text: The Company has implemented and continues to maintain its IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with third-party service providers. These include, but are not limited to, an IT acceptable use policy, a contractor/consultant work policy and a vendor management policy.

companyName: DallasNews Corp


text: Our CIO/CTO leads management's assessment and management of cybersecurity risk with the assistance of the Company's CISO who reports to the CIO/CTO. The CIO/CTO reports to our CFO, is a member of the Executive Operating Team, and provides updates to that group about cybersecurity matters. Our CIO/CTO has more than 29 years of experience managing technology and risks, and advising on cybersecurity issues and our CISO has more than 21 years of relevant experience, is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).

companyName: MCKESSON CORP

ticker: MCK

secItem: Item 1C


text: Our security strategy is a layered approach. We utilize multiple layers of defense, both internally and externally, to ensure the integrity of our systems and data. We engage reputable security partners (assessors, consultants, auditors, and other third parties) for real time analysis and protection of our network infrastructure. This includes the use of preventative and detective tools to monitor, block, and alert us to suspicious activity. We utilize industry and regulator recognized assessment tools, such as the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool, to identify potential cybersecurity threats as well as the impact they could have on the Bank. Dashboards are used to track and monitor cybersecurity activity and trends.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: We use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, hosting companies, supply chain resources, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, we may conduct a review of security assessments provided by the vendor.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: The Audit Committee has primary responsibility for oversight of cybersecurity matters. The Audit Committee receives quarterly updates on compliance and cybersecurity from the CIO and CISO. These updates, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and enhancements to our cybersecurity program.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: Collaborative Approach: A comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by senior management in a timely manner.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: Our CDO and CISO work to protect the Company's information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with the Company's cybersecurity incident response and recovery plans and processes as described above. The CDO is responsible for corporate-wide data security, and the CISO is responsible for developing, implementing and enforcing security policies at the corporate level and providing guidance for the operating companies to manage our overall cybersecurity risks. The CDO and CISO are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity incident response and recovery plans and processes, as described above. The CDO and CISO also periodically meet with certain corporate officers, such as the Company's Chief Financial Officer and General Counsel to review and discuss cybersecurity issues.

companyName: DOVER Corp

ticker: DOV


text: In November 2023, we experienced the Cybersecurity Incident, which temporarily disrupted our operations and involved the exfiltration of certain confidential employee and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following the Cybersecurity Incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including, among other things, enhancing the visibility of our Security Operations Center, training practices, detection tools and capabilities, and implemented new tools and processes, expanded the scope of vulnerability management, and increased scrutiny of internet access. In addition, we adopted several technologies that incorporate artificial intelligence capabilities to enhance our protection capabilities. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our operations. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities.

companyName: Ardent Health, Inc.

ticker: ARDT


text: As of the filing of this Form 10-K, we are not aware of any cybersecurity incidents that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We describe whether any risks from cybersecurity threats, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our business could suffer if information technology systems are disrupted, cease to operate effectively or become subject to a cybersecurity incident." included within our risk factor disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K, which information is incorporated herein by reference.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: Description of Company's processes for assessing, identifying and managing cybersecurity risks The Company takes an integrated, holistic approach to managing risks that pose a significant threat to the Company's business, which includes, but is not limited to its personnel, assets and revenue, as well as those of its clients and vendors. Those assets include systems, networks and data of our clients and our Company, as well as our employees, our application software, our confidential information and other forms of our intellectual property, among other examples. Cybersecurity threats are an important, but not all-inclusive, risk to the Company's business.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: Our cyber risk management program helps mitigate risks that could have a material adverse effect on our business, financial condition, results or operations, cash flows or reputation. See "Risk Factors – Risks Related to Our Business Operations – Security breaches and other disruptions could compromise our information and expose us to liability, and could cause our business and reputation to suffer."

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. For a discussion of how cybersecurity risks could materially affect us in the future, please see the risk factors set forth under the caption Part I, Item 1A, Risk Factors — Risks Related to our Operations.

companyName: Bloom Energy Corp

ticker: BE


text: Cybersecurity risk management is integrated into our overall risk management processes. The program monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of IT presents updates on IT projects, including cybersecurity policies and programs, to executive management at least quarterly.

companyName: STAR GROUP, L.P.

ticker: SGU


text: In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.

companyName: EON Resources Inc.

ticker: EONR


text: The Investment Manager's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Company. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: IT, which provides security systems and firewalls for our computer and data network, is responsible for assessing and managing cybersecurity risks, which may affect us. Integris IT is experienced in assessing and managing cybersecurity risks as a result of providing computer and data network security systems for its clients.

companyName: Blue Line Protection Group, Inc.

ticker: BLPG


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of company data and systems along with other material risks to company operations, at least annual or whenever there are material changes to the Company's systems or operations. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. As part of our risk management process, the Company engages outside providers to conduct periodic penetration testing and other cybersecurity audits. The Company stores company data in cloud environments with security appropriate to data involved and has adopted controls around, among other things, vendor risk assessment, information classification, access and acceptable use and backup and recovery.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: We rely upon internally and externally managed information technology systems and networks for the collection and storage of sensitive data and business information. We approach cybersecurity risks with a comprehensive risk management and governance strategy designed to assess, identify, and manage cybersecurity risks to our business.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: Our cybersecurity processes have been integrated into our risk management processes in order for us to assess, identify, and manage risks related to cybersecurity threats and ensure compliance with our legal and contractual obligations, which require us to safeguard the confidential and sensitive information provided to us by our customers. For example, we use various methods and tools to identify and assess cybersecurity threats across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers. We regularly engage third-party assessors, service providers, consultants, and auditors to support and review our risk management processes and to provide independent validation and verification of our security posture. We have established processes to oversee and identify risks from cybersecurity threats associated with our use of third-party assessors and service providers, such as due diligence, contractual language, monitoring and periodic vendor evaluation and qualification.

companyName: Certara, Inc.

ticker: CERT


text: We have implemented incident response and breach management processes, including (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident; (iii) containment, remediation and recovery from an incident; and (iv) post-incident analysis. Such cybersecurity incident responses are overseen by leaders from our IT, compliance and legal teams as further described under "Cybersecurity Governance" below, and elevated to other senior leaders, third party providers and the Audit Committee of the Board as appropriate and in accordance with our response plan and procedures.

