text: The Governance Committee of our Board of Directors oversees the Company's guidelines, policies, and processes to assess and manage the Company's exposure to risks, which include cybersecurity risks. The Committee meets periodically with management to review and discuss major financial risk exposures, including from cybersecurity threats, and the steps management has taken to monitor and control those exposures. As necessary, our Cybersecurity Incident Management Team ("CIMT") (described below) reports significant cybersecurity threats and incidents to the Governance Committee. The Governance Committee is also periodically briefed by management, including our Chief Digital Officer ("CDO"), with respect to our cybersecurity posture to facilitate its role in overseeing the Company's overall cybersecurity program.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: The Board of Directors has responsibility for oversight of risks from cybersecurity threats. The Board receives a quarterly report from the Chief Information Officer and Chief Information Security Officer on risks from cybersecurity threats and, under the Company's incident reporting plan, the Board is informed by management of certain cybersecurity incidents as appropriate. In 2023, the Board participated in a facilitator-led training and simulation of an information security incident.

companyName: Primerica, Inc.

ticker: PRI

secItem: Item 1C


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, practices and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including: incident management processes (for both internal and third-party hosted systems), maintaining certain security certifications, encryption of certain data, network security controls, access controls, physical security, asset management (such as tracking and disposal), systems monitoring, vendor risk management processes, employee training, penetration testing, dedicated cybersecurity staff, and cybersecurity insurance.

companyName: PetIQ, Inc.


text: Our CTO has over 20 years of technology and cybersecurity-related experience. Prior to joining the Company, he was Vice President of Operations & Security at Linode, where he led systems engineering, information security & compliance, hardware research & development, and project/product management, and previously held senior positions at GE and GE Digital. He received an M.B.A from Penn State University and a B.S. in Information Sciences & Technology from Penn State University.

companyName: Hamilton Lane INC

ticker: HLNE


text: The Utilities' cybersecurity program adopts security measures designed to protect the confidentiality, integrity, and availability of information technology systems, network infrastructure and other assets. The Utilities' security measures, such as awareness and training, monitoring, etc. are designed to prevent, detect, and minimize the effects of a cybersecurity incident. These measures are periodically evaluated and audited against the NIST CSF by internal audit and independent third-party cybersecurity specialists.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Risk Assessment: Management conducts annual cybersecurity risk assessments to identify and evaluate potential threats and vulnerabilities. Management considers the likelihood and potential impact of various cybersecurity risks, considering the Company's assets, systems and operations, in order to prioritize mitigation efforts.

companyName: DallasNews Corp


text: Horace Mann's CISO has more than two decades of experience in IT, including network, infrastructure, and cybersecurity. Before coming to Horace Mann, he led perimeter security at a publicly traded company, and the cybersecurity team of more than 150 members at another publicly traded company. In addition to the CISO, our internal cybersecurity team also works with third-party cybersecurity vendors to both mature the cybersecurity program and assess, monitor, and respond to cybersecurity threats.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: Cybersecurity risk management is an important part of and is integrated into our overall enterprise risk management framework, with cybersecurity risks being among the core enterprise risks identified for oversight by our Board of Directors (the "Board") through our annual enterprise risk assessment. We maintain an enterprise-wide cybersecurity risk assessment program and framework that is designed to identify, assess, and manage cybersecurity risk, vulnerabilities, and threats. The foundation of our cybersecurity program is based on the International Organization for Standardization (ISO) and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In alignment with the concepts and principles articulated in these standards, we have implemented controls related to cybersecurity threats and incidents including monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying, and managing material cybersecurity risks, we: • Leverage technology solutions to provide protection for our assets and detect threats in our environment; • Regular vulnerability assessments and penetration testing to identify, assess, and remediate weaknesses; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery policies and procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing designed to ensure that the Company's mission-critical systems are recoverable, in support of our business continuity needs; and • Work with each of our business and corporate groups with our internal cybersecurity program to integrate cybersecurity requirements into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, executive management, as well as our Board, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Autoliv combines expertise from our internal cybersecurity function with additional specialist capacities from external consultants and partners as may be from time to time. Separately, because we understand the risks associated with engaging third party vendors, such as service providers, consultants and partners, in our cybersecurity risk management processes, we conduct security assessments pre-engagement and monitor their work to mitigate any identified risks.

companyName: AUTOLIV INC

ticker: ALV


text: During the contract review and vendor engagement process, we assess vendors' adherence to appropriate security practices, requirements, and expectations, including compliance with industry standards and applicable laws and regulations. We also engage a third-party to monitor certain service providers so that we may be alerted of important events that would impact such party's risk profile. We have an Information Security Awareness program which seeks to educate our employees on security risks and best practices through training, internal communications, and security awareness campaigns. We maintain cybersecurity insurance coverage that may protect us from losses in connection with certain cybersecurity incidents.

companyName: AUTOZONE INC

ticker: AZO


text: The Cybersecurity Program includes controls designed to identify and perform diligence on third parties as they are leveraged by Roper's businesses in their respective software code development processes or for other purposes that require third-party access to critical infrastructure. The controls include, as appropriate, regularly assessing management of access controls and the cybersecurity risks posed by third parties.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: We assess our information technology, or IT, environment against the NIST Cybersecurity Framework, as well as various cyber-attack vectors, working to identify and remediate risks. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, for example, by enforcing single sign-on or multi-factor authentication where supported, and the use of mobile device management to secure company resources on employee personal devices. Additionally, we engage third-party cybersecurity experts to assess the security of our network and perform continuous system monitoring, and we engage a third party to perform internal audits of our IT General Controls, or ITGCs. We have implemented certain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, for example, by evaluating such service providers' own cybersecurity processes and reviewing available certification and audit reports, including International Organization for Standardization, or ISO, certifications for information security management systems, and System and Organization Controls, or SOC, reports.

companyName: LeonaBio, Inc.

ticker: LONA


text: We engage third-party cybersecurity firms to support our in-house cybersecurity initiatives and provide additional expertise with respect to our cybersecurity programs. Such firms are overseen by our General Counsel and Chief Information Security Officer and provide the following services: • On an annual basis, conduct penetration testing to evaluate the susceptibility of our information systems to cybersecurity threats and the effectiveness of our cybersecurity program; • On a biennial basis, conduct a comprehensive "tabletop" exercise to evaluate our incident response policies and procedures and provide relevant experience for our employees tasked with executing such response; and • On a biennial basis, conduct a cybersecurity assessment based on the National Institute of Standards and Technology's Cybersecurity Framework.

