text: In the event of a suspected or threatened cybersecurity incident, the Company's Chief Information Security Officer ("CISO") determines whether to activate the Company's Cyber Incident Response Team ("CIRT"), composed of different subject matter experts from applicable domains such as network, infrastructure, and application areas in order to evaluate the technical issues relative to the incident. The CIRT is overseen by the CISO. If necessary, the CIRT may engage third-party cybersecurity experts to evaluate and/or remediate the incident. In the event that the CIRT confirms that the incident relates to a cybersecurity incident or compromise of MGIC's computer systems, the CISO will notify the General Counsel, who will advise the Chief Executive Officer ("CEO"), who is a member of the Board of Directors. In addition to advising the CEO, the General Counsel will also convene an established committee whose members include the General Counsel, Chief Financial Officer, Senior Vice President of Investor Relations, and Chief Accounting Officer in order to determine if the event is a material cybersecurity incident so as to trigger an Item 1.05 filing on Form 8-K. If a determination is made that the event is material, or if the CEO or General Counsel otherwise determines it advisable, the CEO or General Counsel, or a delegate thereof, shall notify the Chairman of the Board, Lead Independent Director, and Chairpersons of the Board's Business Technology and Transformation Committee (the "BTTC") and Audit Committee.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: J.P. Morgan's Information Security Program includes the following functions: • Cyber Operations, which is responsible for implementing and maintaining controls designed to detect and defend us, the Adviser, J.P. Morgan, and its affiliates against cyber attacks, and includes a dedicated function for incident response and ongoing monitoring for cybersecurity threats and vulnerabilities, including those among our, the Adviser's, J.P. Morgan's and its affiliates' third-party suppliers. • Technology Governance, Risk & Controls, which is responsible for operationalizing technology risk and control frameworks, analyzing regulatory developments that may impact J.P. Morgan, and developing control catalogs and assessments of controls, as well as overseeing governance and reporting of technology and cybersecurity risk. • Security Awareness, which provides awareness and training that reinforces information risk and security management practices and compliance with J.P. Morgan 's policies, standards and practices. The training is mandatory for all employees globally on a periodic basis, and it is supplemented by firmwide testing initiatives, including periodic phishing tests. J.P. Morgan also provides specialized security training to employees in specific roles, such as application developers. J.P. Morgan's Global Privacy Program requires all employees to take periodic training on data privacy that focuses on confidentiality and security, as well as responding to unauthorized access to or use of information. • Technology Resiliency, which establishes control requirements for planning and testing the prioritized recovery of technology services in the event of degradation or outage, including incident response planning, data backup and retention, and recovery readiness in support of the J.P. Morgan's Business Resiliency Program and operational risk management practices.

companyName: J.P. Morgan Real Estate Income Trust, Inc.

secItem: Item 1C


text: Wynn Resorts' information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees' and guests' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government and is integrated into our overall enterprise risk management system.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: At Century Therapeutics, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of Company information. We have implemented a cybersecurity program in accordance with our risk profile and business that is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Cybersecurity is an important part of the risk management processes and an area of focus for the Board of Directors and management. Each member of Williams' organization, which includes Transco and NWP, from facility operators to board members, has a responsibility to safeguard the organization's cybersecurity. The Chief Information Security Officer (CISO) is responsible for the cybersecurity strategy and execution, while the Board and the Audit Committee are responsible for oversight of cybersecurity risk.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Our Chief Information Officer, Chief Information Security Officer and our Security Team, which includes Security Engineers, our Senior Manager of Cybersecurity and our Chief Information Security Officer, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Security Team has deep expertise in cybersecurity practices, including security threat evaluation, security operations, incident response, investigations, forensics, threat containment, data security vulnerability management, security policies and procedures, vulnerability scans, penetration testing, infrastructure security, network security, cloud security, identity and access management, role-based access, server and endpoint security, e-mail security, security awareness, logging, security governance and risk mitigations. Our Chief Information Security Officer has over twenty years of experience in security leadership over all aspects of cybersecurity, including security operations, security incident management and cybersecurity governance, policies and procedures, as well as deep expertise in defense in depth, zero trust security architectures and security controls for perimeter, network, endpoint, application and data security layers.

companyName: RAMBUS INC

ticker: RMBS


text: The Company's incident response team, comprised of representatives from the Company's information technology, information security, product security, engineering, privacy and legal groups, is responsible for addressing data breaches, intrusions, and other security incidents and implementing the Company's incident response plan. The Company's incident response plan includes processes and procedures for assessing internal and external threats, escalation and activation, crisis management, and post-incident recovery.

companyName: BLACKBERRY Ltd

ticker: BB


text: The Company considers the following factors in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and degree of risk; potential impact, if a risk materializes; and the feasibility, cost and impact of controls. The specific controls used by the Company vary based on the systems and program involved, but typically include vulnerability and patch management, penetration testing, firewalls, intrusion prevention and detection systems, anti-malware (including anti-phishing) technical safeguards and access controls, privileged access management, endpoint threat detection and response, identity and access management, multi-factor authentication, logging and monitoring, data encryption, backup and recovery systems, cyber insurance, and physical security controls. The Company also incorporates threat intelligence and monitors emerging cybersecurity threats relevant to the BPO industry.

companyName: IBEX Ltd

ticker: IBEX


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could effect our information or systems. For more information, please see Item 1A - Risk Factors.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: Our approach begins with regular, in-depth risk assessments that identify both inherent and residual cybersecurity risks. Utilizing standards such as the National Institute of Standards and Technology Cybersecurity Framework, Federal Financial Institutions Examinations Council guidance, and the foundational safeguards outlined in CIS Controls v8, we continuously monitor, evaluate, and update our security controls. These assessments allow us to effectively manage vulnerabilities across our Company assets and software, ensuring that only authorized and securely configured systems are connected to our network. In addition to proactive risk identification, our cybersecurity process includes a robust incident response capability. We maintain detailed procedures for detecting, containing, and remediating cyber threats, which are regularly tested through internal audits and third-party assessments. This ensures that should an incident occur; our team can swiftly activate the Incident Response Plan to minimize potential impacts and restore secure operations.

companyName: MINISTRY PARTNERS INVESTMENT COMPANY, LLC


text: We have previously experienced actual or attempted cyber-attacks on our information systems or networks; however, none of these incidents had a material impact on our operations or financial condition. For additional information on the impact of cyber risks, refer to Part I, Item 1A. Risk Factors on page 13.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: These briefings ensure cybersecurity considerations are integrated into strategic decisions, resource allocation, and risk mitigation planning. In accordance with our incident response plan, any material cybersecurity incidents are promptly reported to the Audit Committee to maintain transparency and oversight.

