text: Our Information Security team conducts annual information security awareness training for employees involved in our systems and processes that handle customer data and audits of our systems and enhanced training for specialized personnel. We also conduct cyber awareness training and simulate responses to cybersecurity incidents, and use the findings to improve our practices, procedures, and technologies. In 2024, as part of upcoming enhancements to security preparedness, members of senior management are scheduled to participate in tabletop exercises led by third-party experts on cyber incident response best practices to apply their learnings to the Company's business continuity management program. The Company provides security awareness education and training for all employees and consultants, conducts monthly internal "phishing" testing and mandatory training for "clickers," and publishes periodic cybersecurity newsletters to highlight any emerging or urgent security threats.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Third parties also play a role in our cybersecurity. We engage third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.

companyName: MANHATTAN BRIDGE CAPITAL, INC

ticker: LOAN

secItem: Item 1C


text: We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Assessments of our cybersecurity safeguards are conducted by independent cybersecurity vendors. Our internal Information Systems team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and cyber security software protection, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. • Incident Identification and Response: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. • Cybersecurity Training and Awareness: All employees and contractors are required to complete semi-annual cybersecurity awareness training. We also conduct periodic drills and simulated attacks—including simulated phishing exercises and other social-engineering tests—to reinforce training, evaluate user response, and assess the effectiveness of our cybersecurity controls. Employees who do not successfully complete these exercises are required to undergo additional, targeted training to address identified gaps and strengthen overall security readiness. • Access Controls: We endeavor to limit users' access to no more than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information. • Encryption and Data Protection: We endeavor to use appropriate encryption methods to protect sensitive data. This includes the encryption of customer data, financial information, and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.

companyName: OneWater Marine Inc.

ticker: ONEW


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any risks from cybersecurity threats for the reporting period covered by this report. However, institutions like us, and our service providers, have experienced cybersecurity events and data incidents in the past and will likely continue to be the target of cyberattacks and intrusions. For additional information on the cybersecurity risks we face, see "Part 1, Item 1A. Risk Factors–Cybersecurity risks and cyber incidents could adversely affect the Company's business and disrupt operations."

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: We recognize the ever-evolving nature of cybersecurity risks. Our cybersecurity risk management program leverages recognized industry standards and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework. MeridianLink also conducts periodic penetration testing and operates a bug bounty program to expose weaknesses in our applications, networks, and systems before they can be exploited by malicious actors. Our Governance, Risk, and Compliance, or GRC team, in close collaboration with our Security Operations and Engineering teams, monitors and mitigates evolving risks from cybersecurity threats, prioritizing alignment with our business objectives and operational needs. We view cybersecurity risk management as a shared responsibility, and at a management level, we periodically perform tabletop exercises which simulate real-world cyberattacks.

companyName: MeridianLink, Inc.


text: we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: Ispire Technology Inc.

ticker: ISPR


text: Our IT security department, led by our Senior Vice President (SVP) IT Infrastructure & Security, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our ISMS to support and promote resilient programs. This includes: • Enterprise security framework and cybersecurity standards; • Cybersecurity awareness and training plans; • Security assessments and monitoring; • Restricted physical access to critical areas, servers, and network equipment; • Incident response, crisis management, business continuity, and disaster recovery plans; and • Third-party IT vendor risk management process to identify, assess, and manage risks presented by our IT vendors and business partners.

companyName: FASTENAL CO

ticker: FAST


text: At least annually, we conduct cybersecurity risk assessments that consider information from internal stakeholders, known information security vulnerabilities, and information from external sources, such as reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessments are provided to our SSG and are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform our broader enterprise-level risk assessment. Key findings of these assessments are periodically presented to the Board and the Audit Committee.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Additionally, we conduct regular internal assessments and audits, complemented by insights from external experts. The outcomes of these evaluations are communicated to senior leadership. Based on these risk assessments, we redesign, implement, and maintain adequate safeguards to reduce identified risks, address gaps, and continuously assess the efficacy of these measures. Our engagement with our key partners, vendors, customers, industry stakeholders, and government bodies is ongoing, aiming to improve our information security policies and procedures over time. We aim to diligently manage risks related to cybersecurity threats from third-party service providers, including, when possible, requesting our service providers to report incidents that may compromise the Company's data.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: Prevention, Detection, and Response ZoomInfo has implemented preventative security and detection measures, including asset protection and access controls in the following key areas: • Critical Assets • Data Protection • Application Protection • Cloud Security • Network Security • End Point Devices • Perimeter Defense • Physical Protection We also maintain written incident response plans and conduct periodic cross-functional tabletop exercises to help assess our incident response plans, processes, and capabilities in addressing cybersecurity threats.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Cyber Risks, Threats and Incidents As a global company servicing customers in over 100 countries, we experience a variety of cybersecurity events and incidents. However, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; though there can be no assurance that a cybersecurity incident that could have a material impact on us will not occur in the future. For further details regarding the cybersecurity risks and uncertainties we face see "Part I, Item 1A. Risk Factors -Technology and Cybersecurity Risks" of this report.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: • Our CISO oversees the information security group and program within our IT department and holds a Bachelor of Arts degree in computer science. Our CISO has served in various roles in information technology for over 24 years within the financial services industry, including previously serving as Head of Information Security and Enterprise Infrastructure, Head of IT Audit and Chief Information Security Officer at other companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Our CTO oversees our IT department and holds a PhD in computer science, an MBA and Postgraduate Diploma in physics. Our CTO has served in various roles in information technology for over 28 years, including senior leadership roles for the investment banking division of a financial services company. • Our Head of IT Infrastructure oversees the infrastructure and service desk departments within our IT department and holds a Bachelor of Business Administration degree in finance and computer information systems. Our Head of IT Infrastructure has served in various roles in information technology for over 20 years.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Vice President of Finance and Treasurer is responsible for our insurance policies and reviews on a regular basis our cyber insurance policy with management to ensure we have appropriate coverage. We have business continuity, contingency and disaster recovery plans and procedures in place in the event of a cybersecurity incident. These plans are tested in conjunction with the Company's annual testing of our cybersecurity incident response readiness and reporting through tabletop exercises.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: The management team delegates responsibility for assessing and managing our cybersecurity risks to the CISO. The CISO has primary responsibility for our overall cybersecurity risk management and supervises both our internal cybersecurity personnel and any external cybersecurity consultants. The CISO has over two decades of security work that includes work for large global enterprises, managing global security teams, and establishing and running security programs for both conventional and high-tech companies, including publicly traded and regulated companies. The CISO reports to an internal security committee periodically regarding current security posture, risk, and trending security incidents and threats relevant to the Company. The security committee comprises key management personnel, department heads, and business unit leaders.

