text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: Our Vice President of Information Security and Enterprise Information Technology ("CISO"), who reports to our Senior Vice President, Chief Information Officer ("CIO"), oversees our information security program and matters of risk relating to cybersecurity. Our CISO possesses more than 20 years of experience in information technology-related roles, including engineering, governance, and security, undergraduate and post-graduate degrees in information technology and security, and industry-recognized cybersecurity certifications. Our CISO and members of our Information Technology team, including our CIO, periodically provide risk reports to the Board and its committees, including assessments of the Company's cybersecurity risks, their potential impact on our business operations, and management's strategies to monitor and mitigate those risks. The committee chairs, in turn, report to the full Board as part of our general risk management process.

companyName: Wingstop Inc.

ticker: WING

secItem: Item 1C


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our IT department who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process. The cybersecurity risk management program also includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Merus N.V.


text: Our cybersecurity risk management efforts are informed by a cyber risk assessment, a continuous evaluation of our risks and vulnerabilities and risk tolerances. Our processes for assessing, identifying and managing cybersecurity risks are led by our Vice President – Information Technology and Chief Information Officer (our "CIO"), a management-level position reporting directly to our Executive Vice President and Chief Financial Officer (our "CFO"). Our CIO, a Certified Information Systems Security Professional ("CISSP") with over 20 years of information systems and information security leadership experience, leads our information technology team members, many of whom have USG security clearances and include one additional CISSP certified team member, in supporting our cybersecurity risk management efforts. This team's efforts are further informed through their participation in external cybersecurity-related panels, industry presentations and advisory boards, tabletop exercises and information-sharing collaborations and partnerships.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management.

companyName: GRIFFON CORP

ticker: GFF


text: Assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities. These assessments may include one or a combination of penetration testing, security audits, incident response planning, vendor risk assessments, and regulatory compliance assessments. Feedback from our maturity and technical assessments is incorporated into our systems and procedures through upgrades intended to further improve our security posture.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: Duncan Fulton. Mr. Fulton, age 49, was appointed Chief Corporate Officer of RBI, in June 2018, overseeing global communications, North American franchising, government relations and ESG initiatives. Mr. Fulton also serves as Chairman of the board of directors for the Tim Hortons Foundation. Prior to joining RBI, Mr. Fulton held several positions with Canadian Tire Corporation (CTC) from November 2009 to March 2018, including Senior Vice President of Corporate Affairs, Chief Marketing Officer for FGL Sports and Mark's Work Warehouse, and President of FGL Sports. Previously, Mr. Fulton was Senior Partner and General Manager of Fleishman-Hilliard from April 2002 to November 2009. Prior to his agency experience, Mr. Fulton served as a communication advisor and spokesman for several political leaders, including former Canadian Prime Minister Jean Chr tien, Ontario Premier Dalton McGuinty and New Brunswick Premier Frank McKenna.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We have experienced, and may in the future experience, whether directly or through third parties, cybersecurity incidents. While prior incidents, including those previously disclosed and not disclosed, have not materially affected our results of operations or financial condition, we cannot assure that they will not be materially affected in the future by such incidents. Additionally, although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity incident would not materially affect our, results of operations or financial condition. For more information on our cybersecurity related risks, see Item 1A – "Risk Factors."

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: Cybersecurity Risk Board of Directors Oversight [Text Block] advisor's Vice President - Communications leads our advisor's information security group responsible for overseeing our information security program. Our advisor's Vice President - Communications has over 18 years of industry experience.

companyName: Moody National REIT II, Inc.


text: We have also developed a cybersecurity risk management process for our third-party vendors. This process aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity risk profile. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors do, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, see Item 1A "Risk Factors."

companyName: SWK Holdings Corp

ticker: SWKH


text: Board of Trustees' Oversight of Risks from Cybersecurity Threats Our board of trustees provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our board of trustees receives periodic updates from the Adviser, the CIO, the CISO, and the Head of NFR CTIS, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: North Haven Net REIT


text: Our cybersecurity efforts will include the use of risk-based administrative, technical, and physical controls. Trio is in the process of implementing an extensive set of policies, procedures, systems and tools designed to help safeguard our systems and data, including firewalls, intrusion detection systems, access controls including multi-factor authentication, vulnerability scanning, penetration testing, independent third-party control audits, an internal bug bounty program, and other systems and processes.

companyName: Trio Petroleum Corp

ticker: TPET


text: The Board, as a whole, rather than any committee of the Board, has responsibility for oversight and review of cybersecurity matters with respect to the Corporation, including the risks from cybersecurity threats to the Corporation. Our Chief Compliance Officer reports to the Board on a semi-annual basis, or more frequently if necessary, on cybersecurity matters and developments applicable to the Corporation. In addition, the Board also receives periodic reports from the Corporation's third-party IT service provider. These reports, whether from the Chief Compliance Officer or the Corporation's third-party IT service provider, include updates on the Corporation's cybersecurity programs, the external threat environment, and the Corporation's programs and processes to address and mitigate the risks associated with the evolving cybersecurity threat environment. In addition, these reports also include updates on the Corporation's overall IT systems and capabilities and the Corporation's business continuity plan that may need to be activated if a material cybersecurity incident involving the Corporation were to occur. In the event of a material cybersecurity incident, our Chief Compliance Officer would make a report to the Board regarding the event, and the Board would engage in oversight responsibility with respect to the Corporation's response to such event.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams that we are able to prevent or sufficiently mitigate harm from. Although we make efforts to maintain the security and integrity of the third party networks and systems we use, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a security incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third party providers, will be effective. See "Item 1A–Risk Factors–Cybersecurity incidents may adversely affect our business."

companyName: LXP Industrial Trust

ticker: LXP


text: The Company has processes in place designed to protect its information systems and to assess, identify and manage material risks from cybersecurity threats. Accordingly, the Company has designed and implemented an Information Security Program, designed to protect the confidentiality, integrity, and availability of its information systems and data (including nonpublic information in its possession, custody, or control), as well as to comply with privacy and Information Security Program requirements for insurers as set forth in applicable state laws and regulations. As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing periodic training and regular phishing simulation and exercises. In addition, the Company has engaged third parties in connection with these processes.