companyName: MASIMO CORP

ticker: MASI


text: As part of our ongoing company-wide risk assessment, our management team has identified several key categories of cybersecurity risk to which we are exposed, including, (i) data security risks, (ii) malware and phishing attacks, (iii) insider and third-party risks, (iv) infrastructure and network risks and (v) regulatory and compliance risks. We identified the above risks based on an analysis of our business and a technical analysis by our information and communications technology ("ICT") consultants of our most critical business activities and associated vulnerabilities. We review our systems against specified security metrics to ensure they are satisfactory, monitor our third-party vendors and partners, participate in threat intelligence sharing, have developed mechanisms designed to detect deviations in our systems, have implemented information technology protocols to control access to our systems and information, provide security awareness trainings, and proactively patch known vulnerabilities. We are working with third-party consultants to build our cybersecurity incident detection processes, including taking the steps described above, and are also working with our vendors and partners to ensure that we are made aware of any cybersecurity incident they experience that may impact our business promptly. In addition, we maintain policies and processes to assess and manage risks relating to third-party service providers, including based on the nature of the engagement with the third party and based on the information and information systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards. Our management team, along with ICT consultants and other advisors, will conduct a risk assessment on at least an annual basis in order to ensure we are appropriately managing known cybersecurity risks and discovering any potentially new risks. To date, we have not identified any material impact on our business strategy, results of operations or financial condition resulting from the cybersecurity risks described above. However, there can be no assurances that the steps we take will be sufficient to avoid a cybersecurity incident and, if an incident were to occur, our business may be materially impacted as a result of any costs associated with remediating a cybersecurity incident or resolving litigation or regulatory enforcement actions as a result such incident, or potential delays to our clinical trials or release of data as a result of an incident impacting our internal systems or those of the CROs on whom we rely to conduct our clinical trials and gather data from such trials. Furthermore, the realization of any of the risks described above could seriously harm our reputation making it more difficult to recruit patients and CROs, conduct clinical trials, obtain regulatory approvals for our current or future product candidates or generate partnering opportunities.

companyName: NewAmsterdam Pharma Co N.V.

ticker: NAMS


text: Cybersecurity is acknowledged as an important enterprise risk at Adtalem. Our Audit and Finance Committee ("AFC"), comprised entirely of independent directors, is responsible for oversight of risks from cybersecurity threats. The Chair of our AFC has received a CERT certificate in Cybersecurity Oversight from Carnegie Mellon University in partnership with the National Association of Corporate Directors. Our CISO briefs the AFC on cybersecurity matters, including the evolving threat landscape and Adtalem's threat mitigation efforts, four times a year. At each quarterly meeting, the Chair of our AFC also briefs the full Board on cybersecurity matters discussed at AFC meetings. Cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of our annual enterprise risk management ("ERM") assessment.

companyName: Covista Inc.

ticker: CVSA


text: We also integrated cybersecurity risk management into our overall risk management framework to ensure that cybersecurity risks are considered in all aspects of our business. The integration ensures that cybersecurity considerations are integral to our strategic and operational decision-making. Our management team works closely with our Chief Digital & Data Officer (CDDO) and Chief Information Security Officer (CISO), ensuring that our cybersecurity efforts align with our business objectives and operational needs. Key components of our cybersecurity approach include, among other things: • establishing a dedicated action team, led by our CDDO and CISO, to oversee and manage cybersecurity risks; • implementing a comprehensive cybersecurity risk assessment process and strategy based on industry standards and established frameworks such as the National Institute of Standards and Technology (NIST) Special Publication 800-61; • implementing a vendor risk management program, which includes cybersecurity and data privacy audits, evaluating vendor risk level, and monitoring risk mitigation efforts; • conducting penetration tests and security maturity assessments throughout the year; • periodically engaging independent third-party assessors to audit our cybersecurity and information system programs to evaluate their effectiveness; • implementing industry-standard technologies and processes to protect our system and data and to help detect potential suspicious activity; • maintaining access controls to safeguard data and systems; • providing annual trainings to employees on responsible information security, data security and cybersecurity practices including appropriate action to take against cybersecurity threats; • conducting periodic phishing simulations to our employees; • engaging in cybersecurity incident tabletop exercises and scenario planning exercises; • maintaining a cybersecurity and information security risk insurance policy, which insures for data incidents or breaches and other technology related exposures; and • periodically reviewing and updating our IRP, privacy policy, and other relevant policies/procedures. These approaches are not exhaustive, and we plan to continuously improve our approaches to cybersecurity risk management.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: If and when it completes its acquisition of U.S. Petrochemical Industries, Inc., a supplier of raw materials to the Petrochemical industry globally in over 30 countries and has several international offices, the Company intends to engage professional cybersecurity professionals to assess the related risks and make full regulatory mandated disclosure in its SEC filings under the Exchange Act.

companyName: Blue Chip Capital Group Inc.


text: Management's role and relevant experience in assessing and managing cybersecurity The NIST CSF is used to assess cybersecurity maturity. An initial baseline assessment has been used to inform our Cybersecurity Strategy and periodic assessments are used to update the NIST CSF scoring. These assessments are carried out by an independent third party to provide appropriate objectivity and challenge. In addition, we are progressing towards certification to the international information security management standard - ISO 27001 and the related standard ISO 27701 for privacy information management. Execution of our cybersecurity strategy is overseen by our Director of Information Security who is a qualified CSIM, CISA and a Fellow of the UK Chartered Institute of Information Security and has over 30 years of experience in cyber security. The Director of Information Security provides the CTO with periodic updates and also chairs the CSRC which provides a forum for senior management to discuss cyber risk management in greater detail.

companyName: Soho House & Co Inc.


text: Members of our management team, with the assistance of third-party technical advisors, help identify, assess and manage our cybersecurity threats and risks. Our third-party technical advisors include consultants with over 20 years of experience in IT leadership as well as subject matter experts in cybersecurity that have extensive experience managing cybersecurity programs.

companyName: Climb Bio, Inc.