companyName: TIDEWATER INC

ticker: TDW


text: As a result of this enterprise risk management process, cybersecurity threats have been and continue to be identified as one of the Company's critical business risks, with our Chief Enterprise Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Chief Enterprise Technology Officer and Chief Information Security Officer monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's global cybersecurity incident response plans, which include provisions for escalation to the Chief Policy Officer and General Counsel, as well as the Board and its committees, as appropriate. As discussed below, the executive risk owners for cybersecurity risk report out to the Audit Committee and, in some cases, the Board, on a regular basis as part of our enterprise risk management process.

companyName: FORD MOTOR CO

ticker: F


text: Information Technology and the Digital Transformation of the Company's assets and business processes are critical to our growth strategy. Inherent to Information Technology and Digital Transformation is the commensurate cybersecurity risk, which we manage by maintaining a cybersecurity program that is integrated into our overall risk management process.

companyName: Third Harmonic Bio, Inc.


text: As noted above, our Sponsor, Advisor and we have experienced various types of cyber-attack incidents which thus far have been contained and not material to us. Our Sponsor and Advisor continue to implement new controls, governance, technical protections and other procedures to mitigate against the risks of a cybersecurity event. Our Sponsor also maintains a cyber risk insurance policy that provides coverage to us but the costs related to cybersecurity threats or disruptions may not be fully insured. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, our Sponsor, Advisor or other vendors or suppliers we engage, fall victim to other successful cyberattacks.

companyName: JLL Income Property Trust, Inc.


text: We utilize the cybersecurity services of our IT MSP, which is a SOC that is operated 24/7/365 and monitors our devices and networks for malicious activity. In addition to antivirus endpoint protection on Company devices, our IT MSP also, for example, monitors IT system metadata around suspicious events, evidence of tactics, tools, or procedures used by attackers, and monitors remote privileged activity.

companyName: MAXCYTE, INC.

ticker: MXCT


text: Both the Board of Directors and the Audit and Compliance Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response policy, plan, procedures and scenario-based playbooks, an incident detection and response program, a vulnerability management program, disaster recovery and business continuity plans, risk assessment processes, security standards, network security controls, access controls, systems monitoring, employee awareness training and cybersecurity insurance. We have obtained Trusted Information Security Assessment Exchange (TISAX) certification labels at multiple global locations.

companyName: LEAR CORP

ticker: LEA


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our full board of directors directly administers its cybersecurity risk oversight function and our audit committee provides additional oversight of maintaining and monitoring cybersecurity risks.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: As a critical infrastructure company, we regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks and data. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face. The security, performance, and reliability of our network may in the future be disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents.

companyName: Allegiant Travel CO

ticker: ALGT


text: The Company performs network and application penetration testing on external high-risk applications as well as network penetration testing across its production, test, and disaster recovery networks. The Company also performs tests on its operational defense and response to assess the ability to detect and respond to a threat actor. This allows the Company to test lateral movement, exploitation, data exfiltration, and evaluate its security posture around three primary security functions: detection, prevention, and response. The Company regularly participates in desktop exercises to help demonstrate incident preparedness and regulatory compliance. All testing results are reported to the Board quarterly through the Governance Model.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Our IT management, in conjunction with our Director of Internal Audit, has responsibility for monitoring and testing the effectiveness of our cybersecurity controls and procedures on a recurring basis.

companyName: FTC Solar, Inc.

ticker: FTCI


text: We have a unified cybersecurity leadership team, composed of members of our Security Executive Steering Committee ("Security ESC") to oversee implementation of appropriate cybersecurity protections and promote accountability. The Security ESC is led by senior executives in our information technology ("IT") and technology operations groups and is comprised of senior executive leaders across the organization with the goal of driving cybersecurity focus through not just technical teams, but the entire business. The Security ESC reviews and evaluates current cyber threats and risks and improvements to our program and provides quarterly updates to the Chief Executive Officer as well as ad hoc updates on urgent matters. We also have a Cyber Security Council ("CSC") and Security Operations Steering Committee that, under the direction of the Security ESC, collectively focus on cybersecurity across Charter and the overall protection of our internal network and related processes, policy, training and actions to protect customer and employee data. The CSC is comprised of senior leaders across the organization and operates under the auspices of the Security ESC, which is ultimately accountable under our enterprise risk management program for cybersecurity.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect our clients, patients, customers, employees, and vendor information and prevent data loss and other security breaches, including a cybersecurity risk assessment program. We also only use third party software for accounting, billing and payroll that have successful SOC 1 type 2 compliance. Both management and the Board are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: ENvue Medical, Inc.

ticker: FEED


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibilities for enterprise cybersecurity risks. The Technology, Innovation, and Cyber Committee of the Board of Directors also reviews enterprise cybersecurity risks in connection with its oversight of cybersecurity and compliance risks. Our cybersecurity risk management team leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: We also have invested in tools and technologies to protect our and our patients' and customers' data and information technology, and we regularly monitor our information technology systems and infrastructure to identify and assess cybersecurity risks. We have designed a Threat Intelligence function that actively looks for emerging threats and risks that target the pharmaceutical industry generally or AbbVie specifically. We rely in part on third parties (including assessors, consultants, advisors and others) in connection with our processes for assessing, identifying, managing and reducing cyber risks.

companyName: AbbVie Inc.

ticker: ABBV


text: In August 2024, Journal Technologies hired a Director of Security Operations to lead the CISO team. With extensive IT leadership experience and a Certified Information Systems Security Professional (CISSP) credential, the Director oversees security strategies, incident response plans, and risk assessments. Reporting directly to senior management, the Director works closely with internal teams and external experts to align Journal Technologies' practices with industry standards.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: As part of our overall enterprise risk management function, we have implemented and currently maintain various information security processes designed to assess, identify, and manage material risks from cybersecurity threats to our critical computer network, third-party hosted services, and our critical data (collectively, our "Information Systems").

companyName: Ubiquiti Inc.