companyName: Lemonade, Inc.

ticker: LMND


text: Vulnerability Scans: Vulnerability scans are executed quarterly across the environment to proactively identify software weaknesses and vulnerabilities that could be exploited in a cybersecurity attack. Any identified vulnerabilities are promptly addressed.

companyName: DallasNews Corp


text: Our CISO has implemented a management-level governance structure and process to assess, identify, manage and report cybersecurity risks, and to manage our overall information security program. The Information Security Board, led by our CISO and comprised of leaders from all of our lines of business and key functional areas such as Global Risk Management, Privacy and Compliance, as well as members of our information security team, meets quarterly, and is responsible for overseeing our information security program, including our information security strategy and related policies and standards. The information security team manages cybersecurity risks and controls, and continually enhances a global security control framework with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously minimizing the business impact should an incident occur.

companyName: ASSURANT, INC.

ticker: AIZ


text: Our IT personnel, third-party service providers, and Board help identify, assess and manage the Company's cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's and industry's risk profile using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of potential threat environments, and evaluating threats reported to us.

companyName: Tracon Pharmaceuticals, Inc.


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer. Together with the Bank's Information Technology Committee, comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security Officer of the Bank works to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors receives training annually.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: We have not, to date, experienced a cybersecurity incident which was determined to be material, although, like any technology provider, we have experienced incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors under the heading entitled "Risks Relating to Privacy and Cybersecurity."

companyName: IMPINJ INC

ticker: PI


text: We also have management level committees and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The Cybersecurity Cross Functional Team (the "Cybersecurity CFT"), led by our CISO, brings together IT, legal, compliance and other function heads. The Cybersecurity CFT meets at least quarterly (or more frequently as needed) and provides a forum for these cross-functional members of management to: consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Gogo Executive Cybersecurity Committee (the "GECC") is comprised of executive leadership and members of the cybersecurity, operations, risk, legal, and internal audit teams. The GECC liaises with the Cybersecurity CFT and provides oversight of all aspects of Gogo's cybersecurity program and, at regular intervals through the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks. • The Incident Response Management Team (the "IRMT"), which includes senior executives and members of our cybersecurity leadership team, was established to support our incident response plan and reports into the GECC. Members of the IRMT are alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The IRMT annually assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. The IRMT also engages with the Company's Board and the Audit Committee depending on the severity of the cybersecurity incident.

companyName: Gogo Inc.

ticker: GOGO


text: Engagement of Third Parties The ERM Committee, internal audit function, information technology function and various other groups each occasionally engage third-party service providers to assist in their management of cybersecurity risk, including but not limited to cybersecurity vendors, assessors, consultants, auditors, and other third parties. The information technology function maintains processes to oversee and identify cyber risks associated with the Partnership's use of third-party service providers who may have access to sensitive Partnership data and systems.

companyName: CVR PARTNERS, LP

ticker: UAN


text: To further enhance security and prevent data breaches, our platform mandates the use of a.pem file for any connection to services within the platform, adding an extra layer of authentication. All client-server communications are encrypted using SSL (Secure Socket Layer), which ensures that all data transmitted over the internet is secure and protected from interception. Additionally, we employ AWS Shield for defense against Distributed Denial of Service (DDoS) attacks, which are increasingly common threats to online platforms. This comprehensive approach to security ensures that our platform remains resilient against attacks, protecting both our infrastructure and our users' sensitive information.

companyName: MANGOCEUTICALS, INC.

ticker: MGRX


text: Risk Assessment and Management As digitization and technological advancements continue to accelerate, the landscape of cybersecurity faces new challenges. Compass Minerals remains vigilant in our efforts to minimize risk by safeguarding systems and protecting private business, partner, and customer information. Protection of our digital assets requires strategically focused cybersecurity processes with persistent execution.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned or otherwise identified as potentially corrupt.

companyName: Criteo S.A.

ticker: CRTO


text: We have implemented processes for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management program. Our cybersecurity program is informed by the National Institute of Standards and Technology Cybersecurity Framework and other applicable globally recognized standards. We use a layered defense model, incorporating a wide range of technologies and practices in an effort to prevent, detect and mitigate threats. These measures include intrusion detection and prevention systems, multi-factor authentication, account management and access controls, encryption and endpoint protection tools. We also implement threat detection and response solutions. To address emerging threats, we employ automated monitoring, vulnerability scans and patch management processes, network monitoring and defenses, antivirus/antimalware protections and network segmentations. Regular assessments, such as penetration tests, security audits and table-top exercises, are conducted to identify vulnerabilities and promote incident response and risk mitigation. We also provide privacy and information security trainings for our employees on a recurring basis. From time to time, we engage auditors, assessors, consultants and other third parties to assist with assessing, identifying and managing cybersecurity risks, including assisting us to conduct some of the foregoing assessments. Our cybersecurity risk management processes also are informed by intelligence received from law enforcement and other governmental agencies, private sector intelligence networks, recognized cybersecurity and intelligence firms and other third-party sources, and as appropriate we engage outside counsel to advise on regulatory compliance and other cybersecurity risk management efforts.

companyName: Walt Disney Co

ticker: DIS


text: The CSO and CISO stay informed on information security risks through regular meetings on key cybersecurity projects and KPIs. Updates are communicated to the Global Security Steering Committee, which provides quarterly reports to the Board of Directors and to the Audit Committee.

companyName: NetApp, Inc.

ticker: NTAP


text: As previously disclosed, in June 2020, we were the subject of a ransomware attack on our network that briefly disrupted access to some of our systems. Although we did not pay the ransomware and did not incur any fines or settlements, we did incur out of pocket expenses costs related to this incident of $100,000. We have not encountered any other cybersecurity challenges that have materially impaired our operations or business.