companyName: Root, Inc.

ticker: ROOT


text: of Risks from Cybersecurity Threats of the date of this Annual Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security.

companyName: Prairie Operating Co.

ticker: PROP


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, please refer to Item 1A. "Risk Factors."

companyName: EPLUS INC

ticker: PLUS


text: Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board's oversight of cybersecurity risk management is supported by the Audit Committee of our Board (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.

companyName: Ellington Credit Co

ticker: EARN


text: In May 2024, the SEC adopted amendments to Regulation S-P, which, beginning in December 2025, require investment companies and SEC-registered investment advisers to adopt written policies and procedures for incident response programs to address unauthorized access to, or use of, customer information, including providing notice to certain individuals affected by any such incident. We will need to comply with this amended rule beginning December 2025. With the SEC particularly focused on cybersecurity, we expect increased scrutiny of our and GECM's policies and systems designed to manage cybersecurity risks and related disclosures.

companyName: Great Elm Capital Corp.

ticker: GECC


text: As we see increased reliance on information technology in the workplace and our business operations, and more companies offering hybrid work schedules, Urban Edge has employed several measures to mitigate cyber risks. The Cyber Steering Committee is responsible for the risk management program which includes, but is not limited to, identifying cyber risks, the risk severity, risk response, and tracking risk remediation. The Cyber Steering Committee meets (i) at least quarterly to review emerging threats, controls, and procedures, (ii) at least annually with the Corporate Governance and Nominating Committee to discuss trends in cyber risks and our strategy to defend our information against cybersecurity incidents, and (iii) promptly following the occurrence of a material cyber incident. In addition to a dedicated information technology and cybersecurity team monitoring our daily operations, the Company engages an independent third-party cybersecurity audit firm to periodically review cybersecurity risks and our Incident Response Program. The third-party firm evaluates our preparedness based on several factors including cyber risk assessment, vulnerability management, disaster recovery, and penetration testing. They also simulate attacks on the Company as part of their audit procedures to gauge if our incident response is repeatable and effective and provide recommendations for areas of improvement. Our vendor management program requires that critical and/or significant third-party service providers furnish information about their cyber policies to ensure compliance with cybersecurity standards.

companyName: Urban Edge Properties

ticker: UE


text: Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on our risk management process and the risk trends related to cybersecurity at least annually. Additionally, on a quarterly basis, the Audit Committee will receive updates from Management on cybersecurity.

companyName: ENCISION INC

ticker: ECIA


text: We engage external parties to aid in processing and managing cybersecurity incidents as needed, including utilization of the services and expertise of local law enforcement and government entities, partnering financial institutions, a third-party security operations center ("SOC"), and managed service providers. In addition, we collaborate with our internal auditors to ensure our processes are documented and followed appropriately.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, who has over 25 years of IT experience and 10 years of cybersecurity management expertise.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: At present the Company has minimal risk related to Cybersecurity as no operational business is conducted on the internet or available through the internet.

companyName: FinTrade Sherpa, Inc.

ticker: FTSP


text: Our Vice President of IT, in his capacity, regularly informs the CEO and CFO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the board of directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: CHUY'S HOLDINGS, INC.


text: Like other large multi-national corporations, we regularly experience cybersecurity incidents, and we expect to continue to be subject to such incidents. To date, there have not been any previous cybersecurity incidents that materially affected us. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors - We and our business partners are dependent on sophisticated information technology and if we fail to effectively maintain or protect our information systems and data, including from cybersecurity events, our business could be adversely affected.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: The Committee receives regular updates from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: Role of External Consultants, Vendors and Other Third Parties We regularly use external consultants and vendors to assist in our management of cybersecurity risks: • We regularly employ third parties to evaluate the security of our networks, including engaging an external vendor to conduct penetration testing against our network. • We engage an external vendor to review and test our cybersecurity incident response plan on at least an annual basis, including to assist with incident response exercises. • We engage a third party to assess the design of our cybersecurity controls and control environment, including assisting with our 2023 NIST Cybersecurity Framework maturity assessment. • We have external vendors on retainer to assist with cybersecurity incident response activities.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: B.Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Company's Information Security business unit primarily manages the day-to-day operations of monitoring cybersecurity risks to the Company's information systems, takes prevention, detection, and remediation measures for cybersecurity incidents, makes initial assessment of reported cybersecurity incidents, and reports such incidents to the Company's CEO, Chief Operating Officer ("COO"), CTO, Board and Enterprise Risk Management Committee as well as certain regulatory bodies, as needed. The following five management personnel are primarily responsible for assessing and managing the Company's material risks from cybersecurity threats: • Gabriel Tirador, Chief Executive Officer: The Company's CEO, along with its COO, oversees the Technology team who monitors the Company's information technology systems for suspicious events. The Company's CEO reports to the Board regarding cybersecurity incidents and issues. The Company's CEO, COO and CTO oversee the use of third-party cybersecurity consultants by the Information Security business unit to engage in periodic evaluations. Mr. Tirador has over 30 years' experience in the property and casualty insurance industry and in the Company and is an inactive Certified Public Accountant. As CEO of the Company, he has overseen its Technology business unit for over 20 years, among other business units. • Victor Joseph, President and Chief Operating Officer: The Company's President and COO oversees the technology team who monitors the Company's information technology systems for suspicious events. Mr. Joseph has overseen the technology team since 2022. Mr. Joseph has been employed by the Company in various capacities since 2009, and was appointed Executive Vice President and COO in January 2022 and President and COO in January 2024. • Theodore R. Stalick, Senior Vice President and Chief Financial Officer: The Company's CFO oversees its enterprise risk management program which, among others, includes oversight of cybersecurity risk management and serves as Chairperson of the Company's Enterprise Risk Management Committee. Mr. Stalick has been the Company's CFO since 2001. Mr. Stalick is a Certified Public Accountant and has a Bachelors Degree in Business Administration, Accounting and Finance concentration, and an MBA, Business Analytics concentration. • Wilson Pang, Vice President and Chief Technology Officer: The Company's CTO regularly provides the Board with updates on cybersecurity risk management or significant reported cybersecurity incidents. The Company's CTO works with the Company's CEO, COO and Head of Information Security to determine the severity of cybersecurity incidents. The Company's CTO also works with its Head of Information Security to direct action in the event of a severe cybersecurity incident. Mr. Pang has over 20 years' experience in the technology industry. He has served in Chief Technology Officer and Chief Data Officer roles in several public companies and has deep expertise in technology, data, and artificial intelligence. He has a Master's and a Bachelor's Degree in electrical engineering.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: Management and Strategy is committed to the integrity and security of the sensitive data that it collects, maintains, and transmits across its computer systems.