companyName: EMCOR Group, Inc.

ticker: EME


text: We have implemented various security measures and controls to protect our systems and data from unauthorized access, use, or disclosure, such as firewalls, encryption, authentication, backup, and recovery, both internally and with our third party managed service provider. We also have established policies and procedures to monitor and respond to cybersecurity incidents, and to comply with applicable laws and regulations regarding cybersecurity and data privacy. We regularly review and update our security measures and controls to address the evolving nature and sophistication of cybersecurity threats. We also provide training and education to our employees and customers on cybersecurity awareness and best practices. In addition, we maintain cyber liability insurance coverage to mitigate the potential financial impact of cybersecurity incidents. Furthermore, internal and external auditors and regulators periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: Role of Management RPC's cybersecurity program is overseen by the Chief Information Officer (CIO) as well as several key members of RPCs Enterprise Technology team including the Principal Security Architect. These key leaders collectively have over 50 years of experience in network security, cybersecurity and enterprise risk management. The Chief Executive Officer and CIO receive regular updates on cybersecurity matters, results of mitigation efforts related to existing risks and cybersecurity incident response and remediation. These leaders communicate closely with members of RPCs Information Security Committee (ISC) which oversees the adopted CIS Control Framework, governs the Company's information security programs and ensures the effectiveness of the Company's cybersecurity and technology risk management practices. In addition, ISC provides oversight to ensure that security strategies are aligned with business objectives. T he Company also maintains business continuity and disaster recovery plans. RPC performs scheduled tabletop exercises periodically to evaluate the resilience of its cyber crisis processes, tools, and proficiency in responding to cyber attacks from both a strategic and technical response perspective.

companyName: RPC INC

ticker: RES


text: The Company partners with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes, including third-party review of the Company's Information Security Management System for ISO 27001 controls, assessment of the Company's cloud products and managed services according to the American Institute of CPAs (AICPA) Service Organization Control (SOC) Audit Type II, and new product validation as part of the Company's secure development lifecycle. The Company additionally engages third-party providers in support of endpoint detection and responses, data loss prevention efforts, and incident management efforts.

companyName: NetApp, Inc.

ticker: NTAP


text: While our full board of directors has overall responsibility for risk oversight, it has delegated to the Audit Committee oversight of our risk management process. Our Audit Committee is committed to regularly reviewing, advising and overseeing the effectiveness of our cybersecurity and data protection programs and practices, including controls, policies and guidelines, security strategy and technology planning, compliance, and preparedness and incident response planning. The Audit Committee reports to the full board of directors when a cybersecurity matter rises to the level of a material or enterprise level risk.

companyName: INSTRUCTURE HOLDINGS, INC.


text: Third-Party Management: We screen vendors, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented users of our systems.

companyName: CEVA INC

ticker: CEVA


text: We believe each of Synovus' employees has a role in the Company's cybersecurity defenses. Employees at various levels and in various lines of business and support functions participate in training programs on cybersecurity and social engineering to mitigate risk, including required annual training, quarterly training on critical topics, and bimonthly security awareness communications. We conduct exercises to test their effectiveness on a monthly basis.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: Cybersecurity risk is part of management's risk oversight, although periodic reports are made to the board of directors of management's implementation and monitoring of our cybersecurity risks programs. Our board of directors addresses our cybersecurity risk management as part of its general oversight function, and the board receives periodic reports from management on the results of our tabletop exercises designed to test our response to cybersecurity and other business interruption situations. Management will update the board, as necessary, regarding any significant cybersecurity incidents should they occur, following the controls and procedures laid out in our business continuity, disaster recovery, data breach and crisis management plans that are designed to ensure prompt escalation of certain cybersecurity incidents, so that decisions regarding public disclosure and reporting of such incidents can be made by management and the board in a timely manner.

companyName: Cambium Networks Corp

ticker: CMBM


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of the board of directors oversight of cybersecurity risks. The audit committee oversees management's implementation of our cybersecurity risk management program.

companyName: FIGS, Inc.

ticker: FIGS


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances in accordance with the incident response policy, including the CTO, CFO, CEO, and others. Our information security function, together with our CTO, works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the cybersecurity subcommittee of the board of directors' audit committee for certain cybersecurity incidents in accordance with the incident response plan. The cybersecurity subcommittee receives periodic reports from the CTO, which reflect input from the third-party service provider, concerning the Company's risk profile, including significant cybersecurity threats and risk and the processes the Company has implemented to address them. The cybersecurity subcommittee also has access to various reports, summaries and presentations related to cybersecurity threats, risk and mitigation.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Information systems and other technologies, including those related to the Corporation's information and operational technology systems, and its technical and environmental data, are an important part of the Corporation's business activities. We must comply with certain elevated contractual requirements, including those related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the United States Department of Defense ("DOD"). We continue to implement cybersecurity processes designed to align with DOD requirements, instructions and guidance and work with the DOD as needed to assess cybersecurity risk and on policies and practices aimed at mitigating these risks. Accordingly, the Company maintains processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity attacks, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report on Form 10-K, we are not aware of any such incidents that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. However, future threats could materially affect our business strategy, results of operations or financial condition. Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled "Risk Factors—Risks Related to Our Business—Data security breaches, or real or perceived errors, failures or bugs in our systems, website or app could impair our operations, compromise our confidential information or our customers' personal information, damage our reputation and brand, and harm our business and operating results."

companyName: Root, Inc.

ticker: ROOT


text: Cybersecurity is a critical component of our overall risks given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and is a member of the enterprise risk management organization, reporting directly to the Chief Risk Officer and regularly reports on the state of the program to the Information Security Committee and the Risk Committee of the Board of Directors. In addition, the CISO works in conjunction with the Chief Information Officer ("CIO") and Chief Technology Officer ("CTO") to address technology strategy, controls, and processes to ensure the security of the network, data, and services for the Bank. The CIO reports Information Technology activities through the Information Technology Steering Committee and the Bank's Board of Directors.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Ongoing Evaluation and Assessment of Systems and Processes. We routinely evaluate our IT systems and infrastructure, including with respect to system security, and regularly implement upgrades to improve system functionality and performance as well as to enhance security. Security controls are routinely assessed by our annual general controls audit and other audits and assessments as well as a thorough assessment performed during the annual cyber insurance application process. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise.