ticker: CLYM


text: Processes for identifying and assessing cybersecurity risks The CISO, with the support of the cybersecurity team and the owners of information technology across the business, monitors current events and trends related to cybersecurity and assesses impact on current systems and operations. There are several processes in place to monitor and review our systems, including third-party solutions, to identify potential risks. Third-party service providers are required to notify us in the event of a cybersecurity incident within their systems, and annual reviews are conducted on the Company's critical third-party vendors. Cybersecurity risks, threats, and incidents, including those from third-party service providers, are tracked and regularly provided to the CISO. The Cybersecurity Leadership Team, which includes the CISO and executives from all business functions across the organization, meets at least quarterly to review and discuss cybersecurity risks facing the Company.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: We rely on technology, including the internet and mobile services, to conduct much of our business activity and allow our customers to conduct financial transactions on our platform. As a result, our systems and operations as well as those of the third parties on which we rely to conduct certain key functions are vulnerable to cybersecurity incidents, which we have experienced in the past. We have a cybersecurity program that includes physical, technological, and administrative controls to detect, contain, respond to and remediate cybersecurity threats and incidents and defined processes to assess, identify and manage material risks from cybersecurity threats. These controls and processes include, among others: • maintaining a vulnerability management program that performs regular vulnerability scans and relies on our risk-based information security program to promote coverage of critical areas; • establishing an offensive security team that actively tests our security controls, imitating methods persons trying to achieve unauthorized access might use to identify any weaknesses; • our global privacy program supported by our privacy engineering and privacy legal teams and the Privacy Advisory Council, a cross functional team of senior leaders from legal, engineering, product, and compliance; • maintaining an incident response plan which includes required responses in the event of a cybersecurity incident; • conducting mandatory annual security and privacy training for all employees and contractors and, where appropriate, giving employees and contractors role-based training focused on content specific to their role at the Company; • undertaking an annual review of our consumer facing policies and statements related to cybersecurity; • requiring employees to treat customer information and data with care through policy, practice and contract (as applicable); • leveraging the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Management and Strategy cybersecurity risk is critical to supporting our vision, enabling our strategy, and safely operating our business. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process which covers all Company risks.

companyName: I-ON Digital Corp.

ticker: IONI


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives occasional briefings from management on our cyber risk management program. Our board of directors receives presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: Eventbrite, Inc.

ticker: EB


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Our Board of Directors has delegated the oversight of cybersecurity risks to our Audit Committee, which oversees management's implementation of our cybersecurity program.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: We conduct assessments across our systems, networks, and data infrastructure to identify, assess and manage potential and material cybersecurity threats and vulnerabilities. These assessments include penetration testing, vulnerability scans, cybersecurity audits, incident response planning, vendor risk assessments, and regulatory compliance assessments. Feedback from these assessments is incorporated into our systems and procedures through upgrades intended to further improve our cybersecurity posture.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: To combat the ever-present cyber risks, the Company maintains a comprehensive cybersecurity program, which includes ongoing employee training, annual risk assessments and a comprehensive cybersecurity environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. We operate in the medical device sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems and partner with a third-party hosted provider. Our cybersecurity program is aligned with industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards.

companyName: ORTHOPEDIATRICS CORP

ticker: KIDS


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: The Board of Directors regularly devotes time during its meetings to review and discuss the most significant risks facing us over the short-, medium- and long-term, and our responses to those risks, including cybersecurity risks. Within these discussions, the Board of Directors receives updates from senior executives including the CRO and, on an annual basis, the CISO on the risks posed by cybersecurity threats and our information security program. Additionally, the CISO provides annual Information Security training to the Board of Directors. The training covers the regulatory landscape, risk management practices, cyber landscape and threats to us and the roles and responsibilities of management and board members.

companyName: Discover Financial Services


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In 2020, we experienced a previously-disclosed cybersecurity incident that resulted in unauthorized access to certain data and caused significant disruptions to our business operations. In response, we engaged leading outside forensics and cybersecurity experts, launched a comprehensive containment and remediation effort and forensic investigation, restored the security of our internal systems and networks and adopted various enhancements to the security of our systems and networks.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. Additional information on the cybersecurity risks that could materially affect us is discussed in Part I, Item 1A, "Risk Factors."

companyName: FAIR ISAAC CORP

ticker: FICO


text: Management provides oversight of cybersecurity risks, ensuring alignment with regulatory requirements and industry best practices. Management also plays a crucial role in overseeing the implementation and effectiveness of cybersecurity measures.

companyName: Teucrium Commodity Trust

ticker: CANE


text: The CCDC reports at least quarterly to the Board and A-Mark's CEO on the following topics, among possible others: our current risk posture and threat landscape; new material cybersecurity threats and high-risk exposures; risk mitigations and controls; incident response readiness; and updates to cybersecurity policies and procedures. The CCDC is also authorized and directed to report to the Board and A-Mark's CEO promptly in the event of a significant cybersecurity incident, as appropriate.

companyName: Gold.com, Inc.

ticker: GOLD


text: b.we maintain a dedicated cybersecurity team under the direction of our Chief Technology Officer (CTO) and supported by our Chief Information Security Officer (CISO), each of whom has expertise related to data and network security, data governance and risk management; c.we regularly test our internal IT controls; d.we regularly conduct internal vulnerability assessments as well as third-party penetration tests;

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Our cybersecurity risk management processes are led by members of our management team, including our CIO and our CTO, who hold degrees in Management Information Systems and Computer Science, respectively, along with an average of 21 years of prior work experience in various roles involving information technology, including cybersecurity, compliance, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategic processes described above, including the operation of our Incident Response Plan. The CIO and CTO report and provide updates to the Audit Committee on risks from cybersecurity threats quarterly or as needed.

companyName: Open Lending Corp

ticker: LPRO


text: We regularly engage with third parties to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, incident response exercises, penetration testing, constant managed detection and response services, and intrusion prevention and detection applications. Our vendor risk management program includes regular reviews and oversight of these third parties, including performance and technological reviews and escalation of any unsatisfactory reviews.

companyName: Federal Home Loan Bank of Boston


text: As part of our continued investment in developing our overall enterprise risk management program, the COO and other members of management make updates to the full board of directors, and going forward beginning in 2024, will also provide updates to the audit committee of our board of directors (the "Audit Committee"), on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies. In addition to such updates, and as part of our incident response processes, our COO is also responsible for informing the Audit Committee of material cybersecurity threats and incidents, based on management's assessment of risk.

companyName: Mobileye Global Inc.

ticker: MBLY


text: As part of our cyber risk management strategy, we established a process for identifying and assessing the material risk of cybersecurity incidents. In the event a cybersecurity incident is identified, the CIRT, which is made up of a cross-functional team, including technology, security, finance and legal professionals, acts in accordance with established processes. The CIRT convenes regular meetings to review and analyze relevant cybersecurity indicators and information. Utilizing an IRC, if it is determined that an incident needs to be reviewed for potential materiality, it is referred to our Chief Legal Officer who will engage the necessary or desirable cross functional professionals as needed in order to make a determination of materiality. We also seek to regularly update and upgrade our technology investments in an effort to further support our ability to identify and assess risks from cybersecurity incidents. We have not identified any cyber threats or incidents that have materially affected or are reasonably likely to materially affect us. For additional information on the potential impact of cybersecurity incidents on our business strategy, operations, or financial condition, refer to Part I, Item 1A. Risk Factors, of this Form 10-K, under the heading "Data Privacy and Security Risks".