companyName: ARVANA INC

ticker: AVNI


text: Cybersecurity threats, including the results of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: Longeveron Inc.

ticker: LGVN


text: Related to Cybersecurity Risks The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management, including from our Vice President, Information Technology, or the VP of IT, regarding cybersecurity matters, such as relevant cybersecurity risk assessments, as applicable. We have established a process for the Audit Committee to be notified in the event of significant cybersecurity threats or incidents.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: Our internal cybersecurity testing and reporting processes allow us to rank our overall risk on a periodic basis so as to enable us to identify and respond to internal risk trends. Further, we follow escalation procedures to support the communication of cyber-related events.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, and conduct tabletop exercises to validate our cybersecurity incident response processes; • the use of various technology and process-based methods, such as network isolation, intrusion detection systems, vulnerability assessments, penetration testing, use of threat intelligence, content filtering, endpoint security (including anti-malware and detection response capabilities), email security mechanisms, and access control mechanisms; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management and diligence process for vendors and service providers.

companyName: Oscar Health, Inc.

ticker: OSCR


text: Franklin Templeton has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Our assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our Information Technology teams meet to ensure that risks are timely identified, patch and vulnerability requirements are monitored, and the necessary changes are implemented.

companyName: BayCom Corp

ticker: BCML


text: The Company's CISO is the member of management principally responsible for overseeing the Company's cybersecurity risk management program, under the CIO's leadership and in coordination with other business leaders across the Company, including legal, product engineering management, internal audit, finance and risk management. The CISO has extensive cybersecurity knowledge and skills gained from over 20 years of technical and business experience in the cybersecurity and information security fields, including as a Chief Information Security Officer and through other leadership and technical roles in IT governance and strategy, security risk and compliance, corporate product security and data privacy, and IT infrastructure. She also holds a Master of Science degree in Information and Cybersecurity from the University of California, Berkeley. The CISO reports directly to the CIO who in turn reports directly to the COO. The CISO receives reports on cybersecurity threats from members of the Cyber Security Office on an ongoing basis and, in conjunction with the Senior Risk Council, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with the Company's legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: team members are responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: Education and Awareness Our Company policies require our employees to assist in the protection of our customers' data. We have various training programs, conducted frequently, designed to heighten employees' awareness of current threats, educate them on effective mitigations and reinforce the importance of handling and safeguarding customer and employee data in accordance with our established security protocols. To evaluate the effectiveness of these training programs and monitor the effectiveness of our security controls, we have implemented mock testing practices. Annual incident response training is conducted for administrative personnel that would be expected to be involved with, and respond to, a security incident.

companyName: CPI Card Group Inc.

ticker: PMTS


text: See "Risk Factors – Risks Related to Our Business – Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: Sanara MedTech Inc.

ticker: SMTI


text: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across our overall enterprise risk assessment to other legal, compliance, strategic, operational and financial risk areas.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our Chief Financial Officer.

companyName: UR-ENERGY INC

ticker: URG


text: Annual risk assessments of Starwood Capital's Information Security Program are conducted to identify emerging information security and third-party risks. In addition, periodic vulnerability assessments and penetration tests are conducted throughout the year to support the identification of risks.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Our risk management and mitigation approach includes the adoption of NIST CSF and NIST 800-53 security control frameworks and adaptive ongoing threat analysis. In addition, our Information Security, or InfoSec, team reviews and conducts a risk assessment of any novel technologies Nasdaq plans to implement. Our policies and our baseline security controls incorporate robust security infrastructure with multi-layered defense systems. We have 17 System and Organization Controls Type 2, or SOC 2, certifications with respect to our information security and infrastructure. Our adaptive analysis monitors the threat landscape relevant to Nasdaq, our vendors and financial industry peers, and threats arising from geopolitical events. As the external threat landscape evolves, our information security controls are regularly evaluated, updated and enhanced to help protect against emerging risks. Additionally, we conduct extensive cybersecurity assessments of our acquired entities, both prior to acquisition and following completion of the transaction, to understand potential threats and mitigate any potential security gaps, as well as to ensure compliance with our security infrastructure and access management practices and policies.

companyName: NASDAQ, INC.

ticker: NDAQ


text: The Cybersecurity Plan includes annual assessments using (i) the Department of Energy's Cybersecurity Capability Maturity Model, (ii) the National Institute of Standards and Technology Cybersecurity Framework, and (iii) the Center for Internet Security Controls. The Company uses the results of these assessments to benchmark the Company's cybersecurity posture, to identify risks from cybersecurity threats, to prioritize any such risks that may have potential material effects on the Company, and to establish effective controls to manage, mitigate and remediate such risks.

companyName: UNITIL CORP

ticker: UTL


text: While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.

companyName: Ellington Credit Co

ticker: EARN


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management team, including our Chief Financial Officer, Senior Director of Information Technology and Senior Vice President, Quality Assurance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal technology and quality assurance compliance personnel and our retained external cybersecurity consultants. Our management team has experience in risk management as well as in the technology and finance industries, equipping them to oversee cybersecurity risks effectively.