companyName: CarParts.com, Inc.

ticker: PRTS


text: The Evergy Board has assigned primary oversight of cybersecurity risk to the Safety and Power Delivery Committee of the Evergy Board. At each Safety and Power Delivery Committee meeting, the CTO discusses the Evergy Companies' cybersecurity metrics and scorecard performance; global, industry and Evergy-specific cybersecurity news; third-party assessments of the Evergy Companies' cybersecurity program; and industry benchmarking results. The Safety and Power Delivery Committee meets regularly throughout the year and may meet more frequently or otherwise be informed of cybersecurity risk and incident information as needed. The Nuclear, Power Supply and Environmental Committee of the Evergy Board supports the Safety and Power Delivery Committee's review of cybersecurity risk limited to power supply resources. The CNO discusses with the Nuclear, Power Supply and Environmental Committee risks specific to Wolf Creek, including cybersecurity risk, at least twice per year. The CNO may inform the Nuclear, Power Supply and Environmental Committee of cybersecurity matters more frequently as needed. At least once each year, the Evergy Board receives a report from management on key business and compliance risks and related mitigation plans, and management discusses cybersecurity matters with the Evergy Board in connection with this report. The Evergy Companies also have a Security and Business Continuity Committee made up of internal security experts and several Evergy corporate officers. This committee meets bi-monthly to discuss relevant security and business continuity issues.

companyName: Evergy, Inc.

ticker: EVRG


text: The CSIRTP framework ensures timely reporting of cybersecurity incidents to the Executive Management Team. Incident severity is judged based on potential impacts, including damage, compromise, loss, and the likelihood of further exploitation. The Chief Risk Officer is informed of all incidents that are determined to be significant. The Chief Executive Officer and the Board of Directors are notified of these incidents as necessary.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: In addition, the Company has established procedures to ensure that management personnel are informed in a timely manner of known cybersecurity risks and incidents that may materially impact the Company's operations and that timely public disclosure is made as appropriate.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: Our systems are being threatened by cybersecurity incidents on a regular basis and our efforts may be insufficient to prevent or defend against incidents or an attack. We, and certain of our third-party vendors, have experienced attacks and incidents in the past, and there can be no assurance that we, or any vendor, will be successful in preventing future attacks or incidents or detecting and stopping them once they have begun. Through the date hereof, risks from cybersecurity threats, including prior incidents and attacks, have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity risks rapidly evolve and are complex, so we must continually adapt and enhance our processes and defenses. As we do this, we must make judgments about where to invest resources to most effectively protect ourselves from cybersecurity risks. These are inherently challenging processes, and we can provide no assurance that processes and defenses that we implement will be effective. See Item 1A, Risk Factors – III. Operating Risks above for more information.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: Board Member Guy W. Adams serves as our Lead Technology and Cyber Risk Director. In December 2017, Mr. Adams was recognized as a Governance Fellow for the National Association of Corporate Directors, The Gold Standard Director Credential. In 2018, Director Adams completed the Cyber-Risk Oversight course presented by the National Association of Corporate Directors.

companyName: READING INTERNATIONAL INC

ticker: RDI


text: As discussed below, members of management report to the Audit Committee, which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: NCR Atleos Corp

ticker: NATL


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.

companyName: Outlook Therapeutics, Inc.

ticker: OTLK


text: Third-Party Risks Given that risks associated with third parties can adversely impact an organization's overall security and risk posture, the Company implements a third-party risk management program to assess the security posture of third-party service providers. This includes security assessments prior to service engagement and ongoing monitoring.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: The Company's information security team, which is led by the Company's Director of Information Technology and also includes the Company's Chief Financial Officer and other members of the Company's internal audit and finance departments, is responsible for assessing and managing the Company's cybersecurity risks and data protection practices. The Company's Director of Information Technology has over 10 years of experience in managing cybersecurity risks and advising on cybersecurity matters.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: As one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program includes: • Collaboration: Through ongoing communications with management and the IT department of Steel Holdings, the Company's IT department monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents applicable to the particular operating company in real time, and reports such threats and incidents to the Data Breach Response Team, who will then report to the Audit Committee when appropriate. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats and such safeguards are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Managed Security Service Provider ("MSSP"): The Company has an Agreement in place with a third-party managed security service provider. They provide strategic and technical services helping our business manage cyber risk and improve security posture. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident. The Company has adopted a Cybersecurity Incident Policy and has established a Data Breach Response Team to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. • Outside Consultants: The Company engages various outside consultants, including forensic specialists, public relations and data breach resolutions firms, outside attorneys and other third parties, to among other things, obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans. • Education and Awareness: The Company provides awareness training to its personnel regarding cybersecurity threats to help identify, avoid and mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Steel Connect LLC


text: As one of the critical elements of the Company's strategy, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly interacts with members of senior management tasked with various risk management functions. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management promptly. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated regularly. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: BRC Inc.

ticker: BRCC


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise, including, risk management, technology, and finance. The Audit Committee reports to the Board of Directors periodically regarding cybersecurity topics presented to the Audit Committee, and all materials made available to the Audit Committee are available to rest of the Board of Directors.

companyName: CYTOKINETICS INC

ticker: CYTK


text: The Audit Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity. The Board of Directors also receives periodic briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our enterprise risk management committee ("ERMC") and internal information technology security staff as part of the Board of Directors's continuing education on topics that impact public companies.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: We have, and will continue to, integrate AI into our solutions, as well as explore potential third-party partnerships to help us be better positioned to offer our clients robust solutions. While AI offers significant benefits, it also presents risks and challenges. AI solutions are evolving and are not infallible, and we may encounter issues with data sourcing, technology integration, program bias into decision-making algorithms, security challenges and the protection of personal information and privacy. The Company typically conducts a risk assessment to identify potential threats and vulnerabilities in the third-party partners' systems, including reviews of data security, the AI model security, and compliance with applicable laws, regulations, and standards related to AI and data security.

companyName: IBEX Ltd

ticker: IBEX


text: The Company's general risk management program is designed to manage identified material risks, which would include material cybersecurity risks. We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities. We rely on a multidisciplinary team (including from our information security function, management, and third-party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.