ticker: UI


text: Under our Cyber Program, our Senior Director, Global Security, and the staff, along with our management-led Cybersecurity Committee, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks, and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in various Company policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Audit Committee and Board, informed. Pertinent policy and practice documents include, among others, Manhattan's Incident Response Policy, our Incident Escalation Matrix, our Materiality Determination Process for Cybersecurity Incidents (governing the Company's materiality determination for reporting purposes) and our Crisis Response Plan.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: The risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Corporation to date, including our business strategy, operations, or financial condition. Cybersecurity is an evolving threat, and the increasing sophistication of threat actors is supported by new technologies, including artificial intelligence and machine learning, which does have the potential to materially affect the Corporation, including our business strategy, operations, or financial condition. However, with our system of internal controls, cyber defense mechanisms in place and the tenure and experience of our Chief Information Security Officer ("CISO") and Information Security Analysts, we have sought to reduce the residual risk that is inherent of cybersecurity.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Our CISO supervises a team of cyber risk architects, engineers and managers who actively work to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. Our cyber risk team collaborates with internal stakeholders to identify and analyze cybersecurity risks to the Company, implement appropriate controls and enable leaders to make risk-based business decisions that implicate cybersecurity considerations. Our CISO also reports on our cybersecurity and data privacy processes, procedures and risks to our executive management team when changes or risks are expected to impact other portions of the business, including with respect to the Wheels Up mobile app, website and proprietary pricing algorithms.

companyName: Wheels Up Experience Inc.

ticker: UP


text: Additionally, for Changes that may impact our manufacturing process, we perform impact assessments prior to performing a Change to understand the (i) level of financial, technical, and compliance risk, (ii) impact on business operations, (iii) impact of configuration and user access security, (iv) impact on connected Information Systems and interfaces, and (v) need for user training. The extent and documentation of impact assessments are commensurate with the level of risk associated with the Change, and the level of testing performed shall be determined by the results of the impact assessment.

companyName: Clene Inc.

ticker: CLNN


text: Security Policy and Requirements As part of our overall risk management program, we have adopted our Information Security Policy which details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources and all of our information systems and resources, including third parties we engage. Our program aligns with the NIST cybersecurity framework.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: TXO Partners, L.P.

ticker: TXO


text: Management's Role Managing Risk Our CIO is responsible for developing and overseeing matters related to cybersecurity and serves as the Company's Chief Information Security Officer. The CIO reports directly to the Chief Operating Officer, who is accountable for the overall information technology and security strategy and governance of the Company.

companyName: AGREE REALTY CORP

ticker: ADC


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Executive Officer with the assistance of contracted third-party cybersecurity advisors. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including incident response processes.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: While Koichi believes he can maintain adequate internal security measures at this stage, there is no guarantee that this will prevent potential breaches, disruptions to our operations, or other related issues.

companyName: Japan Food Tech Holdings, Inc.


text: Our information security function, which is led by our Chief Technology Officer ("CTO"), helps identify, assess, and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including using manual and automated tools, analyzing reports of threats and actors, evaluating our risk profile, conducting audits, conducting threat and vulnerability assessments, and performing tabletop incident response exercises.

companyName: Xometry, Inc.

ticker: XMTR


text: Our Board of Directors has overall responsibility for enterprise risk management and has delegated the oversight of cybersecurity risks to the Audit Committee. The Company's Chief Financial Officer ("CFO") immediately updates the Audit Committee on any significant cybersecurity incident and/or threat that may require an 8-K filing. Furthermore, the CFO reports quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions. These updates include the following: • Recent cyber risks and cybersecurity developments • Cyber risk governance • Assessments by third-party experts • Key cyber risk metrics • Projects and initiatives The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CFO, who reports directly to the Chief Executive Officer. Our CFO leads a team of dedicated professionals who are responsible for a wide range of risk assessment and management and leads specialized teams of internal and external experts focusing on distinct categories of threats.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: We develop and maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program is one component of our enterprise risk management system. The technical, administrative and physical controls underlying our program are based on nationally recognized practices and standards for cybersecurity.

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, and other significant disruptions of information technology networks and related systems. See also "Item 1A. Risk Factors – Risks Related to our Operations – We face risks associated with security breaches through cyber attacks, cyber intrusions, ransomware or otherwise, as well as other significant disruptions of our information technology ("IT") networks and related systems." We have never experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. With the assistance of a third party technology consulting firm, we have adopted and implemented an approach to identify and mitigate cybersecurity risks. For example, we have adopted and implemented, or are in the process of adopting and implementing, many of the voluntary practices recommended under the National Institute of Standards and Technology cybersecurity framework 2.0, which we believe is a best practice for U.S.-based real estate companies.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: The Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Risks Related to Data Security and Intellectual Property," which should be read in conjunction with the information above.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: This governance structure ensures that cybersecurity risks are effectively managed by the IT Department, with oversight from the Executive Committee and the Board. It maintains clear lines of communication and accountability, enabling timely decision-making and response to cybersecurity matters.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: Our Board of Directors exercises general oversight of our risk management activities, including our cybersecurity program. With respect to risks related to cybersecurity, our Board of Directors has delegated the primary oversight responsibility to the Audit Committee. The Audit Committee, along with management, reports to the full Board of Directors on these matters throughout the year.

companyName: ROSS STORES, INC.

ticker: ROST


text: Our cybersecurity and information security program also includes review and assessment by external, independent third-parties, with whom we periodically consult on threat assessments and security enhancements, and incident response preparedness. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. Additionally, the Company has a third-party risk management program that assesses risks from vendors and suppliers. In response to these assessments, we have developed contingency plans for business continuity if our vendors are subject to a cyberattack that impacts our use of their systems.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: nCino's CISO reports cyber security risk assessment results at the Enterprise Risk Management Committee, Information Security, and Board and Audit Committee Meetings. nCino uses formal and informal education and training efforts to identify and mitigate cybersecurity risk, which includes external collaboration with peers and industry groups. nCino maintains a documented process for when and by whom senior management is informed of a cybersecurity incident and when such information will be reported to affected parties. These processes are detailed within our Incident Response Plan which is regularly reviewed and updated by the information security team.

companyName: nCino, Inc.

ticker: NCNO


text: Further, Avient has a Cyber and Data Incident Response Team (CDIRT), which is a cross-functional group established to provide a quick, effective and orderly response to cyber and data related events. The CDIRT's mission is to prevent a material loss of profits, public confidence, or information assets by providing an immediate, effective, and skillful response to any unexpected event in which there is an unauthorized release or access of sensitive information.