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: The Head of IT updates the Chief Financial and Operating Officer who apprises the Audit Committee and Board of Directors of cybersecurity incidents consistent with our cybersecurity incident response plan promptly for any cybersecurity incidents, if applicable.

companyName: MARINUS PHARMACEUTICALS, INC.


text: Our management team, in coordination with our information technology department, is responsible for assessing and managing our material risks from cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Our Head of IT has primary responsibility for our overall cybersecurity risk management program and supervises our cybersecurity personnel. Our Head of IT's experience includes over 25 years of design, implementation and management of cyber-security & information technology programs at various levels and organizations.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Governance and Oversight Bio-Techne's cybersecurity program is led by the Company's Chief Information Officer ("CIO"), with day-to-day management and administration of our cybersecurity program performed by the Director of IT Infrastructure and Security and the IT Security Operations team. The Director of IT Infrastrcuture and Security reports to the CIO, and the CIO reports to the Chief Financial Officer. The CIO is supported by the Incident Response Team ("IRT"), a multi-disciplinary management committee comprising senior members from the Security Operations Team, legal, finance, internal audit and other functions. The IRT supports the CIO in supporting and reviewing information security risks and in the event of a cybersecurity incident provides leadership with respect to incident response, investigation, mitigation and remediation. In addition to leadership and support within management, we also work with security service providers to monitor for vulnerabilities and threats, and which are reported to the Security Operations team. All employees are trained and tested annually on cybersecurity risks, and we continually perform simulated phishing exercises. We also conduct periodic tabletop exercises for key personnel involved in cybersecurity risk management, including the IRT.

companyName: BIO-TECHNE Corp

ticker: TECH


text: With respect to the prevention, detection, mitigation, and remediation of cybersecurity incidents, our information security team, under the direction of our Senior Vice President, IT Operations, monitors our information systems, assesses the severity of any incidents it detects or that are otherwise reported, and follows escalation procedures embedded within our incident response plan to inform the Senior Vice President, IT Operations, other members of management, the Committee, and the Board, each as needed.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: The Board of Directors recognizes the importance of cybersecurity to safeguard confidential information and sensitive data and receives periodic training on cybersecurity risk and best practices for related oversight. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2023, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and evaluate the Company's cybersecurity program in the context of the global risk environment.

companyName: Bancorp, Inc.

ticker: TBBK


text: The CISO, supported by the Information Security Team, is responsible for implementing and managing the Program. The CISO has served in various roles in information technology and information security for over 25 years and has broad and extensive experience in multiple industries including financial services, healthcare, and higher education. The CISO holds a graduate degree in IT management and has attained the professional certifications of Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Boardroom Certified Qualified Technology Expert (QTE), and is a Distinguished Fellow with the Information Systems Security Association (ISSA).

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


text: Our processes also address the cybersecurity risks associated with our use of third-party vendors, some of whom have access to our customer and employee data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, our cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Management's Role in Cybersecurity Our global cybersecurity services team is responsible for assessing our technology environment, identifying emerging cybersecurity threats and evolving cybersecurity threat capabilities, and implementing business processes and technical defenses to safeguard our technology environment and services. Our management has established a cybersecurity and technology risk committee focused on managing cybersecurity and technology risk and implementing cybersecurity and technology plans, strategies and objectives. The committee is chaired by the Deputy Chief Information Security Officer, who reports to the Chief Operating Officer through our Chief Information Security Officer ("CISO"), and is comprised of senior business, cybersecurity, and technology leaders responsible for delivering our products and services. Our cybersecurity program is designed to enable us to detect and respond to cybersecurity incidents, continually improve the effectiveness of our cybersecurity controls, and dynamically respond to the evolving threat landscape.

companyName: FISERV INC

ticker: FISV


text: Board of Directors exercises oversight of cybersecurity risks through its Audit Committee, which is responsible for reviewing and monitoring our cybersecurity strategy and risk management practices. The Audit Committee receives quarterly briefings from the Chief Operations Officer (COO) on emerging threats, incident trends, and the effectiveness of our cybersecurity program. These briefings include updates on risk assessments, third-party audits, and compliance with regulatory requirements, such as the SEC's cybersecurity disclosure rules. The Board is informed annually on cybersecurity matters or as needed in the event of a significant incident.

companyName: Quality Industrial Corp.

ticker: QIND


text: We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts for any breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of any potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.

companyName: NN INC

ticker: NNBR


text: • Incident Response and Recovery Planning – We have established and maintain a cybersecurity incident response procedure plan that addresses our response to cybersecurity incidents and recovery from such incidents, and such plan is tested and evaluated periodically. • Communication, Coordination and Disclosure – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management and other key business functions, as well as the members of the Audit Committee of the Board of Directors, in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. We have established an Incident Response Committee, which is chaired by our SVP Administration, to quickly organize and execute an effective, productive, timely and compliance-conscious response to cybersecurity threats and incidents, as well as coordinate among the cross-functional groups.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: ARCHER-DANIELS-MIDLAND COMPANY The Company has a dedicated cybersecurity team that collaborates with compliance, privacy, legal, and other teams across the global organization to assess the risk landscape. ADM's cybersecurity program is designed to be aligned with applicable industry standards and is assessed regularly by independent third-party auditors. The multifaceted nature of the Company's cybersecurity measures includes aspects of prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. The Company has established processes to oversee and identify cybersecurity risks associated with the use of third-party service providers, which include the completion of due diligence before engaging with any third party, controls for response to mitigate any significant risks, and assessments and reviews during the course of the relationship. Additionally, the Company has ongoing partnerships with government and commercial cybersecurity experts to understand emerging cybersecurity threats.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: The risk factors discussed in this document should be considered together with information included elsewhere in the Annual Report on Form 10–K and should not be considered as the only risks to which the Company is exposed.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: All third-party service providers to the Company are subject to risk assessments to identify the risks, including cybersecurity-related risks, posed by that individual third-party. Changes in vendor services result in a reassessment of risk. Based on the results of the risk assessment, the Company requires each third-party service provider to meet certain due diligence requirements. These due diligence requirements require third-party service providers to provide the Company with evidence of appropriate policies, an independent examination of their control environment, financial results, and operational resilience, as appropriate.

companyName: EVANS BANCORP INC


text: Continuous Improvement – We are committed to continuously improving our cybersecurity posture in line with industry standards and best practices. This includes staying informed about emerging threats and vulnerabilities, conducting regular security audits and assessments and investing in cybersecurity technologies and training as resources allow.