companyName: Leatt Corp

ticker: LEAT


text: Our Chief Information Security Officer ("CISO") recently left the Company and we are in the process of recruiting a new, permanent CISO. We have engaged a temporary third-party CISO (sometimes referred to as a "Virtual CISO") to oversee the cybersecurity risk management program and assist the Information Security team. Our Virtual CISO has over 20 years of experience working in the Information Security field, and is a Certified Information Systems Security Professional. Specifically, she has experience managing and administering enterprise infrastructure, network communications, and information security. Our Virtual CISO receives regular reports from the Information Security team and will provide advice to the team with incident responses, execute any remediation plans, assist with drafting policy, and perform industry standard simulations and security assessments. The Virtual CISO reports to our Senior Vice President and Head of Engineering.

companyName: Compass, Inc.

ticker: COMP


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: Our cybersecurity-specific risk assessment process benchmarks our practices against standards set by the National Institute of Standards and Technology ("NIST"), International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and includes penetration tests to evaluate the security of our information systems, as such term is defined in Item 106(a) of Regulation S-K.

companyName: ARTIVION, INC.

ticker: AORT


text: Employees, contractors, and third parties are required to immediately report any suspected cybersecurity threats to the Corporate Information Security team for triaging. Any threat assessed by the Corporate Information Security team that could impact the safety of customers or personnel, cause damage to, or threaten the confidentiality, integrity, or availability of information assets, or bring about significant business interruption, are escalated for further assessment. In the event that the Chief Information Security Officer, in consultation with the Company's Legal and Compliance teams, determines that a material cybersecurity incident has occurred, a dedicated Crisis Incident Response Team comprised of individuals from various departments across the organization is assigned to coordinate all planned cybersecurity incident-related response activities. The Company will engage third party specialists to assist in any cybersecurity incident investigation, as needed.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: The Chief Information Security Officer ("CISO") works closely with the Chief Information Officer and the Chief Privacy Counsel to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and evaluate whether the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: Security audits and assessments We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, assessments, tabletop exercises, vulnerability scanning and penetration tests. We regularly engage third parties to assess our cybersecurity program, including cybersecurity maturity assessments, penetration testing, and independent review of our security control environment and operating effectiveness. The results of the assessments are included for review by the Security Steering Committee and the Audit and Finance Committee of the Board. We look to enhance our cybersecurity program with the results of the audits, assessments and reviews we perform.

companyName: PENTAIR plc

ticker: PNR


text: From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our program and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: The Company depends heavily on information technology infrastructure to manage our business objectives and operations, support our customers' requirements and protect sensitive information. To date, the Company has not experienced a cybersecurity threat or cybersecurity incident that has materially affected the Company, including our business strategy, results of operations or financial condition. While the Company has a robust cybersecurity program in place and has taken steps to maintain and enhance its cybersecurity, a material security breach could impede the Company's ability to carry on business in the normal course.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS


text: The Company maintains a comprehensive information technology and cybersecurity program which includes frameworks, policies, and procedures to prevent or limit the impact of cybersecurity threats and incidents. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. The Bank's Information Security Officer and Vice President of Information Technology is responsible for implementation of the information technology security program, while the management team is responsible for administering and enforcing the policies and procedures in the program. Third party vendors are utilized to help validate our security posture and controls, and we have developed a third party vendor management program to assess and monitor risks arising from third party vendor systems. In addition, the Board of Directors and Information Security Planning Committee (ISPC) is responsible for the risk management oversight and ensuring that the processes are being implemented and functioning as designed. The ISPC Committee provides monthly reports and updates to the Board of Directors. The Board of Directors and/or ISPC Committee approves updates relating to substantial changes in technology related policies and procedures and reviews the status of Business Continuity Programs, Testing plans and results on no less than an annual basis.

companyName: CARVER BANCORP INC

ticker: CARV


text: We currently manage our cybersecurity risk through practices that are applicable to all users of our information technology and information assets, including our employees and contractors. We notify these users of expectations regarding acceptable uses of our information systems and alert them to potential sources of cybersecurity threats. We use a combination of technology and monitoring to prevent security incidents. The technologies we utilize for cybersecurity monitoring across our information technology environment are designed to prevent, detect and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: Atlas Lithium Corp

ticker: ATLX


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 30 years in managing global IT operations in a wide range of areas, including, but not limited to, cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.

companyName: Brookfield Oaktree Holdings, LLC

ticker: OAK-PA


text: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. The team also reviews a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: We have developed and implemented a cybersecurity risk management program that is designed to identify, assess and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity, and availability of our critical systems and information. Our information security program is developed using industry standards and best practices as a guide, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The program includes penetration tests and periodic vulnerability scans, and evaluations by external service providers. The results of these evaluations are shared with senior management and the audit committee of the board of directors, where appropriate.

companyName: Rallybio Corp

ticker: RLYB


text: We recognize the importance of maintaining the trust and confidence of its customers, clients, business partners and employees. Cybersecurity represents an important component of our overall approach to risk management. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials, employees and contractors, or Information Systems and Data.

companyName: Cidara Therapeutics, Inc.


text: Our risk assessment efforts have indicated that we are a target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized crime, malicious insiders and activists. The impacts of attacks, abuse and misuse of Pfizer's systems and information include, without limitation, loss of assets, operational disruption and damage to Pfizer's reputation.

companyName: PFIZER INC

ticker: PFE


text: The KKR information security team undertakes a variety of measures to monitor and manage the cybersecurity risks of KKR's asset management business. Our technology platforms and applications are designed to enable us to monitor user and network behavior at KKR's asset management business, identify threats using certain analytics, and mitigate attacks across various layers of the enterprise. The KKR information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in our cybersecurity systems. In addition, the KKR information security team conducts periodic phishing simulations, as well as periodic employee training on KKR's security policies and controls and provides other security trainings as part of new employee onboarding.

companyName: KKR & Co. Inc.