companyName: TRINET GROUP, INC.

ticker: TNET


text: Network Security Management. The security of the FNB network infrastructure is maintained via • internal and perimeter firewalls with intrusion detection, • the use of some network segmentation to isolate access to certain applications and systems, • VLANs or virtual local area networks, • email filtering to identify spam, malware, and phishing messages in received email messages, • malware detection, • data loss prevention controls to prevent the theft, or mass exfiltration of data, • Virtual Private Networks (VPN) to control remote access to our network, • intrusion detection capabilities, • network access controls (NAC) to prevent unauthorized assets from connecting to the network, and • web filtering.

companyName: FNB CORP/PA/

ticker: FNB


text: Management Oversight— Our CISO, who reports directly to our CIO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents are described above. He reports information about such risks to the CIO and other members of senior management, who, in turn, report them to our board and audit committee, as appropriate. Our CISO joined the company in August 2022 with over 20 years of risk management, national security and cybersecurity experience garnered at both public and private companies, as well as governmental agencies.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: The Company, like other companies in its industry, faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date, the Company has, from time to time, experienced threats to and security incidents related to its data and systems. For more information about the cybersecurity risks the Company faces, see Item 1A. Risk Factors.

companyName: MACERICH CO

ticker: MAC


text: The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President, or SVP, Head of Finance and Investor Relations, Senior Vice President, General Counsel, internal security staff and external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: Cohen & Steers' cybersecurity incident response plan is a key component of its cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Cohen & Steers' incident response team to help Cohen & Steers control, mitigate and remediate cybersecurity incidents of which they are notified. In addition, the response plan includes prompt reporting to our Board (or the Audit Committee) of certain cybersecurity incidents and of the materiality and disclosure determinations relating thereto.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. In order to assess, identify, manage and address the risk of cybersecurity threats or incidents, the Company has established a Cybersecurity Risk Management Program, which uses a risk-based approach to implement multi-layered controls designed to enable the Company to maintain agility while protecting critical infrastructure and data. This program, which is an integral part of our overall enterprise risk management program, implements controls and frameworks designed to align with industry best practices, including those based on the National Institute of Standards and Technology Cybersecurity Framework, the Sarbanes-Oxley Act of 2002 and HIPPA.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology environment; • monitoring and reporting of those risks to appropriate levels of management; • a team comprised of information technology security, infrastructure, and compliance personnel principally responsible for directing our (1) cybersecurity risk assessment processes, (2) security operations processes, and (3) response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • global associates with access to information technology systems in more than 30 countries and territories across North America, Latin America, Europe, Africa, India, and Asia Pacific receive a combination of general and targeted training to help keep Information Security top of mind; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; and • a third-party security risk management process for key service providers based on their respective roles and risk profiles.

companyName: TransUnion

ticker: TRU


text: Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are owned by our Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Chief Information Security Officer and Chief Product Security Officer who collectively possess over 30 years of experience related to cybersecurity issues in both the private and government sectors, and possess certifications including but not limited to Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM").

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: The Cybersecurity and Technology Controls Operating Committee ("CTOC") is the principal management committee that oversees J.P. Morgan's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of J.P. Morgan's Information Security Program. The membership of the CTOC includes senior representatives from the Global Cybersecurity and Technology Controls organization and relevant corporate functions, including IRM and Internal Audit.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: We have structured our cybersecurity program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and processes to assess, identify and manage cybersecurity risks. Key components of our strategy include annual and ongoing security awareness training for employees, advanced detection and monitoring systems, and robust incident response and containment. We actively monitor and investigate both internally discovered and externally reported issues that may compromise our information systems, permitting quick and decisive action when necessary. We also have engaged third-party service providers and have implemented cybersecurity risk management protocols for such parties. For example, all vendors are required to complete our Ongoing Monitoring Assessment Questionnaire, which helps monitor each vendor's continuing compliance, and we subject our technology vendors to a separate vetting and approval process formally assessing each vendor from a cybersecurity perspective.

companyName: Enhabit, Inc.

ticker: EHAB


text: The Company utilizes a variety of third parties in connection with its cybersecurity risk management. The Company also employs third-party cybersecurity companies to add capacity or expertise when necessary. Additionally, assessments of the Company's cybersecurity program are periodically conducted by independent third-party assessors.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Cybersecurity risk management is an important part of MasTec's overall risk management efforts. We maintain a comprehensive enterprise-wide information security program that comprises policies and controls designed to identify, safeguard against, detect, respond to, mitigate and manage reasonably foreseeable cybersecurity risks and threats. Our approach utilizes diverse security tools to prevent, identify, investigate, resolve and recover from vulnerabilities and security incidents. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: MASTEC INC

ticker: MTZ


text: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. Refer to "Item 1A. – Risk Factors" in this annual report on Form 10-K, including, "We may be subject to interruptions or failures in our information technology systems," for additional discussion on our cybersecurity related risks.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address material cybersecurity risks. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our operations, systems, network, data, products and/or services, and have processes to assess those issues for potential cybersecurity impact or risk.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: The TDS information security program aligns with the National Institute of Standards and Technology (NIST) cybersecurity framework. Risk assessments are conducted periodically leveraging this standard and are integrated into the TDS Enterprise Risk Management (ERM) program. The assessment results are used to drive continuous improvement in the TDS cybersecurity control environment, as well as to manage potential data security risks of third-party service providers. TDS assesses the threat and vulnerability landscape using various commercial, government, vendor and publicly available information sources and tools. TDS manages these evolving risks through ongoing investments in the security program including active monitoring of the internal data environment and the environments of third-party service providers who manage sensitive data. In addition, TDS Information Technology leaders conduct regular cyber incident simulations to ensure preparedness in the event of a cyber-attack. TDS leverages external parties to perform independent assessments and tests of security controls in the environment.

companyName: TELEPHONE & DATA SYSTEMS INC /DE/

ticker: TDS


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have had, or are reasonably likely to have, a material impact on our business or operations. However, due to the evolving nature of cyber threats and their increased sophistication, there remains the potential for adverse impacts on the Company should a cybersecurity incident occur. These impacts could include reputational damage, competitive harm, operational disruptions, financial costs, and regulatory actions. Please refer to the risk factor titled "Cybersecurity incidents may threaten our confidential information, disrupt operations and result in harm to our reputation and adversely impact our business and financial performance." See Part I, Item 1A for further information regarding cybersecurity risks and potential impacts on our business and results of operations.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT


text: Our Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology and finance, which we believe equips them to oversee cybersecurity risks effectively.