companyName: ESCALADE INC

ticker: ESCA


text: The Company maintains a Business Continuity Plan (the "Plan") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board of Directors-approved management committees, as discussed further below, and to the IT Steering Committee. The Plan is coordinated through the SVP/IT Manager and ISO, and key members of management are embedded into the Plan by their design. The Plan facilitates coordination across multiple parts of the Company and is evaluated at least annually.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Areas for potential improvement in our cybersecurity posture include upgrading our WiFi access points, and implementing a cloud backup solution to complement our current on-site backup strategy.

companyName: OZOP ENERGY SOLUTIONS, INC.

ticker: OZSC


text: We regularly review our policies, practices, and plans with assistance from third-party experts and advisors. Our Chief Information Officer is responsible for corporate-wide data security. Our management team is actively engaged in regular reviews of cyber risks. Additionally, our full Board of Directors receives quarterly briefings on enterprise-wide cybersecurity risk management and our overall cybersecurity risk environment.

companyName: AMETEK INC/

ticker: AME


text: As part of our overall risk management program, we run and maintain a formal information security, cybersecurity, and privacy program led by our Chief Information Security Officer ("CISO") that uses a risk-based approach to evaluate new technology, third parties, and changes to the technology landscape. The program is assessed using multiple industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF Version 2.0). We engage with industry partners, assessment firms and advisors, law enforcement, and others to periodically assess our cybersecurity capabilities, and utilize a defense-in-depth approach to protect our systems and services.

companyName: TYSON FOODS, INC.

ticker: TSN


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. For a detailed description of the risks related to cybersecurity, see Item 1A. "Risk Factors." of this Form 10-K, which should be read in conjunction with this Item 1C.

companyName: TUCOWS INC /PA/

ticker: TCX


text: The Company's process for identifying and managing first and third-party risks from cybersecurity threats includes proactive threat hunting, continuous monitoring of the Company's systems and network for cybersecurity events, and regular testing of the Company's Security Incident Response Plan, Business Continuity Plan and Disaster Recovery Plan. An external managed security services provider and an industry-leading security tool continuously monitors, detects, and responds to the Company's systems and network for cybersecurity threats. The Company's IT security partners evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. A third-party with extensive experience in incident response and forensics is on retainer to assist with incidents. The Incident Response Plan includes reporting and escalation procedures to inform the Company's executives, the Audit Committee, and full Board of Directors, as appropriate, to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Incident Response Plan and Disaster Recovery Plan include procedures for business recovery and are tested at least annually. The Company also maintains a cyber insurance policy that provides coverage for material IT security incidents.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: The use of a cyber risk matrix that assesses the likelihood and impact of threats and risks identified in the Company's hardware, software, and data systems. Threats are ranked by potential severity and mitigation / remediation efforts are tracked. Matrix is updated on a semi-annual basis and as new risks are identified. System penetration testing is performed by rotating third-party service providers at least every 18 months. System vulnerability testing is performed by the Company monthly. Network assessments are performed at least annually by qualified third-party service providers.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards & Technology. Our process includes overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants and legal advisors in evaluating and testing the Company's risk management framework and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: CareMax, Inc.


text: Our Chief Information Officer and our IRP stakeholders oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Information Officer has an advanced degree in management information systems and has managed the Company's IT processes and policies inclusive of cybersecurity matters throughout his tenure at the Company, in addition to many years of prior experience in various technology roles at a large U.S. public company. He is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by working with the IT department and external vendors to implement our security risk management, including through the use of both automated and manual tools and reporting, in accordance with the Company's incident response plan and Company cybersecurity policies.

companyName: ESS Tech, Inc.

ticker: GWH


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function, which we rely on a third-party vendor who is associated with a Related Party to provide. Such processes include physical, procedural, and technical safeguards and routine review of our policies and procedures to identify risks and improve our practices. We use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: Envoy Medical, Inc.

ticker: COCH


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our third-party collaborators, service providers, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product candidates' development programs and activities related to our approved products and have a material adverse effect on our reputation, business, financial condition or results of operations."

companyName: bluebird bio, Inc.


text: Although we have not been materially impacted by any cybersecurity incident to date, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled " Our business and operations would suffer in the event of system failures, cyber-attacks or a deficiency in our cyber-security. "

companyName: IEH Corp

ticker: IEHC


text: Key elements of our cybersecurity risk management program includes but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profiles.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: The Company's Board of Directors (the "Board") recognizes the critical nature of managing risks associated with cybersecurity threats and is responsible for oversight of the Company's information security programs, including risk of cybersecurity threats. The Audit Committee, which supports the Board of Directors in the oversight of the Company's information security program, oversees managements design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of Board members with diverse expertise, including technology, financial and risk management experience.

companyName: ASCENT INDUSTRIES CO.

ticker: ACNT


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Theriva acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Theriva Biologics, Inc.

ticker: TOVX


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. Our third-party consultant team is managed by our Vice President Operations who reports to the Chief Executive Officer or the board-level, as appropriate.

companyName: SPARTA COMMERCIAL SERVICES, INC.

ticker: SRCO


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats, and is committed to the prevention, detection, and timely response to cybersecurity threats that may impact the confidentiality, integrity, and availability of its information systems and information assets.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: We engage assessors, consultants, and auditors in connection with our risk assessment processes. These outside advisors assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Autodesk, Inc.

ticker: ADSK


text: Our Chief Executive Officer supervises our IT department (the "IT Department"), which coordinates with our cybersecurity incident management team, which consists of, among others, our Chief Financial Officer, Chief Legal Officer, Head of IT, and a third-party IT and cybersecurity consultant ("CSI Management Team") to identify, assess and manage our cybersecurity threats and risks. Members of our IT Department and CSI Management Team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, internal and external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and evaluating threats reported to us.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: In an effort to detect and defend against cyber threats, the Company annually, and, periodically as needed, provides its employees with various cybersecurity and data protection training programs. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents promptly to the Company's centrally managed cyber defense and security operations.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: Our process for assessing, identifying and managing material risks from cybersecurity threats is integrated into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity organization continually evaluates and addresses cybersecurity risk in alignment with our business objectives. We employ automation, and we also engage our internal audit function and a range of external consultants and other expert third parties in connection with the evaluation and management of cybersecurity risk and the maturation of our cybersecurity program.

companyName: Kenvue Inc.