ticker: KKR


text: Our Information Technology ("IT") Department, led by our Vice President of IT, helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT Department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating and assessing threats reported to us, coordinating with law enforcement about certain threats as may be appropriate, conducting internal and external audits and conducting risk and threat assessments.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: We maintain an incident response plan (IRP) aligned with National Institute for Standards and Technology Risk Management Framework (NIST RMF) when responding to incidents. The IRP sets out a coordinated approach to investigating, containing documenting and mitigating incidents. Our CISO, with oversight from our Chief Information Officer (CIO), is responsible for executing the relevant cybersecurity incident response plan, which includes response criteria for materiality, applicable requirements for incident disclosure and reporting and escalation procedures to various individuals and departments, including our Audit Committee, Senior Management, Key Stakeholders, General Counsel, Chief Financial Officer and Chief Executive Officer, for risks with a potentially material impact for responding to cybersecurity incidents. In addition to our in-house team and third-party security operations services, we also engage assessors, consultants, auditors and other third parties from time to time to assist with assessing, identifying and managing cybersecurity risks. For example, we leverage third-party security and compliance companies with subject matter expertise in these areas for threat identification and remediation. We continue to work with the U.S. Department of Defense on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks, including through participation in the Department of Defense's collaborative information sharing. We also partner with other work groups to support understanding and deployment of the Cybersecurity Maturity Model Certification (CMMC) to promote readiness in complying with cybersecurity requirements for handling CUI and federal contract requirements.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: At the management level, Atleos also established the Office of Risk Management and appointed a Chief Risk Officer to assist the Company in fulfilling its objectives relating to enterprise risk management (ERM), ethics & compliance (E&C), data privacy, third-party risk management (TPRM), business continuity planning (BCP) and sustainability. The Company's Chief Risk Officer is responsible for developing and managing formal programs designed to identify, assess and respond to material and emerging risks and opportunities that may impact the achievement of the Company's strategic objectives.

companyName: NCR Atleos Corp

ticker: NATL


text: The Company has implemented a cybersecurity risk management program that is designed to identify, respond to, protect against and manage cybersecurity threats and incidents. Our cybersecurity risk management processes include regular assessments of our cyber threat detection and response capabilities.

companyName: AlTi Global, Inc.

ticker: ALTI


text: We also maintain policies, procedures and governance structures designed to help us identify, assess and respond to cybersecurity risks. We have a written cybersecurity framework that closely aligns with the NIST's CSF. In addition, we maintain a cyber incident response plan to facilitate our response to cybersecurity incidents and formed an Incident Response Team composed of the Chief Information Security Officer & Head of IT Infrastructure ("CISO"), the Chief Credit & Risk Officer, the Chief Legal Officer, the Head of Operations, the Chief Compliance Officer of the RIA, the Head of Data Science, and the Associate General Counsel. The foregoing officers also include within their working teams, non-management employees who are best positioned to identify, assess, respond to and galvanize both internal and third-party resources necessary in the event of a cybersecurity incident. We test the resiliency of our systems through penetration and disaster recovery tests to continually improve our business continuity plan against an ever-changing threat landscape, create redundancies where appropriate for the protection of the Company's assets, have engaged a security operations center to provide 24/7 monitoring of our environment to detect and respond to suspicious activities in the network, and have cybersecurity insurance. We periodically perform an independent third-party cybersecurity maturity assessment of our systems, policies and procedures focused on the NIST's CSF and the SEC's Office of Compliance Inspections and Examinations cybersecurity guidance.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Our Chief Compliance Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual who has over 20 years of experience with information security and business systems, including digital infrastructure and cybersecurity.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: In line with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risks while the Company's Board of Directors and its Risk Committee actively and continuously provide oversight.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: The CIO, in collaboration with our Corporate Instruments and Control Systems Lead, and General Manager, Control Center Operations, are primarily responsible for assessing and managing our material risks from cybersecurity threats, monitoring the effectiveness of our cybersecurity detection and response processes in countering current threats and providing updates to our executive team.

companyName: HF Sinclair Corp

ticker: DINO


text: Our ISO, under the supervision of the Chief Risk Officer, leads the development and implementation of the Information Security Program. In addition, our Information Technology Department ("IT") also has a dedicated cybersecurity team under the supervision of our Chief Information Officer. Members of our Information Security and IT cybersecurity teams have over 50 years of combined experience in information technology systems and cybersecurity risk management and include a team member that has a ISACA Certified Information Systems Auditor certification and two team members each with a master's degree in cybersecurity.

companyName: OFG BANCORP

ticker: OFG


text: As part of the cybersecurity program, our information systems are monitored by automated tools and the Information Technology team. We have adopted an Incident Response Policy, which outlines the procedures we believe are necessary to identify, investigate, contain, communicate, respond, remediate and recover from a security incident. This Incident Response Policy is overseen by our Vice President of Infrastructure and Security ("VP Infrastructure") along with the Incident Response team, which may consist of members from legal, human resources, finance or other functions, if necessary. The Incident Response Policy provides organizational and operational structure, processes, and procedures to our personnel so employees can respond to incidents that may affect the function and security of our IT assets, information resources, and business operations. We conduct periodic information security awareness training for employees and provide related educational materials.

companyName: MARZETTI CO

ticker: MZTI


text: Our interim CISO reports to our Chief Digital and Technology Officer ("CDTO"), an executive officer, who provides management of cybersecurity risks, reviews operational metrics and performs other relevant activities related to the cybersecurity function.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Primary responsibility for assessing any cybersecurity risks rests with our chief financial officer, who would report any threat to our board of directors.