companyName: Flywire Corp

ticker: FLYW


text: Diamondback's cybersecurity governance program is led by its Senior Vice President and Chief Information Officer, with support from the internal information technology department. Diamondback's Senior Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. Diamondback's Senior Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, Diamondback's cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with its Computer Security Incident Response Plan. Progress and developments in Diamondback's cybersecurity governance program are communicated to members of its and our executive team. Diamondback's and our management takes steps to remain informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by Diamondback; and alerts and reports produced by security tools deployed in the enterprise IT and OT environments. While our board of directors is ultimately responsible for enterprise-wide risk oversight, the board's committees assist the board in fulfilling its oversight responsibilities in certain areas of risk. In particular, the board's audit committee is responsible, among other things, for risk management relating to legal and regulatory requirements, including cybersecurity, which plays an integral role in the risk management strategy and continues to be an area of increasing focus for our board, the audit committee and management.

companyName: VNOM Sub, Inc.


text: While management is responsible for our cybersecurity program and managing our cybersecurity risks, including our procedures and day-to-day operations, our audit committee oversees our enterprise risk assessment and management program, which includes oversight of cybersecurity risks. In performing its oversight responsibilities, our audit committee receives regular reports from, and meets with, our cybersecurity leaders at least semi-annually, to review our information technology and cybersecurity risk profile and to discuss our efforts to prevent, detect, mitigate, and remediate cybersecurity incidents. Our audit committee, in turn, regularly reports to the full board of directors regarding such oversight. When assessing audit committee membership, our board of directors considers each member's information technology and cybersecurity expertise. Our Cyber Incident Response Plan includes protocols under which cyber-related incidents are required to be escalated to senior management and to the audit committee, with ongoing updates regarding any such incident until it has been addressed. In addition to the above, we recently hired a Chief Digital and Technology Officer to oversee all aspects of our technology system infrastructure and processes and manage our team of internal information technology experts, including our Chief Information Officer. The Chief Digital and Technology Officer is supported by a management-level committee and an experienced cybersecurity team that support our processes to assess and manage cybersecurity risk. Each of our Chief Digital and Technology Officer and our Chief Information Officer has over 25 years of information technology experience, primarily in the manufacturing and consumer goods industries. Our Chief Information Officer also has a degree in Management Information Systems, and both our Chief Digital and Technology Officer and our Chief Information Officer have a Masters of Business Administration. We also currently engage a third-party consultant who reports directly to our Chief Information Officer and provides Chief Information Security Officer, or CISO, advisory services. This consultant has approximately 15 years of experience serving in cybersecurity leadership positions, including as a CISO at other U.S. publicly traded manufacturing companies.

companyName: AZEK Co Inc.


text: Our internal audit team performs audits of our information systems and network security. The audit scope, timing and frequency of our cybersecurity control framework is integrated into the Company's overall risk management process and the planning for, and results of, those audits are reviewed with the Audit & Finance Committee.

companyName: Endo LP


text: Management and Strategy the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Governance:

companyName: Longeveron Inc.

ticker: LGVN


text: Our Cybersecurity Committee is comprised of senior representatives from our legal, IT and OT, engineering, corporate security, risk, human resources, finance, accounting, public relations, investor relations and executive management teams. This committee plays a key role in assessing and managing our risks from cybersecurity threats. In particular, our Cybersecurity Committee is responsible for: (i) establishing and promoting company-wide support for the management of cybersecurity risk; (ii) providing oversight and ensuring alignment between our cybersecurity strategy and business objectives; (iii) reviewing and advising on cybersecurity policy and governance; (iv) providing a forum for review of cybersecurity risk in alignment with our business objectives and risk tolerance; (v) promoting cross-company alignment of cybersecurity programs and actions; and (vi) reviewing our cybersecurity incident response plan ("CIRP"). Our Cybersecurity Committee meets at least quarterly with senior representatives from our cybersecurity team and outside experts to discuss cybersecurity threat updates, new cybersecurity regulations, cybersecurity projects and entity-wide results of cybersecurity preparedness initiatives. If a cybersecurity incident occurs, our Cybersecurity Incident Response Team, which includes several members of our Cybersecurity Committee, will oversee the execution of our CIRP.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), although this does not imply that we meet all technical standards, specifications or requirements under NIST CSF.

companyName: Hughes Satellite Systems Corp


text: Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), who is responsible for managing cybersecurity risks as well as protecting our products, networks and systems. Our CISO has extensive information technology and program management experience and has served many years in our corporate information security organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security engineering, incident response, compliance, and software development.

companyName: Criteo S.A.

ticker: CRTO


text: As part of the assessment of the protections we have in place to mitigate risks from cybersecurity threats, we engage third parties to conduct risk assessments on our systems.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our acquired businesses and consolidated bottling operations maintain separate cybersecurity systems and environments that may differ in scope and complexity from our own. However, for all consolidated entities, our cybersecurity risk management program is designed to help coordinate the Company's identification of, response to and recovery from, cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as to comply with applicable legal obligations.

companyName: COCA COLA CO

ticker: KO


text: We believe the members of our management team involved in assessing and managing material cybersecurity risks have the experience needed to perform their duties, including through education, certification, work experience or a combination thereof. For example, our Vice President–Information Technology has approximately 25 years of IT experience in various roles, the majority of which has been at publicly-reporting real estate companies. In addition, the other members of our management team identified above have from 14 years to 29 years of work experience managing risks or control environments, including experience at the Company and other professional businesses, or, as third-party advisors, helping businesses manage risks or control environments.

companyName: STAG Industrial, Inc.

ticker: STAG


text: We assess our information security program using an industry-leading cybersecurity framework, the Center for Internet Security Critical Security Controls. A risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on us and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.

companyName: Torrid Holdings Inc.

ticker: CURV


text: The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large international companies. The CISO holds an undergraduate degree in business and is pursuing a master's degree in business. The CISO also has attained the professional certification of Certified Information Systems Security Professional (CISSP). The CIO holds an undergraduate degree in business and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies. The Company's Chief Executive Officer and Chief Financial Officer each hold undergraduate and graduate degrees in their respective fields, and each have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Blue Ocean Acquisition Corp


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to customers and/or corporate partners or customers; violation of privacy laws and other litigation and legal risk; and reputational risk.

companyName: Hoth Therapeutics, Inc.