companyName: EASTMAN KODAK CO

ticker: KODK


text: Management Oversight At a management level, our cybersecurity program is led by our Vice President, Global Cybersecurity who oversees a team with extensive knowledge and expertise. He is a Certified Information Security Professional and has over 20 years of cybersecurity experience and reports to our Chief Information Officer, who reports to our Chief Executive Officer. Our Vice President, Global Cybersecurity also chairs our Cybersecurity Management Committee which consists of senior business and functional leaders, including our Chief Information Officer and General Counsel. The Cybersecurity Management Committee is intended to provide cross-functional support for cybersecurity risk management.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: CEO and CFO supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include ensuring routine briefings from internal security personnel, obtaining threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and providing Company personnel with alerts and reports produced by security tools deployed in the IT environment.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Through the Company's enterprise risk management program, the Board is responsible for overseeing cybersecurity, information security, and IT risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. The Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and IT risks. As appropriate, the Board or Audit Committee reviews and discusses with management the Company's procedures and practices as well as any potential identified incidents with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Executive Vice President, Operations is responsible for keeping the Board apprised of cybersecurity incidents and the Board is charged with determining the materiality of such incident.

companyName: Sitio Royalties Corp.


text: Cybersecurity is a significant and integrated component of Winchester Bancorp's risk management strategy, designed to protect the confidentiality, integrity and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. As a proactive measure, the Company maintains insurance coverage for cybersecurity incidents experienced by the Company, however, such insurance coverage may not be sufficient to cover all losses incurred. During the year ended June 30, 2025, we did not, to our knowledge, experience a cybersecurity incident materially affecting or reasonably likely to materially affect the Company. Risk Management & Strategy (Scope)

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity".

companyName: AVENUE THERAPEUTICS, INC.

ticker: ATXI


text: An array of protective technologies have been implemented to detect and respond to indicators of malicious behavior before an incident ever takes place; however, should a cybersecurity incident occur, the Company has incident response and recovery procedures, which include determination of materiality and proper notification and reporting to the appropriate parties. These include legal and regulatory reporting requirements as well as notifications to impacted customers. The Company collaborates with peer financial institutions, local universities, threat intelligence organizations, third-party providers, law enforcement and our customers to share tactical threat intelligence and best practices in protecting against emerging threats.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: The cybersecurity and data protection program at Littelfuse is based on foundational principles outlined in applicable industry and internationally accepted-cybersecurity frameworks. The Company has experienced and will continue to experience cyber-attacks, attempts to breach its systems, and other similar incidents, however we do not believe that the prior cyber incidents have materially affected or currently are reasonably likely to materially affect the Company. Littelfuse faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows, or reputation. Like all cybersecurity programs, there is no guarantee that every attack method and technique has been fully addressed, as these change constantly, but Littelfuse is diligent in its attempts to protect data of the Company and its stakeholders.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Our CISO, who holds advanced qualifications and has extensive experience in cybersecurity, leads a global team of cybersecurity professionals. Our CISO reports to our CIO who is responsible for the Company's technology, data and information management strategy, and brings over two decades of relevant experience to the role.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Risks Related to Kodak's Business and Operations—Cyber-attacks or other data security incidents that disrupt Kodak's operations or result in the breach or other compromise of proprietary of confidential information about our workforce, our customers, or other third parties could disrupt our business, harm our reputation, cause us to lose customers, and expose us to costly regulatory enforcement and litigation, any of which could lead to material adverse effects on Kodak's results of operations, business and financial condition" in this Form 10-K.


text: The Company maintains controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Audit Committee in a timely manner.

companyName: Sleep Number Corp

ticker: SNBR


text: Our information security program leverages components from industry frameworks and generally recognized best practices, including International Organization for Standardization 27001 and National Institute of Standards and Technology ("NIST") standards, such as the NIST Cybersecurity Framework, which emphasizes identification, protection, detection, response and recovery. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors. We also collaborate with thought leaders in cybersecurity including with key vendors, clients, business partners, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and improve the effectiveness of our information security policies and procedures. This collaboration allows us to rapidly adopt industry best practices developed through firsthand experience mitigating cyber incidents. Our program also includes processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.

companyName: INSIGHT ENTERPRISES INC

ticker: NSIT


text: The Company's Audit Committee of our Board of Directors is charged with specific responsibility for overseeing risks from cybersecurity threats. Our Data Protection Officer provides the Audit Committee with quarterly reports on cybersecurity risks and any material cybersecurity incidents. In addition, our Data Protection Officer provides semi-annual reports directly to our Board of Directors. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.

companyName: THOR INDUSTRIES INC

ticker: THO


text: Cybersecurity risk management is integrated into our broader Enterprise Risk Management ("ERM") framework to promote a Company-wide culture of awareness and proactive risk management. Our ERM framework is overseen by the Audit Committee and Board of Directors. Our Chief Information Officer ("CIO") and Vice President of IT Infrastructure and Security ("VP IT") are responsible for updating the Audit Committee and Board of Directors on Embecta's cyber risk. The CIO and VP IT have oversight of cybersecurity strategy, policy, standards, architecture, and processes that protect Embecta's enterprise network, Information Systems and information assets, and product technologies. The ISRC oversees our cybersecurity governance and manages various controls, ensuring accountability at all levels of the organization, including senior management and the executive leadership team. The ISRC meets quarterly, oversees enterprise and cybersecurity risk management and reports to the ERM team and the Audit Committee. These committees receive updates on cybersecurity-related topics throughout the year including any major cybersecurity incidents. Additionally, the Board of Directors receives periodic updates on information security and cybersecurity matters from our CIO and VP IT.

companyName: Embecta Corp.

ticker: EMBC


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. Delek has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention designed to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.

companyName: Delek US Holdings, Inc.

ticker: DK


text: We have implemented processes that are intended to assess, identify, manage and reduce cybersecurity risks. We maintain a global incident response plan and disaster recovery management plan, each designed to protect against, identify, evaluate, respond to and recover from an incident. These plans anticipate an array of potential scenarios and provide for the assembly of a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that may be composed of both company personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available.

companyName: Renalytix plc

ticker: RNLXY


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the heading "Risk Factors" in Part I of this Annual Report on Form 10-K, including the risk factor titled "If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects."