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: Our ISC members includes our CIO and our Director of IT Security, Risk and Compliance who have a combined 20 years of risk management experience encompassing cybersecurity and technology security, such as threat assessments, risk management, cybersecurity insurance, incident response, end user awareness and vulnerability management.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: Our cyber risk management program includes: • Regular assessments of cyber risks, taking into account the evolving threat landscape, technological advancements and changes in our business operations. • Proactive identification and mitigation of vulnerabilities in our information systems through regular scanning, testing and patch management. • Implementing and continuously monitoring security controls, including firewalls, intrusion detection systems, encryption and access controls, to safeguard against unauthorized access and data breaches. Our controls are based on the latest Center of Internet Security (CIS) Critical Security Controls best practices for cybersecurity and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). • Regular testing of our Cyber Incident Response Plan through tabletop exercises to ensure a swift, coordinated and effective response in the event of cyber incidents to minimize impact on operations.

companyName: DNOW Inc.

ticker: DNOW


text: Our cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect our information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned, or managed by us. Our focus is on protecting sensitive information, such as the personal information of our customers and employees, and confidential business information that a competitor or a malicious actor could leverage. Our cybersecurity program has several components, including the adoption of information security protocols, standards, and guidelines consistent with industry best practices and engaging third-party service providers to conduct security assessments.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including, among others, our Executive Vice President of Talent, Advocacy & Communications, Vice President of IT, and Associate Director of IT Operations. Our Vice President of IT is an IT security professional and members of our IT Department have certain credentialling in cybersecurity. We also rely on third-party security analysts who have certain certifications related to cybersecurity.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: As of the date of this report, risks from cybersecurity threats or incidents have not materially affected, nor are they reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. However, in light of emerging and changing cybersecurity threats and vulnerabilities, the Company cannot guarantee that it will not be a victim of a cybersecurity attack in the future that could materially affect the Company. See Item 1A, Risk Factors for more information.

companyName: RLI CORP

ticker: RLI


text: Corporate Governance Our Board has ultimate oversight of cybersecurity risk, which it manages as part of our ERM program. This program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board on its activities on a quarterly basis or more frequently as warranted.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: Our Governance, Risk, and Compliance (GRC) team oversees our third-party cybersecurity risk management program, which evaluates the security posture of certain third-party vendors. Our assessments may include the collection and verification of various cybersecurity measures implemented by our third-party vendors. Depending upon the third-party vendor as well as the data and information systems to which the vendor will have access, the GRC team may review the vendor's information security policies and standards, examine the vendor's certifications and attestations, and review vulnerability assessments or other evaluations.

companyName: Everpure, Inc.

ticker: PSTG


text: We design and assess our cybersecurity risk management program guided by the NIST Cybersecurity Framework to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: Although cybersecurity threats, including those stemming from prior incidents, have not materially affected the Company in the previous fiscal year, and there are no known imminent cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations, or financial condition, we cannot guarantee that we will remain unaffected in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned "Risks Related to Operations" contained in Item 1A. Risk Factors.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A - Risk Factors - We use information technology in our operations and offer online banking services to our customers, and unauthorized access to our or our customers' confidential or proprietary information as a result of a cyber-attack or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers."

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Part I, Item 1A Risk Factors of this Annual Report on Form 10-K, including the risk factor titled "System security risks, data protection breaches, cyber-attacks, and systems integration issues could disrupt our internal operations or information technology services provided to customers, and any such disruption could reduce our expected revenue, increase our expenses, damage our reputation, and adversely affect our stock price."

companyName: Digital Turbine, Inc.

ticker: APPS


text: Cybersecurity risk management is integrated into our broader Enterprise Risk Management ("ERM") framework to promote a Company-wide culture of awareness and proactive risk management. Our ERM framework is overseen by the Audit Committee and Board of Directors. Our Chief Information Officer ("CIO") and Vice President, CISO & IT Infrastructure and Security ("VP IT") are responsible for updating the Audit Committee and Board of Directors on Embecta's cyber risk. The CIO and VP IT have oversight of cybersecurity strategy, policy, standards, architecture, and processes that protect Embecta's enterprise network, Information Systems and information assets, and product technologies. The ISRC oversees our cybersecurity governance and manages various controls, ensuring accountability at all levels of the organization, including senior management and the executive leadership team. The ISRC meets quarterly, oversees enterprise and cybersecurity risk management and reports to the ERM team and the Audit Committee. These committees receive updates on cybersecurity-related topics throughout the year including any major cybersecurity incidents. Additionally, the Board of Directors receives periodic updates on information security and cybersecurity matters from our CIO and VP IT.

companyName: Embecta Corp.

ticker: EMBC


text: As of the date of this Form 10-K, we believe that we have limited risks associated with a breach in cybersecurity. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (of which we are not aware of any), have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Hypha Labs, Inc.

ticker: FUNI


text: Our CFO oversees our cybersecurity risk management, including appropriate risk mitigation strategies, systems, processes, and controls, and receives updates from IT and our third-party IT service providers on cybersecurity and information security matters. The CFO communicates with the Audit Committee and the Board periodically regarding the state of our cybersecurity risk management, current and evolving threats and recommendations for changes. We have also implemented a cyber incident response plan that provides a protocol to report certain incidents to the CFO with the goal of timely assessment of such incidents, determining applicable disclosure requirements and communicating with the Audit Committee and the Board for timely and accurate reporting of any material cybersecurity incident. The incident response plan is reviewed and tested in the annual cybersecurity desktop exercise.

companyName: Capstone Green Energy Holdings, Inc.

ticker: CGEH


text: The Company's cybersecurity risk management processes are integrated into the Company's overall risk management processes. The Board of Directors has overall responsibility for the oversight of the Company's risk management and has delegated the oversight of specific risk-related responsibilities to certain Board committees. The Audit Committee oversees the Company's business and financial technology risk exposure, which includes data privacy and data protection, information security and cybersecurity, as well as the controls in place to monitor and mitigate these risks.

companyName: YUM BRANDS INC

ticker: YUM


text: We acknowledge the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. While we are in the process of enhancing our cybersecurity practices, we are committed to continually improving and adapting to evolving threats to maintain a high standard of protection.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: We maintain a Data Privacy & Security working group that is responsible for setting data security and privacy policies, overseeing those policies, and tracking and reporting on data security and privacy performance. The working group is comprised of our Chief Information Security Officer, Global Data Privacy Officer, Chief Administrative Officer, and General Counsel. The working group reports to the Audit Committee at least annually. In addition, the Company has an Impact Committee that maintains functional working groups that focus on a number of issues, including Data Privacy & Security. The Impact Committee reports to the Board at least annually. The Company's Global Data Privacy Officer also reports to the Audit Committee at least quarterly and provides the Audit Committee with updates regarding the Company's data privacy environment. We also have a Chief Information Security Officer who reports to the Audit Committee at least annually regarding the Company's data security environment.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: Cyber Governance On a quarterly basis, the CISO presents key security metrics to the Company's IT Advisory Council, which is composed of functional leaders across the Company and is responsible for IT governance oversight in the Company. Specifically, this IT Advisory Council is responsible for establishing program strategies in alignment with LivaNova's business objectives, as well as providing guidance on the implementation of appropriate and necessary security controls in alignment with the Company's Information Security Policy. Among other things, the IT Advisory Council reviews summaries of information security incidents, audit findings, or other test reports, and ensures appropriate root-cause analyses are performed and corrective actions are taken. It also reviews year-over-year goals, security objectives, and priorities for the Company's information security program.

companyName: LivaNova PLC

ticker: LIVN


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.

companyName: HPS Corporate Lending Fund


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks.

companyName: GTJ REIT, INC.


text: We use third party specialists to conduct periodic assessment and testing of our policies, standards, processes, and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, risk assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Where appropriate we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results.

companyName: Hillenbrand, Inc.

ticker: HI


text: We acknowledge that the absence of comprehensive cybersecurity processes could potentially expose the company to risks, which might materially affect our operations, financial condition, or strategic decisions in the future. We are committed to improving our cybersecurity posture as our resources allow.

companyName: T3 Defense Inc.

ticker: DFNS


text: Engaging Third Parties on Risk Management As part of our risk management process, we engage with a range of outside providers, including cybersecurity assessors, consultants, legal advisors and auditors, to conduct periodic internal and external assessments, including, but not limited to, penetration testing. Our collaboration with these third parties also includes regular audits, threat assessments and consultation on security enhancements.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Mid Penn engages a team of external assessors, auditors, and consultants to support our cybersecurity and risk management efforts. We seek information and guidance from reputable third-party organizations such as CISA, RMA, and FS-ISAC to aid in making responsible decisions and mitigating risks. We utilize threat detection and prevention technologies to analyze network traffic and identify atypical behavior that may indicate a potential cyber threat. This proactive approach is intended to enable us to detect threats before they can cause harm to our systems or compromise sensitive information. Additionally, we conduct regular penetration testing and vulnerability assessments to identify and remedy potential deficiencies in our systems.

companyName: MID PENN BANCORP INC

ticker: MPB


text: Our Board of Directors has delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks to the Audit Committee. Our Head of IT, under the supervision of our Chief Financial Officer, is responsible for the establishment and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The Head of IT will regularly consult with outside security experts and management to evaluate certain aspects of the cybersecurity risk management program. The Head of IT has approximately 15 years of experience in information security and cybersecurity risk management. The IT team also institutes and maintains controls for our systems, applications, and databases.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: However, common cybersecurity threats and risks make it imperative that we maintain adequate precautions with respect to cybersecurity and, to this extent, we have industry standard security controls in place to protect our systems and our data.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: The Committee is updated during the quarterly Committee meetings by the Senior VP of Global IT and System Operations and the IT Security Officer concerning the Company's significant cybersecurity threats and risk and the processes we have implemented to address them. The Committee also receives reports, summaries or presentations related to cybersecurity threats, risk and mitigation. The Company's Senior VP of Commercial Operations, General Counsel, Chief Financial Officer and Chief Executive Officer may also participate in Committee meetings and will receive updates from the Committee as appropriate.

companyName: ENZO BIOCHEM INC


text: The Director of IT Security, Risk and Compliance implements and oversees our processes for regularly monitoring our information systems and detecting and reporting cybersecurity incidents. That process includes convening an incident response team composed of the Director of IT Security, Risk and Compliance, Vice President of Information Technology, Chief Compliance Officer, and General Counsel. The incident response team is responsible for overseeing the assessment of and response to any cybersecurity incident and for monitoring the Company's mitigation and remediation efforts. The incident response team is also responsible for informing executive management, the Audit and Risk Committee and, where appropriate, the Board of Directors, regarding the detection, mitigation, and remediation of cybersecurity incidents.

companyName: Bioventus Inc.

ticker: BVS


text: We require all employees to undertake data protection and security training at least annually. We provide specialized training to targeted groups of employees depending on their role and the larger threat landscape. We are briefed regularly by national law enforcement, and work with external consulting firms on custom training and evaluations.

companyName: IonQ, Inc.

ticker: IONQ


text: As a global company, we utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions. As we become more dependent on information technologies to conduct our operations, and as the number and sophistication of cyberattacks increase, the risks associated with cybersecurity increase. Failure to effectively anticipate, prevent, detect and recover from the increasing number and sophistication of cyberattacks could have a material adverse effect on our results of operations or financial condition. To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.

companyName: MOSAIC CO

ticker: MOS


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess and evaluate risks impacting our operations across our organization, including those risks related to cybersecurity. While we believe we maintain an effective cybersecurity program, the techniques used to infiltrate IT systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: The corporate information security organization has implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the Center for Internet Security controls. In addition, GEO has robust policies and procedures related to cybersecurity and general IT practices that include but are not limited to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: GEO GROUP INC

ticker: GEO


text: The CISO and Team manage a program for enterprise cybersecurity that is guided by the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. Key areas of responsibility in the program include governance, risk and compliance, threat analysis and response, security architecture and engineering, security operations, and secure manufacturing operations. The CISO and Team also manage a program for connected products and services cybersecurity risk management that is guided by the ISA/IEC 62443 standard to enable protection and resiliency across products and services. Key areas of responsibility include product security, software development, innovation management, threat analysis and incident response. Both the enterprise and connected products and services programs are designed to assess, identify and manage risks from cybersecurity threats in order to protect and preserve the security, integrity and continued availability of the Company's information technology systems and connected products and services, and also to protect the confidentiality and integrity of information owned by, or in the custody and care of, the Company. Elements of the programs include policies, standards, architecture, processes, tools, technology, employee education and training, and incident response. Our risk management processes undergo at least quarterly review to identify potential gaps and areas for additional investment, resources and focus. Our enterprise and product security programs undergo regular testing, including periodic vulnerability scanning and penetration testing. In addition, we also periodically engage third parties to assess our enterprise and product security programs and provide consultation and advice to assist with assessing, identifying, and managing cybersecurity risks. Our Enterprise Risk Management ("ERM") Program annually assesses and, on an ongoing basis, monitors the Company's key risks, including cybersecurity risk.

companyName: Xylem Inc.