ticker: HOTH


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: • risk assessments designed to help identify and address material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness training for all of our employees and contractors; • a cybersecurity incident response plan that includes procedures for responding to, escalating, and reporting cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, software, and vendors who access our data and/or systems.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: Related to Cybersecurity Risks The Audit Committee of our Board of Directors is responsible for the general oversight of risks related to data privacy and cybersecurity. The Audit Committee periodically reviews the Company's cybersecurity program with management, including (i) the adequacy of controls and security for the Company's information technology systems and (ii) the Company's response plan in the event of a security breach impacting those systems. Our CF&AO has primary responsibility for overseeing the day-to-day management of cybersecurity risks and has served in that role for three years. Our CF&AO oversees the policies and processes described above and provides the periodic management briefings to the Audit Committee, including any cybersecurity incidents and related responses. Further, at least annually, the Board of Directors receives updates of potential cybersecurity incidents, as well as the data privacy and compliance programs, and its members actively participate in discussions with management regarding cybersecurity risks.

companyName: Savara Inc

ticker: SVRA


text: regular vulnerability scans and tests utilizing threat intelligence feeds in the assessment of hardware and software; and external service providers and other third parties, where appropriate, to assess, test, or otherwise assist with aspects of our systems addressing cybersecurity threats.

companyName: DNA X, Inc.

ticker: SONM


text: Our cybersecurity risk management program includes a number of components, including but not limited to a Cybersecurity Incident Response Plan ("CSIRP"), annual cybersecurity awareness training for our employees, vendor risk management, regular system maintenance including application of security patches as appropriate, regular penetration test and security assessments and implementation of enhancements to security measures used to protect our systems and data.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Entergy and the Registrant Subsidiaries maintain a security-risk-management system with defined roles, duties, governance, and accountability. Under this physical- and cyber-risk model, Entergy and the Registrant Subsidiaries streamline security into a centralized program. The Chief Security Officer (CSO) is responsible for

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: We face various cyber risks, including, but not limited to, risks related to unauthorized access, misuse, data theft, computer viruses, system disruptions, ransomware, malicious software and other intrusions. We utilize a multilayered, proactive approach, as part of our overall risk mitigation strategy, to identify, evaluate, mitigate and prevent potential cyber and information security threats through our cybersecurity risk management efforts. We have an IT manager who is responsible for the identification, evaluation, and management of cybersecurity risks and controls. Our IT manager has related experience including: (i) network architecture design and planning: working on overall design and planning of network architecture, selection of related equipment and software, and its implementation; (ii) information security architecture design and planning: assisting the development of information security strategy, technical architecture and management system plan, design, and implementation; (iii)

companyName: Future FinTech Group Inc.

ticker: FTFT


text: We consider our information technology ("IT") and information systems to be valuable and vital assets and must be protected as such. We maintain a series of policies and supporting procedures designed to help ensure the security and confidentiality of our IT and information systems and to help ensure that they are properly protected from a variety of threats such as error, fraud, embezzlement, sabotage, terrorism, extortion, industrial espionage, service interruption, and natural disaster. Information is protected according to its sensitivity, value, and criticality with particular focus given to protecting confidential information, such as personal identifying information, unpublished financial results and other data deemed proprietary to us. Our cybersecurity network, including management, employees and service providers, prioritizes protecting and otherwise managing our information assets, and recognizes that information security is an important part of our business.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: The Program is integrated into the Company's enterprise risk management program. The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: To manage the risk of a material impact on CRH's operations or financial performance due to a cybersecurity incident, CRH has implemented a mandatory Cybersecurity Incident Escalation Standard as part of its Company-wide Information Security Policy. This Standard, which is supported by relevant guidelines and procedural documentation, provides a structured approach adapted to the systems of each CRH operating company and business unit to manage the incident response process through a series of pre-defined phases, including triage, containment, eradication, recovery, and post-incident analysis.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Our risk management program regularly assesses third-party risks (inclusive of fourth-party risk) by conducting activities to identify and mitigate risks from third-parties (e.g., vendors, suppliers, and other business partners). Cybersecurity risks are evaluated when selecting and managing applicable third-parties that handle or process employee, business, or customer data, and a review process that includes due diligence over a third-party's information security and technology control environment is conducted at onboarding and periodically throughout the lifecycle of the relationship to ensure that systems of third- parties meet certain security baseline requirements. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: We score cybersecurity risks based on the likelihood and impact on our operations. Such cybersecurity risks are integrated and evaluated as part of the global Enterprise Risk Management ("ERM") program, which is managed by the Senior Vice President General Counsel. The Governance Committee of the Board of Directors maintains oversight of the ERM program and the Audit Committee maintains oversight of the cybersecurity program to ensure risks to the Company are managed within our risk appetite.

companyName: CRAWFORD & CO

ticker: CRD-A


text: Our board of directors maintains active oversight of cybersecurity risks through a structured governance framework: • The full boar d of directors receives comprehensive cybersecurity briefings at least annually, supplemented by sessions focused on emerging threats and program strategy. • The Audit Committee receives regular updates (typically quarterly) that cover, among other topics, performance against operational metrics and results of recent audits and assessments. • Our CISO, under the direction of our Executive Vice President and President – Global Platform Group, leads our Program, working with key stakeholders and resource groups, including industry groups, peer institutions, internal committees (the Information Security Management Committee), and law enforcement, as needed, to understand, identify, and address cybersecurity risks. Our CISO maintains direct reporting access to the board of directors, ensuring that time-sensitive matters may be escalated as needed. • Our internal audit team is responsible for testing key IT controls, while leaders from our legal, finance, communications, and risk management teams participate in incident response training, including annual tabletop exercises, to ensure swift and effective responses to cybersecurity incidents.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: The Company communicates regularly with employees to increase awareness around phishing and spoofing attempts and other cybersecurity schemes. Employees are encouraged to report suspicious emails or incidents to the General Counsel or the President and Chief Executive Officer.

companyName: Farmland Partners Inc.

ticker: FPI


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See "Item 1A. – Risk Factors" in this Report for a further discussion of risks related to cybersecurity.

companyName: CapStar Financial Holdings, Inc.


text: CIM Group's personnel responsible for cybersecurity policy comprises of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, simulated phishing campaigns, required password complexity, the use of multi-factor authentication, information security protocols, modern end point protection against threats, patching strategy, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: Our cybersecurity and information technology ("IT") program includes a number of safeguards, such as network segmentation, conditional analysis, external threat monitoring, access and authentication controls, incident response planning and testing of controls and procedures. We assess for internal and external vulnerabilities through the use of quarterly vulnerability scanning, annual third-party penetration testing and periodic cybersecurity maturity assessments. The results from these assessments are comprehensively addressed based on risk priority and are used to continually improve our cybersecurity risk posture.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: The Company maintains a cybersecurity risk management program designed to mitigate cybersecurity risks through a comprehensive framework that integrates cybersecurity into the Company's overall risk management processes.