ticker: KVUE


text: Material Effects of Cybersecurity Incidents Past cybersecurity incidents have not had, and are not reasonably expected to have, a material impact on the Company's business strategy, operations, or financial condition.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: Board Oversight of Security Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO and the Chief Information Security Officer of the Adviser ("CISO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Barings BDC, Inc.

ticker: BBDC


text: The IRT is responsible for deciding on a containment strategy to respond to the cybersecurity incident, coordinating resources, and communicating to management with subsequent notification to the Audit Committee, if warranted.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: We recognize that employees play a critical role in maintaining a strong cybersecurity posture. Our Information Governance Policy sets forth the requirements for employee conduct relating to company information and company-managed devices, including relevant privacy, data security and data retention policies. We believe that our Information Governance Policy is aligned with industry best practices and applicable legal and regulatory requirements. In addition to our Information Governance Policy, we conduct cybersecurity training programs emphasizing the importance of cybersecurity awareness at least annually and more frequently as necessary or advisable. These programs address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness and best practices for safeguarding sensitive information. Employees are held accountable for completing all assigned cybersecurity programs and meeting certain performance thresholds in phishing awareness exercises, and there is a range of consequences for underperformance that includes termination.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.

companyName: Fyntechnical Innovations Inc

ticker: FYNN


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, such as legal counsel, threat intelligence service providers, and cybersecurity software providers.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. In the last three years, the Company has not experienced any material cybersecurity incidents and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). For additional discussion of whether and how risks from cybersecurity threats could materially affect or are reasonably likely to materially affect the Company, see Item 1A. Risk Factors – "We are subject to cybersecurity threats and may face risks to the security of our sensitive data and information technology which may adversely affect our business, results of operations, financial condition and cash flows. "

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Notwithstanding the steps we take to address cybersecurity, we may not be successful in preventing or mitigating all cybersecurity incidents or threats. See Item 1A. Risk Factors - Risks Related to Our Business and Operations – The occurrence of cyber incidents, or a deficiency in our cybersecurity, or the cybersecurity of our service providers, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, regulatory enforcement and other legal proceedings, and/or damage to our business relationships, all of which could negatively impact our financial results – for a discussion of cybersecurity risks. To date, we have not experienced any material cybersecurity incidents.

companyName: JBG SMITH Properties

ticker: JBGS


text: The Audit Committee receives periodic reports from our cybersecurity function concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition..

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: Marathon Oil's senior leadership and the Audit and Finance Committee of our Board receive regular cybersecurity updates, with formal reporting to the Audit and Finance Committee at least annually. Our CIO regularly provides reports to senior leadership and the Audit and Finance Committee regarding our ongoing assessment of cybersecurity threats and risks, data security programs designed to prevent and detect threats, attacks, incursions and breaches, as well as management, mitigation and remediation of potential, and any actual, cybersecurity and information technology risks and breaches. In addition, the Audit and Finance Committee and management review reports from internal audit regarding evaluation of our information technology department on a regular basis.

companyName: MARATHON OIL CORP


text: Our cybersecurity programs and procedures are designed to identify and address threats that are subject to ongoing compliance assessments, certifications, and testing. We conduct assessments of threat models to determine which risks are most likely to impact us. Our security and controls team gathers threat and risk data and updates through various sources, such as systems reviews, security research activities, and internal and external security scans and alerts, as appropriate. As applicable, in certain circumstances, we also collaborate with industry partners in the security community, our peers and law enforcement agencies, to support our cybersecurity threat intelligence capabilities. This information is collected, categorized, and assessed to identify, prioritize, and manage significant cybersecurity risks. As a result, our process is continually evaluated and evolves as the threat landscape changes.

companyName: Symbotic Inc.

ticker: SYM


text: We assess and identify material risks from cybersecurity threats primarily through the work of our Information Security organization as part of our enterprise risk management ("ERM") process. The ERM process, administered by management with input from each business segment and function, continually monitors material risks facing L3Harris, including cybersecurity threats. Our Chief Information Officer ("CIO"), has extensive experience leading information technology for global organizations across aerospace, defense and industrials, works directly with our CEO and other members of senior management to assess cybersecurity threats as part of the ERM process. The CIO also oversees the internal cybersecurity organization of more than 100 full-time employees headed by our Chief Information Security Officer (our "Cybersecurity Team").

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Governance Overview The Board oversees cybersecurity risk through multiple methods. The Audit Committee of the Board has been delegated certain cybersecurity oversight responsibility and, among other things, receives quarterly updates and presentations from the information security team regarding the Company's cybersecurity environment, cybersecurity risks and threats, cybersecurity projects the Company has implemented and plans to implement and other cybersecurity developments, and such committee reports to the full Board after each meeting. In addition to these quarterly reports to the Audit Committee, the information security team provides a presentation to the Board at least annually regarding the same topics covered with the Audit Committee. In addition, members of the Company's internal audit team have certain responsibilities with respect to projects designed to test the Company's cybersecurity controls and improve the overall cybersecurity environment.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity strategy, which applies to us and the Adviser.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Our CISO and Chief Technology Officer ("CTO") oversee our day-to-day technology and security activities. Our CISO has been with the firm since 2013 and has over 20 years of IT experience in various industries. He is a Certified Chief Information Security Officer from the Carnegie Mellon University executive education program, as well as a Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP). Our CTO joined the firm in 2020 with 25 years of IT experience, including 12 years of executive level technology experience in the asset management industry.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: In accordance with our cybersecurity incident response plan ("IRP), our Chief Information Officer, members of our management team, including personnel representative of the following functions – legal, IT, finance, audit, operations, engineering, human resources, communications, and additional executives as applicable under the plan – and external cybersecurity support providers (collectively, "IRP stakeholders"), are primarily responsible to assess and manage our material risks from cybersecurity threats.

companyName: ESS Tech, Inc.

ticker: GWH


text: Our Audit Committee, through their responsibilities designated to them in the Audit Committee Charter, oversees cybersecurity risk management as part of its risk oversight function and oversees management's implementation of our CRMP.