ticker: XYL


text: • Insurance: YETI also maintains a cybersecurity and information security risk insurance policy. • Third Parties: YETI has processes in place to oversee and identify risks from cybersecurity threats associated with third-party vendors. Such processes vary based on factors such as the type of vendor, whether the relationship will implicate our technology, and the type of data involved, if any.

companyName: YETI Holdings, Inc.

ticker: YETI


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity threats and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, threat modeling, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: Bandwidth Inc.

ticker: BAND


text: As part of its oversight of the Company's risk management noted above, the Audit Committee oversees, reviews and discusses with management the Company's risks from cybersecurity threats and management's role in assessing and managing such risks. The Audit Committee receives regular presentations, reports and updates from the CISO and other members of management on developments regarding the Company's cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics.

companyName: FAIR ISAAC CORP

ticker: FICO


text: We expect to regularly evaluate and enhance our cybersecurity policies and procedures in response to emerging threats or developments affecting our industry.

companyName: Natics Corp.

ticker: NTCS


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including: an incident response plan and procedures, incident detection and response playbook, business continuity plans, encryption of certain data, network security controls, identity management and access controls, physical security controls, 24/7 systems monitoring, vendor risk management processes, employee cybersecurity and privacy training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: MACROGENICS INC

ticker: MGNX


text: While the Company's information systems are exposed to cybersecurity threats and risks, the Company has not experienced any material cybersecurity incidents affecting its business strategy, results of operations, or financial condition, and any costs or operational impacts related to cybersecurity incidents were immaterial during the period presented.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: Omega's Vice President of Information Technology (" VP of IT ") manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes and risk assessment related to information security and data protection, including data privacy and network security (our "Cybersecurity Program"). The VP of IT has served in various roles in information technology and information security for over 30 years and, along with other members of the IT department, holds relevant and applicable certifications. The VP of IT reports directly to the Company's Chief Financial Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our Board and the Audit Committee of our Board.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.

companyName: Triller Group Inc.

ticker: ILLR


text: Through its Manager, the Fund maintains a cybersecurity risk management program designed to identify, assess, manage, and mitigate threats, as well as respond to and recover from cybersecurity incidents. This program is coupled with an enterprise risk management program and covers the Fund's key information systems.

companyName: Venture Lending & Leasing IX, Inc.


text: For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy strategy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.

companyName: INSPIRE VETERINARY PARTNERS, INC.

ticker: IVPR


text: Our CIO periodically provides the Executive Leadership Team, which consists of the Company's executive officers and other senior leaders, with cybersecurity briefings, information and trainings, and updates the Audit Committee on cybersecurity biannually or more frequently as appropriate. At any time, Board members may raise concerns regarding the Company's cybersecurity posture and recommend changes regarding controls or procedures to management. Our CSIRP includes a process for incidents to be evaluated for material impact, with an escalation protocol requiring reporting of material incidents to the Executive Response Team and to the Board of Directors.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: While we have significant security processes and initiatives in place, we may be unable to detect or prevent a breach or disruption in the future. For more information about cybersecurity-related risks, please see " Item 1A. "Risk Factors " of this Form 10-K.

companyName: FEDEX CORP

ticker: FDX


text: Role of the Board of Directors Our Board of Directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full Board of Directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full Board of Directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Where necessary, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. Please see the risk factor entitled " We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our products and data processed by us or third-party vendors. " in Part I, Item 1A. Risk Factors in this report for more information.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Owlet, Inc.

ticker: OWLT


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Part 1, Item 1A. "Risk Factors - Risks Related to Our Business – Our business operations could be negatively impacted by an outage or breach of our information technology systems, network disruptions, or a cybersecurity event."

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: Our Executive Director of Information Technology, or IT, and other relevant personnel help identify, assess and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We (including the Executive Director of IT) use various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal audits, conducting threat assessments, conducting third-party threat assessments, conducting vulnerability assessments, and arranging a managed detection and response process with a third-party vendor.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Gamida Cell Ltd.


text: Cybersecurity Incident Response Plan — In October 2023, we experienced a cybersecurity incident in which certain information of our users was accessed and downloaded from individual 23andMe.com accounts without the account users' authorization. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations, reset customer passwords, required two-factor verification for new and existing customers, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats which may materially impact our operations. For more information about our cybersecurity related risks, see "We have experienced a criminal cyber incident and could in the future experience other security breaches, disruption to our business, or reputational harm" in Part 1, Item 1A, Risk Factors of this Form 10-K.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Periodic Review, Testing and Training In accordance with our policies, we perform periodic assessments and tests of the application of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a range of activities, including internal audits, assessments, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures as a component of our SOX compliance program.

companyName: PubMatic, Inc.

ticker: PUBM


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks and attacks to the security of the systems of our third-party vendors and service providers. For more information on our cybersecurity related risks, see "Our internal computer systems, or those used by our third-party collaborators, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our development programs and business operations" in Item 1A- Risk Factors.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: Our cybersecurity risk management the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis; cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management;

companyName: FLANIGANS ENTERPRISES INC

ticker: BDL


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, customer's data, sensitive financial information and personal identifiable information ("Information Systems and Data").

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: Depending on the environment, system and data, we have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our critical technologies and data, including, for example: incident response plan; disaster recovery/business continuity plans; risk assessments; encryption of certain data; network security and access controls for certain systems; physical security; asset management, tracking and disposal; systems monitoring; and employee training.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Senior Management oversee the cybersecurity program through weekly and monthly updates, and report on the cybersecurity program to the Audit and Risk Committee for oversight, on a quarterly basis. Additionally, cybersecurity risks are reviewed annually as part of the ERM program. The ISIT Function leads ongoing training and awareness initiatives that applies to all Seadrill personnel, including employees, contractors and contingent workers, emphasizing cybersecurity as a critical organizational priority and mitigating the potential human factor in cyber incidents.

companyName: Seadrill Ltd

ticker: SDRL


text: We have not adopted a Code of Business Conduct and Ethics that applies to our principal executive officer, principal financial officer, principal accounting officer, or persons performing similar functions since one person, Daniel Allen, serves in all the above capacities.

companyName: Blue Line Protection Group, Inc.

ticker: BLPG