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Security Awareness Education. Understanding the need for regular cybersecurity training, we have instituted a mandatory training program for all employees.

companyName: Archer Aviation Inc.

ticker: ACHR


text: The Risk Committee monitors the quality and effectiveness of the Company's information technology security, and at least annually reviews, appraises, and discuss with management the quality and effectiveness of the Company's information technology security, data privacy, disaster recovery capabilities and cybersecurity and related risks. Additionally, the IT Committee reviews quarterly reports regarding the information security program and technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: The Board exercises its oversight of material risks from cybersecurity threats through the Board's newly established Cyber Risk Committee. Per its charter, the Board's Cyber Risk Committee oversees the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the related security, confidentiality, availability, recoverability, integrity, and disaster or incident response programs. It coordinates with the Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee on cross disciplinary issues such as cybersecurity.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: The Board of Directors and the Audit Committee oversee management's efforts to address cybersecurity and information security risks. Senior management provides the Board of Directors updates on the Company's cybersecurity program at least once a year, including as part of the Company's enterprise risk management assessment, and the Audit Committee reviews the cybersecurity program at least twice a year and on an as-needed basis. Such reviews, among other things, include the results of internal and/or external assessments, a review of cybersecurity governance at the management level, and a review of the Company's cybersecurity program and progress toward various initiatives.

companyName: IDEX CORP /DE/

ticker: IEX


text: For a discussion of how risks from cybersecurity threats affect our business, see "Risk Factors—Failure to maintain the security of our information technology networks, or those of our third-party service providers, or data security breaches could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow" in Part I, Item 1A of this Form 10-K.

companyName: Hamilton Lane INC

ticker: HLNE


text: The Chief Security Officer (CSO) and his delegates meet with the Cybersecurity and Technology Committee at least quarterly to, among other items, review any cybersecurity incidents, review key risks and metrics on the Company's cybersecurity program and related risk management programs, and discuss the Company's cybersecurity programs and goals. The Cybersecurity and Technology Committee also participates in cybersecurity tabletop exercises with management and receives training on cybersecurity trends and developments. The Cybersecurity and Technology Committee updates the full board of directors at each quarterly board meeting, or more frequently if needed.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: The Audit Committee also oversees Matson's ERM program, which includes cyber and information security risks. The ERM process, which follows the Committee of Sponsoring Organization Framework, is designed to promote visibility to the Board and management of critical risks and risk mitigation strategies across various time frames, including the short-, medium- and long-term. Risk mitigation efforts are integrated into strategic plans and budgets. The Chief Financial Officer and the head of internal a udit review the Company's risk management activities with the Audit Committee and the Board on a regular basis. Management also regularly updates the full Board at and between Board meetings on the ERM program and other risk-related matters. In addition, executive sessions of the Board, which are led by the Lead Independent Director, have focused on certain risk oversight topics from time to time. The Lead Independent Director consults with the Chairman of the Board regarding risk-focused topics at Board meetings.

companyName: Matson, Inc.

ticker: MATX


text: Despite ongoing cyber-attacks, such as unauthorized access, phishing, and ransomware, we have not identified any cybersecurity incidents that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations, or financial condition. Our proactive security measures, alongside those of our third-party vendors, aim to protect our information technology systems and the sensitive data they hold. To bolster our cybersecurity posture, Transcat has engaged a third-party Managed Security Services Provider ("MSSP") to enhance our defensive capabilities. This partnership includes comprehensive vulnerability scanning both internally and externally to detect potential security weaknesses before they can be exploited. Our MSSP also provides round-the-clock monitoring through a 24x7x365 Security Operations Center ("SOC"), safeguarding our digital assets ("Endpoint Detection and Response - EDR"), identities ("Identity Detection and Response - IDR"), and integrating supplemental logging sources such as firewalls and Enterprise Resource Planning systems ("Extended Detection and Response - XDR"). Furthermore, we have established Incident Response as a Service ("IRaaS") to ensure rapid and effective action in the event of a security breach.

companyName: TRANSCAT INC

ticker: TRNS


text: The Advisor through the Resource Sharing Agreement utilizes external cybersecurity vendors and consulting firms to perform internal and external penetration testing, vulnerability assessments, and cybersecurity reviews. These independent evaluations assess the effectiveness of the Advisor's, and in turn the Company's, cybersecurity framework and risk management practices and help identify areas for continued focus and improvement.

companyName: 5C Lending Partners Corp.


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Technology Risk Management Committee, which is comprised of representatives from our business operations and support functions (e.g., legal, finance, internal audit, commercial, privacy), assesses cybersecurity risks based on probability and potential impact to key business systems and processes. Cybersecurity risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress on risk mitigation reported to the Technology Risk Management Committee and tracked as part of our overall risk management program, which is overseen by the Audit Committee of our board of directors.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: The Company's chief security officer is responsible for developing and implementing our information security program. Our chief security officer has more than 35 years of experience in technology, operations, information risk and security. Our chief security officer has deep experience developing comprehensive information security programs for large and complex organizations. He also brings extensive experience in both the military and the private sector and is a specialist in attack surface reduction, incident response and recovery, targeted threat hunting, forensics/malware analysis and threat group analysis.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use various means to assess cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors and ongoing due diligence with key third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available where applicable as part of our oversight of third-party providers.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: The Ares cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training, including for all of the employees of Ares. Ares' cybersecurity training programs also include annual certification requirements for employees of Ares with respect to certain policies supporting the cybersecurity program including the Information Security and Electronic Communications policy, Data Protection policy and Privacy Policy. Ares undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of Ares' and our critical third-party service providers and other partners. Ares also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: We utilize the United States National Institute of Standards and Technology, Cybersecurity Framework (NIST CSF) in considering the design and in assessing our processes. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: We understand the importance of maintaining an active cybersecurity risk management and strategy program. As an emerging technology company, we understand that we may face cyber threats that range from common cyberattacks, such as ransomware, to more advanced attacks such as advanced persistent threats perpetrated by nation-state actors and other highly organized actors. Our cybersecurity risk management program is guided by industry standards, such as the National Institute of Standards and Technology ("NIST"). We strategically partner with industry leading external vendors to perform cybersecurity assessments, as well as regular penetration testing to better understand our potential vulnerabilities, threat vectors, and impact on critical assets or operations. As part of these processes, our cybersecurity team identifies and prioritizes risks to devise our annual cybersecurity mitigation strategy and address operational risks. Our cybersecurity program is organized around the following key areas:


text: Our director of information security provides regular reporting (at least quarterly) to the Risk Committee and Technology Committee of our board of directors and our Management Committee, the Bank's highest-level governance, strategic planning, oversight, and policymaking group, on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, and more frequently if there is an ongoing cybersecurity incident. Our board of directors oversees our information security program through regular review of policies and principles, including our information security policy designed to establish clear management direction and commitment to preserve the confidentiality, integrity, and availability of all information technology assets, including data.

