliers and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systematic risks. Below is a discussion of our risk management and approach to governance as it relates to cybersecurity. For additional information on the impact of cyber risks, refer to Part I, Item 1A. " Risk Factors ", Risk Management and Strategy

companyName: GAXOS.AI INC.

ticker: GXAI


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our Leadership Team is responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as directly through the Audit Committee. Management and members of the Information Security Group ("ISG") regularly present to the Board of Directors regarding information security and an in-depth review of our processes for assessing, identifying, and managing material risks from cybersecurity threats. On a quarterly basis, the Audit Committee is informed by management concerning the status of existing and new cybersecurity risks, status of how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status of key information security initiatives. Additionally, on a biennial basis, we engage third parties to assess our information security program, using the NIST framework, as well as penetration testing.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: In the event of a security issue, we have a written incident response plan and have retained trusted experts to assist us in quickly triaging, containing, and understanding the issue. Our management team periodically reviews our response readiness and completes tabletop exercises on potential cybersecurity breaches with the assistance of a third-party cybersecurity consultant. We use the results from these exercises to enhance our response plan and cybersecurity protections going forward.

companyName: QXO BUILDING PRODUCTS, INC.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees cybersecurity risk strategy and governance and other information technology risks. Our Chief Executive Officer and Chief Financial Officer are responsible for assessing and managing cybersecurity risk, and providing briefings regarding the assessment and management of such risk to the Board of Directors. Although our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.

companyName: Charging Robotics Inc.

ticker: CHEV


text: Related to Cybersecurity Risks Our cybersecurity risk management program and related operations and processes are directed by our CIO. Currently, the CIO role is held by an individual who has been in the role for over nine years, has over 22 years of cybersecurity, information technology and systems engineering experience, and has advanced training in the field of technology.

companyName: WisdomTree, Inc.

ticker: WT


text: Our cybersecurity risk management program is integrated into the overall enterprise risk management program overseen by Hess' Chief Risk Officer, who also serves as our Chief Financial Officer, and shares certain methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other areas affecting our and Hess' business risks, including financial, compliance, EHS and governance matters, among other topics.

companyName: Hess Midstream LP

ticker: HESM


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's Board of Directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: The Fund deploys a range of people, process and technical controls that are designed to protect the Fund's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Fund's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyberattacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: BlackRock Private Credit Fund


text: Our cybersecurity crisis management plan sets forth the items, procedures, and actions we expect to address and follow in the event of a cybersecurity incident, including detection, response, mitigation and remediation. When a potential threat or incident is identified, our cyber security incident response team will assign a risk level classification and initiate the escalation and other steps called for by our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our Chief Executive Officer, who will determine whether and what elements of our cybersecurity crisis response and management plan should be activated, including escalation to other senior management. Our Chief Executive Officer will inform our board of directors of cybersecurity incidents, as appropriate, considering a variety of factors, including financial, operational, legal, or reputational impact.

companyName: Cardiff Lexington Corp

ticker: CDIX


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee is responsible for advising on our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Annexon, Inc.

ticker: ANNX


text: Risks from Cybersecurity Threats While we are subject to ongoing cybersecurity threats, we do not believe that the risks from these threats have materially affected, or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to our Information Technology, Cybersecurity and Data Protection" in this Annual Report.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: The CRC engages third-party expertise from time to time as it deems necessary or appropriate to test our cybersecurity defenses, to evaluate the cybersecurity programs of current and potential vendors and service providers, and to seek specialized legal advice regarding cybersecurity.

companyName: REGENCY CENTERS LP


text: Our information security program comprises administrative, technical and physical safeguards designed, under a risk-based approach, to reasonably mitigate cybersecurity risks to the confidentiality, integrity or availability of our information systems and information. These include safeguards designed to oversee service-provider relationships in a manner consistent with the risks presented by the engagement and use of the service provider.

companyName: BEST BUY CO INC

ticker: BBY


text: Our Audit Committee and Nominating and Corporate Governance Committee are primarily responsible for, among other things, overseeing our compliance and ERM programs, information technology systems, and our processes and data, including cybersecurity and data privacy. These responsibilities include reviewing and discussing with management our policies and processes relating to risk assessment and risk management. Cybersecurity and data privacy are regular topics on the Audit Committee's agenda and management reviews at least quarterly the results of cybersecurity monitoring and discusses performance metrics, any incidents identified and potential recommended modifications to our technology, organization training, awareness and governance with our Audit Committee. A summary of these results are also reported by the Audit Committee to the Board at least annually.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: Our Technology Group monitors material risks over time and updates the Company's mitigation measures as appropriate. The Technology Group also regularly reports to the CDO and other key executives, as identified in the incident response plan, on the status of material risks, mitigation measures, and incidents related to such risks.