companyName: GRAHAM CORP

ticker: GHM


text: As a part of our overall risk management, the Company has engaged a third-party service provider to advise as to our maintenance of cybersecurity and risk management. The C ompany has instituted a comprehensive cybersecurity risk management program that employs various methods to monitor and assess our threat environment and risk profile. These methods include the use of manual and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating any threats reported to us and conducting periodic vulnerabilities assessments. We have company-wide policies and procedures in place that further enhance our ability to identify and manage cybersecurity risks. Our employees receive ongoing training under our security policies. Any incidents identified by the third-party service provider are to be reported promptly to the board of directors.

companyName: TEN Holdings, Inc.

ticker: XHLD


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Senior VP of Global IT and System Operations and IT Security Officer.

companyName: ENZO BIOCHEM INC


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Technology Risk Committee, which is a standing subcommittee of the Operational Risk Committee, is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Risk Committee is chaired by our Chief Technology Officer and members include our Chief Information Officer, Chief Information Security Officer, and administrators of key business systems. The Technology Risk Committee reports regularly to the Operational Risk Committee, which reports to the Executive Risk Committee, which includes our Chief Executive Officer and other executive officers. Through this committee reporting structure, management is informed about and monitors the information security program and its management of cybersecurity risks and incidents. When a cybersecurity incident is detected, we follow a cybersecurity incident response plan and associated procedures as we mitigate, respond and recover from the incident. Management assesses the materiality of a cybersecurity incident to our business and determines the communications that are made to internal and external parties at the appropriate times. When a cybersecurity incident is detected, we follow a cybersecurity incident response plan and associated procedures as we mitigate, respond and recover from the incident. Management and, if required, external subject matter experts are directly involved in assessing the materiality of a cyber security incident to our business, and determine the communications that are made to internal and external parties at the appropriate times. The cybersecurity incident response plan is tested annually using a simulation exercise involving representatives from organizations across the Bank, including executive management.

companyName: SANDY SPRING BANCORP INC


text: The Board oversees the effectiveness of the Company's management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives reports on the Company's technology and cybersecurity functions, including vulnerability assessments, any third-party and independent reviews, the threat environment, and other information security considerations. The Board also receives on a regular basis information and updates regarding cybersecurity matters. The Cybersecurity Steering Committee meets multiple times throughout the year to discuss the Company's cybersecurity programs and practices, risk management related to cybersecurity and a wide range of other related topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. At least once each year, the Board and the Company's executive leadership team discuss the Company's approach to cybersecurity risk management with the Company's VP of Information Technology.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency. Our administrative and operating networks are targeted by hackers on a regular basis. Any failure, unexpected, or unauthorized use of technology systems could result in the unavailability of such systems, and could result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. See "Risk Factors – Cyber Risk Factors" for further information.

companyName: AVISTA CORP

ticker: AVA


text: We face significant and persistent cybersecurity risks due primarily to (i) the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and (ii) our use of third-party products, services and components. We are committed to maintaining strong governance and oversight of these risks and to implementing mechanisms, controls, technologies and processes designed to help us assess, identify and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: KonaTel, Inc.

ticker: KTEL


text: We conduct risk assessments to identify cybersecurity threats at least annually, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Innoviva, Inc.

ticker: INVA


text: The Company's entire Board of Directors is engaged in risk management oversight, including the oversight of risks from cybersecurity threats. In accordance with the NYSE listed company rules, the Audit Committee assists the Board of Directors in its oversight of Domino's company-wide risk management and the process established to identify, assess, measure, monitor and manage risks, including major information security and cybersecurity risks, with input from the Company's internal committee dedicated to assessing and managing enterprise risk comprised of members of the Company's Executive Leadership Team who report directly to our Chief Executive Officer in addition to other senior leaders within the Company (the "Enterprise Risk Committee").

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Our Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover. These teams are managed by the Vice President, Information Security and Privacy, who reports to the Senior Vice President, Chief Strategy and Digital Officer. Our cybersecurity leaders collectively have more than 25 years of relevant experience and multiple professional certifications.

companyName: GENESCO INC

ticker: GCO


text: We have previously and may in the future become the target of cyber-attacks by third parties seeking unauthorized access to our or our customers' data or to disrupt our ability to provide our services. As a result, we have expended and plan to continue to expend significant resources in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities. Notwithstanding the measures and processes we take to manage cybersecurity risk, there is no guarantee that these measures and processes will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For a description of the risks from cybersecurity threats that may materially affect the Company and how those risks may affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including without limitation "Strategic and Operational Risks—If we or our third-party service providers experience, or are unable to protect against cyber-attacks, ransomware, security incidents, or security breaches, or if unauthorized parties otherwise obtain access to or otherwise compromise our customers' data, our data, or our platform and information technology systems, then our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced, and we may incur significant liabilities or additional expenses."

companyName: Datadog, Inc.

ticker: DDOG


text: Our CISO has 42 years of experience in a diverse array of information and security technologies and has managed various domains, with expertise in enterprise resource planning, finite scheduling, middleware technologies, network control, operational control, identity access and governance and data center management. He and our other dedicated cybersecurity personnel collectively hold numerous certifications, including in relation to forensic investigation, threat hunting and digital forensics, risk and information system controls, Google cybersecurity, information security auditors and fraud examiners. Additionally, the collective cybersecurity team members have substantial experience in information technology disciplines and prioritize remaining educated on current threats.

companyName: Pactiv Evergreen Inc.


text: Comprised of specialists in risk assessment, vulnerability management, and threat intelligence, the Cybersecurity Core Team focuses on identifying, evaluating, and mitigating cyber risks. Their backgrounds include various cybersecurity certifications including CISSP, CISM, Offensive Security Certified Professional ("OSCP"), Certified Information Systems Auditor ("CISA"), and Certified Cloud Security Professional ("CCSP"). This team conducts regular risk assessments, monitors the threat landscape, and collaborates with other departments to promptly address vulnerabilities.

companyName: Snap One Holdings Corp.


text: The Program is included in the Company's enterprise risk management program. The CISO is responsible for developing and implementing our Program and reporting on cybersecurity matters to the Board. Our CISO has over 20 years of related experience, and others on our Corporate Information Security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: The Chief Information Security Officer ("CISO") is the management position with primary responsibility for the development, operation, and maintenance of our information security program, which includes cybersecurity. Our CISO has cybersecurity experience that includes being a lead auditor for ISO/IEC 27001 and ISO 22301 with knowledge of both operations and governance. He previously served as Chief Technology Officer for an international managed security service provider, during which time he served as Virtual CISO, Incident manager and security auditor for several multinational companies. We have established a Cybersecurity Steering Committee to provide a management-level oversight of cybersecurity. The Cybersecurity Steering Committee reviews the annual risk assessment and provides comments on the overall information security program. Oversight of the information security program at the Board level sits with the Audit Committee. The Audit Committee is informed of cybersecurity-related risks through the CISO providing quarterly updates on the information security program and more frequently as circumstances require.

companyName: GUESS INC

ticker: GES


text: Risk from cybersecurity threats While Stewart regularly defends against, responds to and mitigates risks from IT systems and software vulnerabilities, broader cybersecurity threats and data security incidents, as of the date of this report, Stewart has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization, however, there can be no guarantee that we will not experience such an incident in the future. Stewart experienced no known material cyber breaches during the three-year period ending December 31, 2024. For additional information concerning Stewart's risks related to cybersecurity, see Item 1A. Risk Factors.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: The Company and its business units leverage several information security controls frameworks, standards and best practices with the International Organization for Standardizations (ISO) 27001 used as the overarching framework. The ISO 27001 establishes a multi-pronged information security standard for organizations to manage information security risks, build cyber resilience, and improve operations.

companyName: Graham Holdings Co

ticker: GHC


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any.

companyName: Berenson Acquisition Corp. I


text: Our Information Security Program is led by our CISO, who reports to our CIO, and overseen by the TIRC, which serves as a sub-committee to the Management Risk Committee. The TIRC provides oversight, leadership and direction for data risks, technology risks and information security. Our CISO leads the Information Security organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function. Reporting to the CISO is the Security Intelligence Incident Response Team, which is responsible for managing cybersecurity incidents by leading, designing and implementing threat intelligence, continuous monitoring and rapid response services.

companyName: Discover Financial Services


text: Our Chief Risk Officer has primary responsibility for our enterprise risk management program, including oversight of our cybersecurity risk management program. Our Chief Information Security Officer has primary responsibility for our cybersecurity risk management program and supervises the Company's cybersecurity personnel. Both individuals have extensive work experience in various roles involving risk and compliance, including cybersecurity and information security.

companyName: Axos Financial, Inc.

ticker: AX


text: We recognize that security is an enterprise concern and requires stakeholders from across the enterprise to understand and manage this risk. Our security management structure reflects a centralized security program that coordinates security functions across the enterprise. The CISO, who oversees the CST, reports directly to our chief information officer and is responsible for the overall strategy and function of the cybersecurity program. We also have a cybersecurity steering committee that takes an active role in setting strategic direction for cybersecurity initiatives and provides oversight and guidance for overall information security risk management. The CISO provides regular reports on our cybersecurity program and potential risks to the Audit and Enterprise Risk Committee ("AERC") of the Board of Directors. The AERC regularly briefs the full Board on these matters. One AERC member holds the CERT Certification in Cybersecurity Oversight from Carnegie Mellon University, and a second has significant work experience related to technology.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: We will develop and implement a company-wide cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program will be integrated into our overall enterprise risk management program and includes a cybersecurity incident response plan.

companyName: HeartCore Enterprises, Inc.

ticker: HTCR


text: Mandatory cybersecurity training for all employees upon onboarding and through annual refreshers, fostering a culture of security awareness across the organization.

companyName: QHSLab, Inc.

ticker: USAQ


text: The Company engages in a continuous, focused risk monitoring process to identify the likelihood and impact of internal and external threats to our information security systems and data and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. The CISO and COO together lead efforts to design, implement and operate necessary controls commensurate with the materiality and criticality of identified risks and the sensitivity of the information assets and systems used throughout the bank. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect b1BANK.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: The Audit Committee is responsible for reviewing and assessing the overall cybersecurity risk management program and management's processes and policies with respect to cybersecurity risk monitoring, identification, assessment, and response. Senior management and the Audit Committee receive at least quarterly updates on Bunge's cybersecurity readiness and the current "threat environment," which includes an update on the cybersecurity threat landscape, the strategic priorities of the cybersecurity risk management program and progress made in respect of those priorities, a review of cybersecurity incidents, as well as additional updates on an as-needed basis. Our internal audit team also reports to the Audit Committee on the effectiveness of management in identifying and appropriately controlling risks, including cybersecurity risks. The Audit Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.

companyName: Bunge Global SA

ticker: BG


text: We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including Microsoft Azure CSPM and SOC 2. We use this framework, together with information collected from periodic manual assessments and automated testing, to tailor aspects of our cybersecurity practices given the nature of our assets, operations and business. The Company's processes to assess, identify and manage material risks from cybersecurity threats include, but are not limited to, the following: • The members of the information technology team actively monitor threats to the information technology environment. They work with a third party to provide additional 24/7 monitoring of cyber threats. These internal and external cybersecurity teams are empowered to contain network access through various application controls. Structural protections are also in place to mitigate risks of end point failures and provide for continuity of operations. • The Company uses various systems to manage threats, for example, firewall protections, anti-virus protections, vulnerability scans, among others. Such systems are regularly reviewed for adequacy and potential enhancements. • The Company employs an information security and training program for our employees, including regular internal communications and ongoing end-user testing to measure the effectiveness of our information security program. • The Company utilizes a third-party service that provides real-time threat intelligence feeds and global threat data to enhance threat detection capabilities and proactively defend against emerging cyber threats. • We monitor the location of our geographic location of data sent to third party systems.

companyName: Volato Group, Inc.

ticker: SOAR


text: Our CISO has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional. Our CISO manages the Company's information security and oversees our data security personnel and our incident response and business continuity management programs to assess and manage the cybersecurity element of our risk management program, including policies, cybersecurity training, security operations and engineering, cyber threat detection and incident response. Our CISO promptly informs and updates the Board about any information regarding security incidents that may pose a significant risk to the Company.

companyName: VSE CORP

ticker: VSEC