companyName: Federal Home Loan Bank of Boston


text: The Risk Committee of our Board of Directors, in coordination with our management risk committee, has primary responsibility for overseeing cybersecurity, information technology and information security systems, processes, policies and risk management and the effectiveness of security controls. At least quarterly, the Risk Committee meets with management and reviews reports related to the status of our information technology related risks, which includes information such as the status of our environment, employee education, penetration testing, server patching, systems availability, as well as debriefs of Company cybersecurity tabletop exercises, director education sessions on a variety of topics concerning cybersecurity, and annual assessment. The Committee also reviews the Chief Compliance Officer's quarterly report, which includes information regarding certain data security incidents that meet the risk criteria for inclusion in the report. Management also keeps the Committee apprised of changes in the threat landscape, such as new projects or strategies that may involve cybersecurity risks, evolving trends, and cyber incidents that involve our customers and suppliers.

companyName: Enact Holdings, Inc.

ticker: ACT


text: The Board receives regular updates from the Computer Security Incident Response Team ("CSIRT") to provide insight into significant cybersecurity risks, potential impacts on business operations, and management's strategies for identifying, monitoring, and mitigating these risks. This includes sharing results from assessments or audits of relevant processes.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: As part of our cybersecurity program, team members are offered cybersecurity training and participate in awareness programs including phishing simulation exercises, regular cybersecurity newsletters and reminders and programming and events during cybersecurity awareness month.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: The Information Security Program employs various information security controls, tools, and strategies to combat threats and to ensure the Company's information and systems remain secure. The Information Security Program contains specific provisions for identifying, assessing, and mitigating cyber threats, including but not limited to ransomware attacks, denial of service attacks, phishing and social engineering, data breaches, credential theft, and vulnerability exploitation.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Management directly responsible for assessing, measuring, and managing cybersecurity risks include the Chief Information Security Officer ("CISO") and the Chief Technology and Operations Officer ("CTOO"). The current CISO has more than 20 years of technology leadership experience, including significant direct involvement in cybersecurity efforts, and holds multiple industry certifications. The current CTOO has more than 25 years of experience in audit, risk, operations, and technology leadership, including previous roles as Chief Audit Executive and Director of Bank Operations. The CISO and CTOO regularly report cybersecurity risk information to the Board or a Board committee.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: UHS also has a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain and eradicate the issue, and then restore systems in the event of a major disruption. Regularly, UHS conducts tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve recovery practices. As part of these processes, UHS regularly engages with assessors, consultants, auditors, and other third parties to review UHS' cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the Head of Information Technology of Oxford Funds, manages the Company's cybersecurity program. The President and CCO of the Company oversee the Company's oversight function generally and rely on Oxford Funds' Head of Information Technology to manage the assessment and management of material risks from cybersecurity threats. The Head of Information Technology has more than 9 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for his oversight function as CCO to the Company for 9 years and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: Our cybersecurity team, consisting of the VP of Information Technology, Director of Information Security, and Director of Infrastructure, is principally responsible for managing our cybersecurity risk assessment processes, our security controls, mitigation process and our response to cybersecurity threats. The Company also participates in a cybersecurity risk insurance policy.

companyName: Clarus Corp

ticker: CLAR


text: The Audit Committee receives reports from the Executive Director of IT concerning our significant cybersecurity threats and risks, as well as the processes we have implemented that are designed to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: We recognize the critical importance of maintaining the trust and confidence of partners, shareholders, government agencies and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: The foundation of our cybersecurity program is based on the International Organization for Standardization (ISO) and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We routinely assess material risks from cybersecurity threats, including from any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. These risk assessments are designed to identify internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain safeguards intended to address and minimize identified risks and continue monitoring and testing the effectiveness of such safeguards.

companyName: Fabrinet

ticker: FN


text: We devote resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. Our cybersecurity risk management program is designed to help coordinate the Company's identification of response to and recovery from cybersecurity incidents across all consolidated entities. This includes rapid identification, assessment, investigation and remediation of incidents, as well as complying with applicable legal obligations, communicated promptly and effectively.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: The Company's Board of Directors provides oversight of the Company's cybersecurity risks through its Audit Committee. Three of the eight members of the Board of Directors, all Audit Committee members, possess skills related to information technology and cybersecurity. The Audit Committee reviews the Internal Audit team's cyber-related control audits to confirm that cyber risks are being appropriately managed and also reviews a periodic report produced by the CIO and CISO on the performance of the Company's cybersecurity program. In addition, the CIO and CISO present a comprehensive cybersecurity update to the full Board of Directors on at least an annual basis.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: On behalf of the Board, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee regularly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities, and compliance with cybersecurity and privacy laws and regulations. The Company's Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer briefs the Audit Committee quarterly, and more often, if necessary, on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: The AIMC meets with the Audit Committee on a quarterly basis and meets with the BOD at least annually. Additionally, the Audit Committee regularly meets with members of the Company's internal audit function to discuss risk management activities, compliance, best practices, and other related matters.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: The Audit Committee of our Board of Directors (the "Board") oversees our cybersecurity risk. The Audit Committee receives regular cybersecurity specific updates from management (including our Chief Security Officer ("CSO") and/or other key personnel), typically on a quarterly basis, about the prevention, detection, mitigation, and remediation of cybersecurity threats and cybersecurity incidents, as well as the evolving cybersecurity landscape, recent program enhancements and other relevant topics. The Audit Committee reports to our Board and a number of our Audit Committee and Board members have experience in assessing and managing cybersecurity risks. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee and/or the Board on an as-needed basis.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: Our cybersecurity risk assessment process helps identify our cybersecurity threat risks by assessing our cybersecurity program against industry and best practices standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and the Center for Internet Security ("CIS"), as well as by annually engaging experts to attempt to infiltrate/test our information systems (as such term is defined in Item 106(a) of Regulation S-K).

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Incident reports and issues identified from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our regularly scheduled Board meetings, the General Counsel and CRO, the SVP, Information Technology, the vCISO and the CEO regularly communicate regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the Board, ensures the Board's oversight is proactive and responsive. The Board of Directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Rhinebeck Bank. The Board of Directors closely reviews the annual vCISO report of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: We maintain what we believe are appropriate levels of cybersecurity insurance that covers settlements, judgments and defense costs arising out of a failure of network security, a privacy breach, media liability, business income loss resulting from a cyber event and for cyber extortion coverage. This cybersecurity insurance coverage also provides for the following breach response services in connection with incidents involving the theft, loss or unauthorized disclosure of third-party information and computer system security breaches: • Computer expert services (such as a cybersecurity firm to determine the existence and cause of an actual or suspected electronic data breach or a PCI forensic investigator in connection with investigations dealing with credit card data); • Legal services; • Notification services to provide notification to impacted individuals; • Call center services; • Breach resolution and mitigation services, including credit monitoring and identity theft monitoring; and • Public Relations and crisis management expenses.

companyName: Zumiez Inc

ticker: ZUMZ


text: To assess and manage cybersecurity threats from material risks, Dime maintains an Incident Response Team comprised of members from the major business areas in the Bank to ensure appropriate subject matter experts are represented. All cybersecurity events include a determination of whether the incident has materially affected or is reasonably likely to materially affect the Bank's business strategy, results of operations, or financial condition by following implemented processes. Dime has not identified any cybersecurity threats that have materially affected operations or financial position.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: While unauthorized persons have attempted to access our information systems in the past, and will likely continue to do so in the future, we have not, to date, identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information on these risks, see "Risk Factors—If we or our third-party service providers or vendors experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data or our platform, our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced and we may incur significant liabilities."

companyName: Braze, Inc.

ticker: BRZE


text: Our risk management process also assesses third party risks. We perform assessments to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers and potential fourth party risks when handling and/or processing employee, business, or customer data.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: If our efforts to maintain information security, cybersecurity, and data privacy are unsuccessful or if we are unable to meet increasingly demanding regulatory requirements, our reputation, results of operations, and financial condition could be adversely affected.

companyName: GROOVY COMPANY, INC.


text: We have partnered with third parties to support our information security systems and processes, and to help design, build, test, implement and maintain them. Annual risk assessments are conducted by third party consultants to help ensure that risks to our IT infrastructure are minimized or eliminated.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: In the ordinary course of business, the Company is subject to cybersecurity risks, which the Company manages as a component of its overall risk management strategy. The Company's management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. The Company has created a cybersecurity monitoring and reporting framework which is uses to respond to any potential cybersecurity risks. As part of this framework, the Company utilizes a third party vendor to provide network security and assist with protection against cybersecurity risks through network assessments, monitoring, and related activities. The Company's management continues to assess material risks from cybersecurity threats, its compliance policies, and its reporting framework in order to limit the risk posed by cybersecurity incidents.

companyName: Kingfish Holding Corp


text: contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company's response to a cybersecurity incident.

companyName: SKYX Platforms Corp.

ticker: SKYX


text: ACRES upholds a robust cybersecurity initiative, encompassing policies and protocols aimed at safeguarding its systems, operations, and entrusted data, including ours, from potential threats or risks. ACRES employs a range of protective measures within its cybersecurity framework including physical and digital access controls, identity verification, mobile device management software, employee training programs emphasizing cybersecurity awareness and best practices, tools for identifying abnormal activities, and vigilant monitoring of data usage, hardware, and software.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: The ISP has three core functions underlying its design, which are intended to provide Chegg with appropriate oversight and governance to execute, monitor, measure and report on the performance of the program in a consistent manner: • management (control owners) have a responsibility to own and manage risks associated with day-to-day operations, including the design, implementation, and ongoing operation of controls; • compliance and cybersecurity teams enable the identification of emerging risks in daily operation of our business, providing compliance and oversight in the form of frameworks, policies, tools, and techniques to support management; and • independent assessors provide objective evaluation by assessing whether the first and second functions above are operating successfully, providing assurance that controls are effective in both design and operation.

companyName: CHEGG, INC

ticker: CHGG


text: Collaborative Approach: We have implemented a broad, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In addition, we manage a cross-functional program across our engineering, manufacturing and technical services teams, together with our suppliers and channel partners, designed to ensure the proper security of our products from design through manufacture and shipment.

companyName: Fortinet, Inc.

ticker: FTNT


text: Cybersecurity is a dynamic and constantly evolving field. We are committed to continuously improving our cybersecurity posture by staying informed about emerging threats, adopting industry best practices, and integrating feedback from our assessments and incidents. Our goal is to maintain a resilient cybersecurity framework that protects our assets and supports our long-term business objectives.

companyName: VAIL RESORTS INC

ticker: MTN


text: The Cybersecurity Advisory Committee ("CAC") meets regularly and is responsible for overseeing management of the Company's cybersecurity risk. The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the CLO. The CAC is responsible for, among other things, setting the Company's governance structure for managing cybersecurity risk and reviewing noteworthy cybersecurity incidents and strategies to prevent recurrence. IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks. They also hold leadership positions outside of IBM in the field of cybersecurity, serving on governing and advisory boards of public and private institutions at the forefront of issues related to cybersecurity, including technology development, cybersecurity policy, and national security.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity, including immediate notification of any material cybersecurity events, and information technology matters and related risk exposures from our Executive Vice President of Technology as well as other members of the senior leadership team. The Board receives updates from management and the Audit Committee on cybersecurity risks.

companyName: NOODLES & Co

ticker: NDLS


text: Our Board of Director's Enterprise Risk Management Committee (the "ERMC") is responsible for the oversight of risks from cybersecurity threats. At least annually, the ERMC receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as anticipated emerging threats, cybersecurity posture, progress towards predetermined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer, Chief Information Officer, and Chief Privacy and Information Risk Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. Additionally, the Disclosure Committee periodically receives reports on cybersecurity threat risks to ensure that required disclosures are accurate and timely.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Management and Strategy our business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our business, meeting applicable regulatory requirements and maintaining the trust of our stockholders. Cybersecurity is an important and integrated part of our enterprise risk management function that identifies, monitors and mitigates business, help protect us from a major cybersecurity incident that could have a material impact on operations or our financial results, the Company is in the process of continually implementing policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we expect to take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include but are not limited to: penetration testing by a third-party vendor, agent-based security scanning that runs continuously, establishing information security policies and standards, implementing information protection processes and technologies, monitoring our information technology systems for cybersecurity threats and implementing cybersecurity training. The Company has reached SOC 2 Type 2 status which shows the Company's compliance with best industry practices. The SOC 2 Report has become a benchmark standard, and now an often-specified requirement, in the software procurement process. Established by the American Institute of Certified Public Accountants (AICPA), criteria and reporting principles are outlined as a means for organizations to create a documented framework of policies and procedures to prove how they manage and secure data in the cloud and ensure protection of customer privacy and ensure internal communications are suitably handled. This achievement reflects the Company's stated goals of best-in-class data protection and internal processes. In addition, we annually purchase a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.

companyName: Artificial Intelligence Technology Solutions Inc.

ticker: AITX


text: Our cybersecurity risk management program includes: • risk assessments and rating platforms that are leveraged to help identify material cybersecurity risks to our critical systems, information, services and our broader enterprise information technology environment; • a cybersecurity team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents through monitoring and identification activities; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • annual cybersecurity awareness training for employees and web and mobile developers, including responsible information security, data security and cybersecurity practices; • a computer incident response team ("CIRT") that leverage our cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents, escalating notifications and reporting requirements to regulatory bodies; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: Cybersecurity Risks The Company is currently not aware of any material cybersecurity incidents or threats that have impacted the Company or its business, financial condition, results of operations, employees or customers in the past fiscal year. However, the Company and its customers routinely face risks of Incidents, as the Company relies heavily on information technology systems. Although the Company makes efforts to maintain the security and integrity of the Company's information technology systems, these systems and the proprietary, confidential internal and customer information that resides on or is transmitted through them are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that the Company's security efforts and measures and those of the Company's third-party providers will prevent breakdowns or incidents affecting the Company's or the Company's third-party providers' databases or systems that could adversely affect the Company's business.

companyName: ROBERT HALF INC.

ticker: RHI


text: We conduct periodic cyber risk assessments and assessments of our operational-technology network. We use these risk assessments together with risk-based analysis and judgment to determine which security controls to use to address identified risks. We also complete internal and external testing of software, hardware, defensive capabilities and other information security systems as advised by industry standards, and we use the test results to address identified vulnerabilities. We regularly conduct cyber threat exercises, which help us identify and address any gaps in our incident response plan. These exercises also help us practice sound decision-making skills to enhance our ability to react effectively during a material cyber event.

companyName: NuStar Energy L.P.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. Finally, all users employed by or contracted to the Company are required to complete annual cybersecurity education and training, which includes identifying suspicious emails, internet threats, telecommunication threats and ransomware.

companyName: TruBridge, Inc.

ticker: TBRG


text: We regularly assess, identify, and manage material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: As of the date of this Annual Report on Form 10-K, cybersecurity threats, including the results of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations or financial condition. While we have no knowledge of any material data security breaches to date, any compromise of our data security could result in a violation of applicable privacy and other laws or standards, significant legal and financial exposure beyond the scope or limits of our insurance coverage, interruption of our operations, increased operating costs associated with remediation, equipment acquisitions or disposal, added personnel, and a loss of confidence in our security measures, which could harm our business, athlete experience, reputation or investor confidence. See Item 1A. "Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: DICK'S SPORTING GOODS, INC.

ticker: DKS


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report. We maintain a cyber liability insurance policy. However, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.

companyName: SinglePoint Inc.

ticker: SING


text: In an effort to detect and defend against cyber threats, the Company annually provides its employees with various cybersecurity and data protection training programs. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents promptly.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: As a global leader in CRM technology, our services involve the storage and transmission of our customers' and our customers' customers' data. As such, we have in the past been, and likely will in the future be, the target of cybersecurity threats and other efforts to breach or compromise our services and underlying infrastructure. With trust as our foremost value and the foundation of everything we do, we recognize the importance of maintaining the safety and security of our systems and data.

companyName: Salesforce, Inc.

ticker: CRM


text: Use of third-party software and services also exposes the Corporation to cybersecurity risk as numerous service providers host critical data or have direct contact with our bank customers. Although the Corporation adheres to industry standard practices in conducting thorough due diligence of vendors and contract management, should a vendor experience a breach the bank could still suffer reputational harm, and potentially financial losses. Expanded use of cloud-based technologies and providing our customers more internet-based product offerings to continue to remain competitive will serve to increase these potential risks. The Corporation's third party risk management program helps to mitigate risks posed by reliance on third and fourth parties. Governance of third parties includes a due diligence and risk assessment prior to contract execution, with oversight completed based on a frequency defined by the third parties risk profile.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: We are not aware of any cybersecurity threats or incidents that have materially impacted us during the fiscal year ended September 30, 2025, or that are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. We routinely face risks of cybersecurity incidents, whether through attempted or actual: cyber-attacks or cyber intrusions, ransomware and other forms of malware, computer viruses, attachments to emails, individual or brand impersonation, phishing, extortion or other scams. Although we make efforts to maintain the security and integrity of our systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a cybersecurity incident or disruption, and there can be no assurances regarding the effectiveness of our security efforts and measures or those of our third-party providers who have access to, transmit, or store such data. For additional information regarding our cybersecurity risks, see our risk factors under Item 1A in Part I of this Annual Report.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: Our cybersecurity program is led by our senior vice president, chief information security officer ("ciso"), who is responsible for identifying, assessing, and managing our collective information security and technology risks. Our ciso has more than 20 years of experience in the information security and technology fields. The ciso reports to our executive vice president, chief technology officer, who has spent more than 25 years of service in various leadership roles in information technology across multiple Fortune 500 companies.

companyName: STARBUCKS CORP

ticker: SBUX


text: The Information Security Office conducts company-wide cybersecurity training, including through an annually required course of online training modules and a continuous email phishing test campaign. In addition, the CISO leads an annual cybersecurity tabletop exercise with company leadership to continually improve the organization's preparedness for cyber incidents. These exercises consider real-world events that could impact the business and seek to fine-tune response activities in an effort to minimize future cybersecurity incident impacts.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: These processes are overseen by our Chief Technology Officer, who has over 30 years of experience consulting and leading technology teams at several global multi-unit brands, including Blockbuster, FedEx, and Yum! Brands.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: Our associates and contractors play a vital role in the safeguarding of systems and data. All are required to complete annual security awareness training to ensure they stay current on best practices and emerging cyber threats. We also conduct routine phishing exercises to help associates and contractors recognize and appropriately respond to suspicious emails. Supplemental training is provided throughout the year to individuals and teams with elevated-risk profiles.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Moatable, Inc.