companyName: AVIENT CORP

ticker: AVNT


text: We have implemented a cyber incident response standard operating procedure (the "SOP") detailing actions to be taken in the event of a cyber incident. Pursuant to the SOP, any suspected cyber breaches or detected vulnerabilities are promptly reported by our cybersecurity team to our Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO") for further assessment and/or remediation. In addition, we require our employees to regularly participate in mandatory cybersecurity training that covers critical aspects of digital security, including phishing prevention, threat awareness, and safe data handling practices. Cybersecurity risk considerations are also incorporated into our broader business continuity planning. In addition to our internal processes, our partnerships with various third-party vendors comprise a key component of our cyber risk management program. We engage several reputable third-party companies to monitor and maintain the performance and effectiveness of our products and services, as well as to conduct System and Organization Controls (SOC) assessments and our mandatory cybersecurity training for employees.

companyName: STEM, INC.

ticker: STEM


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. We face ongoing risks from certain cybersecurity threats, and we cannot provide assurance that, if those risks materialize, our business strategy, results of operations or financial condition will not be materially affected in the future. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: In addition, the Chief Information Security Officer presents updates at least annually to the Board of Directors with respect to the information security program, including the results of our independent, third-party assessment. The Board of Directors also participates in annual table-top exercises involving simulated data security incidents and the Company's responses to those incidents.

companyName: Zoetis Inc.

ticker: ZTS


text: The Program integrates seamlessly with the Company's enterprise risk management program. Continuous threat and vulnerability assessments inform system and control updates, effectively mitigating risks. Layered security controls work together to protect customer information and transactions. Additionally, third-party experts conduct periodic program evaluations through penetration testing, audits, and best practice consultations, with results driving program improvement initiatives. As a regulated entity, California Bank of Commerce undergoes regular bank regulatory examinations evaluating the information security program and its compliance with federal regulations.

companyName: California BanCorp \ CA

ticker: BCAL


text: Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing Company's cybersecurity risk management processes. Our cybersecurity risk assessment and management processes are implemented and maintained by our President and Chief Executive Officer.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: Our incident response plan designates our ISC as primarily responsible for identifying and evaluating any cybersecurity incident or suspected incident and reporting any such incidents to our General Counsel in order for management to evaluate materiality, and to report to our Audit Committee, our Board and make public disclosures, as applicable. Our General Counsel is responsible for routinely updating both the Board and the Audit Committee on the Company's cybersecurity personnel, practices and processes and, pursuant to our data breach response policy, which is updated from time to time, he must report to the Board in the event of any detected material incident and regularly update the Board on any mitigation and remediation steps being taken in connection with the Company's response. The Company has, from time to time, engaged external experts, including cybersecurity assessors, consultants, auditors, and legal counsel, in evaluating and testing our risk management systems and on a project-specific basis to assist us with projects that will improve our IT infrastructure, strengthen our products' security posture, and improve our cyber readiness. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: Security Policy and Requirements We have an Information Security Policy that details the overall risk-based framework and governance for the management and security of our information technology assets and information. The policy applies to everyone who accesses our data or information resources, including third parties we engage.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a vendor management policy for service providers.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: Each of the Company, 26North and our industry generally is highly dependent on information systems and technology and as a result, could be prone to cybersecurity threats and attacks. In response, 26North maintains a cybersecurity program that includes policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated.

companyName: 26North BDC, Inc.


text: Verizon effectuates cybersecurity management by providing for close cooperation among the CISO's team and other teams within the company, as well as by integrating cybersecurity risk into Verizon's overall enterprise risk management structures and processes. Each of our business units and certain functional groups have a Business Information Security Officer, who is an integral member of that unit or group, but reports to the CISO. This structure provides the CISO with line of sight across the enterprise. The CISO and members of their leadership team also meet regularly with business unit senior leaders, including the CEO, the Chief Financial Officer and the Chief Human Resources Officer, to discuss business priorities, emerging threats and trends, and the performance of the cybersecurity program.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") is responsible for overseeing our cybersecurity risk management processes, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives regular reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from our information technology and cybersecurity experts. In addition, on at least an annual basis, the Board receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes.

companyName: GENTEX CORP

ticker: GNTX


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as third-party systems that could adversely impact our business in the event of a Cybersecurity Event affecting those systems.

companyName: PROS Holdings, Inc.


text: Our Board has delegated to its Audit and Finance Committee the responsibility for overseeing cybersecurity risk exposures in addition to our broader risk management program. Management (including our Chief Information Officer ("CIO") and our CISO) reports at least annually to the Audit and Finance Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster our security systems and the cyber readiness of our personnel.

companyName: EASTMAN KODAK CO

ticker: KODK


text: Our approach includes regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment. Our third-party security expert consultant has over 30 years of experience with cybersecurity, information technology development and deployment, and information technology risk assessment and management, including information security management.

companyName: Onconetix, Inc.

ticker: ONCO


text: We maintain a regularly revised Cybersecurity Incident Response Plan and Cybersecurity Incident Notification Policy, which provide protocols for evaluating and responding to cybersecurity incidents, including escalation of information to senior leadership, including the Board of Directors, as appropriate, and meeting external reporting obligations. We periodically perform tabletop exercises where we perform walkthroughs of cybersecurity incident situations to test our response plans. To date, we have not experienced any cybersecurity incidents that materially affected, or are likely to materially affect, our business strategy, results of operations, or financial condition, but future incidents cannot be predicted. See "Item 1A. Risk Factors" for additional information regarding cybersecurity-related risks that could impact our business.

companyName: Performance Food Group Co

ticker: PFGC


text: All our manufacturing sites have formal business continuity plans that address site-specific priority responses, each determined through business impact analyses that integrate within our overall corporate crisis management response plan and enterprise risk management program. We also conduct frequent drills and exercises of formal cyber response procedures and business continuity plans. Lessons learned from the outcomes of these exercises are then assessed and used to inform and improve our formal cyber response procedures and business continuity plans.

companyName: ALBEMARLE CORP

ticker: ALB


text: Since the beginning of the last fiscal year, Matson has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, but the Company faces certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect the Company. For more information on the risks and impacts of these matters to Matson, see Part I, Item 1A. Risk Factors – "The Company's information technology systems have in the past and may in the future be exposed to cybersecurity risks and other disruptions that could impair the Company's ability to operate and adversely affect its business. "

companyName: Matson, Inc.

ticker: MATX


text: Separately, employees are trained to promptly report any suspicious behavior or events to the Company's Core Security Incident Response team. This team includes IT, cybersecurity, compliance, and risk management team members from both TKO and Endeavor. The core team oversees the investigation and handling of all reported incidents (which incidents are tracked in real time). If the core team determines that the reported event could potentially impact personally identifiable information processed by the Company, confidential/proprietary information or cause a financial loss, the core team reports the matter to TKO's Cybersecurity Executive Steering Committee, which includes TKO's Chief Administrative Officer, General Counsels, Chief Financial Officer, Chief Accounting Officer, Chief Product & Technology Officer, Corporate Secretary and Head of Investor Relations, as well as Endeavor's Chief Financial Officer, Chief Accounting Officer, General Counsel, Chief Compliance Officer, Chief Information Officer, SVP, Internal Audit, SVP, Privacy & Cybersecurity, SVP, Cybersecurity, SVP, Head of Corporate Security and Chief Communications Officer. Reported events that may cause a financial loss are also reported to the legal department's fraud investigation team. The Cybersecurity Executive Steering Committee is charged with managing the Core Security Incident Response Team and determining whether any disclosures may be required as a result of the reported event.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: To date, due to our limited financial resources, we have not adopted any special processes for assessing, identifying, and managing material risks from cybersecurity threats to the Company or through our use of any third-party service provider, and we have not engaged any assessors, consultants, auditors, or other third parties in connection with such risks. We are not aware of any previous cybersecurity incidents involving the Company and we do not believe cybersecurity risks have materially affected us or our strategy, results of operations or financial condition. Our president, who is also our sole director and sole employee, is responsible for the oversight of risks from cybersecurity threats and is informed about such risks because of his direct participation in the Company's operations, transactions, and relationships. Our president has no prior work experience in cybersecurity and no relevant degrees, certifications, knowledge, skills, or other background in cybersecurity. Although we face cybersecurity risks, we believe such risks are reduced by the nature of our operations in which our product sales are made and payments are received through eBay and our website and email systems are maintained by third parties. We do not independently maintain any servers or other extensive information systems and correspondence and other business information is stored on our president's computer system, which is not on a network and is protected by a third-party virus protection program. We may be unable to successfully identify threats, prevent attacks, satisfactorily resolve cybersecurity incidents, or implement adequate mitigating controls. Any breach of our or our providers information systems or other cybersecurity-related incidents that results in, or may result in, the loss, theft or unauthorized disclosure of data, or any delay in determining the full extent of a potential breach, could have a material adverse impact on our business, results of operations, and financial condition, including harm to our reputation and brand, reduced demand for our products, time-consuming and expensive litigation, fines, penalties, and other damages.

companyName: Outdoor Specialty Products, Inc.

ticker: ODRS


text: Enterprise Risk Management At the core of our business, we host, collect, process, use and retain significant amounts of financial, personal and other sensitive data across our own technology environment and the third-party information systems of our vendors, service providers and partners. In order to keep this data secure, we maintain an enterprise risk management ("ERM") program designed to systematically identify and manage risk including risk from cybersecurity threats. The risk committee of the board of directors oversees our ERM program and it is reviewed annually by both the risk and audit committees of the board of directors. The risk committee also monitors and reports to the board regarding issues arising with respect to the risk governance structure and performance of the risk management function. The board, as a whole and through its committees, regularly engages with the Chief Risk Officer, management and outside advisors to identify, assess and manage risks of the company and to ensure the risk management function has the appropriate resources and authority to fulfill its responsibilities. An executive risk committee, comprised of senior leaders of our lines of business and corporate functions, provides executive level accountability for the ERM program.

companyName: FISERV INC

ticker: FISV


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated the oversight of cybersecurity and other information technology risks to the Board's Audit Committee. As part of this oversight, we created the Information Security Advisory Team (the "Task Force"). The Task Force is comprised of senior managers and executives from multiple departments within the Company, including the IT, finance, legal and operations departments. The Task Force oversees our information security program and our strategy, including management's implementation of cybersecurity risk management. The Task Force meets at least quarterly to discuss matters involving cybersecurity risks.

companyName: MARA Holdings, Inc.

ticker: MARA


text: We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature. We believe our information security program is appropriate for a company of our size and stage of development, taking into account our operations and risks.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: The board of directors oversees risks from cybersecurity threats. However, there are no specific processes by which the board may be informed about such risks.

companyName: Unite Acquisition 2 Corp.


text: Sponsor Oversight: The Sponsor has a fundamental role in overseeing the Funds' cybersecurity risk management. The Sponsor receives regular updates on cybersecurity matters from management and third-party service providers, ensuring that cybersecurity risks are managed proactively at the highest level of the organization.

companyName: Amplify Commodity Trust

ticker: BDRY


text: Diamondback's cybersecurity risk management program, which it provides to us under the services and secondment agreement, includes: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise IT environment; • a security team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) its response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of its security controls; • security tools deployed in the IT environment for protection against and monitoring for suspicious activity; • cybersecurity awareness training of its employees, including incident response personnel and senior management, including those who provide these services for us; • cybersecurity tabletop exercises for members of its cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: VNOM Sub, Inc.


text: The Company's cybersecurity program is an integral element of the Company's overarching strategic plan and risk management system. The robustness of the cybersecurity initiatives directly impact the realization of the Company's mission, vision, and goals. Aligned with the National Institute of Standards and Technology Cyber Security Framework, the Company employs a comprehensive "defense-in-depth" strategy, deploying multiple security measures to safeguard its operational environment and data integrity systems.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Our CISO leads a global cybersecurity organization, which develops our strategic cybersecurity priorities and executes operational plans. Our CISO has over 25 years of cybersecurity experience in the healthcare, finance, and telecommunications industries and in government. Prior to his role at Kenvue, our CISO spent over 10 years at J&J in cybersecurity, and he retired from the United States Air Force Reserves in 2018 as a Lieutenant Colonel, where he had responsibility for cybersecurity. He is a Certified Information Systems Security Professional and holds a Masters in Telecommunications Management from the University of Maryland, University College and a Directorship Certification from the National Association of Corporate Directors. Our CPDO has over 10 years of privacy and digital legal experience. Prior to his role at Kenvue, our CPDO worked for over 15 years in J&J's Law Department. He also worked as a lawyer in private practice at the law firm Linklaters LLP, in industry associations, and in government, and he acted as Vice Chair of the Consumer Goods Privacy+ Consortium, an association developing compliance strategies and best practices to meet requirements of global privacy laws. He holds a Juris Doctor from Luiss Guido Carli University (Rome, Italy) and a Master of Laws in European Law and Economic Analysis from the College of Europe (Bruges, Belgium). The other members of the cybersecurity organization have decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants.

companyName: Kenvue Inc.

ticker: KVUE


text: Senior executives provide the Board of Directors with quarterly updates concerning cybersecurity risks and the Company's cybersecurity strategies and objectives. In addition, members of management briefed on specific issues attend Board meetings to provide additional insight into the specific issues being discussed, including risk exposure.

companyName: MEDIFAST INC

ticker: MED


text: The above cybersecurity risk management processes are integrated into our overall risk management program. Cybersecurity threats are understood to be dynamic and to intersect with various other enterprise risks. As such, cybersecurity is considered an integral component of our enterprise-wide risk management approach. As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Partnership.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: We place the utmost importance on information security and privacy, including protecting the personal medical, financial and insurance information of our patients and employees. As part of a larger digital technology program, we have a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including through monitoring and assessing our threat environment; vulnerability assessments; detecting and responding to cyber-attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness and incident response plans; and investments in cybersecurity infrastructure and technology intended to reduce cybersecurity risk. Key aspects of our cybersecurity risk management program include the following: • adoption of the National Institute of Standards and Technology, or NIST, Cybersecurity Framework to assess the maturity of our cybersecurity programs; • periodic comprehensive cybersecurity program assessments conducted by an external cybersecurity consultant; • enterprise-wide security and privacy policies that are reviewed and updated annually; • information security and privacy training included in mandatory onboarding and annual compliance training for all personnel; • regular testing, both by internal and external resources, of information security defenses; • incident response procedures; • third-party cyber risk program to assess cybersecurity and information security risk associated with third parties that perform contracted services using information on our network; and • a security operations center that is designed to continuously monitor information on our network, investigate potential cyber threats and report on information security incidents.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: (5)Third-Party Risk Assessments. We maintain a comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks presented by third parties, including our vendors and service providers. We have a dedicated information technology vendor management team that reports to our Chief Information Officer ("CIO"). We conduct initial and regular cybersecurity assessments of third-party vendors that we engage with in our operations and their information security policies and systems in order to identify, evaluate, and address potential vulnerabilities.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Management and the Company's third-party information security officer discuss information technology needs and activity and assess and manage material cybersecurity risks and the Company's practices for the prevention, detection, mitigation, and remediation of cybersecurity incidents, as necessary and appropriate. Our third-party information security officer has 30 years of experience in the IT management field and has consulted with large and mid-size corporations on proper IT processes and security. Our CEO during the year ended December 31, 2023 and our CFO have managed information technology departments during their careers. Our CFO was trained as an auditor and an information technology auditor at the public accounting firm of Ernst & Young LLP and audited public companies, information technology departments, and third-party information technology service providers for 12 years.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Fund and the Advisers. This cyber risk management program is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Fund and other affiliates of TIAA.

companyName: Nuveen Churchill Private Capital Income Fund


text: We are not aware of any risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. As discussed more fully under Item 1A "Risk Factors," there is a risk that we could experience a security incident and a compromise of our information technology systems and data. There is no assurance that our cybersecurity program will in all cases prevent such security incidents. We also maintain cybersecurity insurance that we regularly review to assess for appropriate coverage.

companyName: Waystar Holding Corp.

ticker: WAY


text: our PRC subsidiary has established Information Security Committee and appoints the CEO, Mr. Tao Guolin to be the head of the committee;

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risks and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. The Chief Financial Officer also promptly informs and updates the Board about any information security incidents that may pose significant risk to our Company.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, security management works with senior management to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and reports to the audit committee of the board of directors, which reviews our overall risk management framework and programs.

companyName: Confluent, Inc.

ticker: CFLT


text: Our IT policies and procedures include the expectations of all employees and all third parties who may be given access to our IT systems to maintain the security of our IT systems.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: The Company relies on Ashford Inc. and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Lodging & Hospitality, LLC ("Remington Hospitality") ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.

companyName: Stirling Hotels & Resorts, Inc.


text: In the last three fiscal years, we have not identified any cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: The Corporation's Chief Information Security Officer (CISO) is responsible for assessing and managing the Corporation's risks from cybersecurity threats. The CISO is an active Certified Information Security Systems Professional and has been with the organization for 17 years with over 20 years of experience in technology infrastructure and security.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: The secure processing, maintenance and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, customers, suppliers and business partners, is important to our operations and business strategy. As a result, cybersecurity, data classification and data protection are key components of our long-term strategy.

companyName: QXO, Inc.

ticker: QXO


text: We continuously monitor our information technology environment to detect and respond to threats in real-time. Our dedicated cybersecurity team uses sophisticated tools to track anomalies, potential vulnerabilities, and ongoing attacks. This includes leveraging a best-in-class third-party 24/7/365 Security Operations Center.

companyName: Paysign, Inc.

ticker: PAYS


text: Cybersecurity represents an important component of our overall approach to risk management. Our information security risk management (ISRM) policies, standards and practices are integrated into our overall enterprise risk management approach, and cybersecurity risks are one of the business risks that are subject to oversight by our Board of Directors. Our ISRM policies, standards and practices align with National Institute of Standards (NIST) and Technology Cybersecurity Framework and International Organization for Standardization (ISO) 27001.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: In order to mitigate cybersecurity risk, LiveRamp maintains a security program based on widely known and accepted industry standards, including NIST CSF, ISO 27001, and SOC 2. Aligning to these standards allows our program to adjust to changing conditions such as new technology, industry best practices, or organizational risk tolerance.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: The Enterprise Technology group, in conjunction with the Enterprise Risk Management department, and most specifically within that group, the Chief Information Security Officer, are responsible for implementing and maintaining the Company's cybersecurity risk management program. The Enterprise Technology group includes cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Individuals within these departments are subject to professional education and certification requirements. As a governance and oversight function, the Enterprise Risk Management department measures and reports on the quality of information and cyber risk management across all functions of the Company. Cybersecurity risk is reported by both the Enterprise Risk Management and Enterprise Technology departments through monthly cybersecurity meetings with executive management and quarterly Enterprise Risk Management Committee meetings.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. To protect against such threats, we employ an array of data security technologies, processes and methods across our infrastructure to protect systems and sensitive information from unauthorized access. We maintain comprehensive identity and access management practices (e.g., roles and access privileges for each user; multi-factor authentication, privileged user accounts, single sign-on, user lifecycle management) and employ a variety of security information and event management tools. Non-technical safeguards also play an important role in our cybersecurity program. We provide standard operating procedures, work instructions, guidelines, communications, training programs, tools and other documentation and resources to help employees avoid risky practices, help us promptly identify potential or actual issues and employ cybersecurity requirements in their day-to-day work We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow-up on matters already reported. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: Our cybersecurity risk management program includes: physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and customer, employee, bank partner and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse, or theft of information and other data, confidential information, or intellectual property. However, to date, these incidents have not had a material impact on our operations. Any significant disruption to our service or access to our systems could adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Risk Factors – Risks Related to Information Technology and Data Privacy.

companyName: Savara Inc

ticker: SVRA


text: Our management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and, when formally adopted, implementing and maintaining our cybersecurity program.

companyName: TEN Holdings, Inc.

ticker: XHLD


text: Our CISO oversees our cybersecurity policies and processes, including those described in the section titled "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: • Ongoing threat intelligence monitoring aimed at helping Samsara identify threats that may impact Samsara's production and information environments; • Mechanisms for real-time or otherwise prompt reporting through multiple channels, including e-mail and instant messaging to a team of on-call incident responders; • Supplemental retrospective reviews of reported incidents to identify trends and track resolution of incidents identified during the incident review process; • Routine product reviews to assess progress on key security initiatives, along with assessing existing and emerging product-related risks; and • Annual tabletop exercises in which we test our incident response procedures with management representatives from across the company.

companyName: Samsara Inc.

ticker: IOT


text: As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For further discussion, please see the risk factors titled "Maintaining cybersecurity and data security is important to our business and a breach of our cybersecurity or data security could result in serious harm to our reputation and have a material adverse impact on our business and financial results" and "We are highly dependent on information and communication systems and system failures and other operational disruptions could significantly disrupt our business, which may, in turn, materially adversely affect our business, financial condition and results of operations and our ability to make distributions to our stockholders" in Part I, Item "1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: The Board of Directors has responsibility for oversight of cybersecurity risk management. As part of our enterprise risk management program, the Board has established oversight mechanisms that seek to implement effective governance in managing risks associated with cybersecurity threats.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: We maintain a cybersecurity program that includes development and implementation of policies, procedures and tools designed to help ensure availability of critical information technology and telecommunication systems and safeguard sensitive information. The cybersecurity program is assessed against industry standards, including the Center for Internet Security critical security controls. This assessment is conducted by a third party periodically and internally at least annually. We are also required to comply with cybersecurity standards under the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection and by the Department of Homeland Security Transportation Security Administration. We also periodically collaborate with law enforcement experts, external assessors, consultants, industry peers and other third parties in connection with understanding market and threat conditions used to identify, assess and mitigate cybersecurity risks.

companyName: WISCONSIN POWER & LIGHT CO


text: Oversight of cybersecurity risk is maintained by the Company's Board of Directors and is supported by the Audit Committee of our Board of Directors (Audit Committee). The Audit Committee is primarily responsible for overseeing our design, execution and administration of the Company's enterprise risk management process, and with regard to cybersecurity risks, setting expectations and accountability for management and reviewing management's assessment of the effectiveness of our cybersecurity controls, including policies and procedures to address our cyber risks and overseeing the Company's cybersecurity disclosures. The Company's information security program is managed by the Company's Director of IT, whom reports to the Chief Financial Officer (CFO), and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The Director of IT periodically briefs the Audit Committee and our CFO, as well as our Chief Executive Officer, other members of the Board of Directors and other members of our senior management as appropriate. These reports include, but are not limited to, new developments, evolving standards, vulnerability assessments, third-party and independent reviews, threat environment summaries and technological trends. When applicable, the Audit Committee and other members of the Board of Directors also receive prompt information from the CFO regarding any material cybersecurity incident and appropriate ongoing updates thereto.

companyName: Mayville Engineering Company, Inc.

ticker: MEC


text: Our ITGCs are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our Board of Directors. We conduct cybersecurity penetration testing annually to identify and remediate cybersecurity gaps. We also perform cybersecurity assessments of all our third-party providers who have access to our information technology systems and data.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: In addition, the Audit Committee of the Board (the "Audit Committee") monitors internal audit's coverage of cybersecurity governance, risks, and related controls, including any identified deficiencies, from cybersecurity or other risks, that could adversely affect the ability to record, process, summarize, and report financial data. The Risk Committee coordinates with Audit Committee for review of information security matters, as needed.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: On a regular basis, the technology steering committee, led by management, receives comprehensive reports summarizing cybersecurity threat monitoring and incident management activities. These reports also include details about remediation efforts to address identified threats and incidents. Additionally, both internal and external assessments of our company's cybersecurity threat monitoring capabilities are shared with the committee. Meeting minutes from these committee sessions are diligently maintained and provided to the Board of Directors.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: JetBlue places great importance on safety including cybersecurity, to protect against various threats. The Company's cybersecurity strategy prioritizes detection, analysis and response to cyber threats, effective management of cyber risks, and resilience against cyber incidents. Safety is the Company's #1 value, and the strength of our safety is supported by exercising vigilance in security, including cybersecurity.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: The full Board of Directors has overall responsibility for overseeing the cybersecurity processes of identifying and mitigating cybersecurity risks. The Board of Directors has not delegated this responsibility to any one Committee, as its structure and size allows for the entire Board of Directors to oversee this responsibility. Periodically, our management provides updates to the Board of Directors regarding our internal control program, including any significant changes to its IT infrastructure and/or cybersecurity program. Management also communicates directly with the Board of Directors to report any material risks from cybersecurity threats.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: We have policies and procedures to oversee and manage the cybersecurity risks associated with both internal or external threats including the regular review of security reports, relevant cyber attestations, and other independent cyber ratings. These practices include technical controls and processes, as well as contractual mechanisms to mitigate risk. Additionally, we utilize cyber ratings, prepared by reputable external agencies which provide an independent ranking of our cybersecurity maturity and coverage, to assess our cyber proficiency on a standalone basis and comparatively against peers and other companies reviewed annually by the Board of Directors. We have also implemented certain third-party risk management processes to vet, select, and monitor suppliers.

companyName: ONE Gas, Inc.

ticker: OGS


text: W. P. Carey 2024 10-K – 21 Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state and confirming that the affected systems are functioning normally.

companyName: W. P. Carey Inc.

ticker: WPC


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Company's Chief Information Officer, other members of Management and a dedicated Cybersecurity team. • Collaborative Approach: The Company has implemented a comprehensive approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, logical access controls, and endpoint protection, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Network Penetration Testing: The Company performs an internal and external network penetration test led by its Internal Audit team and addresses any findings in a timely manner.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: As of the date of this Annual Report on Form 10-K, risks from cybersecurity threats have not materially affected, and we do not believe are reasonably likely to materially affect, us, our business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. For more information about these risks, please see "Risk Factors – Cyber-attacks or other failures in our telecommunications or information technology systems, or those of our collaborators, contract research organizations, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations." in this Annual Report on Form 10-K.

companyName: Karuna Therapeutics, Inc.


text: Board Oversight of Cybersecurity Risks Our Board of Directors (Board) is responsible for the oversight of our risk management program and regularly reviews information regarding our most significant strategic, operational, financial, legal and compliance risks, including cybersecurity risks. The Board delegates its oversight of cybersecurity risks to the Audit Committee; however, the Board reviews risks and mitigation plans through direct presentations and discussions with management as well as through receipt of committee chair reports at each regularly scheduled Board meeting.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: Our ECS team is led by our CISO. Our CISO reports to our CIO who, in turn, reports to our Executive Vice President and Chief Financial Officer. Our CISO has over 20 years of experience in leading global security functions and strategies. Collectively, the other members of our ECS team have decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ECS team.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: Related to Cybersecurity Risks Our Head of Information Technology (IT), under the oversight of our General Counsel, is responsible for the administration and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who currently holds the title of Head of IT has more than 20 years of experience in information security and cybersecurity risk management.

companyName: Disc Medicine, Inc.

ticker: IRON


text: Notwithstanding the extensive approach the Partnership takes to cybersecurity in conjunction with Greystone, the Partnership may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Partnership. See "Item 1A. Risk Factors," for a discussion of cybersecurity risks.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Notwithstanding any of these measures, our systems, networks, products and services remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cyber security threats, please see the risk factor titled, "Our operations, businesses, products, and business strategy are subject to cybersecurity risks,"in Item 1A. "Risk Factors."

companyName: DOVER Corp

ticker: DOV


text: We have not identified an indication of a substantive cybersecurity incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A Risk Factors above.

companyName: BATTALION OIL CORP

ticker: BATL


text: We and our third-party service providers conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan.

companyName: LUXURBAN HOTELS INC.

ticker: LUXH


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk management assessment process, covering all company risks. As part of this process, appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: The CISO reports to the CFO, who provides the Committee with bi-annual updates about our cybersecurity program and material risks.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: Threat Identification: We utilize advanced threat detection tools and services that continuously monitor our network for signs of unauthorized access, anomalies, and potential breaches. Our third-party cybersecurity provider is equipped with sophisticated detection technologies that help to swiftly identify even the most subtle signs of compromise. We focus on: Real-time monitoring of our networks; Regularly updated intrusion detection systems (IDS);

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Our Board has ultimate oversight for risks relating to our cybersecurity strategy. In addition, the Board has delegated primary responsibility to the Audit Committee for assessing and managing data privacy and cybersecurity risks, reviewing steps management has taken to monitor and control such cybersecurity risks, and regularly inquiring with our management team and internal auditors in connection therewith. The Audit Committee performs quarterly reviews of any confirmed cybersecurity incident. Additionally, on a bi-annual basis, the Audit Committee receives a comprehensive update regarding any cybersecurity events occurring during the prior period, progress of cybersecurity programs, changes in cybersecurity policies, and ongoing assessments of risks and mitigation activities, and to discuss the evolution of our cybersecurity strategy. The information in these reports and the results of these discussions are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.

companyName: Satellogic Inc.

ticker: SATL


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our SafetySmart platform ("Information Systems and Data").

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Cybersecurity Program Overview The Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks applicable to the Company. The Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Overland Advantage


text: Other members of our management team, including those from legal, finance, and internal audit, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants we engage; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Vista Outdoor Inc.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors– Intellectual Property Tax, Regulatory, and Litigation Risks" in this annual report on Form 10-K.

companyName: CINCINNATI BELL INC


text: Oversight of cybersecurity risk currently rests with department managers, who are responsible for monitoring IT systems, addressing potential risks, and reporting issues directly to senior management.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: While we believe that our current cybersecurity measures are robust, we recognize that the cybersecurity landscape is constantly evolving, and we remain vigilant in monitoring and adapting our practices to address emerging threats. We are committed to maintaining the confidentiality, integrity, and availability of our systems and data and to protecting the interests of our clients and stakeholders.

companyName: GT Biopharma, Inc.

ticker: GTBP


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a Cybersecurity Incident Response Policy; various other policies, plans, and frameworks in regards to (without limitations) access, acceptable use, password security and software system development; physical and administrative access and network security controls; data segregation; encryption of certain data; leveraging of certain SOC II-certified vendors; management, tracking and disposal of certain assets; systems monitoring; participating in information sharing and analysis centers (ISACs) to share and receive threat intelligence specifically related to biopharma and healthcare companies; and maintaining cyber insurance.

companyName: ACELYRIN, Inc.


text: We have a comprehensive cybersecurity training and awareness program. We require employees and contract employees to regularly participate in information security training and use internal phishing campaigns to measure the effectiveness of the training program.

companyName: Vital Energy, Inc.

ticker: VTLE