companyName: EVgo Inc.

ticker: EVGO


text: The Board considers cybersecurity risks in business strategy by getting updates on the Bank's cybersecurity risk assessment. It assesses the experience of management personnel responsible for preventing, mitigating, detecting and remediating any cyber incidents, including the Chief Information Security Officer.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security team lead by our Executive Vice President, Technology works with management and the legal department, to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit & Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1A. Risk Factors" for more information regarding the Company's cybersecurity-related risks.

companyName: LFTD PARTNERS INC.

ticker: LIFD


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "Cybersecurity breaches and technological discussions could damage our reputation and profitability," above. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.

companyName: PLUMAS BANCORP

ticker: PLBC


text: Role of the Board. Our board of directors exercises direct oversight of our strategic risks through its oversight of our enterprise risk management function. The Audit Committee of the board of directors in particular is responsible for overseeing our IT security controls and the adequacy of our IT security program, compliance and controls with management. As part of such oversight, the board of directors, including members of the Audit Committee, receive periodic reports from management and our third-party service providers to assess the primary cybersecurity risks we face.

companyName: Construction Partners, Inc.

ticker: ROAD


text: As part of its regular oversight of risk management, our audit committee is responsible for the oversight of cybersecurity risk and threat mitigation related to our information technology and information systems including protection and security of employee and customer data. Our Vice President – Technology Solutions is responsible for the day-to-day management of our cybersecurity program and reports directly to our President. Our Vice President – Technology Solutions has served in this role for over three years and has more than 25 years of experience in the aggregate, including ten years with the Company, in various information technology roles. Our audit committee is responsible for overseeing cybersecurity risks, and our management team reports to our audit committee on the Company's cybersecurity program, current cybersecurity projects and industry trends and efforts to mitigate cybersecurity risk on at least a semi-annual basis.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: We have outlined preliminary policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities for preliminary assessment, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our policies and procedures include processes which incorporate regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through an internal reporting channel.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: As of the date of this annual report, we maintain cyber liability insurance that provides cyber incident response coverage. However, costs, damages, and remediation associated with cybersecurity incidents may not be adequately insured under our insurance policy and may be subject to applicable deductibles, to the extent that they are covered. See also " We cannot assure that we can maintain cyber liability insurance coverage and we could be subject to uninsured liabilities. " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to our cyber liability insurance.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: Prevention and Preparation We undertake regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts we engage a third-party to conduct an external review of our vulnerabilities at least annually. We continue to strengthen our authentication mechanisms including broad adoption of multi-factor authentication and geolocation-based blocking. To support our preparedness, we perform a tabletop exercise at least once a year to test our incident response procedures.

companyName: American Homes 4 Rent

ticker: AMH


text: The GIS Program includes a Cyber Defense team, which manages the Incident Response Plan (IRP), and consists of subject matter experts from GIS and Information Governance, who work together to monitor and respond to cybersecurity incidents. The IRP outlines our cyber and incident response policies and governs our incident response lifecycle, which divides overall incident response into serial phases. The Crisis Management Team (CMT) is responsible for oversight during an incident, in conjunction with the Cyber Coordination Team (CCT). The CCT manages responses to cybersecurity and compliance incidents, collaborating with subject matter experts from various departments in response to specific incidents. When an incident reaches a certain threshold of severity, our CISO and CIO escalate the matter to our Chief Operating Officer, who is another member of our Management Team, to determine next steps, as well as possible customer and external communication. Throughout the incident response process, the Legal team is engaged, as appropriate, and helps consider whether disclosure is required once a determination is made in connection with the company's leadership and the CMT.

companyName: CME GROUP INC.

ticker: CME


text: Our management, represented by Director, Rick Orman, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance, including integration of cybersecurity risk considerations into our overall risk management strategy and communication of key priorities to relevant personnel. Management is responsible for cybersecurity-related matters including approval of processes; review of assessments and other matters; evaluation of potential impact of incidents to determine materiality based on the nature and scope of the incident and any impact to operations, assets, or reputation; and response to incidents, including reporting certain incidents to the audit committee. The audit committee receives periodic reports from management, including our acting Chief Executive Officer concerning any cybersecurity threats and risks considered to be significant and the processes we have implemented to address them.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: The AAM Information Security Council (ISC), comprised of leadership representatives from across the organization, meets periodically to discuss current threats and trends and the resulting information security initiatives and priorities. The ISC members provide support for policy changes and insights into how the information security team can most effectively educate, communicate, and support AAM. The ISC is led by AAM's Chief Information Officer (CIO) and CISO, our frontline business leaders with regard to cybersecurity risk management. AAM's CIO has been an IT professional in various capacities for over 25 years and maintains the following certifications: Certified CISO, Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Privacy Technologist.

companyName: Dauch Corp

ticker: DCH


text: As part of our cybersecurity procedures, we leverage a number of security tools, including but not limited to email filters, firewalls, and antivirus protection. We also test certain of our applications for vulnerabilities. In an effort to raise cybersecurity awareness, we work with an external partner to send email notices to our employees regarding cybersecurity best practices.

companyName: BRAINSTORM CELL THERAPEUTICS INC.

ticker: BCLI


text: Because cybersecurity threats continue to evolve, thereby increasing inherent risk, the Company's Corporate Information Security team is augmented by contracted external managed security service providers, who collectively work 24/7 to monitor cybersecurity threats through processes such as endpoint and network security, email protection, data loss prevention, vulnerability scanning and mitigation, identity and access management, logging and monitoring, and threat hunting. Independent third parties test the Company's cyber capabilities and audit its cloud security. The Company regularly tests its systems to discover and address any potential vulnerabilities. Senior and Executive management also participate in cybersecurity industry collaboration and information-sharing forums and utilize the information gained to drive protective and detective cybersecurity strategies and tactics.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Key also has a Privacy Team led by a Chief Privacy Officer (CPO) who has over ten years of experience in legal, compliance, and risk roles at financial institutions, focusing primarily on data protection and privacy. Our CPO holds an undergraduate degree in finance, a master's degree in business administration, and a juris doctorate. He is licensed to practice law in the state of Ohio and has obtained the CIPP/US certification through the International Association of Privacy Professionals. The CPO and Privacy team have the authority to escalate privacy risks to the Board. The Privacy and Information Security teams work together to implement controls around how personally identifiable information is managed and protected and to comply with applicable laws and regulations.

companyName: KEYCORP /NEW/

ticker: KEY


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Relating to Our Operations".

companyName: Autodesk, Inc.

ticker: ADSK


text: As one of the important elements that comprise and has been integrated into our overall enterprise risk management approach, our cybersecurity program includes the following:

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by our cyber defense team, notifications from employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to our IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.

companyName: Playa Hotels & Resorts N.V.


text: For the fiscal year ended December 31, 2023, we did not experience any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Utz Brands, Inc.

ticker: UTZ


text: The Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO") provide direct oversight and management of the cybersecurity risk management program. The CISO and the Information Security team assess and manage the day-to-day cybersecurity and threat management programs. Our CISO has more than 20 years of relevant experience in leading and building risk management and cybersecurity programs. Our CISO maintains the following credentials: Certified Information Systems Auditor and Certification in Risk Management Assurance. The CRO and CISO report periodically on important updates related to the Information Security Program and threat landscape to the Board of Directors and its designated committee with responsibility for oversight of risk management.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: In addition, our Board receives regular reports from management on matters relating to strategic and operational initiatives, financial performance, cybersecurity and legal developments. The Company's Enterprise Risk Management program, which has been adopted by the Company to further enhance oversight of risks inherent to our business and allow members of the Board and management to gain a greater understanding of the efforts being undertaken to manage the risks confronting the Company, covers cybersecurity risks.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: e. Training: The Company provides periodic training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices.

companyName: Axogen, Inc.

ticker: AXGN


text: Our risk governance structure includes a Third-Party Risk Management Program with first-level oversight by management's Third-Party Risk Management Committee and conforms to bank regulatory guidance. This program includes due diligence and periodic monitoring of the information security controls such providers have in place to protect our confidential data received, processed and/or stored by such providers.

companyName: 1ST SOURCE CORP

ticker: SRCE


text: The Board provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Global Chief Information Security officer or their designee regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: PIMCO Capital Solutions BDC Corp.


text: In addition, we have established a working group composed of senior leaders from various departments, including operations, finance, IT, information security, internal audit, and legal. This working group's responsibilities include (i) ensuring that information security goals and objectives are identified, meet organizational and business requirements, and are integrated into relevant processes, (ii) reviewing the effectiveness of the information security program, (iii) providing clear direction and highly visible management support for security initiatives, (iv) providing resources required for information security projects and initiatives, (v) overseeing programs to maintain information security awareness, including training and team-specific guidance, and (vi) coordinating the information security aspects of supplier relationships.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, among other things: an incident response plan, vulnerability management, systems monitoring, disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls for certain systems; data segregation and access controls for certain systems; physical security measures; asset management; employee training; certain testing; and IT and software development lifecycle training. NetScout also employs certain proprietary detection tools, enabling enhanced visibility and warning systems in response to certain cybersecurity threats.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: The Company utilizes various technical and qualitative processes to assist in identifying, assessing and managing cybersecurity risks. The Company's processes include periodic discussions and risk reviews with management and, depending on facts and circumstances, may include internal audits, third-party assessments, post-remediation reviews, engagements with independent third-party service providers and key governmental agencies, regular employee training, an incident response plan and backup and recovery plans. Our periodic engagements with independent third-party service providers are designed to provide qualitative and technical cybersecurity assessments. The Company has a corporate-level cybersecurity team, led by the CISO, that, among other responsibilities, receives and reviews reports regarding potential threats, trends and remediation strategies. The cybersecurity team evaluates threat intelligence and information obtained from various sources, including internal, public or private sources, government agencies and external consultants. Certain of the Company's subsidiaries have separate cybersecurity teams that, along with the corporate-level cybersecurity team, play a role in the Company's efforts to monitor, identify, assess and manage cybersecurity risks.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: In 2024, we did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Privacy, Data, and Cybersecurity" in this Annual Report on Form 10-K.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. Some of the other steps we have taken to detect, identify, assess, classify, and attempt to mitigate cyber security and risks include: • Adopting and periodically reviewing and updating information security and privacy policies; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Complying with the Payment Card Industry Data Security Standard (PCI-DSS); • Implementing an Information Security Management System (ISMS) that is certified as meeting the requirements of the ISO 27001 standard; • Implementing a Privacy Information Management System (PIMS) that complies with the requirements of the ISO 27701 standard; • Engaging an industry-leading, suitably qualified and experienced third party to independently evaluate our information security systems on a regular basis; • Adopting a vendor risk management program, which includes receiving the results of cybersecurity evaluations conducted on certain vendors engaged in high-risk data processing; • Providing security and data protection training and awareness to our employees, contractors and key partners with access to sensitive information and systems; and • Maintaining cyber liability insurance.

companyName: Bally's Corp

ticker: BALY


text: If a cybersecurity breach occurs, the Board of Directors and/or the Audit Committee will determine whether the incident or threat is "material" (.i.e. is there a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision or if it would have significantly altered the "total mix" of information made available?), assessing among other factors potential or actual financial impacts, reputational damage, and operational disruptions.

companyName: Kun Peng International Ltd.

ticker: KPEA


text: The CISO is responsible for developing, maintaining, and enforcing the Program's policies and procedures, as well as reporting on the Program's performance and material cybersecurity risks to the Audit Committee. The CISO has the relevant expertise and authority to carry out the Program's objectives and to coordinate with other key stakeholders within and outside the Company. The CISO's expertise includes decades of information technology and cybersecurity as a subject matter expert, including more than a decade of executive management experience as a CISO for Fortune 500 companies.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: Our Board of Directors actively considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risk to the Audit Committee. The Audit Committee is instrumental in overseeing the implementation of our cybersecurity risk management program by management.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: In the ordinary course of our business, our third-party service providers ("TPSPs") collect, process and store certain information and other data related to us or our customers and their users. We assess the cybersecurity practices of our TPSPs through a variety of measures, including a due diligence process designed to assess and manage the potential risks of such TPSPs to the Company. This process involves evaluation of security questionnaires, review of available SOC 2 reports, and performance of interviews prior to onboarding TPSPs over certain risk thresholds, with annual re-reviews for our highest risk tier TPSPs. Despite these measures, we are reliant on the security practices of our TPSPs, which may be outside of our direct control.

companyName: LIVEPERSON INC

ticker: LPSN


text: To identify and manage the material risks of cybersecurity threats to our business, operations and control environments, we have made investments in our technology and have implemented policies, programs and controls, with a focus on cybersecurity incident prevention and mitigation. Our cybersecurity program is integrated into our risk management process and is managed by a dedicated cybersecurity team that is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework. As part of our cybersecurity process, we engage external experts and consultants to assess our cybersecurity program and compliance with applicable practices and standards.

companyName: DT Midstream, Inc.

ticker: DTM