text: Chevron's cyber risk management process includes testing and risk assessments of technologies, third-party suppliers, and its IT and OT networks. These assessments ensure that our focus is on the highest priorities to maintain the security of our company's assets. To further protect the company's systems and data, Chevron's cybersecurity organization has threat intelligence capabilities to monitor security breaches impacting third-party suppliers. As third-party risks increase, the company's approach to third-party supplier risk management and qualification continues to evolve, including the ongoing expansion of its current supplier risk management program beyond IT vendors to other high-risk, third-party vendors.

companyName: CHEVRON CORP

ticker: CVX


text: Our CTO, holding a Doctorate in Strategic Intelligence, has served in various roles in technology research and military intelligence for 27 years. Our Director of IT, holding a degree in Computer Technology, has served in various roles in information technology for 30 years. Our Vice President of Platform Engineering has served in various roles in information technology and information security for over 33 years.

companyName: VirnetX Holding Corp

ticker: VHC

secItem: Item 1C


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through an internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our products) and implement appropriate changes.

companyName: AUDIOEYE INC

ticker: AEYE


text: Additionally, in order to reduce cybersecurity risks related to our use of third-party service providers, we (i) obligate our service providers to adhere to strict privacy and cybersecurity measures and (ii) perform risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is assigned a tiered risk rating, which determines the frequency and extent of evaluation for the service provider. Furthermore, we collect and evaluate SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents for our key service providers.

companyName: Rithm Capital Corp.

ticker: RITM


text: The Company's incident response plan provides clear communication protocols, including with respect to members of senior management, including the CEO, CFO, COO and CLO, the Audit Committee, internal and external counsel, particularly with respect to legal obligations to report the incident to tenants, regulators and law enforcements, and to the Disclosure Committee and external counsel with respect to the Company's SEC reporting obligations.

companyName: American Homes 4 Rent

ticker: AMH


text: We are acutely aware of risks associated with third -party service providers and we incorporate cybersecurity into our third -party vendor management policy. We conduct thorough security assessment to determine the category of risk third parties pose to Rocky Brands, with a priority focus on vendors with products or services that will have access to private and sensitive information. Vendor assessments incorporate inputs, including for example, BitSight and Service Organization Control Type 2 ( "SOC2") information available for our third -party vendors. Our assessments and monitoring are designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: Our cybersecurity risk management program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and other relevant organizations.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Despite these measures, the Company may be vulnerable to cybersecurity incidents that could disrupt operations, compromise sensitive data, or result in financial or reputational harm. Any material cybersecurity incident would be assessed and disclosed as necessary.

companyName: Coeptis Therapeutics Holdings, Inc.

ticker: COEP


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee our cybersecurity efforts and cyber-related risks. The Audit Committee, comprised fully of independent directors, is responsible for oversight of our (i) information security policies, including periodic assessment of risk of information security breach, training programs, significant threat changes and vulnerabilities and monitoring metrics and (ii) effectiveness of information security policy implementation.

companyName: Century Communities, Inc.

ticker: CCS


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.

companyName: ALEXANDERS INC

ticker: ALX


text: Service Providers. Like many companies, the Corporation relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Corporation maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Corporation data. The Third-Party Risk Management Policy applies to any business arrangement between the Corporation and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is audited as part of the Corporation's annual Internal Audit Risk Assessment.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Our management team is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers as needed.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the audit & risk oversight committee of our board of directors (Audit & Risk Oversight Committee). Our Audit & Risk Oversight Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The privacy & product compliance committee of our board of directors (Privacy & Product Compliance Committee) oversees risks related to privacy and data use, including overseeing compliance with our comprehensive privacy program. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors, including through the Audit & Risk Oversight Committee and Privacy & Product Compliance Committee.

companyName: Meta Platforms, Inc.

ticker: META


text: The Company has integrated its cybersecurity program into its overall risk management processes by instituting corporate measures and protocols that apply to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel, as well as similar processes in case of a crisis-related event at our portfolio properties. Our employee guidelines also address employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.

companyName: EQC Liquidating Trust


text: Our cybersecurity strategy is proactively designed to protect our digital infrastructure, customer environments, and business continuity. This approach is supported by our management and Board, with structured oversight to ensure compliance with evolving regulatory, risk, and industry best practices.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Regular risk assessments by management, including our Director of Information Technology, and audits to identify vulnerabilities and areas for improvement. The company performs annual financial and risk assessment audits aimed at identifying potential security threats. Clear delineation of roles and responsibilities within the organization for cybersecurity-related tasks.

companyName: HG Holdings, Inc.

ticker: STLY


text: Related to Cybersecurity Risks Our Vice President of Enterprise Technology Solutions is responsible for the strategic leadership and direction of the Company's information technology organization and possesses 25 years of tenure and experience with the Company in matters of privacy assurance, cyber, digital, and data security. As part of its risk oversight role, our Audit Committee of the Board of Directors oversees cyber risk, information security and technology risk, including management's actions to identify, assess, mitigate and remediate material cybersecurity issues and risks. The Audit Committee receives regular reporting from our Vice President of Enterprise Technology Solutions on our technology and cyber risk profile, enterprise cybersecurity program and key enterprise cybersecurity activities. We experienced no material cybersecurity incidents in fiscal 2024.

companyName: Vera Bradley, Inc.

ticker: VRA


text: Our cyber risk management program is designed to follow the ISO 31000 and the NIST Special Publication 800-37 frameworks and is in the scope of our ISO 27001 certifications.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: User Training & Education: We realize that human error can be a significant cybersecurity risk, so we have implemented education and training programs for our staff to raise awareness about cybersecurity best practices. By promoting a culture of security consciousness, we empower our staff to identify potential threats and respond effectively, in a way that is designed to enhance the overall cybersecurity posture of our organization.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: We have established an Operational Risk and Compliance Committee ("ORCC"), which includes our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Chief Information Officer ("CIO"), and Group directors across all functional teams. This committee, which meets monthly, oversees how risk and compliance standards are operationalized and enforced throughout the Group, including the implementation of risk mitigation activities where required. Areas that the ORCC covers, among others, include the Group's cybersecurity risk and control environment and the enterprise risks and control environment of technology and legal risks.

companyName: Flutter Entertainment plc

ticker: FLUT


text: The Company, our Manager and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our Manager's systems, train the Manager's employees and generally advise on cybersecurity processes. At least annually, our Manager has its information technology team and its third-party security firm make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and the Manager's employees, and the latest threats that have emerged.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: The Bank's primary responsibility for managing cyber risk is vested in the Bank's Information Security Officer ("ISO"). The Bank's ISO, who reports to the Chief Risk Officer, has four years of experience in information security and risk management. The ISO is responsible for the day-to-day management of the Cyber and Information Security Program, including oversight of risk assessments, incident response, employee training, and third-party vendor cybersecurity controls.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Our board of directors, in connection with management led by our Senior Vice President of Information Technology, work collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout our Company are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our board of directors monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.

companyName: STORE CAPITAL LLC


text: Risk Management/Strategy The protection of our data, including athlete and teammate data, is critical to the Company's strategy of being a trusted advisor throughout the athlete and teammate experience. Cybersecurity is integrated into the Company's Enterprise Risk Management framework and is overseen by management and the Audit Committee.

companyName: DICK'S SPORTING GOODS, INC.

ticker: DKS


text: –the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; –cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: In the event of a security incident, our incident response processes are designed to escalate certain cybersecurity incidents to senior leadership, the audit committee and the board of directors, as deemed appropriate.

companyName: SI-BONE, Inc.

ticker: SIBN


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Specifically, the board of directors' audit committee, is responsible for overseeing management's risk assessment and risk management policies, which include management of cybersecurity risk management processes.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Our cybersecurity risk management program operates within the Company's overall enterprise risk management program and is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of our overall enterprise risk, including legal, compliance, strategic, operational, and financial risk.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: Our Cybersecurity Approach and Integration We have implemented processes for overseeing and identifying material risks from cybersecurity threats, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. As part of management's oversight of cybersecurity, our Chief Security Officer ("CSO") presents on our cybersecurity practices to the Nominating and Corporate Governance Committee of our Board of Directors (the "NCG Committee") and to our full Board of Directors on a periodic basis. Our Senior Vice President, Internal Audit & Risk Management (the "Chief Audit Executive"), periodically presents enterprise risks, including cybersecurity risks, to the Audit Committee of our Board of Directors (the "Audit Committee"). Our Chief Compliance Officer regularly attends meetings of the NCG Committee to provide insights from the compliance perspective relating to cybersecurity.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Our cybersecurity policies, standards, processes, and practices are integrated into the Company's overall risk management and compliance program and are overseen by the Audit Committee. The Compliance Committee, led by our Chief Compliance Officer ("CCO") and the IT Committee, led by our Chief Financial Officer ("CFO") are responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures. In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the security and availability of information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: ALIMERA SCIENCES INC


text: Our Head of IT has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of IT professionals to monitor and assess cybersecurity risks, and is responsible for strategic leadership of our cybersecurity risk management program. The Head of IT role is currently held by an individual who has close to twenty years of professional IT management experience in the life sciences industry. Our Head of IT also provides regular updates on our cybersecurity risk to our executive leadership team and other management committees responsible for IT and cybersecurity risk management. Under our CSIRP and other applicable policies and procedures, we have established a framework for responding to cybersecurity incidents based on severity of the incident, which includes escalation to our executive leadership team and other management committees and assessment of materiality of cybersecurity incidents individually and in the aggregate.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Evaluation of third-party vendors' security practices to ensure they meet our strict standards, especially when they have access to sensitive data. Investment in Security Infrastructure: Investment in cybersecurity technologies and infrastructure to stay ahead of emerging threats.

companyName: QHSLab, Inc.

ticker: USAQ


text: Our management team provides periodic updates to the audit committee regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company. Our chief operating officer, with the assistance of third-party technical advisors, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help the Company and our employees to address cybersecurity risks. Our third-party technical advisors include consultants with over 20 years of experience in IT leadership as well as subject matter experts in cybersecurity that have extensive experience managing cybersecurity programs.

companyName: Climb Bio, Inc.

ticker: CLYM


text: Notwithstanding the foregoing, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Hudson Pacific Properties, Inc.

ticker: HPP


text: To facilitate the success of the Company's cybersecurity program, cross-functional teams work with the CISO and SOC seek to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and Management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board of Directors, as appropriate.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: The Chief Risk Officer holds the Certified Risk Manager designation, and has more than 30 years of technology experience, including 15 years overseeing cybersecurity processes, risk assessment and risk management.

companyName: AMERISAFE INC

ticker: AMSF


text: Recognizing the importance of cybersecurity to the success and resilience of our business, our Board of Directors considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our CAO meets regularly with management to proactively review current cybersecurity threats as well as our potential exposure. Our CAO, supported by members of our management team and information technology group, briefs the Audit Committee on cybersecurity matters as needed and holds discussions on cybersecurity risks, incident trends and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: Technical Safeguards We regularly assess and deploy technical cyber-safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, third-party cybersecurity threat assessments and incident response experience.

companyName: PGT Innovations, Inc.


text: The Audit and Finance Committee has oversight over and regularly reviews our cybersecurity, including IT risks, controls, procedures, and plans to mitigate cybersecurity risks and respond to security incidents. The Audit and Finance Committee receives reports on at least a quarterly basis from the Chief Information Officer and the Vice President, Information Security, on, among other issues, our cyber risks and threats, the status of projects, management's strategies to strengthen our IT systems, assessments of our security program, third-party assessments and testing, our emerging threat landscape, and the review of our cybersecurity insurance policy. Pursuant to our incident response procedures, material cyber incidents will be reported to the Chair of the Audit and Finance Committee upon a determination of material status. Due to the importance of cybersecurity, the full Board of Directors also receives updates on cybersecurity matters from management at least annually.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Our risk management strategy comprises of ensuring access controls are in place to prevent unauthorized users from accessing our systems. Our systems are completely cloud-based and our providers have their own security protocols to assist us. We retain audit logs and login records for review, and we use multifactor authentication and username/password management for all of our systems.

companyName: Envirotech Vehicles, Inc.

ticker: EVTV


text: Based on information known to us, we also do not believe any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to "Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" and "If we or our tenants fail to adhere to applicable privacy and data security laws, this could have a material adverse effect on us or on our tenants' ability to meet their obligations to us" included "Item 1A, Risk Factors" of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity threats.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: In the event of a cybersecurity incident, the IT Department promptly reports the matter to the Chief Financial Officer. The Chief Financial Officer is responsible for assessing the severity and potential impact of the incident and determining the appropriate course of action. The Chief Financial Officer keeps the Board informed of significant cybersecurity incidents and provides updates on the overall status of our cybersecurity program as needed.

companyName: Alzamend Neuro, Inc.

ticker: ALZN


text: As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: XCEL ENERGY INC

ticker: XEL


text: Material Cybersecurity Incidents During the fiscal year ended December 31, 2024, we did not experience any material cybersecurity incidents. Given our current operational status, we do not believe cybersecurity risks have materially affected, or are reasonably likely to materially affect, our financial condition or results of operations.

companyName: RIDGEFIELD ACQUISITION CORP

ticker: RDGA


text: We conduct periodic testing of software, hardware, defensive capabilities, and other information security systems to assess our cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, we consider both our individual risks and industry standards.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: Our Board of Directors and Board Risk Committee have delegated oversight authority to a management-level Risk Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise. The Risk Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience. The ISO and Director of IT present Information Security and Information Technology reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats. This information is subsequently reported up to the Board Risk Committee.

companyName: SIERRA BANCORP

ticker: BSRR


text: We believe cybersecurity risk management is an important part of its overall risk management efforts. The Company has a policy of transparency regarding our data collection, use, retention and sharing practices, and it is our commitment to implement appropriate technical security measures to protect all Company stakeholders and manage third party risk.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: During the year ended December 31, 2023, we did not identify any risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us. However, in the future, we may face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our operations could be disrupted by failure of our information systems or cyber-attacks."

companyName: Innoviva, Inc.

ticker: INVA


text: The Company's audit committee is briefed on cybersecurity risks at least once each calendar year and also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. The SVP of IT Security reports quarterly to the Company's audit committee and such report addresses overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, recommendations for changes and/or updates to policies and procedures.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: From time to time, we experience cybersecurity incidents and threats to our systems and information. Through the date hereof, no risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, and we do not believe are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity threats rapidly evolve and are complex, so we must continually adapt and enhance our processes. As we do this, we must make judgments about where and how to invest resources to most effectively protect ourselves from threats. These are inherently challenging processes, and we can provide no assurance that the processes that we implement will be effective. For more information regarding cybersecurity risks that could impact the Company, see our risk factor Governance

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: The Company's cybersecurity strategy focuses on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company relies primarily on its qualified internal team, with assistance from third party service providers, to operate and maintain its information technology infrastructure and systems and to evaluate, test and update various information security processes and to manage material risks from cybersecurity threats to the Company's critical computer networks, third party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature.

companyName: QUOTEMEDIA INC

ticker: QMCI


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurance that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors—Risks Related to Our Business" of this Annual Report for more information regarding the cybersecurity risks we face.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: Critical business and operational data are backed up nightly and securely stored offsite to mitigate the risks of cybersecurity incidents or equipment failure. We provide cybersecurity awareness training to our employees, incident response personnel, and senior management.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: The Risk Committee oversees the management process associated with cybersecurity risk. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings. The Board Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. The Board Risk Committee provides reports to the full Board on the Company's information security program on an annual basis.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: The Company maintains a 24 x 7 operations center that monitors the Company's IT environment and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.

companyName: Johnson Controls International plc

ticker: JCI


text: Aquestive's cybersecurity program is built on four key pillars: Governance, Process, Compliance and Audit. While we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, and results of operations, Aquestive's cybersecurity program is built upon a set of policies, procedures, and standards supported by training and awareness. In addition, cybersecurity risks are also reviewed as part of our overall Enterprise Risk Management program.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: The KESC, our cybersecurity leaders, and/or our CIRT evaluate each incident, as appropriate, in terms of its impact on our operations, our ability to conduct business with customers and suppliers, our brand reputation and health, safety, and the speed and degree to which the incident has been contained. These teams are also responsible for activating containment and resolution efforts and interfacing with third-party service providers like our MSSP where appropriate to support the Company through the resolution of the incident. After initial identification, the KESC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness and communicates with our leaders, including the CIO and CIRT about the same.

companyName: Kimball Electronics, Inc.

ticker: KE


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored; • performance of security control assessments on an ongoing basis; • addressing results of analysis and reporting security status to the executive team; • monitoring information systems to detect attacks and indicators of potential attacks or compromises; • identification of unauthorized use of the information system resources; • deployment of monitoring systems and agents strategically within the information system environment; and • require that third party service providers who store, process or transmit data with access to electronic Protected Health Information (ePHI) undergo an independent third-party audit to achieve system organization controls certification annually.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: We conduct periodic reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and attempt to improve our security measures and planning. We collaborate with external experts, including consultants and auditors, in evaluating and testing our information security program. Our employees and certain of our contractors are required to participate in security awareness training at least annually.

companyName: NCR Voyix Corp

ticker: VYX


text: Please see 1A. Risk Factors in this Form 10-K for more information regarding cybersecurity-related risks that could materially affect our business strategy, results of operations, or financial condition, including under the heading "Our business may be adversely affected by information technology disruptions".

companyName: Enpro Inc.

ticker: NPO


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Advisor, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and their program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President, Chief Risk and Transformation Officer, has 30 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 13 years. The CISO provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: The Investment Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us and to protect the systems, data and other digital assets of the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: Our EIP organization, led by our CISO, is responsible for the design and implementation of our information security program. Our current CISO has been with the Company for more than nine years—serving as our CISO for nearly eight years—and has extensive cybersecurity experience through leadership and consulting roles. His current leadership team has over 100 years of combined cybersecurity experience. These and other EIP team members work closely with stakeholders across the company to implement the program's policies, standards and processes. They also help ensure awareness that securing customer information and honoring our privacy promises are core employee obligations, as highlighted in our Code of Ethics and reinforced through our Valuable Information Protection training program.

companyName: BEST BUY CO INC

ticker: BBY


text: We are not aware of any specific cybersecurity incidents that individually or together materially affected our business in 2023, however we acknowledge that the current cyber environment means that we, like other companies in our industry, are under constant threat from hackers, terrorists and other cyber criminals that, if successful, could lead to data breaches, unauthorized access to sensitive information, and other cyber threats that would be reasonably likely to materially affect our business strategy, financial condition, or results of operations.

companyName: Snap One Holdings Corp.


text: As a foundation of this approach, the Company has implemented a layered governance structure to help assess, identify and manage cybersecurity risks. Martin Marietta's cybersecurity policies encompass incident response procedures and information security. In order to help develop these policies and procedures, the Company monitors the privacy and cybersecurity laws, regulations and guidance applicable to, as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks. The Company partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise, to monitor and test the performance and effectiveness of its cybersecurity controls and defenses. As described in Item 1A "Risk Factors" of this Form 10-K, the Company faces risks from cybersecurity threats that could have material adverse effect on its business including its business strategy, results of operations or financial condition. While the Company has experienced attacks on the security of its information technology systems to date, management is not aware that the Company has experienced a material cybersecurity incident during the 2023 fiscal year.

companyName: MARTIN MARIETTA MATERIALS INC

ticker: MLM


text: We assess and identify security risk to the organization by: • conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted. • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Service Center's Chief Information Officer. • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; and • continuously scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify, prioritize and mitigate potential material cybersecurity risks to our critical systems and information; • an internal Information Technology staff responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our associates, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors.

companyName: DIXIE GROUP INC

ticker: DXYN


text: Executive Oversight of Cybersecurity. Management is responsible for the Company's planning, identification, assessment, and mitigation of risks from cybersecurity threats. Our CISO, Chief Legal Officer, and Chief Financial Officer comprise our Core Cybersecurity Management Team (the "CCMT"). The CCMT has oversight of Teradata's CIRP and is informed and consulted on the response and resolution process for cybersecurity incidents. The CCMT is responsible for determining communications to inform relevant stakeholders of cybersecurity incidents as applicable, relevant, and/or required, including the Board; Audit Committee; the executive leadership team; investors; customers; employees; law enforcement; and regulators.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Risk Management and Strategy Assessing, identifying and managing cybersecurity risks are integral to our enterprise risk management activities. Our cybersecurity program leverages people, processes, and technology to timely identify and respond to cybersecurity threats. The Company has access control systems to limit physical and virtual access into our system to authorized users. In addition, we utilize services and software from third-party providers to monitor the Company's network and obtain expeditious alerts of anomalous activity. The Company takes a risk-based approach to manage cybersecurity risks and reviews third-party reports to oversee and identify cybersecurity threats. The Company maintains cybersecurity insurance to defray costs associated with a cybersecurity incident.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Our information technology department diligently monitors our daily operations, overseeing the security of our computer networks through implemented systems and processes aimed at safeguarding sensitive data. Utilizing encryption and authentication technologies, we fortify our systems against unauthorized access and data loss. This proactive approach ensures the integrity and confidentiality of our data, mitigating potential risks posed by cyber threats.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity strategy, risk management, and governance.

companyName: PJT Partners Inc.

ticker: PJT


text: Our Cybersecurity and Digital Risk Management ("CDRM") organization, under the leadership of a Global Chief Information Security Officer ("Global CISO"), operates a cybersecurity program that is designed to help us identify, assess, manage, and mitigate risks relating to cybersecurity threats and incidents. We design our cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the NIST Cybersecurity Framework, as guidance in supporting our ability to perform such functions.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Third-party risk management is an important focus of the Cooper Standard cybersecurity program. Cybersecurity is evaluated and considered throughout the lifecycle (onboarding, ongoing operations, offboarding) of third-party relationships as we conduct business with them. We review the security posture of each third-party prior to initiation of the relationship, and periodically throughout the relationship. We evaluate several aspects of information security, utilizing guidance from globally recognized frameworks (e.g., ISO 27000:2022). Critical service providers are also required to submit independently certified assurance of their security controls based on internationally recognized standards (e.g., ISEA 3402, SOC 1, SOC 2, etc.). Finally, upon relationship termination, we ensure each third party is properly offboarded, addressing critical cybersecurity concerns such as eliminating access and obtaining and/or deleting Company data.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: Risk Management and Strategy recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats which include, among other things, operational risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of privacy or security laws and related litigation and legal risk, and reputational risks.

companyName: Expion360 Inc.

ticker: XPON


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the IT Department works with the CSI Management Team to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business. In addition, our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which, together with the board of directors, evaluates our overall enterprise risk.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: As part of our overall risk management process, we conduct an annual assessment of information systems and organizational assets, as well as periodic vulnerability scanning, penetration testing, security audits, and ongoing risk assessments. We also maintain incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually. We use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: NLIGHT, INC.

ticker: LASR


text: We have developed a program for assessing, identifying and managing material risks from cybersecurity threats to our information and information systems. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective identification, prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cybersecurity risks and mitigations. We have a comprehensive cybersecurity program which includes risk management designed to protect the confidentiality, integrity and availability of our information systems and maintain compliance.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: We recognize the critical importance of cybersecurity and data protection and understand the potential harm to our business from cybersecurity incidents. Accordingly, we place a high priority on mitigating risks associated with cybersecurity threats and any cybersecurity incidents.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: We maintain an information security program designed to identify, assess, and manage material risks arising from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware, software, and data, including intellectual property and confidential, proprietary, or sensitive information, such as customer data.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by the officers of Rand and RCM, and is primarily administered by our experienced third-party IT service provider. The officers of Rand and our third-party IT service provider are in regular communications as a means to discuss and determine actions to be taken by the Corporation with respect to our ongoing cybersecurity risk mitigation efforts.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2024 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Business Operations - A cyber security incident could cause a violation of HIPAA, breach of member privacy, or other negative impacts." under "Item 1A. Risk Factors."

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: Our reliance on third-party service providers, such as Google Cloud for server hosting and Stripe for payment processing, incorporates a level of inherited security measures. Nonetheless, our commitment extends to continuously assessing and enhancing our cybersecurity frameworks to align with evolving industry standards and best practices.

companyName: PAID INC

ticker: PAYD


text: In 2024, we did not identify any cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, cash flows or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, nor provide assurances that we have not experienced undetected Cybersecurity Events. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: PROS Holdings, Inc.


text: Lyke is notified real time by the managed service provider for matters requiring immediate attention. Mr. Lyke also reviews a standardized monthly report with key IT systems data and statistics, including red flags requiring resolution, if any. Management reports serious cybersecurity incidents to the Committee and our Board.

companyName: MAYS J W INC

ticker: MAYS


text: Our board of directors oversees management of our cybersecurity risks through the Audit Committee. As needed, the chairperson of the Audit Committee provides updates on the Company's cybersecurity risk program to the full board of directors.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Our internal security controls and our cybersecurity processes, technologies, and controls are governed by the Company's Chief Security Officer and Chief Information Security Officer, or CISO, who reports quarterly on security matters, including cybersecurity, to the Company's internal Enterprise Risk Committee. Our CISO has been with us since 2011 and has worked in cybersecurity for over 21 years. In addition, as a provider of cybersecurity offerings, we employ numerous leaders who have experience in the cybersecurity industry. All Company employees must complete required annual information security and privacy training, which are reviewed and updated annually. They also receive ongoing security awareness education through emails, presentations, and other available training materials on our intranet. Pursuant to the Board's oversight of the Company's operational risk management, the Board has designated authority and responsibility to its Audit Committee to regularly review our processes and procedures for managing cybersecurity risks and handling cybersecurity incidents. The Audit Committee receives quarterly updates from the CISO and others from the CISO's security team regarding our security programs, including a review of cybersecurity risks, threats, and vulnerabilities. Additionally, the Board of Directors receives an annual report on the cybersecurity threat landscape from at least one senior leader.

companyName: SecureWorks Corp


text: The Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board of Directors is responsible for overseeing overall risk management for the Company. The Audit Committee receives reports from the CISO regarding the cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Members of the Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party service providers in normal course of business use. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house our critical systems and data.

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB


text: The Board oversees the Company's overall ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee is responsible for overseeing our risk exposure to information security, cybersecurity and data protection, as well as the steps management has taken to monitor and control such exposures, and regularly provides reports to the Board on cybersecurity risk management. The Audit Committee Charter was amended in October 2023 to explicitly set forth the Audit Committee's responsibility for such oversight. The Audit Committee receives regular presentations and reports from our Director of Global Cybersecurity and our CIO on cybersecurity risks and prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. Our Information Security Council also report to the Board at least annually on data protection and current internal and external developments in cybersecurity, as part of the Board's enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: we are not aware of any cybersecurity threats, and have not experienced any cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: The Board of Directors maintains overall oversight of cybersecurity risk, and the Audit Committee provides direct oversight of the Company's activities to prevent, detect and respond to cybersecurity threats. The Chief Information Officer ("CIO") and a designated system security engineer are the primary responsible management parties to monitor, assess, and manage cybersecurity risk. Our CIO has led global IT organizations for over ten years with direct oversight responsibility for cybersecurity, the global IT landscape and its data integrity. Our security engineer is solely focused on monitoring, assessing, and managing Superior's cybersecurity breach prevention, detection and management, including the ongoing cybersecurity risk education of our employee base. Our security engineer's experience includes the design and implementation of IT security systems, tools, and processes, comprehensive security assessments, and the implementation of remediating action plans for detected weaknesses.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity in connection with its general risk assessment and oversight. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: ATN International, Inc.

ticker: ATNI


text: Entergy's CSO is responsible for overseeing physical, cyber, and reliability risk, including governance, compliance, and threat intelligence. The CSO's background includes serving as the Global Lead Business Information Security Officer for a multinational pharmaceutical and biotechnology company, Vice President of Cybersecurity Solutions for an international consulting firm, and an operations manager for a multinational technology company. The CSO is also a former intelligence officer in the U.S. Marine Corps, with experience in the Fleet Marine Force, Joint Staff J-2/Defense Intelligence Agency, and Headquarters Marine Corps Command, Control, Communications, and Computers (C4I). The CSO participated in numerous exercises and crisis operations during his time in the military. The CSO is a certified Information Security Manager from the Information Systems Audit and Control Association and a certified Information Privacy Manager from the International Association of Privacy Professionals. The CSO also completed the Harvard Kennedy School Executive Education Program in Cybersecurity and the FBI Domestic Security Executive Academy.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: The Company has established an Executive Privacy & Security Council ("EPSC") that meets semi-annually. Formed in 2003, the EPSC consists of a cross-functional senior leaders, including the Chief Information Officer ("CIO"), the Chief Information Security Officer ("CISO"), the Chief Risk Officer ("CRO") and General Counsel among others. The EPSC receives a monthly written executive briefing on topics, and with metrics related to cybersecurity, including incident prevention, detection, mitigation and remediation. Quarterly, the IT Risk Council, made up of senior IT leaders, is also provided with an update of cybersecurity risks and preparedness. Various other meetings are held on cybersecurity topics periodically, including monthly business operating reviews, and meetings of the Enterprise Risk and Capital Committee ("ERCC") and executive leadership team.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: The Board of Directors is composed of members with diverse expertise, including risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively. Further, certain members of the Board of Directors are National Association of Corporate Directors ("NACD") CERT Certified in cybersecurity oversight.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems, as overseen by our Board, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct risk assessments of certain third-party providers before engagement and have established monitoring procedures in an effort to assess and mitigate potential data security exposures originating from third parties. We from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: RYVYL Inc.

ticker: RVYL


text: We utilize various tools and security technology to help us deter, detect, identify, and respond to potential cybersecurity threats. Annually, we undergo external evaluations by third-party consulting services, including the performance of penetration testing and vulnerability scanning. With respect to third-party service providers, we generally require our vendors to maintain security controls to protect our confidential information and data, and we perform risk assessments of IT vendors, including their ability to protect data from unauthorized access. When the Company learns of a cybersecurity incident at a third-party service provider, the Company's respective department contacts maintain communication with the third-party service provider and communicate the incident to our Chief Technology Officer ("CTO"). As described in Part 1, Item 1A (Risk Factors), our operations rely on the secure processing, storage, and transmission of confidential and other information in our IT systems and networks. Computer viruses and other events beyond our control, including cybersecurity attacks and other cyber incidents such as denial of service, system failure, security breach, intentional or inadvertent acts by employees or vendors with access to our systems or data, or disruption by malware, could expose our IT systems and those of our vendors to system interruptions, impacting the availability, reliability, speed, accuracy, and other proper functioning of these systems or result in the release of proprietary information or sensitive or confidential data, any of which could materially and adversely affect our business. Because the sophistication of cybersecurity threats is increasing and new techniques for attack are being developed rapidly, including attacks enabled by artificial intelligence, we cannot be certain that the controls and preventative actions that we have implemented to reduce the risk of cybersecurity incidents and to protect our systems will be effective in preventing a cybersecurity incident from materializing. While we have experienced minor cybersecurity incidents, we are not aware of any material cybersecurity incidents that occurred during the year ended December 31, 2024. Our Audit Committee, with delegated authority from our Board of Directors, has primary oversight of cybersecurity risks.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Our Board of Directors has adopted, and reviews annually, a Risk Appetite Statement that articulates the Company's attitude towards risk. The Company's Risk Appetite Statement identifies key risk categories and establishes risk tolerances for each. Associated risk metrics are monitored quarterly by Management and reported to the Audit/Compliance/Risk (ACR) Committee of the Board and the Board of Directors. Management measures and reports inherent risk, mitigating controls, residual risk and emerging risk for various key risk categories, inclusive of cybersecurity and information security risks.

companyName: First Financial Northwest, Inc.


text: Our cybersecurity program under the Chief Information Officer ("CIO") is led by our Chief Information Security Officer ("CISO"). The Board of Directors delegates oversight of cybersecurity risks to the Audit Committee, which receives updates from the CISO and CIO at least annually. Cybersecurity is integrated into the risk management process for the company through various mechanisms, including quarterly business reviews, annual budget planning, and linkage to the Enterprise Risk Management ("ERM") process.

companyName: AGILENT TECHNOLOGIES, INC.

ticker: A


text: Vista engages with independent assessors and other third parties to validate security controls, standards, and policies, conduct annual penetration tests of networks and systems to identify threats and vulnerabilities, and assist with forensic analysis of material cybersecurity incidents. In addition, to identify and assess material risks from cybersecurity threats, Vista's enterprise risk professionals collaborate with subject matter specialists, the Vista CIO, and Vista's Chief Compliance Officer ("Vista CCO"), Vista's Chief Operating Officer and Vista's Chief Legal Officer, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: Team and Internal Operations Our Cybersecurity team is comprised of a diverse group of security veterans with experience managing all facets of information risk including, but not limited to, Application Security, Data Governance, Security Engineering, Security Processes and Services, Secure Software Development (S-SDLC), Governance Risk and Compliance (GRC), Risk Management, Cyber Threat Intelligence, Breach Readiness, Cyber Defense Center for monitoring (CDC), Offensive Security, and Security Awareness.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Other non-technical protocols include securing of documents and work areas that could contain personal, non-public information and independent verification of information changes by outside vendors.

companyName: PERMIAN BASIN ROYALTY TRUST

ticker: PBT


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our Chief Information Officer, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance.

companyName: Shake Shack Inc.

ticker: SHAK


text: Cybersecurity processes have been integrated into the Company's broader framework of risk management. The Company's Board of Directors exercises oversight of cybersecurity risks. The Board of Directors entrusts the Audit Committee with responsibility for regularly reviewing and assessing cybersecurity risks to ensure a proactive approach to safeguarding the Company's digital assets. The Audit Committee's primary role is to provide an independent and objective assessment of the Company's cybersecurity risk management practices to confirm that they are both effective and aligned with the Company's strategic objectives. The Audit Committee also reports its findings and recommendations to the Board of Directors, helping the Board of Directors to make informed decisions regarding cybersecurity strategy, investments, and risk. Notwithstanding the Company's efforts, the Company is aware that preventative measures cannot prevent all cybersecurity incidents. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."

companyName: SAUL CENTERS, INC.

ticker: BFS


text: Cybersecurity incidents are evaluated by a cross-functional management team based on defined quantitative and qualitative criteria and communicated to leadership. We have cybersecurity and information technology third-party consultants to assist in performing forensic and technical analyses and advising leadership as needed.

companyName: TE Connectivity plc

ticker: TEL


text: The Board of Directors has overall oversight responsibility for risk management. Oversight of cybersecurity risks has been delegated to the Audit Committee of the Board of Directors. The Audit Committee also reports material cybersecurity risk to the full Board of Directors.

companyName: HNI CORP

ticker: HNI


text: The Company maintains a cyber security risk management program designed to prevent, detect and respond to information security threats. The program is designed to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, as well as the banking-specific framework from the FFIEC's Cybersecurity Assessment Tool (CAT). The Company's program is led by our Chief Technology Officer ("CTO") and chief information security officer ("CISO"), whose teams are responsible for leading short and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes. The CTO chairs the Bank's Technology, Operations, and Compliance ("TOC") Committee, which has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks. TOC meets at least quarterly to assess, among other things, cyber threats or risks to the Company and drive awareness and alignment across the Company for effective cybersecurity risk management and reporting.

companyName: CROSSFIRST BANKSHARES, INC.


text: Our board of directors understands the critical nature of cybersecurity and is closely involved in overseeing our efforts to mitigate cybersecurity risks. We are in the process of formalizing governance structures and oversight mechanisms to ensure that these risks are managed effectively, with the aim of strengthening our operational integrity and enhancing stockholder confidence.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: APA maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of APA's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into APA's corporate risk register. The program includes general controls for managing changes in and access to APA's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite APA's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.

companyName: APACHE CORP


text: Risk Management and Strategy CONSOL Energy has a cybersecurity risk program that is based on industry standards and best practices managed by a dedicated staff and specialists that support this program. We have implemented a set of system, network and application-level controls to protect our corporate data and systems. These controls are monitored for cybersecurity risk events and incidents on a continuous basis by a dedicated staff of cybersecurity professionals and various third-party providers. These controls are updated as necessary to protect the Company. In addition, the Company also takes a proactive approach by monitoring cyber threat intelligence to stay informed regarding emerging risks. The cybersecurity risk program also utilizes third-party assessors, consultants and auditors to perform various services, such as tabletop exercises and network penetration tests. The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. Employees with network access participate quarterly in required training, including spear phishing and other awareness training. The program also has a policy in place to address vendor and third-party risk. Cybersecurity risk is also evaluated during the acquisition process for new products and services.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: Cybersecurity Incident Impact The Company describes whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect it, including its business and operating results, financial condition, and impact on the Company's reputation and customer relationships under the "Risks Related to Technology and Cybersecurity" heading and subheadings thereunder in Part I, Item 1A. "Risk Factors" of this Annual Report, which disclosures are incorporated by reference herein.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Each employee's and contractor's ability to recognize and report cybersecurity threats is an important component of our cybersecurity program. On an annual basis, all Company employees are required to complete cybersecurity training. In addition, we regularly utilize employee exercises and communications designed to reinforce key cybersecurity training messages.

companyName: HF Sinclair Corp

ticker: DINO


text: We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements, customer expectations, business priorities and emerging cybersecurity risks, and we expect to continue to make investments to maintain the security of our data and infrastructure. The underlying controls of the cyber risk management program are based on industry standards for cybersecurity and IT, including the National Institute of Standards and Technology ("NIST") frameworks and ISO 27001 requirements, although this does not mean that we meet all technical standards, specifications or requirements under NIST or ISO 27001 standards.

companyName: Qorvo, Inc.

ticker: QRVO


text: Management is responsible for the Company's day-to-day risk management and the Board serves in an oversight role. The Board has empowered the Audit Committee with formal oversight of enterprise risk matters, including with respect to cybersecurity. The Audit Committee and management periodically review the Company's policies with respect to risk identification, assessment, and management, including cybersecurity risk exposures and the internal controls and procedures in place to manage such risks, as well as the steps that management takes to monitor and control such exposures. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues.

companyName: GRAY MEDIA, INC

ticker: GTN


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, we continue to closely monitor cyber risk. To protect its information and cyber assets, the Company conducts appropriate cybersecurity exercises and training. For example, employees must complete cybersecurity training at least annually, which educates our employees on the Company's policies and procedures for incident reporting, and avoiding common cybersecurity threats such as phishing attacks.

companyName: Uniti Group LLC


text: Engaging Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we plan to engage external experts, including consultants and auditors, in evaluating and testing our risk management systems. These services will enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties is expected to include annual audits, ongoing threat assessments, and regular consultations on security enhancements.

companyName: Signing Day Sports, Inc.

ticker: SGN


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: In addition, our cybersecurity IRP is part of our overall Information Security Program, which is led by the Company's Information Technology ("IT") Vice President ("VP") and Chief Information Security Officer ("CISO") and is overseen by the Company's Chief Financial Officer & Chief Operating Officer ("CFO & COO").

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: The Audit Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Unity Biotechnology, Inc.


text: The Company has experienced cybersecurity incidents in the past, but none of these incidents, individually or in the aggregate, have had a material adverse effect on our business, financial condition or results of operations. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Our Operations and Technology," which is incorporated by reference into this Item 1C.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: While cybersecurity threats remain a risk to the Company's business operations, our risk mitigation strategies have been effective to date. Accordingly, no such threats have materially affected our business strategy, results of operations or our financial condition in the past three fiscal years. Despite our cybersecurity policies and practices, we may not be successful in preventing or mitigating a cybersecurity incident resulting in a material adverse effect. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see the business and operational risk factor: We rely heavily on information technology systems that, if not properly functioning, could materially adversely affect our business in Item 1A, Risk Factors.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: At the management level, the Company has established an incident review committee consisting of senior executives including the Chief Legal Officer, Chief Financial Officer, Chief Accounting Officer, Vice President of Communications and Corporate Relations, Chief Digital and Operations Officer, Director of Internal Audit and Deputy General Counsel, that meets regularly with the CISO to ensure identified issues are addressed expeditiously and reported to the appropriate regulatory agencies as required. In addition, the CISO escalates issues determined to be significant to the Chief Legal Officer in accordance with the Company's incident response processes.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: We maintain an incident response plan and related policies and protocols which outline procedures for identifying, reporting and responding to cybersecurity incidents. Our incident response plan is regularly updated to address new threats and tested through crisis simulation exercises involving our shipboard and shoreside employees. We also have an incident response team who is trained to handle a wide range of security events and collaborates with external cybersecurity experts when necessary.

companyName: CARNIVAL PLC

ticker: CUK


text: Understanding the potential risks associated with third-party service providers, we shall implement stringent processes to oversee and manage these concerns. We shall conduct thorough security assessments before engaging with any third-party provider and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This involves quarterly assessments by our management and continuous evaluations by our security engineers. This approach is designed to mitigate the risks of data breaches or other security incidents originating from have not encountered cybersecurity issues that have significantly impacted our operational performance or financial status.

companyName: SEATech Ventures Corp.

ticker: SEAV


text: Our cybersecurity program is designed to protect the confidentiality, integrity and availability of critical assets and information, using a proactive and risk-based approach. We utilize the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as other globally recognized standards. The NIST framework is structured around six Core Functions (Govern, Identify, Protect, Detect, Recover and Respond) and is a comprehensive approach to information and cybersecurity risk management. Our program includes policies, practices, procedures and controls designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments.

companyName: TD SYNNEX CORP

ticker: SNX


text: Our information security function, led by our Director of Information Technology, helps identify, assess and manage the Company's cybersecurity threats and risks. Our Director of Information Technology helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, monitoring provided by a third-party security operations center, deploying manual and third-party service provider automated tools in certain environments, subscribing to reports and services that identify cybersecurity threats (and analyzing such reports), conducting scans of certain environments, evaluating our industry's risk profile and threats reported to us, conducting internal audits and threat assessments for certain threats, conducting vulnerability assessments using third-party tools to identify vulnerabilities, engaging third parties to conduct threat assessments, using external intelligence feeds and monitoring the dark web.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: The Board is kept informed about cybersecurity issues through a structured and responsive communication process tailored to their needs. This involves updates provided by the Chief Information Security Officer ("CISO") or other members of management during Board meetings or specific sessions dedicated to cybersecurity. Additionally, management reports to the Board on significant cyber incidents, emerging threats, and the effectiveness of existing security measures. The communication framework is intended to keep the board informed about cybersecurity matters, allowing them to make informed decisions and provide strategic guidance to fortify the Company's defenses against potential threats.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: We maintain a cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework's guidance and HIPAA, which applies to the Company and each of its subsidiaries. The cybersecurity program seeks to protect the enterprise against threats from cybersecurity risks, to comply with applicable laws and regulations, and to establish and enhance our processes for responding to cybersecurity events.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: The Cybersecurity Committee will receive prompt updates from officers regarding material cybersecurity incidents that come to management's attention. The Cybersecurity Committee will receive quarterly updates which address relevant cybersecurity issues and risks, if any. These reports are provided by the officers of the Wind-Down Entity, which include our Chief Executive Officer and Chief Operating Officer.

companyName: Woodbridge Liquidation Trust

ticker: WBQNL


text: The Risk Committee of the Board of Directors, including a subcommittee of the Risk Committee, provides oversight of cybersecurity risks and receives regular reports on cybersecurity from the CISO. The CISO is responsible for the design and execution of the Company's Information Security Program, which is supported by the governance structure defined within the Risk Framework. The CISO reports as necessary to executive management, the Risk Committee of the Board and the Board of Directors on cyber and information security issues and the effectiveness of the Company's cyber and Information Security Program. The Risk Committee of the Board and the Board of Directors receive the results of the Company's annual cybersecurity risk assessment. Aligned with leading industry standards, including the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework, the Information Security Program is built upon a foundation of policies, standards and procedures, which leverage the National Institute of Standards and Technology standards and regulatory requirements, to help safeguard customer information and reduce the risk of cyber incidents and breaches. The Information Security Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring and a Security Operations Center that provides full-time support and additional operational measures to monitor and respond to data breaches and cyber attacks.

companyName: M&T BANK CORP

ticker: MTB


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. As of this reporting, the Bank has not experienced any S1-Critical/Material incidents.

companyName: COMMUNITY WEST BANCSHARES /


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Corporation and its customers, the Corporation maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Corporation, including the Corporation's data held, or IT services provided, by third-party vendors or other service providers. The CISO is responsible for implementing and maintaining the IRP, which includes: a. Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Chief Operating Officer oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. The Audit committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: Incident Response and Recovery Planning: CTO and the MSP have established a written information security incident response plan that addresses the response to a cybersecurity incident, which plan is tested and evaluated on a regular basis.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Incidents & Risks To date, we have not experienced any material internal or external cybersecurity incidents and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risks Related to Information Systems" identified in the "Risk Factors" section of Part 1 of Item 1A herein.

companyName: TEAM INC

ticker: TISI


text: The IRP requires an Information Security Incident Response Team ("IRT") which includes, at a minimum, the following representatives: CTO, CISO, CLO, Data Protection Officer, and department heads of Network Operations, Engineering, and Information Security to oversee all details of the incident response. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Although we devote significant resources to implementing, maintaining, testing and upgrading our cybersecurity systems and processes, these security measures do not provide absolute security. Despite our efforts to maintain an effective cybersecurity risk management program, it is possible that our cybersecurity risk mitigation and prevention efforts may not be able to adequately mitigate or prevent all possible security breaches, whether because of the use of new techniques that may not be known or recognized, because cyber-attacks can originate from a wide variety of sources, or for other reasons. See "Risk Factors—We are subject to cybersecurity risks and security breaches and may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents."

companyName: Enova International, Inc.

ticker: ENVA


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a Business Combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: COLOMBIER ACQUISITION CORP. II


text: Park's Board of Directors recognizes the importance of cybersecurity in safeguarding sensitive information. The Board Risk Committee is responsible for overseeing Park's Enterprise Risk Management program which includes responsibility for cybersecurity. The Park information security and business continuity teams, both part of Park's Enterprise Risk Management, manage and oversee the Incident Response Plan and Cybersecurity Response Playbook. The Incident Response Plan and Cybersecurity Response Playbook guide Park's response to cybersecurity issues and events. The Board Executive Committee is engaged in the final determination of whether a cybersecurity issue or event is material, as discussed below. Park's Board of Directors is regularly apprised of cybersecurity risks. Park's information security team prepares and issues a quarterly report to the full Board of Directors on the status of incidents, health of program, penetration testing results, and risk assessments. Park's cybersecurity operations team also prepares and issues a quarterly report to the full Board of Directors identifying cybersecurity trends, internal data, issues, events, and key-risk indicator metrics.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Longeveron Inc.

ticker: LGVN


text: Given the small size of our organization, we leverage a third-party information technology ("IT") service provider for management of our information systems needs. Our IT service provider works closely with executive management in the assessment, identification and management of cybersecurity threats. Cybersecurity threats are prevented and detected by multiple approaches, including perimeter defense, vulnerability management, intrusion testing, multifactor authentication and data protection. We have also implemented a formal cybersecurity awareness program that includes cybersecurity training for all employees and relevant contractors and is integrated with our overall risk management process. Material risks from cybersecurity threats, including those associated with the use of third-party service providers, are assessed during our annual review of our enterprise risks and related controls.

companyName: PARKERVISION INC

ticker: PRKR


text: We have various processes and procedures in place to evaluate cybersecurity threats associated with third parties. We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, performance, results of our operations, or financial condition.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: We maintain a cybersecurity incident response plan designed to secure the enterprise, mitigate the impact of an incident, restore normal business operations, prevent similar future incidents and comply with applicable regulatory obligations arising from an incident. As part of the above process, we periodically engage with consultants and other third-parties, including annually having a third-party perform penetration testing and review our cybersecurity program to help identify areas for improvement and/or compliance. The Company's cybersecurity procedures have been developed based on the National Institute of Standards and Technology ("NIST") cybersecurity framework. We also engage with a third-party security operation center to assist in monitoring our cybersecurity risk environment. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers.

companyName: Mativ Holdings, Inc.

ticker: MATV


text: We have taken a multifaceted approach to addressing cybersecurity risks, including leadership from our senior management and Board of Directors, direct supervision and operational execution from our information technology ("IT") department and active involvement of employees. The Company's senior management devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats. We periodically assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our IT team reviews cybersecurity risks, and we have a set of Company-wide policies and procedures concerning cybersecurity matters, including policies related to encryption standards, remote access, multi factor authentication, confidential information, the use of the internet, social media, email and wireless devices and incident response.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT