text: The Company's Cybersecurity Committee, which is comprised of cross-functional management team members, is notified following discovery of a potential or actual cybersecurity breach. Subject to the severity of the actual or potential breach, the Company's Executive Committee may also be notified, and an external breach team may be retained, including mitigation experts and external legal counsel. The Cybersecurity Committee will convene to evaluate the materiality of the breach, with input from the external breach team as required. Internal and external legal counsel will determine whether any disclosures are required pursuant to all relevant jurisdictional rules and regulations. The Company's Board of Directors will be notified as necessary.

companyName: SSR MINING INC.

ticker: SSRM


text: Our cybersecurity risk management program is aligned with the National Institute of Standards and Technology Cybersecurity Framework. We identify key assets that are critical to our business and assess potential cyber threats and vulnerabilities associated with those assets and the operations they enable. Following that assessment, we implement strategies and design controls to manage those risks. For example, we use single sign-on to limit access to our networks and multi-factor authentication to verify users' identities. We also continuously monitor our systems and networks to protect against internal and external threat actors. We have policies and procedures in place, such as our Privileged Access Management process, to limit and control access to our confidential information by our vendors and other third parties. We also conduct due diligence and reviews of cybersecurity policies of third parties that access our systems or data. Additionally, we are focused on segregating our manufacturing processes from the Company's other networks to minimize the risk of interruptions to our manufacturing operations resulting from cyber breaches. To increase our employees' vigilance of cybersecurity risks and educate them on best practices relating to those risks, we conduct cybersecurity trainings and awareness campaigns, such as quarterly phishing campaigns.

companyName: ENTEGRIS INC

ticker: ENTG

secItem: Item 1C


text: Our Chief Information Security Officer ("CISO") has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. Our CISO has over 25 years of security experience in executive leadership, operations, incident response, and consulting in various industries including retail, technology and healthcare, as well as support of Federal government agencies and intelligence. Our CISO reports to our Chief Information Officer ("CIO"), who is also responsible for overseeing cybersecurity risks and communicating with the Board and Audit Committee.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: The Company's enterprise threat and vulnerability identification and detection capabilities operate on an ongoing basis, with results reported to Information Security daily. The capabilities utilize endpoint sensors and network scanning to meet and maintain leading bad actor tactics and techniques, including machine learning and artificial intelligence, to protect against potential malicious threats or other potentially unwanted programs or identity abuse, including privilege escalation or abuse of least privilege access enforced by the Company. The information gathered by the Head of Information Security through these activities, through assessment results provided by cybersecurity consultants or advisors, as well as through gathering cyber-risk landscape insights from various other third-party sources, informs the Company's assessment of the risk of cybersecurity threats.

companyName: NeueHealth, Inc.

ticker: NEUE


text: The CIO, in his capacity, regularly informs the Executive Chairman, Chief Executive Officer, Corporate General Counsel, and Chief Financial Officer, of aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we are facing.

companyName: Century Communities, Inc.

ticker: CCS


text: Managing risk related to cybersecurity is a top priority for Spire, and the Company remains focused on addressing threats that would jeopardize the confidentiality, integrity and availability of stakeholders' information or the ability to continue providing safe and reliable service to customers. To date, Spire has not experienced any material cybersecurity breach that impacts the Company's business strategy, results of operations, or financial condition.

companyName: SPIRE INC

ticker: SR


text: In the event of a cybersecurity incident, we maintain a regularly tested incident response program, including response playbooks specifically designed to address our areas of higher risk. Pursuant to our escalation protocols, designated personnel, including our CISO and VPAA, along with appropriate members of our management and executive team, are responsible for assessing the severity/priority of a cybersecurity incident and associated threat, containing the threat, and remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We also maintain cybersecurity insurance coverage; for more information regarding cybersecurity insurance, see " Item 1A. Risk Factors ".

companyName: VICI PROPERTIES INC.

ticker: VICI


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to [the audit committee of ]our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.

companyName: SinglePoint Inc.

ticker: SING


text: Due to the small size of our operations, our advisor has elected to outsource the information technology function to a third-party managed service provider, or the MSP, that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our advisor's hosted services, all of the computer and computer-related hardware and software used for our advisor to manage our operations, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.

companyName: Strategic Realty Trust, Inc.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we leverage the expertise of a managed service provider, and when warranted will engage with independent third parties in evaluating and testing our risk management systems. These service providers enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies meet generally accepted industry best practices. Our Chief Information Officer also performs ongoing review of current practices to further ensure cybersecurity.

companyName: Stran & Company, Inc.

ticker: SWAG


text: In an effort to deter and detect cyber threats, we engage a third-party service provider to periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use and mobile security, and further educates employees on the importance of and process for reporting all potential incidents immediately.

companyName: AIR T INC

ticker: AIRT


text: Our systems face cybersecurity risks, and we have in the past experienced threats to and breaches of our data and systems. However, to date, these incidents have not had a material impact on our business, results of operations or financial conditions. There can be no assurance that we will not experience any material cybersecurity threats or incidents in the future. See Item 1A "Risk Factors—A material disruption in or security breach affecting our information technology systems could significantly affect our business and lead to reduced sales, growth prospects and reputational damage".

companyName: Greenbrook TMS Inc.


text: We have a rigorous process, including a formal IT risk assessment, to assess our service providers prior to allowing our information to be processed, stored or transmitted by third parties, and we include standardized contractual requirements in each contract where appropriate. We validate our service providers' security via questionnaires, open-source intelligence and, where appropriate, SOC1 reports on financially significant third-party service providers. Our process also includes regular monitoring of risk related to third parties on a periodic basis or when services or product purchases expand beyond their original scope or intended use.

companyName: TEXTRON INC

ticker: TXT


text: Board Oversight of Cybersecurity Risks The board of trustees provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The board of trustees receives periodic updates from the Company's Chief Financial Officer ("CFO") and Chief Compliance Officer ("CCO") regarding the overall state of GC Advisors' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Golub Capital Private Credit Fund


text: Viasat Cybersecurity Risk Management, Strategy and Governance Disclosure Viasat builds, maintains, and operates satellite and telecommunications systems, infrastructure and services used by both government and commercial customers across the globe. We recognize the importance of building a resilient cybersecurity program focused on reducing cybersecurity risk to our customers, partners and our own organization. Our Cybersecurity Engineering organization, at the direction of the Board of Directors, has developed and implemented a cybersecurity risk management and technical assistance program intended to protect the confidentiality, integrity and availability of the services provided and the information stored, processed or transmitted by our critical systems and infrastructure, while assisting staff to develop, operate and maintain secure products and services.

companyName: VIASAT INC

ticker: VSAT


text: We voluntarily obtain third-party security examinations relating to our internal controls over financial reporting in accordance with SOC 1. Our SOC 1 examination is conducted every six months by one of the four largest independent international auditing firms, and addresses, among other areas, our physical and environmental safeguards for production data centers, data availability and integrity procedures, change management procedures and logical security procedures. We also obtain third-party examinations relating to our internal controls over security and privacy in accordance with SOC 2. Our SOC 2 examination is conducted every year and addresses, among other areas, internal controls around security, availability, and processing integrity. We publish SOC 1 reports semiannually and SOC 2 and SOC 3 reports annually.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Board of Directors oversees our risk management process, including cybersecurity risks. The Audit Committee oversees our enterprise risk assessment. The Audit Committee meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity.

companyName: Lightstone Value Plus REIT II, Inc.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: LENSAR, Inc.

ticker: LNSR


text: Our information technology team, led by our Vice President of Information Technology, helps identify, assess, and manage our cybersecurity threats and risks. Our information technology team assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example analyzing threat reports, conducting audits, and using intelligence feeds.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Our Vice President of I&T is responsible for developing, implementing, and maintaining our cybersecurity risk management policies and procedures. The individual currently serving in the role of Vice President of I&T has over twenty-five years of experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within complex and international business verticals such as pharmaceutical/biotech, technology, financial services, and retail. The Vice President of I&T reports to our Chief Financial Officer, and provides periodic cybersecurity updates to our board on at least an annual basis. Our incident response process contemplates that the executive team will notify the board of a material cybersecurity incident.

companyName: Deciphera Pharmaceuticals, Inc.


text: Cyber criminals are becoming more sophisticated and effective every day, and all companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing our systems and data a top priority. Our Board and our management are actively involved in our overall enterprise risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, procedures and processes for assessing, identifying, and managing material risks from cybersecurity threats. There can be no guarantee that our policies, procedures and processes will be properly followed in every instance or that those policies, procedures and processes will be effective. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us. For more information about risks relating to cybersecurity matters see "Item 1A. Risk-Factors—General Risk Factors—We may be vulnerable to security breaches or cyber attacks which could disrupt our operations and have a material adverse effect on our financial condition and operating results."

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Our program is designed to protect the confidentiality, integrity, and availability of systems and data. The state of our program maturity and regulatory compliance is regularly assessed by external audits and reviews by third party cybersecurity auditors and assessors. Among the key features of our cybersecurity risk management processes are the following: • policies and procedures designed to comply with data security and privacy obligations; • security technology and tools deployed in our IT environment that help us to identify and manage critical cybersecurity risks, as well as to detect and respond to incidents; • security awareness training offered to our workforce, and specialized incident response training for our cybersecurity team in partnership with our Business Continuity and Emergency Response department; • a Security Operations Center that monitors and responds to incidents; and • a third-party risk management program that includes diligence and contracting processes for vendors and service providers based on their respective function and risk profile.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Beachbody Company, Inc.

ticker: BODI


text: BitGo maintains a $250,000,000 policy against loss, theft and misuse. Currently we have approximately $253,000,000 of treasury value at Bitgo, based on the SOL price of $202.51 per token. Coinbase has an insurance policy for any cash held in the account of $250,000. We currently have less than $250,000 of cash held at Coinbase and less than $6,000,000 in SOL value, based on the SOL price of $202.51 per token. At the current price of SOL as of the date of this report, these policies are not adequate to fully cover the full loss of our SOL.

companyName: UPEXI, INC.

ticker: UPXI


text: Our management team, including each of our Chief Financial Officer, Head of IT and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team's cumulative experience includes many years of experience managing cybersecurity risks including serving in similar roles leading and overseeing cybersecurity programs at other companies.

companyName: Singular Genomics Systems, Inc.


text: We expect that cybersecurity will become an important part of our risk management processes and an area of focus for our Board of Directors and management. We expect that our Board of Directors will be responsible for the oversight of risks from cybersecurity threats. We expect our senior management will provide our Board of Directors updates on a quarterly basis regarding matters of cybersecurity. This is expected to include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. We expect that our Board members will also engage in periodic conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Bimergen Energy Corp

ticker: BESS


text: Our Board and its Audit Committee are supported in their oversight of information technology and cybersecurity matters and risks by two management committees, the Operational Risk and Resilience Committee and the Information Security Steering Committee (the "ISSC"), both of which regularly report to the Audit Committee. The ISSC is responsible for providing management oversight for our cybersecurity risk management program, and its membership includes our Chief Technology Officer and Chief Information Security Officer, among other members of senior management. Our Chief Technology Officer and Chief Information Security Officer have each served in various roles in information technology and/or information security for many years, and have extensive information technology and cybersecurity experience. The Chief Technology Officer, and Chief Information Security Officer, alongside other multidisciplinary teams across the Company, work to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The broad, cross-functional management team leverages significant experience and expertise across a range of areas, including risk management, technology, and legal and regulatory affairs, among others, for assessing and managing cybersecurity risks.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: An Information Technology Steering Committee was established to assist Management and the Board of Directors in the oversight and risk management of information security. This Committee is responsible for updates which summarize cybersecurity threats and incident monitoring activity, along with details of remediation to address threats and incidents. The summary considers both internal as well as external threat events and outlines management's approach to enable the timely identification and notice of a material incident, should one occur, without unreasonable delay.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: Our IRP provides clear communication protocols, including with respect to members of executive management, internal and external counsel, the Audit Committee and our Board. These protocols include a framework for assessing our SEC and other regulatory reporting obligations related to a cybersecurity incident.

companyName: Public Storage

ticker: PSA


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs," which disclosures are incorporated by reference herein. We have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.

companyName: PROKIDNEY CORP.

ticker: PROK


text: Management is also responsible for upholding our cybersecurity processes. Our Vice President of IT Infrastructure is responsible for cybersecurity oversight and for developing strategies to mitigate cyber risks, monitoring policy compliance and educating staff on security practices. Our Cybersecurity Management team, led by our Vice President of IT Infrastructure, reports to the Audit Committee of the Board of Directors on cybersecurity matters, including incident reports, compliance status and updates on cybersecurity initiatives. The Audit Committee aims to meet at least once each fiscal quarter to specifically address cybersecurity matters, but convenes as necessary to fulfill its cybersecurity oversight responsibilities.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Cybersecurity partners, including assessors, consultants, advisors and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data and services. The cybersecurity partners provide services including, but not limited to systems inventory monitoring, configuration management, vulnerability scanning, user management, mobile device monitoring, capacity monitoring, network protection and monitoring, IPS/IDS management, remote access monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our cybersecurity team is led by our chief information security officer, who is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior management and other teams across the Company. The chief information security officer provides regular updates to the Cybersecurity Committee (discussed further below) of which he is also a member. Our chief information security officer has extensive cybersecurity knowledge and skills gained from over 19 years of experience at the Company as chief information security officer and chief information officer where he has been responsible for implementing and maintaining cybersecurity and data protection practices, implementing complex technology solutions, and managing large groups of technology professionals. He holds multiple cybersecurity industry focused certifications and reports directly to the Co-Chief Executive Officer.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: Matthews uses a number of means to assess cyber risks related to its third-party service providers, including processes governing interconnections with third-party systems and regular review of critical vendors' cybersecurity positions for potential risks. Third-party service provider assessments begin during onboarding and continue throughout the relationship, based upon an assessment of third-party risk. Those assessments include review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), and direct interaction with key vendors to assess and address risks. Contracts with third-party service providers contain appropriate protective provisions for the Company including audit rights, third-party notification obligations, and security requirements for the retention of data.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: We engage a third-party Vendor as mentioned above, CompuData. Our vendors are whitelisted and are SOC II certified. Our Whitelisted Vendor applications are Newbook, Sage, Clover, and Office 365.

companyName: PISMO COAST VILLAGE INC


text: We have implemented processes to assess, identify, and manage risks from cybersecurity threats, including the following: • Muti-factor Authentication: We secure access to our network and systems through multi-factor authentication. • Layered Email Protection: We have adopted a layered approach to email protection. • Zero-Trust Security Model: We are working towards a zero-trust security model, utilizing group-based access controls to manage network resources. • Continuous Monitoring: We continuously monitor our systems for security anomalies, to help enable early detection of issues and facilitating a rapid response. • Regular Scans: We conduct weekly and monthly scans to identify and prioritize the mitigation of the most critical vulnerabilities. • Quarterly Penetration Testing: We engage third-party consultants to perform quarterly penetration testing, examining our environment from various perspectives, including end-user and employee use cases, to thoroughly assess system vulnerabilities. • Collaborative Evaluation and Remediation: In collaboration with our third-party consultants, we evaluate the outcomes of our testing, address and remediate any identified issues, and subsequently re-test the environment to confirm that the mitigations have effectively resolved the vulnerabilities. • Regular Assessments and Gap Analyses: Our cybersecurity team regularly meets with the third-party consultants to assess overall risk and conduct gap analyses, ensuring the effectiveness of our current cybersecurity measures. • Comprehensive Risk Assessment: Our comprehensive risk assessment includes evaluating potential security risks associated with the use of external service providers. • Incident Response Readiness: We maintain a documented incident response readiness process that details the procedures to follow in the event of a security incident. • Data Backup: We maintain comprehensive backups of all system files to facilitate data recovery during a security incident. In addition to the above-described technology controls, we have implemented mandatory training and awareness programs designed to educate our employees on cybersecurity risks. These include periodic exercises to help employees identify phishing schemes and other social engineering tactics, and we provide various methods for them to report suspicious activity that may give rise to a cybersecurity incident.

companyName: HORTON D R INC /DE/

ticker: DHI


text: CISO, in his capacity, regularly informs the Chief Financial Officer and Chief Executive Officer of all aspects related to cybersecurity risks and incidents. This ensures that the senior management team is kept abreast of the cybersecurity posture and potential risks facing New Horizon. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Chief Compliance Officer and Director of IT regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and any cybersecurity incidents impacting the Company.

companyName: Stone Point Credit Corp


text: The Audit and Risk Committee ( Audit Committee) has oversight responsibility for risks and incidents relating to cybersecurity, including compliance with regulatory requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee receives regular briefings on our cybersecurity posture, cybersecurity trends, and cybersecurity risks from management and, if they occur, is briefed regarding any material cybersecurity incidents. The Audit Committee reports any findings or recommendations to the Board of Directors, as appropriate.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: We commit significant resources to protecting and continuing to improve the security of our computer systems, software, networks, and other information or operations technology assets. Our cybersecurity efforts are designed to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or otherwise cause damage.

companyName: ONE Gas, Inc.

ticker: OGS


text: Our cybersecurity risk management program is focused on the key areas below: • Governance. In fulfilling its oversight responsibility, our board of directors receives regular reports from our senior management team on our cybersecurity risks and exposures, infrastructure and countermeasures, and other monitoring, testing and recovery systems. • Collaborative Approach. We use a comprehensive, cross-departmental approach for identifying, evaluating, preventing and/or mitigating cybersecurity threats and incidents, and have implemented controls and procedures that provide for the prompt escalation of significant cybersecurity incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner. • Technical Safeguards. We deploy technical safeguards intended to protect our IT networks and related systems from cybersecurity threats, including firewalls, intrusion prevention, detection and isolation systems, anti-virus and malware functionality, backup functionality, and access controls. These technical safeguards are regularly evaluated and improved through vulnerability assessments, network penetration testing and threat intelligence, including by third-party consultants, who also continually monitor our information security. Any significant developments related to our technical safeguards, including any material results of any vulnerability assessments or network penetration testing, are reported to our board of directors, and we adjust our cybersecurity risk management policies and practices as necessary. • Management of Third-Party Risk s. We use a risk-based approach to evaluating cybersecurity risks presented by third parties, such as vendors, service providers, and external users of our IT networks and related systems, as well as risks related to our use of third-party systems that could adversely affect our business in the event of a cybersecurity incident centered on those systems. • Education and Awareness. We provide regular, mandatory cybersecurity training for our employees to help them identify and avoid potential cybersecurity threats and understand our policies and guidelines related to our IT network and related systems. As part of this training program, we regularly test our employees for information security awareness, including through random electronic communications designed to simulate how a threat actor might attempt to compromise our IT network and related systems. • Cybersecurity Insurance. We carry comprehensive cyber liability insurance coverage that covers us against claims related to certain first-party and third-party losses, including data restoration costs and crisis management expenses, subject to the policy's coverage conditions and limitations.

companyName: STAG Industrial, Inc.

ticker: STAG


text: Our advisor has formed a Cyber Governance Committee ("CGC"), comprised of our advisor's Chief Compliance Officer, Senior Vice President of Human Resources and Information Technology Director, to oversee cyber governance and to assess and manage, along with our advisor's Chief Executive Officer (also our Chairman of the Board of Directors) and our advisor's Chief Financial Officer (also our Chief Financial Officer), material risks, if any, from cybersecurity threats. The CGC meets quarterly to review incident summary reports, new threats, risks, industry and regulatory changes. Our advisor's Chief Executive Officer and Chief Financial Officer and the CGC are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. In addition, our incident response plan and related processes provide for incident escalation procedures for any cybersecurity incidents that meets pre-established reporting thresholds.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: The Company's information security program currently includes the following controls, which are deployed as the Company deems applicable: • endpoint threat detection and response; • identity and access management; • privileged access management; • logging and monitoring involving the use of security information and event management; • multi-factor authentication; • firewalls and intrusion detection and prevention; • web application firewalls and bot security tools; and • vulnerability and patch management.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Over his 16-year career, the Company's Chief Technology Officer has served in multiple Information Technology and Cybersecurity roles, such as Senior Engineer, responsible for implementing hardened infrastructure for both physical and cloud applications; Solutions Architect, designing infrastructures for highly regulated industries including Financial Services, Local/State Government and Healthcare; Director of Service Delivery, overseeing engineering, solutions architecture and maintains the System and Organization Controls (SOC) program prior to joining Unity Bank. During his tenure at Unity Bank, he is a member of various Risk and Cybersecurity Committees of the New Jersey Bankers Association, is a member of FS-ISAC, The Independent Community Bankers of America and our primary banking vendors advisory and risk management committees. The Company's Chief Compliance Officer was appointed as the Company's Information Security Officer in 2016.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: We regularly evaluate the cybersecurity risks that could affect our information systems, as well as on an ad hoc basis when there is a significant change in how we do business that may expose our information systems to more such risks. These evaluations include identifying the possible internal and external risks, how likely and harmful they are, and whether our current policies, procedures, systems, and safeguards are adequate to handle them.

companyName: 89bio, Inc.


text: See Part I, Item 1A, "Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, including the risk factor titled, If our information technology systems or data, or those third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of customers or sales.

companyName: Pulmonx Corp

ticker: LUNG


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: The underlying process and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology ("IT"), including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). We have an annual risk assessment performed by a third-party specialist of our cyber risk management program against the NIST CSF. This assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with our third-party specialists, have developed a risk mitigation plan to address such risks, and where necessary, to remediate potential vulnerabilities identified through the assessment process.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with information technology controls; user and employee awareness of cybersecurity policies and practices; information systems configuration management; and infrastructure security systems. Management makes concerted efforts to select third-party software providers with a demonstrated track-record of effectively addressing cybersecurity concerns. In event of a cybersecurity incident, we would rely upon these providers. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including Microsoft Azure CSPM and SOC 2. We use this framework, together with information collected from periodic manual assessments and automated testing, to tailor aspects of our cybersecurity practices given the nature of our assets, operations and business.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: Pursuant to the Company's ERM practices, oversight of cybersecurity risk management has been assigned to the full Board and to the Board's Audit Committee. Quarterly updates are provided by Company management, including the Company's Chief Information Security Officer, to the Audit Committee (three times per year) and the full Board (annually), to help ensure an ongoing dialogue regarding the Company's cybersecurity initiatives, threats and incidents.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Employee training and phishing campaigns are conducted every year. The Company's employees are expected to help safeguard the Company's information systems and to assist in the discovery and reporting of cybersecurity incidents.

companyName: Xenetic Biosciences, Inc.

ticker: XBIO


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, clinical trial data, customer data, manufacturing data, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Impact of Risks from Cybersecurity Threats We are regularly subject to cybersecurity attacks. None of the risks from cybersecurity threats we've faced to date have materially affected, and we do not believe are reasonably likely to materially affect the Company, our business strategy, results of operations or financial condition. Governance.

companyName: S&P Global Inc.

ticker: SPGI


text: GoHealth's cybersecurity risk management program is based on industry standards and best practices, aligning with the Center for Internet Security and the National Institute of Standards and Technology (NIST) Cybersecurity Frameworks. The Company conducts control self-assessments and risk assessments in collaboration with assigned control owners and risk owners to evaluate the maturity and effectiveness of its cybersecurity processes. Based on prior third-party assessments, GoHealth has completed the majority of its Governance, Risk and Compliance (GRC) roadmap initiatives and is currently deploying various comprehensive security tools and programs to further strengthen its cybersecurity posture.

companyName: GoHealth, Inc.

ticker: GOCO


text: Set forth below is information regarding our cybersecurity risk management, strategy, and governance, along with a related description of our information security and data privacy practices.

companyName: TARGET CORP

ticker: TGT


text: Material Impact on Company During 2023, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: CVR ENERGY INC

ticker: CVI


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. These reports include updates on our processes for preparing for, preventing and detecting cybersecurity incidents. Between such regular updates, the Audit Committee would be notified regarding any significant cybersecurity threat or incident, if applicable. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: We seek to leverage a comprehensive risk management program aligned with the National Institute of Technology Cybersecurity Framework 2.0 that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: We conduct ongoing social engineering testing and training across our entire employee base. We maintain a vendor management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Our independent auditors periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: The Board of Directors receives periodic updates on our cybersecurity risks from our SVP of IT and Operations, which include risk assessments, areas of emerging risks, incidents and industry trends, and other areas of importance. These reports include updates on our progress preparing for, preventing, detecting, responding to and recovering from material cyber incidents, if any. In addition, as needed, management updates the Board of Directors regarding any material cybersecurity incidents.

companyName: Evolus, Inc.

ticker: EOLS


text: Additionally, BancShares has implemented a threat awareness program that includes cross-organizational information sharing capability for threat intelligence and membership and engagement with intelligence communities including the Financial Services Information Sharing and Analysis Center, Federal Bureau of Investigation, United States Department of Homeland Security, and others. BancShares also utilizes external experts and third-party assessors to maximize its risk intelligence coverage and management ability.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: The CTO regularly reports to our senior leadership team, as well as periodically to our Board of Directors, regarding our cybersecurity program and material cybersecurity risks. The CTO coordinates with other teams including internal Audit, to ensure a combined focus on technology modernization and remediation needs. The CTO is briefed weekly on current security operations and relevant issues across the cybersecurity threat landscape.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: The IRP includes: • Identifying the Incident Response Team (IRT); • Coordinating IRT activities, including developing, maintaining and following appropriate procedures to respond to and document identified information security incidents; • Conducting post-incident reviews to gather feedback on information security incident response procedures and to address any identified gaps in security measures; • Provide training and conduct periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; • Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of its general risk oversight function. The Board satisfies its responsibility to oversee cybersecurity risk through full reports by the Chair of the Audit Committee chair regarding such committee's considerations and actions, as well as through regular reports directly from officers responsible for oversight of risks. The Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board and the Audit Committee receives periodic reports, summaries, and presentations from our senior management, including the Chief Information Officer and Global Head of Cybersecurity, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: We have a dedicated unit, led by the Senior Vice President ("SVP") of Enterprise Strategy and Execution, to implement cybersecurity controls, assess and report on cybersecurity risks, and consult with our ERM unit, which is responsible for identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: The Company's Vice President, Head of IT, Senior Manager of IT Infrastructure, Systems, and Security, the Company's Information Security Management System ("ISMS") Management Review Team, and third-party service providers (collectively, the "Information Security Function") help identify, assess, and manage the Company's cybersecurity threats and risks. The Information Security Function identifies and assesses risks from cybersecurity threats by monitoring and evaluating the Company's threat environment and risk profile using various methods and tools including, for example: subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and bad actors, conducting scans of the threat environment, and evaluating our industry's risk profile and threats reported to us. We also complete internal and external security audits, third party threat assessments, and vulnerability assessments.

companyName: Vor Biopharma Inc.

ticker: VOR


text: We engage external parties, including consultants, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we also have a third-party risk management program designed to help protect against the misuse of information technology by third parties and business partners, which includes certification of our major technology suppliers and any outsourced services through accepted security certification standards.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: In connection with its oversight of our broader enterprise risk management program, our ISO, on a periodic basis, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. The chair of the audit committee and the ISO provide periodic reports on cybersecurity risk management to the full board of directors.

companyName: Vigil Neuroscience, Inc.


text: The Company's board of directors ("Board") is responsible for overseeing and monitoring our risk management processes, including as to cybersecurity-related risks. The Board is assisted in its oversight responsibilities by the standing Board committees, and the audit committee of the Board ("Audit Committee") is responsible for overseeing our cybersecurity risks. Our Chief Information Officer provides cybersecurity updates and reviews the Company's cybersecurity risks and protection measures with either the Audit Committee or the full Board on at least a semi-annual basis. Topics covered in such meetings have included (i) results of quarterly phishing simulation tests, (ii) results from cybersecurity audits and penetration testing, (iii) review and enhancements to policies (including the Incident Response and Business Continuity policies) and (iv) recent, high profile cybersecurity incidents. The Board and Audit Committee also engage in regular discussions regarding cybersecurity risk management with the Company's senior management and independent and internal auditors.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training. Further training is performed on a scheduled basis, covering cybersecurity topics and overall security hygiene, which reflect current techniques and tactics employees may encounter.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: Our information security risk management program is integrated into our overall risk management program. Our BOD has a formalized enterprise risk management program, or ERM Program, which the Risk Committee of the BOD, or Risk Committee, on behalf of the BOD and the Audit Committee of the BOD, oversees. Our ERM Program addresses the identification, prioritization and assessment of a broad range of risks (e.g., cybersecurity, financial, operational, business, reputational, governance and managerial), and the formulation of plans to develop and improve controls for managing these risks or mitigating their effects in an integrated effort involving our BOD, relevant committees of the BOD, management, and other personnel. Our ERM Program is led by our General Counsel and is a component of management's strategic planning process. Our BOD and Risk Committee have primary oversight responsibility regarding our information security risk management program. Our BOD and Risk Committee each receives regular and frequent updates on cybersecurity and information technology matters from management (including our Chief Information Officer, or CIO) and, periodically, from outside experts. For example, the CIO provides reports to our BOD, Technology Steering Committee and Risk Committee regarding information security risks, as well as plans and strategies to mitigate those risks, on a periodic basis.

companyName: CoreCivic, Inc.

ticker: CXW


text: Management has also developed procedures to assess the operations and internal controls of material service providers through questionnaires, inquiries, reviews of available policy statements, and evaluation of System and Organization Controls assurance reports, which are assessed in the aggregate to determine if the service providers have adequately addressed the risks of cybersecurity threats within their operations. The overall assessment includes an evaluation of a service provider's breach notification policies and procedures and any reported cybersecurity incidents. Management is not aware of any cybersecurity incidents at any of its service providers that have materially affected or are reasonably likely to materially affect the Partnership's operations.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate key personnel, including our Director of Operations, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: To identify and assess material risks from cybersecurity threats, our Cybersecurity Governance, Risk and Compliance ("GRC") team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter experts, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: The Company's Chief Financial Officer ("CFO"), Information Technology ("IT") manager, legal function and external information technology and cybersecurity service provider help to identify, assess and manage our cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our and our industry's risk profile using various methods, including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, conducting internal audits, and conducting internal and external threat and vulnerability assessments.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: NeuroOne Medical Technologies Corporation We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: We are a global bioscience company dedicated to healthy aging. In the ordinary course of our business, we may collect, process, store and transmit proprietary, confidential and sensitive information, including personal information (including health information), intellectual property, trade secrets, and proprietary business information owned or controlled by ourselves or other parties. We use our data centers and our networks, and those of third parties, to store and access our proprietary business and other sensitive information. We rely upon third parties service providers and technologies to operate critical business systems to process confidential and personal information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, employee email, and other functions. We have established cybersecurity risk management policies and procedures aimed at safeguarding the confidentiality, integrity, and availability of our critical systems and information, including those involving third-party service providers. Further, we are actively working to enhance our policies and procedures into a more comprehensive cybersecurity risk management program, our current measures are designed to address cybersecurity risks effectively. Our cybersecurity risk management policies and procedures include the ChromaDex Incident Management Plan.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: Our Board of Directors oversees our cybersecurity, risk assessment, vendor management and disaster recovery and business continuity risk management framework. The Board of Directors reviews and approves our cybersecurity, disaster recovery and business continuity risk management framework on an annual basis.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: Prior to Calidi his work experience was in the arena of Healthcare Information Technology, Software and Services, and his early career was in Enterprise Systems, Data Storage, and the secure management and restoration of data in high-availability installations for mission-critical clients, including Blue Cross-Blue Shield organizations and the US Government. Mr. Thesing received a Bachelor of Science in Business, Information Systems, and Marketing from California Polytechnic University, San Luis Obispo. He is supported by external IT and internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training, and risk management efforts.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Responsibility for cybersecurity risk management is driven by Company leadership who are responsible for communicating the requirements for vigilance and compliance throughout the organization. The cybersecurity program is led by our Vice President of Information Technology ("VP of IT"), who reports to the Chief Financial Officer and has over 25 years of experience building, implementing and managing information systems, including the development and deployment of risk mitigation strategies for such systems. The VP of IT is a member of and works in conjunction with other leaders of the Company's Cyber Governance Committee, which is responsible for oversight of the Company's cybersecurity program. The Cyber Governance Committee comprises cross-functional members of management, and in addition to the VP of IT, includes the Company's Chief Compliance Officer, Chief of Staff, and Chief Accounting Officer. Together, these individuals meet periodically to align cybersecurity and privacy strategy with business needs and risk appetite, monitor the execution of key cybersecurity initiatives, and serve as an escalation point for any related issues.

companyName: SpringWorks Therapeutics, Inc.


text: Material Incidents We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. We, and the third parties that we engage, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.

companyName: ENTERPRISE BANCORP INC /MA/


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, is actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Propanc Biopharma, Inc.

ticker: PPCB


text: The Company's cybersecurity program is led by the Chief Information Security Officer (CISO), who reports to the Senior Vice President and Chief Technology Officer (CTO). The CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, many of whom hold cybersecurity certifications in Information Systems Security or Information Security Management, and through the use of technological tools and software and results from third party audits. Additionally, the CISO directs the Global Information and Cyber Security Council (the "Council"), which includes a diverse range of relevant experts. The Council includes management from global technology, compliance, privacy, controlling, operations, security, automation, ERM, and internal audit. The Council promotes alignment and communication of new and ongoing cybersecurity prevention techniques and provides a forum for staying current on the latest cybersecurity threats. The CTO and CISO report information about such risks to the Board of Directors, the Sustainability and Technology Committee, or the Audit Committee during the regular cybersecurity reviews.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our VP of Information Technology and Information Security Officer ("VP of IT"), who is supported by other members of management, as necessary. Our VP of IT is responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. The Company also has an IT Executive Steering Committee comprised of the VP of IT, CFO, General Counsel, CTO and VP of Operations. The VP of IT provides regular cybersecurity updates to the audit committee. The Company's VP of IT has served in this role for two years and has more than 24 years of relevant experience. In addition, we have an information security team comprised of dozens of employees dedicated to cybersecurity with extensive experience and relevant certifications. The VP of IT is responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating in the event of a cybersecurity incident.

companyName: GENTEX CORP

ticker: GNTX


text: Our Chief Information Officer presents quarterly briefings to the strategy committee and/or our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties. The strategy committee provides at least quarterly updates to the board of directors on such reports. In the event of a material cybersecurity incident or series of incidents, our Chief Information Officer will notify the strategy committee and the audit committee of the Company's board of directors and work with legal counsel to ensure appropriate disclosures are made to regulatory agencies.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: Cybersecurity is recognized as a top enterprise risk and is managed by our Business Information Systems ("BIS") team, a cross-functional team, which is led by our Vice President of Business Information Systems ("VP of BIS"), which reports to the ERM team on a quarterly basis. The Audit Committee of the Board of Directors oversees cybersecurity risks and receives quarterly cybersecurity reports from our VP of BIS and conducts at least two in-depth cybersecurity discussions annually. Our VP of BIS has more than 35 years of experience in Information Technology, including cybersecurity leadership roles. Our Director of Information Security, who reports directly to the VP of BIS, has over 20 years of experience in Information Security Management and maintains Certified Information Security Manager ("CISM") and Certified Data Privacy Solutions Engineer ("CDPSE") certifications.

companyName: SOUTHWESTERN ENERGY CO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses and limit our growth."

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees our management of enterprise risks, including cybersecurity risks. Members of the management team, including our IT director and General Counsel, brief the Audit Committee on the effectiveness of risk management efforts on at least a semi-annual basis. In addition, these risks are reviewed by the Board of Directors at least annually.

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: Our head of the ITS Department, and our executive management are primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: Our CISO is principally responsible for assessing and managing all aspects of the Program, including the Company's Regional Information Security Officers (RISOs), third-party consultants, development of industry trends and control testing and tracking by risk level. Our CISO meets periodically with senior executives, including the Company's President and Chief Executive Officer, to discuss the Company's cybersecurity strategy, and its monitoring, prevention, detection, mitigation, and remediation of cybersecurity risks. Regular reporting on the Program is also provided to the Company's Enterprise Risk Management Committee, which is comprised of the President and CEO, Senior Vice President – Enterprise Risk Management, Executive Vice President – Investments, Executive Vice President – Chief Financial Officer, Executive Vice President – Secretary, and the Of Counsel and Assistant Secretary. Collectively, the CISO and RISOs, along with their teams, in collaboration with the technology and business owners, implement the Program. Legal, Compliance, and Internal Audit functions also assess the Program's adherence to regulatory requirements and internal controls.

companyName: BERKLEY W R CORP

ticker: WRB


text: The Company is managed by the Adviser. As an indirect subsidiary of KKR, the Adviser is subject to and participates in KKR's processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below.

companyName: KKR Enhanced US Direct Lending Fund-L Inc.


text: Our cybersecurity risk management and strategy processes are led by our CISO and the Cyber Risk Committee. Our CISO has over 25 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and controls, as well as relevant certifications, including Certified Industry Systems Security Professional. Our CISO has worked in highly regulated environments for over 20 years and has built strong relations with cybersecurity authorities including the Federal Bureau of Investigation, the Department of Homeland Security, and the Cybersecurity and Infrastructure Security Agency to aid with investigative and intelligence objectives. The Cyber team has an average of over 10 years of cyber-related experience with several senior team members each having over 20 years of cyber experience. Several were also a Chief Information Security Officer or Head of Cybersecurity for their respective former organizations. Other key members of the Cyber team each have over 20 years of relevant experience in Compliance, Audit, Legal, and Data Privacy.

companyName: Warner Music Group Corp.

ticker: WMG


text: We maintain written information security policies and procedures, including a Cybersecurity Incident Response Plan ("CIRP") for incidents involving potential or actual compromises of information security. Our CIRP is overseen by the cyber executive response team, which is chaired by our Vice President, Risk Management and includes representatives from our IS and legal departments. In the event of a cybersecurity incident, we have implemented procedures to (i) mobilize third-party subject matter experts and (ii) notify executive leadership and the Audit Committee and/or the full Board of Directors, in each case, as appropriate.

companyName: BXP, Inc.

ticker: BXP


text: Our third-party business partners also play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party business partner risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new third-party business partners and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: The Company's cybersecurity risk management program is supervised by our CISO, who reports directly to the Company's Chief Information Officer ("CIO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our current CISO received his Master of Business Administration degree from Columbia University and has over 20 years of cybersecurity experience, including relevant prior senior leadership positions held with three other large companies.

companyName: COCA COLA CO

ticker: KO


text: Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee (the "InfoSec Committee"). The InfoSec Committee is currently made up of a cross-disciplinary team, including the Company's acting Chief Information Security Officer (CISO), Chief Financial Officer, Chief Legal Officer, VP of People, IT director, VP of Software Engineering, Senior Director of R&D, and VP of Global Marketing. The InfoSec Committee meets on a regular basis to review and discuss the direction of the Company's cybersecurity program. Our acting CISO is responsible for the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 25 years of experience in information technology.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: We have established a process to review and assess vendors' security posture and practices prior to their onboarding. Vendors that access, store or process our data are required to respond to a cybersecurity questionnaire and provide applicable security audit reports and certifications. Our process also includes contractual requirements to maintain data protection safeguards for vendors that process data on our behalf.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, consultants, and auditors in evaluating and supporting our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Rapid7, Inc.

ticker: RPD


text: While the Company faces a number of cybersecurity risks in connection with its business, as of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have partnered with third-party cybersecurity agencies to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our cybersecurity partners work to continuously scan and monitor our networks for threats and vulnerabilities and provide access to a 24/7 incident response team. Further, through our partnerships, we conduct annual security risk assessments, which are designed in alignment with the National Institute of Standards and Technology Cybersecurity Framework and perform annual penetration tests and breach and attack simulations to validate security controls. These partnerships are actively managed by members of our management team, together with our information technology department, to ensure effective implementation.

companyName: Piedmont Lithium Inc.


text: The head of our Information Technology department, along with our cybersecurity program manager, are principally responsible for overseeing the risks related to cybersecurity. They are responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the senior leadership with regular updates on cybersecurity-related matters. These team members combined have more than 39 years of experience in technology and information security risk management across a number of organizations, have multiple relevant technical and governance certifications, and are active in a number of cybersecurity related boards and organizations.

companyName: Varex Imaging Corp

ticker: VREX


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program with our Board maintaining oversight of cybersecurity risk management, and, to that end, the Board typically meets regularly with business personnel responsible for cybersecurity risk management and receives periodic reports.

companyName: Tracon Pharmaceuticals, Inc.


text: In managing cybersecurity risk, we employ a defense-in-depth strategy and regularly monitor our cyber environment for potential new threats. Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.

companyName: Otter Tail Corp

ticker: OTTR


text: Our Global CISO, who reports to our Chief Operating and Legal Officer ("COLO"), has principal management-level responsibility for our cybersecurity program, which includes assessing and managing our cybersecurity risks, along with developing and implementing cybersecurity processes, policies, and controls that are used for managing cybersecurity risk across the Company. Our Global CISO joined HPE in January 2025, and previously held relevant leadership positions at other public and private companies. He brings over two decades of technology experience spanning information and cyber security, including serving as CISO at other large companies. Our Global CISO is supported by a leadership team managing Cyber Defense; Governance, Risk, and Compliance; Security Strategy; Cybersecurity Architecture and Engineering; and Identity and Access Management, all of whom have extensive experience in private sector cybersecurity roles. Supporting these leaders is a team of cybersecurity professionals with relevant educational and industry experience. The Global CISO periodically meets with the Cyber Governance and Incident Disclosure Committee, our enterprise risk management function, and chief-level executives, as well as the Audit Committee of our Board of Directors, to discuss cybersecurity risks, as well as related mitigation and remediation activities. The CDC monitors the detection, investigation, mitigation, response to, and remediation of cybersecurity incidents, and regularly reports to our Global CISO, engaging with the Executive Committee and the Cyber Crisis Management Team, as appropriate.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our management and audit committee are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Repare Therapeutics Inc.


text: As an exploration stage company, our business activity to date has been identifying, acquiring, and exploring mineral properties. We have not yet adopted formal cybersecurity risk management programs or formal processes for assessing cybersecurity risks. We understand the importance of managing material risks from cybersecurity threats and are committed, as part of our continuing growth, to implementing and maintaining an adequate information security program to manage such risks and safeguard our systems and data. We do not store in our systems any customer or similar data.

companyName: Atlas Lithium Corp

ticker: ATLX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software and training providers.

companyName: Longboard Pharmaceuticals, Inc.


text: Our control over the security posture of and ability to monitor the cybersecurity practices of third-party vendors and service providers, including Galaxy Digital and any digital asset custodians, exchanges, or validators we utilize, is limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by third parties. Given our significant digital asset holdings, any cybersecurity breach affecting our third-party service providers could have a material adverse effect on our business, financial condition, and results of operations.

companyName: Forward Industries, Inc.

ticker: FWDI


text: We deploy robust controls, including firewalls, anti-malware systems, intrusion detection and prevention, encryption, and access controls. These measures are supplemented by continuous monitoring, vulnerability assessments, and penetration testing conducted both internally and by third-party assessors. Insights from these assessments inform the enhancement of our security controls and help us mitigate emerging threats effectively. We also actively engage with key consultants as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity program.

companyName: HEICO CORP

ticker: HEI


text: The Registrants utilize monitoring tools, including but not limited to, cybersecurity incident and event management, penetration testing, intrusion detection and prevention, vulnerability assessments and anti-virus systems to detect anomalous or suspicious system or network activity. The Registrants may also become aware of a potential cybersecurity event or incident through employee reports, notification by a third-party service provider or business partner with potential impact to the Registrants or their systems, customers or notification by a government agency. The Registrants' subject matter specialists from across the enterprise provide input and expertise into risk governance processes, including cybersecurity, information technology, legal, compliance, operations, and enterprise risk management.

companyName: PPL ELECTRIC UTILITIES CORP


text: Our IT department collaborates with our Chief Operating Officer to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards. As part of our risk management process, we conduct regular IT security audits to assess and respond to internal and external security threats. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends and their potential impact on the Company's risk environment.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: The CISO has held several senior-level information technology roles in his twenty-five-year tenure with the Company and has served in his current role since 2021. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Advisor and its affiliates also partner with independent third-party experts to provide a comprehensive cybersecurity solution that safeguards organizations against a broad spectrum of cyber threats. This comprehensive cybersecurity solution offers advanced threat detection, prevention, and response capabilities, including real-time monitoring, threat intelligence, behavioral analysis, endpoint detection and response, malware prevention, and automated response actions. Additionally, the comprehensive cybersecurity solution also provides access to cybersecurity experts, who provide proactive threat monitoring and incident response support to effectively detect, investigate, and remediate security incidents.

companyName: Lightstone Value Plus REIT II, Inc.


text: As noted, to operate our business, we utilize certain third-party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. Response, eradication and recovery, Post-incident analysis and future preparations.

companyName: SPAR Group, Inc.

ticker: SGRP


text: As noted above, the Company relies on our internal Information Systems in connection with the Company's day-to-day operations. The Company relies on the internal processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: SHF Holdings, Inc.

ticker: SHFS


text: Our CIO manages our Cyber Security Program, including the management of risks arising from cybersecurity threats. Our management receives quarterly, and more frequently, if necessary, presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our CIO works, in coordination with our senior management, to implement new programs, as needed, and to oversee our current programs which are designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: POTBELLY CORP

ticker: PBPB


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to our Cybersecurity Incident Management Team, which consists of a representative from our IT Firm, IT Lead, Principal Financial Officer and General Counsel. In addition, our incident response policy includes reporting to our disclosure committee and audit committee of the board of directors for certain cybersecurity incidents.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: Material Cybersecurity Risks, Threats, and Incidents Like most multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, unauthorized access and other cyberattacks, and we expect the sophistication and frequency of such attacks to continue to increase. For example, during the second half of 2023, one of our largest distributors experienced a cybersecurity incident which impacted their ability to place orders and consequently impacted the timing of orders received. This incident, however, as well as other cyberattacks to date, did not have a material impact on our business strategy, results of operations or financial condition. There can be no assurance that future incidents will not materially affect us, including our business strategy, results of operations or financial condition. Please refer to "Item 1A. Risk Factors—Risks Related to Our Business" for further detail about the material cybersecurity risks we face.

companyName: Envista Holdings Corp

ticker: NVST


text: Cybersecurity is an important part of our overall risk management processes and an area of focus for our Board of Directors and management.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Our management team is responsible for monitoring industry trends, consulting with outside IT vendors, and taking basic steps to protect company systems and data. Although none of our executive officers have formal cybersecurity credentials, we recognize the importance of increasing our capabilities in this area as we scale our operations and infrastructure.

companyName: Arculus System Co., Ltd.

ticker: AQLS


text: Our Chief Executive Officer, Joe Ragan, leads management's assessment, identification and management of cybersecurity risk. Mr. Ragan is familiar with cybersecurity matters arising out his public company chief financial officer experience. Our Board of Directors oversees our enterprise risk management system. The Board of Directors meets quarterly, or more frequently as necessary, with members of management to provide updates on all matters, including cybersecurity.

companyName: ExcelFin Acquisition Corp.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. As the historic external property manager of the VineBrook Portfolio and a current subsidiary that engages in property management functions and employs the majority of our employees, we maintain cybersecurity policies, standards, processes and practices at the Manager that cover our 20 physical office locations and over 525 employees. In general, we seek to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing our information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: VINEBROOK HOMES TRUST, INC.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Scientific Officer, President and Chief Operating Officer, Vice President Finance and General Counsel who also serves as our compliance officer. These members of management have prior work experience in various roles involving managing information security programs and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents.

companyName: CalciMedica, Inc.

ticker: CALC


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor's officers detailing the Sponsor's annual due diligence on GLDM's service providers, including a summary of any potential operational or cybersecurity risks and any incidents which could impact GLDM. The Board of Directors also periodically receives reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.

companyName: World Gold Trust

ticker: GLDM


text: In the regular course of business, the Registrants handle a range of sensitive security and customer information. The Registrants are subject to numerous laws and rules concerning safeguarding and maintaining the confidentiality of this information. The Registrants utilize a risk-based, comprehensive, systematic and layered approach to cybersecurity risk, which helps them to continually assess, identify and manage enterprise-wide material cybersecurity risks. The Registrants have a comprehensive cybersecurity threat detection and monitoring program for their technology and network infrastructure, which leverages various systems, processes and operational measures to monitor, detect and respond to cyber incidents. The Registrants have established a security incident response plan, a business resiliency and event management framework, as well as disaster recovery mechanisms, which are tested and updated to prepare the Registrants to respond to material cybersecurity threats. The Registrants' cybersecurity processes, including their threat detection, monitoring and response protocols, are subject to periodic internal audits. The Registrants' Enterprise Security team partners with Internal Audit and third-party experts to conduct periodic penetration tests and assessments of the Registrants' cybersecurity processes.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. Leaders of our Ondas Networks and Ondas Autonomous Systems segments, together with members of our finance team meet to assess cybersecurity risks and identify new risks and assess our risk management framework on a quarterly basis. Among the members of this committee will be employees who are knowledgeable about our products and services and have prior experience managing cybersecurity risks.

companyName: Ondas Inc.

ticker: ONDS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors — Our business and operations may suffer in the event of information technology system failures, deficiencies, or intrusions which could materially affect our results."

companyName: Omega Therapeutics, Inc.


text: To effectively prevent, detect, and respond to cybersecurity threats, the Company employs a multi-faceted cybersecurity risk management program supervised by our Vice President of Technology (VP of Tech), who reports directly to our CEO. The VP of Tech is responsible for leading our enterprise cybersecurity strategy. This responsibility includes establishing processes designed to prevent and monitor potential cybersecurity risks, assessing potential cybersecurity incidents, implementing mitigation measures, and maintaining the cybersecurity program itself. We do this so that we can continuously enhance our cybersecurity capabilities and strengthen our defensive posture.

companyName: AIR T INC

ticker: AIRT


text: The program is integrated into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee of our Board as part of the committee's involvement in managing and overseeing cybersecurity risks.

companyName: Expion360 Inc.

ticker: XPON


text: Onex Corp. maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Onex Corp.'s cybersecurity management team periodically discusses and reviews cybersecurity risks and related mitigants at its Cybersecurity Excellence Quarterly Forum.

companyName: Onex Direct Lending BDC Fund


text: We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business. We follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf.

companyName: Amesite Inc.

ticker: AMST


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.

companyName: New York REIT Liquidating LLC


text: Our internal controls also provide for the Audit Committee to receive prompt information regarding any cybersecurity incident that meets established reporting thresholds, as well as for updates regarding any such incident until it has been fully remediated. The Audit Committee provides updates to the Board regarding such matters, as appropriate.

companyName: CubeSmart

ticker: CUBE