companyName: MARINEMAX INC

ticker: HZO


text: The CFO also provides updates to the Audit Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: Company's executive officers oversee the strategic processes to safeguard data and comply with relevant regulations and has overall responsibility for evaluating cybersecurity risks, as well as related policies and risks in connection with the Company's supply chain, suppliers and other service providers. The Company does not currently engage any assessors, consultants, auditors, or other third parties in connection with any such processes, given the size and scale of the Company, the resources available to it, the anticipated expenditures, and the risks it faces in terms of cybersecurity. The Company's executive officers are responsible for overseeing and periodically reviewing and identifying risks from cybersecurity threats associated with its use of any third-party service provider.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: As part of our broader approach to risk management, our cybersecurity program is designed to follow an "identify, protect, detect, respond and recover" approach to cybersecurity that is based off of the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). Our strategy also includes segmentation of corporate and operations networks, defense in depth and the least privileged access principle. Operational networks have fundamentally distinct safety and reliability standards and pose unique threats in comparison to information technology networks. Realizing these differences, we routinely evaluate opportunities to refine our cybersecurity program in order to mitigate operational network risks. We include business continuity planning as a component of our strategy to help ensure critical systems are available to support our company in the instance of a disruptive event. We also participate in various industry organizations to stay abreast of recent trends and developments.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: LINGERIE FIGHTING CHAMPIONSHIPS, INC.

ticker: BOTY


text: Our information risk management framework is designed to manage and protect against risks in three broad categories: (i) operational risk; (ii) financial risk; and (iii) safety, environmental, and regulatory risk. We consider and evaluate reputational risk as an element of each of these risk categories.

companyName: Sonendo, Inc.

ticker: SONX


text: The Company has implemented a comprehensive approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to timely identify, classify and escalate certain cybersecurity incidents to provide management visibility and allow for direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: Xencor Inc

ticker: XNCR


text: Primary responsibility for executing our cybersecurity program rests with our Vice President of Corporate Strategy and Planning, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of related work experience. The Vice President of Corporate Strategy and Planning is responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to our Chief Executive Officer. The Vice President of Corporate Strategy and Planning at times attends meetings of the Board to report on any material developments to our risk management practices, including our cybersecurity program.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Bank's Chief Information Officer (CIO) provides direction and oversight for information technology and security across the Company, including existing and emerging initiatives. In this role, she leverages more than 25 years of information technology experience. In addition, the Bank's Chief Information Security Officer (CISO) has been with the Company for more than 12 years and has maintained various applicable cybersecurity and IT audit certifications. Prior to joining the Bank, he worked for a Fortune 500 company and had 15 years of information technology experience working in networking, information security and information technology auditing. The CIO and the CISO are supported by a team of information technology and information security specialists.

companyName: BANNER CORP

ticker: BANR


text: Our primary third-party service providers utilize two-factor authentication as well as login and password protections with email are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Regions regularly tests and assesses its environment so it can update and maintain its systems and controls to mitigate the risks from cyber threats and vulnerabilities. These include risk assessments and penetration testing as well as testing against security controls. Layered security controls are designed and maintained to complement each other and enhance risk mitigation efforts. Regions is aiming to continue to develop and enhance controls, processes and technology to respond to evolving disruptive technology and to protect its systems from attacks or unauthorized access. In addition, Regions' TPRM function establishes the risk-based framework that governs all associates, subsidiaries, and affiliates who are engaged in the sourcing, planning, risk assessment, due diligence, contracting, ongoing monitoring, and governance of vendor engagements, including those that present cybersecurity risks for Regions. The TPRM framework includes the initial inherent-risk assessment conducted at onboarding and the applicable due diligence risk assessments, based on the engagement's risk profile. Upon completion of the applicable due diligence, the contract is constructed and negotiated, with efforts made to ensure appropriate terms are in place to further mitigate the risks presented. Thereafter, each engagement is reassessed on the established cadence associated with the inherent-risk tier, and performance scorecards are completed to to denote material changes in the engagement.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Consistent with the overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while the Board and its Audit and Finance Committee perform an oversight function.

companyName: EASTMAN KODAK CO

ticker: KODK


text: from Cybersecurity Threats have not experienced any material cybersecurity incidents, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. We rely extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze, and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Based on the context and details of the potential cybersecurity incident, the incident response plan includes prompt review by one or more members of the IT team, with appropriate responses deployed as promptly as is practicable under the circumstances. Additionally, the CIO receives reports on potential cybersecurity incidents. As part of overall enterprise risk management, additional reporting of potential cybersecurity incidents is also provided to our General Counsel, Chief Accounting Officer, Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: With respect to third parties who provide services affecting critical business management systems, we collect and maintain SOC2 type II reports (attestation of controls at a service organization over a minimum six-month period). For other third-party service providers, cybersecurity risk is addressed as appropriate.

companyName: CODEXIS, INC.

ticker: CDXS


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us during fiscal year 2025 or are reasonably likely to materially affect us in the near term, including our business strategy, results of operations, or financial condition. Additional information about our cybersecurity risks is discussed in "Disruptions to our information systems, including security breaches, losses of data or outages, and other security issues, have and could in the future adversely affect our operations" in Item 1A. Risk Factors, which should be read in conjunction with the information above.

companyName: JABIL INC

ticker: JBL


text: Company's board of directors has not to-date exercised any oversight of risks from cybersecurity threats and none of its committees is tasked with or responsible for oversight of risks from cybersecurity threats. The Company's board of directors will review its cybersecurity oversight going forward on a periodic basis and, if the Company makes adequate resources available, effect changes therein.

companyName: AIRWA INC.

ticker: YYAI


text: Oversight of Third-Party Providers Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services – including hardware, software, staffing, and support – to maintain certain security protections including, but not limited to, compliance with applicable data protection laws, and implementation of administrative, physical and technical safeguards to protect our data, including how our data is stored, accessed and transmitted. In addition, all providers within these service categories must sign our data security attachment that articulates the specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we, or third-party providers that we rely on, will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. During fiscal 2024, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Part 1, Item 1A, Risk Factors of this Annual Report.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Management is responsible for our company's day-to-day risk management activities. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing cybersecurity risks. He has 26 years of experience in both military and corporate leadership roles, including 13 years of experience in CIO-level leadership roles, including consulting with major firms, covering technology and security operations responsibility.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: The CISO and the CRO are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents with the support of our information security department.

companyName: Federal Home Loan Bank of Indianapolis


text: The organizational structure of the IT department of our subsidiary MED includes a specialized cyber-security team. Different levels of anomaly incidents are addressed through different workflows and reporting paths as stipulated in the Guideline, generally led and overseen by the head of the IT department in MED.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and mitigations are also subject to oversight by the Security Committee of our Board of Directors. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We Could Be Harmed by Data Loss or Other Security Incidents," which should be read in conjunction with the information above.

companyName: AMAZON COM INC

ticker: AMZN


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Our information security program is managed by our Senior Vice President and Chief Information Officer ("CIO"), who has over 25 years of IT Risk Management experience. The CIO's cybersecurity team, which includes a team of personnel with more than 30 years of collective information and product security experience, ranging from early-career professionals with cybersecurity degrees to seasoned professionals with multiple cybersecurity-related certifications, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic reports to our management team and our Board, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of related projects, assessments, and emerging threats. Our cybersecurity program is regularly evaluated and reported on to senior management and the Board.

companyName: Terran Orbital Corp


text: The Critical Security Controls, a prescriptive, prioritized, and standardized set of globally recognized best practices, guide our information security strategy. The Critical Security Controls are developed and maintained by the Center for Internet Security, Inc., a nonprofit organization with over 20 years of experience in helping individuals, businesses and governments protect themselves against cyber threats. We also consider best practices from third-party vendors and payment processors and from the Cloud Security Alliance, a nonprofit organization that leverages global expertise to offer research and education programs related to cloud security.

companyName: CubeSmart

ticker: CUBE


text: At the holding company level, Old Republic employs security awareness and training initiatives to inform associates about their role in cybersecurity risk mitigation.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We and our third-party service providers have frequently been the target of cybersecurity threats and expect them to continue, and for an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: EXELIXIS, INC.

ticker: EXEL


text: Cybersecurity incidents and risks of which we are aware as of the date of this Form 10-K have not materially affected our business strategy, results of operations, and financial condition, although we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business strategy, reputation, results of operations, or financial condition. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.

companyName: LOWES COMPANIES INC

ticker: LOW


text: External Advisors. We, along with our Board and its committees, engage outside advisors where appropriate to assist in the identification, oversight, evaluation and management of the risks facing our business, including cybersecurity risks. Advisors may be engaged either on a regular basis to inform the Board or management of ongoing risks, or occasionally to advise on specific topics. Such advisors include law firms, cybersecurity experts and other consultants.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: We aim to proactively identify the manners in which our business could be materially impacted by cybersecurity risks including:

companyName: Kun Peng International Ltd.

ticker: KPEA


text: Cyberattacks continue to increase in frequency and magnitude generally, and cyber criminals are becoming more sophisticated. Although we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and client expectations and will continue to make significant investments to maintain the security of our and our client's data and our cybersecurity infrastructure, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective against new and/or emerging threats, vulnerabilities and techniques designed to circumvent such measures. To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, please refer to "Risk Factors" (Part I, Item 1A of this Report).

companyName: Rimini Street, Inc.

ticker: RMNI


text: In addition, as part of its risk management strategy, Voya Financial has an established and integrated cybersecurity incident response plan that focuses on incident detection, management and response. The information security team periodically reviews and updates the plan and tests playbooks within the plan through tabletop exercises.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, risk and compliance reviews, and regular meetings with KULR executives. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform vulnerability testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: Oversight of Cybersecurity Risk Our cybersecurity risk management strategy is led by the Information Technology Director (IT Director) and the Director of Information Security (IS Director). Our IS Director has over eleven years of experience managing information security, developing cybersecurity strategy and implementing relevant and effective cybersecurity programs. Together, our IT Director and IS Director hold numerous credentials, including a Bachelor of Science in Cybersecurity & Information Assurance. Both have extensive experience in cybersecurity management with credentials including CISSP, CCSP, GIAC, GCFA, GCIH, and others.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: We rely on technology in all aspects of our business, including information systems of our third-party service providers. The information systems upon which we depend have been, and likely continue to be, subject to cybersecurity threats such as unauthorized access attempts, business email compromise, phishing, malware, ransomware, hacking and other cyberattacks attempting to disrupt operations. Our dependence on these information systems exposes us to cyberattacks, both directly and through cyberattacks impacting our service providers. A significant cybersecurity incident could result in service interruptions, security events, regulatory compliance failures, the inability to protect employee or corporate information or assets against unauthorized access or use, or other operational difficulties. As described above, we continuously monitor our cybersecurity threats, including risks associated with our use of service providers. We are not aware of any risks from cybersecurity threats, or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: PARKERVISION INC

ticker: PRKR


text: Employee awareness of cybersecurity risks and threats is also an important part of an effective control environment. We periodically communicate to employees about this cybersecurity awareness. We are working on an implementation plan to require each of our employees to complete an annual information security training course, in addition to other training requirements. This should lead to an educated, informed, and prepared workforce, with an awareness of potential cybersecurity threats, how they may occur, and how to report and escalate such matters.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Our Chief Executive Officer, Chief Financial Officer, General Counsel and other key officers and our Information Security team work collaboratively across the Company to implement and monitor our Information Security Program, which is designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our Information Security team is deployed to address cybersecurity threats and to respond to cybersecurity incidents, including those stemming from any violation of our cybersecurity policies. Further, our Information Security Team monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Cybersecurity risk management has been integrated into the Company's overall enterprise risk management program ("ERM") through the Company's enterprise risk governing bodies, which are the Global Risk and Compliance Council ("GRCC") and the Enterprise Risk Steering Committee ("ERSC"). Our CSO reports on cybersecurity risk to the GRCC and ERSC and also serves as a member of the ERSC. The CSO regularly meets with members of our executive leadership team to discuss cybersecurity risks, as well as related mitigation and remediation activities. In addition, information on cybersecurity risks is further integrated into our overall ERM through our central internal audit function, which incorporates such information in regular audits of our cybersecurity and data protection controls and processes.

companyName: Dell Technologies Inc.

ticker: DELL


text: Our enterprise risk management framework considers cybersecurity risk in conjunction with our other Company risks as part of the overall risk assessment process. Our enterprise risk management team collaborates with the information security function, led by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), to gather their insights and risk mitigation strategies for managing cybersecurity threats. This integrated approach helps us assess, identify, and manage cybersecurity risks along with our other operational, financial and strategic risks, assisting in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL


text: The information security operations team within our information technology function reports to our Chief Information Officer, who regularly updates our Board of Directors and the Audit Committee. The function is governed by various policies on different aspects of cybersecurity. Our Board of Directors and the Audit Committee, as applicable, then reviews such information, including management's proposed mitigation strategies and plans, to monitor our progress on mitigating the risks.

companyName: MARCUS CORP

ticker: MCS


text: We aim to incorporate responsible practices throughout our cybersecurity risk management processes. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks to our IT systems and information. As a part of this process, we engage independent third-party specialists to review our cybersecurity environment, including formal reviews and assessments, and we request specific, actionable recommendations for improvement.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: External Assessments We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures for handling and control of sensitive data and systems, in an effort to identify areas for continued focus, improvement and/or compliance (e.g., SOC, SOX, PCI, HIPAA).

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: The Bank's cybersecurity program is managed by its Chief Information Security Officer ("CISO") with oversight from executive management and the Bank's Board of Directors. The CISO reports to both the Bank's CIO and its Chief Risk Officer ("CRO").

companyName: Federal Home Loan Bank of Dallas


text: Board Oversight of Cybersecurity Matters Oversight of information security matters is conducted by our full Board of Directors. The Board annually receives a comprehensive presentation on information security and controls from our Chief Information Officer (CIO) and, as may be necessary for specific topics, follow up occurs at additional meetings during the course of the year.

companyName: TEXTRON INC

ticker: TXT


text: We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our response to a cybersecurity incident.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Our Chief Risk Officer has over 20 years of experience developing and leading global risk organizations across multiple Fortune 500 companies. He holds an undergraduate degree in aerospace engineering from the Georgia Institute of Technology.

companyName: NCR Atleos Corp

ticker: NATL


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A. Risk Factors—Risks Related to Our Intellectual Property, Information Technology, Cybersecurity and Privacy—A cybersecurity incident, other technology disruptions or failure to comply with laws and regulations relating to privacy and the protection of data relating to individuals could negatively impact our business, our reputation and our relationships with customers.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: Our Board of Directors has delegated risk management oversight responsibility for information security, which includes data privacy and cybersecurity, to the Governance and Nominating Committee. Certain of our board members, including certain members of our Governance and Nominating Committee, have backgrounds or experience in risk management and/or information technology. On at least an annual basis, the Governance and Nominating Committee receives updates from our CISO, Chief Information & Technology Officer ("CITO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. The Board of Directors also receives regular reports from the Governance and Nominating Committee on these and other risk-related matters as necessary. Our CISO provides information to the Governance and Nominating Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed designated thresholds.

companyName: TYSON FOODS, INC.

ticker: TSN


text: The Company has also established a dedicated Cybersecurity Working Group, with members from both the Traditional Business and Journal Technologies, to collaborate on threat intelligence, incident response strategies, policy alignment, and security technology advancements. This partnership ensures both entities remain proactive in addressing evolving threats and benefit from shared expertise to implement coordinated security measures. The Company's senior management works closely with the CISO and the Cybersecurity Working Group to identify matters requiring the attention of the Board of Directors.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: We recognize the importance of implementing and maintaining measures to safeguard our information technology systems and data. We and the Manager have entered into agreements with third parties for hardware, software, telecommunications and other information technology services in connection with our business. In addition, we and the Manager have developed or may develop proprietary software systems, management techniques and other information technologies incorporating software licensed from third parties. The Company integrates cybersecurity risks into its overall enterprise risk management program. Pursuant to the MSA, the Manager provides us with back-office services, including services for the management of our data and cybersecurity risk. Together with the Manager, we seek to assess, identify, and manage cybersecurity risks with the help of independent cybersecurity services as follows: (i) we have a multi-layered system designed to protect and monitor data and cybersecurity risk, which includes the use of firewalls and protection software, and an independent cybersecurity vendor regularly assesses our cybersecurity safeguards and updates our cybersecurity infrastructure, procedures, policies, and education programs, as appropriate; (ii) we have monitoring and detection systems designed to identify cybersecurity incidents, and we have an incident response plan designed to provide action to contain cybersecurity incidents, mitigate their impact, and restore our normal operations; (iii) we require our employees and contractors to receive annual cybersecurity awareness training and incident response plan training; and (iv) we have access controls designed to provide users of the systems containing our data with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: The Company has implemented processes to identify, prioritize, assess, mitigate and remediate risks associated with third-party service providers. As part of these processes, we conduct security assessments of critical third-party providers before engagement and contractually require third parties we engage to implement security programs commensurate with their risk.

companyName: MONRO, INC.

ticker: MNRO


text: Internal and external Penetration Testing is performed annually. Tests are conducted or reviewed by independent third parties or qualified Associates independent of those that develop or maintain the security program. Testing is performed annually by third party auditors contracted through the company's IT department. Management reviews test results promptly and ensures that appropriate steps are taken to address adverse test results. Remediation efforts are organized and made available to the Committee as well as for review by third party auditors and examiners.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: We rely on Cheniere's cybersecurity leadership team, which consists of its Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of our cybersecurity governance, cyber risk management and security operations and are responsible for maintaining our technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: CISO, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing SideChannel, Inc. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: SideChannel, Inc.

ticker: SDCH


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: Rise Gold Corp.

ticker: RYES


text: Risk management policies. The Company has developed and implemented an information security program (the "Cyber Program") and an incident response plan (the "IRP"), which include various processes and controls intended to protect the integrity and availability of the Company's systems and information. These processes and controls were primarily designed and assessed based on the cybersecurity framework published by the National Institute of Standards and Technology. The Company retains or engages various third-parties in connection with design, implementation and monitoring of certain processes and controls. In addition, the Company maintains business continuity and disaster recovery plans.

companyName: PIONEER NATURAL RESOURCES CO


text: To ensure robust oversight, we are establishing a Security Council, led by our Principal Security Engineer, that is comprised of senior leaders, including our Chief Executive Officer, Controller, Chief Financial Officer, and Interim General Counsel. The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and our cybersecurity program, as well as responsibility for management of our information security systems.

companyName: Skillz Inc.

ticker: SKLZ


text: At UFP Industries, we recognize the importance of managing cybersecurity risks to protect our operations, data, and stakeholders. Our program is aligned with industry-recognized frameworks, including the NIST Cybersecurity Framework and CIS Top 18 Security Controls. We employ a structured approach to identify, assess, and manage potential threats, ensuring our defenses are proactive and multi-layered. Regular reviews and third-party assessments help us adapt to evolving risks, while our incident response plan and business continuity strategies are designed to minimize any operational impact from cybersecurity incidents. Risk Management and Strategy.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: As of May 1, 2024, we have not encountered any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. Nevertheless, we acknowledge that complete risk elimination is challenging, and undetected incidents may still occur.

companyName: Securetech Innovations, Inc.

ticker: SCTH


text: Management updates the Board on any significant cybersecurity occurrences. The Board receives periodic briefings on cybersecurity risks, incidents, and risk mitigation measures, and reviews management's cybersecurity policies and response plans at least annually.

companyName: INTERGROUP CORP

ticker: INTG


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, security controls, and responses to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise enhance our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • tabletop exercises conducted at the management level to ensure the Company is prepared in the event of a cybersecurity incident and to help identify areas of improvement for the cyber security incident response and risk management programs; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, cybersecurity resilience and recovery; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Oversight responsibility for information security matters is shared by the Board (primarily through the Audit Committee) and senior management. The Audit Committee oversees the company's cybersecurity and information security program and receives periodic updates from senior management on cybersecurity and information security matters. The Vice President of Global Information Technology and Information Security or key members of the executive leadership team update the Audit Committee periodically on the cybersecurity landscape, including the status of ongoing threats and company initiatives.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Our Board of Directors oversees cybersecurity risk. Cybersecurity reviews by the Board are scheduled to occur at least quarterly, or more frequently as determined to be necessary or advisable. Presentations to the Board of Directors are made by senior management, including our Chief Information Security Officer ("CISO"), our EVP of Microsoft Security, our EVP of Cloud + AI, and the head of our Customer Security and Trust organization. The presentations address topics such as cybersecurity threats, incidents, top risks and related remediation efforts, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, regulatory developments, and digital diplomacy efforts. In addition, we have an escalation process in place to inform senior management and the Board of significant issues. Cybersecurity issues are also considered during separate Board meeting discussions regarding important matters like ERM, audit issues, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: MICROSOFT CORP

ticker: MSFT


text: We conduct quarterly risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. This process involves evaluating their infrastructure security policies and controls to ensure high levels of code quality. Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We follow the Critical Security Controls, or CIS, guidance to defend our systems and networks against the most prevalent cyber-attacks. We have allocated adequate resources and have designated executives and IT management personnel to manage the cybersecurity risk assessment and mitigation process. We track quarterly Risk Register scores, which are derived from assessments of impact and likelihood, and monitor adoption rates of CIS controls to gauge our progress. These metrics are systematically tracked and reported to the board on a quarterly basis. As part of our overall risk management program, we regularly provide required training to employees at all levels and in all departments on cybersecurity.

companyName: MAXLINEAR, INC

ticker: MXL


text: We recognize the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party vendors. We perform a thorough review of the cyber security measures in place, including any documented third-party audits, for any partners who process our data. Sign-off is required by the Information Security team before agreements can be put in place.

companyName: Mistras Group, Inc.

ticker: MG


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: PURE CYCLE CORP

ticker: PCYO


text: Our CISO has more than 26 years of experience in cybersecurity and information technology, including, prior to joining KDP in 2019, more than 11 years as a principal in Ernst & Young's cybersecurity practice. Our CISO reports directly to our Chief Information Officer, who also has over 37 years of experience in information technology and cybersecurity.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for almost 20 years, and has received industry-recognized information security certifications. Our CTO, to whom the CISO reports, has served as Walmart's CTO since 2019 and prior to that had experience managing technology and other risks at several other large public companies.

companyName: Walmart Inc.

ticker: WMT


text: From a monitoring perspective, generally speaking, our information security office associates monitor the environment for threats, events and potential incidents. Depending on the potential severity of any identified incident, the company's incident response process, modeled after National Institute for Standards and Technology (NIST) frameworks, is initiated. As part of this process, each incident is evaluated and inventoried by our incident response team and reported to our legal compliance subcommittee for further action. Depending on severity, certain other internal and external parties may participate in the incident response process from a compliance and financial reporting perspective.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: The Company has implemented a comprehensive cybersecurity program to assess, identify and manage risks from cybersecurity threats that may result in adverse effects to the confidentiality, integrity, and availability of its information systems and oversee compliance with applicable regulatory, operational, and contractual requirements.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: The Audit Committee of the Company's Board is responsible for overseeing the Company's cyber risk. Based on details provided by the DIT and DIS, the Chief Financial Officer (CFO) provides the Audit Committee quarterly updates that encompass a broad range of topics, including: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; and • Compliance status and efforts with regulatory requirements and industry standards.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Oversee Third-Party Risk Because we are aware of the risks associated with third-party vendors, service providers and business partners, we have implemented processes to oversee and manage these risks. We conduct initial risk assessments of third-party providers before engagement. These assessments include due diligence reviews of third parties that have access to our networks, confidential information and information systems in order to assess the risks from cybersecurity threats. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Matador Resources Co

ticker: MTDR


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct the company's response to cybersecurity incidents.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: Index to Financial Statements Our program and practices regarding information security, cybersecurity, and data privacy include the following: • Audit & Risk Committee and Board of Directors updates. To inform and educate the Audit & Risk Committee in its primary oversight responsibility for information security, cybersecurity, and data privacy, management provides updates on these topics. For example, the Chief Information Security Officer addresses information security risks and controls, cyber threats, and other program updates, and senior members of the risk team provide enterprise risk management program updates. In addition, the Board of Directors receives updates from management regarding Target's overall risks, which include risks related to these topics. • Integration into enterprise risk management program. By aligning the identification, assessment, and management of risks related to information security, cybersecurity, and data privacy with our overall approach to risk oversight by the Board of Directors, its committees, and management, we have integrated these practices into our enterprise risk management program. • Management expertise. Our Chief Information Officer leads the strategic direction and management of Target's enterprise technology systems. He is responsible for Target's technology roadmap and oversees Target's global product engineering, infrastructure, cybersecurity, data sciences, and architecture teams. He has held a variety of leadership roles across the company and has developed significant knowledge and skills regarding enterprise technology systems, including cybersecurity. Our Chief Information Security Officer has a strong background in technology, information security, cybersecurity, risk management, audit, and compliance and held executive roles in information security prior to joining Target. He continues to develop his expertise in these areas and contributes to the broader cybersecurity community by serving in several board and advisory roles and promoting collaboration, best practice sharing, and talent development. Our Chief Legal & Compliance Officer and Chief Corporate Affairs Officer have extensive experience, and have developed critical knowledge and skills, in the areas of risk oversight and compliance, including as such areas relate to cybersecurity. • Systems and processes. We use a combination of industry-leading tools and in-house technologies to protect Target and our guests, operate a proactive threat intelligence program to identify and assess risks, including from threats associated with our use of third-party service providers, and we run a cyber fusion center to investigate and respond to threats. Our program is based on recognized industry security standards and control frameworks, which we seek to validate through internal and independent assessments. Our cybersecurity team regularly tests our controls through penetration testing, vulnerability scanning, and attack simulation. In addition, we have an incident response program to address potential security and privacy incidents. As part of this incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of potential security and privacy incidents. The program uses a coordinated escalation model to provide information to, and engage with, relevant members of management and the Board of Directors, as needed, throughout the incident response process.

companyName: TARGET CORP

ticker: TGT


text: Additionally, the Audit Committee, which consists solely of independent directors, is responsible for overseeing cybersecurity risks and related initiatives. The Audit Committee reviews our enterprise risk and cybersecurity risks. It also reviews the steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity on a quarterly basis.

companyName: SITE Centers Corp.

ticker: SITC


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President of Information Technology, risk management and internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: TERAWULF INC.

ticker: WULF


text: Participates in regular reviews and discussions dedicated to the Company's risks related to the protection of our data and systems, including cybersecurity and privacy. Receives periodic updates from external advisors regarding cybersecurity risk management and reporting.

companyName: US Foods Holding Corp.

ticker: USFD


text: Due to the ever-changing threat landscape, our operations and services may be subject to certain risks, including hacking or other unauthorized access to control or view systems. Our business is dependent on the security and integrity of the systems and products we offer.

companyName: PlayAGS, Inc.


text: Our cybersecurity risk management strategy and processes are designed to identify, assess, and manage risks to the confidentiality, integrity, and availability of our information technology environment, systems, and information. The cybersecurity risk management process is managed centrally and is led by our global chief information security officer ("CISO") who reports to our global chief information officer. Our cybersecurity program takes a risk-based approach and is integrated with our global enterprise risk management program. Our cybersecurity risk strategy is aligned with cyber/information security frameworks and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: TE Connectivity plc

ticker: TEL


text: Our Board actively oversees Interpublic's risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Board oversees the Company's risk assessment and risk management policies and performs an annual review and assessment of the primary operational and regulatory risks facing Interpublic, their relative magnitude and management's plan for mitigating these risks. At least annually, our CIO and CISO report to the full Board with a comprehensive report addressing a broad range of topics, including updates on strategy and investments, significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, industry trends, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor "Security breaches, loss of data and other disruptions, including from cyberattacks and other cybersecurity incidents, could compromise personal, confidential, or other sensitive or proprietary information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation", included in Part I, Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference into this Item 1C. We did not experience any material cybersecurity incidents during the last fiscal year.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and annual policy acknowledgments.

companyName: ESS Tech, Inc.

ticker: GWH


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act (GLBA) 12 CFR 364, Appendix B, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The cybersecurity program is built upon a foundation of advanced security technology, our internal employee team, and operations based on industry best practices recommendations from the National Institute of Standards and Technology (NIST) Cybersecurity Framework, Federal Financial Institutions Examination Council (FFIEC) Guidelines, and Center for Internet Security (CIS) Benchmarks. This consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. Our Chief Information Security Officer and our Chief Information Officer, who reports directly to our Chief Executive Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: The management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO"), who reports directly to our Chief Executive Officer ("CEO"). Our CIO is responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy. Our CIO and Director of Cybersecurity both have over 20 years of cybersecurity oversight experience. Our CIO previously served as CIO for a New York Stock Exchange listed manufacturing company prior to joining the Company. Additionally, our Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: We have not been materially impacted by any cybersecurity threats or prior cybersecurity incidents, including with respect to our business strategy, results of operations or financial condition. However, we cannot provide assurance that we will not be materially affected in the future by such risks, threats or any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.

companyName: Greenwich LifeSciences, Inc.

ticker: GLSI


text: Our Board of Directors is focused on cyber security. Specific responsibility for cybersecurity oversight is managed by the Audit Committee. The SVP, Head of Legal and Compliance is responsible for the management and mitigation of identified risks and the presentation of any changes in risk factors, identified risks, overall cybersecurity efforts and upcoming improvements to the Audit Committee. The SVP, Head of Legal and Compliance is also responsible for the response to and the remediation and resolution of a security incident involving a potential or actual compromise of our proprietary information and/or personal information. The SVP, Head of Legal and Compliance reports to the Audit Committee quarterly with respect to the Company's cybersecurity infrastructure and risk assessment and reports any security incidents to the Audit Committee. The Audit Committee will report the Company's cybersecurity infrastructure and risk assessment and any findings and recommendations to the full Board of Directors for consideration if and when the Audit Committee deems it necessary or appropriate.

companyName: Talis Biomedical Corp

ticker: TLIS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. The Audit Committee of the Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats. The Audit Committee also oversees our cybersecurity risk and receives regular reports from our CIO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: We conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems, implementation of two factor authentication for logins, and improved rules for password maintenance. Additionally, we require our associates to complete cybersecurity awareness training provided by NINJIO.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external independent auditors. These assessments include a variety of activities including information security assessments, audits and independent reviews of our ISMS, control environment and operating effectiveness. For example, in 2022 and 2023, we conducted independent audits to assess our ISMS against the ISO/IEC 27001:2013 standard and received certification of compliance with the standard. In 2022 we also undertook independent testing to achieve conformance with ISO 30107-3 Level 1 and 2 for Presentation Attack Detection (PAD), for our Bioweb server and Verified dashboard. We also undertake regular penetration testing of our systems. The results of significant assessments are reported to management and the Board. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.

companyName: authID Inc.

ticker: AUID


text: Our Board of Directors provides oversight of the Company's cybersecurity risk management program and integrates this oversight into its overall evaluation of enterprise risk. Our Audit Committee has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once each year and following any material cybersecurity incidents.

companyName: Verastem, Inc.

ticker: VSTM


text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy, and information security policies and procedures is mandatory at least annually for all employees. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors, or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques. Certain employees also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.

companyName: Cohen & Co Inc.

ticker: COHN


text: The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments. In addition, our employees and contractors receive periodic training under our IT security policies, including simulated intrusion attempts, and are required to certify compliance with our cybersecurity practices. In February 2025, we obtained ISO 27001 certification for our information security management systems.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: The Program governs all FLIAC internal systems, as well as third parties providing service to the Company, and is based on the following five pillars: • Identify - The first pillar of the Program is to identify the organization's critical assets, vulnerabilities, and potential threats. This involves conducting a thorough quantitative and qualitative risk assessment and asset inventory based on the organization's information systems, data repositories, and network infrastructure. Additionally, it involves categorizing and classifying the importance of different assets, assessing their potential impact on the organization if compromised, and identifying applicable regulatory compliance requirements. This pillar of the Program also involves regular engagement with the broader security community and monitoring of new and emerging cyber threat information. • Protect - After identifying the assets and vulnerabilities, FLIAC applies comprehensive asset protection methods allowing for accurate risk mitigation techniques. This includes deploying a range of security controls such as firewalls, intrusion detection systems, antivirus software, encryption mechanisms, and access controls. The goal is to establish multiple layers of defense to prevent unauthorized access, data breaches, cyber-attacks, and other cybersecurity incidents. Employee awareness training (including phishing simulation exercises to train employees to recognize and report phishing attacks) and secure coding practices also fall under this component to ensure a culture of security throughout the Company. • Detect – The Program focuses on the timely detection of any suspicious activities or security breaches. This involves implementing security monitoring systems, intrusion detection systems, and log analysis tools to continuously monitor network traffic, system logs, and user behavior. Real-time alerts and security incident management processes help in identifying potential security incidents promptly. • Respond – If a security incident is detected, a response plan is triggered to minimize the impact and contain the threat. This component involves establishing an incident response team and defining incident response procedures. The team is trained to respond promptly, investigate the incident, mitigate the damage or harm, and restore normal operations. Communication plans, escalation protocols, legal considerations, regulatory requirements, (including appropriate and timely reporting and disclosure of cybersecurity incidents to regulators and affected individuals), and coordination with external entities, like regulators, law enforcement, vendors and other key stakeholders, are also part of the response process. • Recover - The final pillar of the Program focuses on recovering from a security incident and restoring normal operations. This includes activities such as system restoration, data recovery, and analyzing the incident to identify lessons learned and improve future incident response capabilities. It also involves assessing residual risks, updating security controls, and continuously monitoring and testing the Company's security posture to ensure readiness for potential future incidents.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


text: The Board of Directors of the Company (the "Board"), as a whole and through its committees, oversees the Company's risk management process, including operational, financial, legal, strategic, marketing and brand reputation risks. The Technology and Cybersecurity Committee of the Board (the "Committee") oversees risk management associated with the Company's information technology use and protection, including data governance, privacy, compliance, and cybersecurity. The Committee comprises Board members with particular expertise in technology and management, equipping them to oversee cybersecurity risks effectively.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Our Director of Information Security has twenty years of cybersecurity experience, has completed a Masters in Homeland Security, with an emphasis on cybersecurity, and holds several cybersecurity certifications. Our Director of Information Security is responsible for leading the Information Security Team which has established a cybersecurity risk management program of policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We have integrated these processes into our overall risk management systems and processes, and routinely assess risks from cybersecurity threats, including any potential unauthorized access to or activity conducted through our information systems that may result in material adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. This program includes established reasonable safeguards to minimize the identified risks; processes to reasonably address any identified gaps in existing safeguards; updates to existing safeguards as necessary; and monitoring the effectiveness of those safeguards.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: The CISO has been at Williams for over 25 years. During that time, he has held a variety of IT positions at multiple levels in the organization ranging from network engineering to application development, project management as well as several IT Manager and Director roles. He has had oversight of our cybersecurity and risk management programs since 2017. Active in government and private sector partnerships, he is currently serving as the outgoing Chair of the Oil & Natural Gas Subsector Coordinating Council and recently acted as the Chair of the Interstate Natural Gas Association of America security committee. Our CISO holds degrees in Business Administration and MIS from the University of Oklahoma and is certified in Leadership from Harvard Business School's executive education. In 2018, he obtained his Chief Information Security Officer certification from Carnegie Mellon University.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: As of December 31, 2023, no risks from cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: APA Corp

ticker: APA


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: Our Chief Technology Officer ("CTO"), who reports directly to our Vice President of Finance and, ultimately, our Chief Financial Officer, is responsible for the day-to-day management of our cybersecurity risk management program. The individual currently serving in this position is a third-party consultant who maintains 20 years of experience advising similarly situated companies on information technology and cybersecurity risk management. Our CTO provides regular cybersecurity updates to our Vice President of Finance and Chief Financial Officer on matters relating to our cybersecurity program and cybersecurity risk management.

companyName: Lifeward Ltd.

ticker: LFWD


text: Ashland's information security program also includes policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies. This includes the use of a 24/7 Security Operations Center as well as an in-house, dedicated threat hunting team. Additional safeguards also include employee training and awareness programs around phishing, malware, and other cybersecurity risks. In addition, the Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems and regularly engages consultants and other expert third parties to assist the Company in the identification and assessment of risks.

companyName: ASHLAND INC.

ticker: ASH


text: Our business requires that we develop and maintain large and complex technology systems, and that we rely on third-party systems and applications, to run our operations and to store the significant volume of data and information that we acquire, including the personal information of our customers and employees and our intellectual property, trade secrets, and other sensitive business and financial information.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K, including "We rely significantly on information technology systems and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively and have a material adverse effect on our business, reputation, financial condition, and results of operations."

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: ADT also conducts privacy impact assessments and empowers its employees to effectuate these privacy considerations on an ongoing basis. All ADT team members are required to complete and acknowledge annual training to raise awareness of current security risks and behavior and around our Information Security and Privacy policies. Additional education and training are also required for specific groups based on their roles within the organization.

companyName: ADT Inc.

ticker: ADT