ticker: MTBLY


text: The CISO then conducts a preliminary analysis of the incident and determines whether activating the full IRT is warranted. Types of incidents that would generally require the activation of our IRT include but are not limited to a breach of personal information, a denial-of-service (DoS) or distributed DoS attack, excessive port scans, a firewall breach, or a virus or malware outbreak.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks is overseen by our Chief Information Officer (CIO). Our CIO has maintained certification as a Certified Information Security Manager since 2006 and brings extensive experience in information technology and in-depth knowledge in developing and executing our cybersecurity strategies. At the direction of the Board of Directors, our management has developed a cybersecurity policy which includes the establishment of, and ongoing monitoring by, a cybersecurity steering committee led by the CIO and comprised of executives from key departments, including legal, finance, accounting, operations, engineering and human resources. The committee meets quarterly and on an as-needed basis and is charged with overseeing and assisting the information technology department in directing cybersecurity activities to protect the Company, including its operations, systems and related information. It also oversees and reviews policies, procedures, and internal controls for cybersecurity as well as the cybersecurity risk management program.

companyName: ITC Holdings Corp.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CISO of the Adviser, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's compliance program and relies on the Adviser's CISO and the Adviser's CCO to assist with assessing and managing material risks from cybersecurity threats. The Adviser's CISO has 10 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's CCO has been responsible for this oversight function as CCO to the Company for 1 year and has worked in the regulatory and financial services industry for over 30 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Barings BDC, Inc.

ticker: BBDC


text: The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology.

companyName: Phillips 66

ticker: PSX


text: To date, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation, interfere with the progress of our clinical trials, interfere with our efforts to pursue regulatory approvals for our product candidates, or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. We have attempted to preemptively mitigate the financial impact of any cybersecurity incident and currently maintain a cyber liability insurance policy. However, our cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations. For further information regarding risks from cybersecurity threats, please refer to "Item 1A. RISK FACTORS—Risks Related to Our Business."

companyName: Pulmatrix, Inc.

ticker: PULM


text: We employ various processes and controls to aid in our efforts to identify, assess, and manage our material risks from cybersecurity threats and to protect against, detect, and respond to cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, we consider and gather information with respect to the confidentiality, integrity, and availability of our information systems (as defined in Item 106(a) of Regulation S-K). We have adopted policies and procedures that are designed to assist us with managing identified risks at a system and organizational level and with assessing the materiality of the risk, its severity, and potential mitigations or remediations. Our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: In addition, our management team, comprised of senior staff and executives from multiple departments within the Company, including IT, finance, legal, and operations, leads all efforts for our overall cybersecurity risk management program and supervises both our internal information security personnel and our retained cybersecurity consultants.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: Our Board has overall oversight responsibility for our risk management, including our cybersecurity risk management. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored. We have not experienced any cybersecurity incidents in fiscal year 2025.

companyName: Minerva Gold Inc.

ticker: MINR


text: We do not believe we have experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial conditions, including in Fiscal 2025. However, cyber threats continue to evolve, and there can be no assurance that the actions and controls we have implemented and are implementing will be sufficient to protect our systems, information, or other property. While we maintain cybersecurity insurance to protect against potential losses arising from security incidents, the costs related to threats or disruption may not be fully insured.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: Failure to comply with cybersecurity regulations could result in financial penalties, legal liabilities, and reputational harm. The Company conducts regular compliance reviews to ensure alignment with evolving regulatory requirements. •24/7 monitoring for cybersecurity threats. • Real-time threat detection and forensic investigation tools. • Collaboration with third-party security firms for penetration testing. This plan ensures that cyber threats are identified, contained, and mitigated efficiently.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Board of Directors has the ultimate oversight of the Company's risks—including cybersecurity risks—with our Audit Committee assisting the Board of Directors in its oversight of cyber and information security risks. Members of management that possess information security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates on our cybersecurity program from management on a regular basis and more frequently as determined to be necessary or advisable. Updates to the Audit Committee include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the Board of Directors at least annually. Finally, in the event a material cybersecurity incident were to occur, the CEO and Vice President of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident and making the determination of materiality and any related disclosure.

companyName: HARROW, INC.

ticker: HROW


text: Risks from Cybersecurity Threats Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: To minimize our risk and exposure to material cybersecurity incidents, we also conduct company-wide annual and ongoing cybersecurity awareness training and education of our employees. This includes but not limited to topics such password hygiene, phishing, and other cybersecurity-related information. In addition to performing an annual risk assessment and developing a detection and mitigation plan, along with a comprehensive review and update of our cybersecurity and data privacy policies and procedures, we continuously evaluate new and emerging risks and ever-changing legal and compliance requirements. Our comprehensive information security program includes agreements with third-party cybersecurity partners for continuous monitoring, alerting, and response. To supplement our cybersecurity and data privacy risk assessment, identification, management and mitigation efforts, we regularly consult with third-party experts, which include the following services: • conduct annual cybersecurity and data privacy risk assessments; • conduct external and internal penetration tests; • monitor critical infrastructure for abnormal behavior; and • provide validation of the Company's cybersecurity and operations processes against the National Institute of Standards and Technology cybersecurity framework.

companyName: DIODES INC /DEL/

ticker: DIOD


text: We rely on a multidisciplinary team including third-party service providers to assess how identified cybersecurity threats could impact our business. The Company's cybersecurity function is managed by the Company's Chief Financial Officer, who assumes the overall responsibility and accountability of the function and with select members of the Company's management is collectively responsible for the day–to–day assessment and management of cybersecurity risks, their prevention, mitigation, detection, and remediation. Our Chief Financial Officer and other members of management have undergone various briefings from our cybersecurity advisory firm to prepare them to effectively assess and manage material risks from cybersecurity threats. Additionally, members of the third-party service providers have cybersecurity experience and/or certifications.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: In 2024, we hired a new Chief Information Security Officer to oversee the cybersecurity program and lead the Information Security team. Our CISO has over 17 years of experience building security teams and driving security initiatives for public, high-growth, and regulated companies. He is a Certified Information Systems Security Professional and reports to our Senior Vice President and Head of Engineering.

companyName: Compass, Inc.

ticker: COMP


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The information security function is led by our CISO, under the direction of our CIO. Our CISO, who has been serving in this position since January 2020, has over 20 years of experience in information security and is a Certified Information Systems Security Professional. Our CISO maintains primary responsibility for developing cybersecurity strategies; cybersecurity governance; identifying, assessing and monitoring cybersecurity risks; preparing for and responding to cybersecurity incidents; verification and testing of cybersecurity; and disaster recovery governance. Our CISO may authorize specific Company associates to assist in managing these responsibilities if determined necessary, including the Crisis Response Team. Our CIO and CISO have oversight responsibilities of the Company's cybersecurity program.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI