text: We maintain a cybersecurity management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats and incidents. We review our program design on at least a quarterly basis and update as needed to address the risks and threats that our corporate security team has identified. Our team also benchmarks our program to industry recognized frameworks, including the International Organization for Standardization. The Audit Committee of the Board of Directors receives regular reports on cybersecurity risks and evaluates these risks as a part of their enterprise risk review.

companyName: National CineMedia, Inc.

ticker: NCMI


text: Although we have designed its cybersecurity program and governance procedures noted above to mitigate cybersecurity risks, we continue to face unknown cybersecurity risks, threats and attacks. We have had no material cybersecurity incidents, and these risks, threats and attacks have not had a material impact on our operations, business strategy or financial results; however, they may have a material impact in the future.

companyName: ASURE SOFTWARE INC

ticker: ASUR

secItem: Item 1C


text: The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, which is overseen by the Audit Committee and the Board. The Company employs robust cybersecurity and data privacy programs that are designed to assess, identify and manage material risks from cybersecurity threats. These programs are independently assessed every three years against the U.S. National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition. See "Risk Factors - General Risk Factors" for additional information.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: In addition, the Company's Enterprise Risk Management Council (ERMC) considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The ERMC is comprised of the Executive Leadership Team, as well as the Chief Accounting Officer, Chief Compliance Officer, Corporate Secretary, Chief Sustainability Officer, Treasurer and Vice President, Internal Audit. The CIO and CISO attend each ERMC meeting. The ERMC meets during the year and receives periodic updates on cybersecurity risks from the CIO and CISO. We have an established process and playbook led by our CISO governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the Board (including our Lead Independent Director and the Audit and Risk Committee chair).

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Risk Assessment Process. On an annual basis, a risk assessment and maturity analysis is performed for the FNB environment based on the NIST CSF Framework. The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events. The risk assessment considers the inherent risk and controls implemented in the FNB environment and measures the residual risk to ensure it is within the FNB risk tolerance.

companyName: FNB CORP/PA/

ticker: FNB


text: TDS' Information Technology Security leaders are responsible for assessing and managing cybersecurity risks. Management has a depth of cybersecurity experience focused on increasing the organization's resilience to security threats and stays current on new developments through continuing education and monitoring of the cybersecurity landscape. The TDS environment is monitored for potential security threats and security events are investigated and acted on to minimize potential risk to the environment.

companyName: TELEPHONE & DATA SYSTEMS INC /DE/

ticker: TDS


text: Our CEO and COO receive regular updates from Artemis and EVEMeta regarding technology system integrity, cybersecurity considerations, and best practices. These updates include assessments of vulnerabilities, product-related security implications, and measures to address emerging risks. As our company continues to grow and mature, we expect to enhance our internal cybersecurity governance processes, including formalizing responsibilities, increasing engagement with external experts, and providing regular briefings to our Board of Directors on relevant cybersecurity developments.

companyName: Brag House Holdings, Inc.

ticker: TBH


text: We implement controls and procedures designed to measure and mitigate risk with third-party vendors and business partners who have access to sensitive information, including conducting a security risk assessment. Identified security risks are remediated or documented, and in some cases, the business relationship may be ended or not pursued. We also perform a vendor security assessment process for purchases over a certain minimum threshold.

companyName: TRIMBLE INC.

ticker: TRMB


text: Under the oversight of the audit committee of the Company's Board of Directors, and as directed by the Company's Chief Financial Officer, the Vice President of Information Technology is primarily responsible for the assessment and management of material cybersecurity risks, establishing and maintaining adequate and effective internal controls covering cybersecurity matters, and disclosing any material cybersecurity matters faced by the Company. This also includes hiring appropriate personnel and/or third party service providers, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, including the Company's Chief Financial Officer and, as applicable, the Company's Board. The Company's current Vice President of Information Technology has more than 20 years of experience with information technology and related systems security matters and processes.

companyName: iANTHUS CAPITAL HOLDINGS, INC.

ticker: ITHUF


text: Our Chief Financial Officer is responsible for management oversight of our information security program and controls, which includes cybersecurity risk management. Our Director of IT ("Director")

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report on Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors, "We are reliant on information technology systems and may be subject to damaging cyber-attacks or security breaches" and "We are subject to data privacy laws, rules and regulations and any non-compliance with such laws, rules and regulations, could adversely affect our business, financial condition and operating results" in this Annual Report on Form 10-K.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: In the ordinary course of our business, we use, store and process a bare minimum of data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of data segregation, penetration testing, and training.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: Employee Training. We provide all employees with annual training on information security, data protection, and relevant company policies so that they are empowered to identify cybersecurity risks and take action. To further enhance awareness and responsiveness to potential threats, we also conduct regular phishing simulations and email communications on cybersecurity trends awareness throughout the year. Third Party Assessment. We engage independent third party consultants to review the effectiveness and maturity of our cybersecurity program.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal data protection program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: • we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO); • we maintain a dedicated cybersecurity team under the direction of our Chief Information Officer (CIO), who has expertise related to data and network security, data governance and risk management; • we regularly test our internal IT controls; • we regularly conduct internal vulnerability assessments as well as third-party penetration tests; • we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; • all employees are required to complete periodic trainings that cover security and privacy best practices and company policies; and • we have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: The Audit and Finance Committee (the "Audit and Finance Committee") of our Board of Directors is responsible for reviewing and monitoring general IT and cybersecurity matters, including related risks, and reporting to the Board its determinations, actions and recommendations related thereto. Our Audit and Finance Committee is composed of independent directors with extensive executive leadership and risk management experience. Our CISO, together with our CIDO, provide quarterly updates to our Audit and Finance Committee regarding the cybersecurity risk landscape, specific risks affecting the Company and solutions to mitigate those risks, and legal and regulatory requirements relating to cybersecurity. These updates assist the Board in performing its oversight and risk management function. In addition, the full Board receives an annual report on cybersecurity directly from the CISO.

companyName: ENTEGRIS INC

ticker: ENTG


text: Our CISO is responsible for assessing and managing cybersecurity risks and maintaining our cybersecurity program. Our CISO has over 20 years of experience, including five years as our CISO, managing technology risks across multiple industries, including financial services, technology and manufacturing. Through strategic hiring and internal development, our CISO increases the levels of skill and experience on our IT Risk Management team to stay ahead of evolving cybersecurity threats. As of the date of this filing, 94% of our IT Risk Management team has technical industry certification, and members of the IT Risk Management team have an average of 15 years of cybersecurity experience. Our CISO currently serves as an advisor to multiple industry groups. Our cybersecurity program undergoes an annual controls effectiveness assessment and bi-annual program maturity evaluation against industry peers and consistently receives assessments indicating that it is ahead of the cybersecurity programs of our peer group.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: The Board of Directors is responsible for overseeing management's processes to identify and mitigate risks, including cybersecurity risks. The Board's Audit Committee leads the review and discussion of cybersecurity threats with management and receives updates from the CISO each quarter. Senior management, including the CISO, are available to address questions or concerns from the Audit Committee related to our risk management plan.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: At the Board of Directors level, our Audit Committee oversees our risks related to information security and privacy. To accomplish this responsibility, the Audit Committee meets quarterly with our CTO and CISO to receive and discuss updates on our cybersecurity program. Top risks, key initiatives, material cyber incidents, remediation activity and security metrics are shared to report the overall loss potential, program effectiveness, risk management conditions and current threat landscape. Our Board of Directors is committed to maintaining a well-informed and security-aware business by regularly engaging through updates on the organization's roadmap and evolving threat landscape.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT infrastructure; • security controls intended to protect against, detect, and respond to cybersecurity threats, and a security team principally responsible for managing our (1) security controls, (2) cybersecurity risk assessment processes, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Eventbrite, Inc.

ticker: EB


text: Management's Role Managing Risk The Company's IT Committee, which includes senior executives and other members of management, meets regularly to monitor and discuss cybersecurity issues. The Senior Vice President of Information Technology, the Executive Vice President and Chief Accounting Officer ("CAO") and the Co-Chief Operating Officer ("COO") play a pivotal role in informing the Board on cybersecurity risks. They provide comprehensive briefings to the Board on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Board, Senior Vice President of Information Technology, CAO and COO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company.

companyName: Matador Resources Co

ticker: MTDR


text: Risks from Cybersecurity threats or previous incidents have not materially affected business strategy, results of operations, or financial condition. A vendor management report is presented to the Board of Directors on an annual basis by the Chief Technology and Information Security Officer.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Our Board considers risk assessment and development of risk mitigation strategies to be a responsibility of the entire Board in consultation with the appropriate Board committees. The Board regularly engages in risk oversight on a broad range of matters, including challenges associated with strategic acquisitions, cybersecurity, regulatory and other legal and compliance matters. For more focused risk oversight, our Board committees are tasked with specific risk management roles.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Cybersecurity Service Providers and Third-party Consultants. We engage cybersecurity consultants and other third parties to assess and enhance our information security practices. These third parties conduct assessments, penetration testing, and vulnerability assessments to identify weaknesses and recommend improvements. We also utilize third-party tools and technologies to support our efforts to enhance our cybersecurity functions.

companyName: Archer Aviation Inc.

ticker: ACHR


text: b. Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties, such as vendors, suppliers, and other business partners associated with our use of third-party service providers. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: TEJON RANCH CO

ticker: TRC


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See the Risk Factor titled "We are subject to cyber-security risks, including those related to customer, employee, vendor or other company data and including in connection with integration of acquired businesses and operations" for a discussion of risk associated with cybersecurity.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: Risk Identification and Assessment As part of our overall risk management system, we have a dedicated InfoSec team to oversee management's process for effectively monitoring and mitigating risk. The InfoSec team regularly reviews threat intelligence from various sources, including third-party InfoSec consultants, assesses the applicability of known threats and threat actor behavior and tactics to the Company, and assesses whether these threats pose risks to the Company. The InfoSec team then evaluates potentially appropriate administrative, technical, and physical controls to mitigate and reduce these risks within the appropriate business context and applies such controls where appropriate. We also have implemented a process to identify and mitigate risks from cybersecurity threats related to our use of third-party service providers.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: We maintain a security incident response plan that is utilized when cybersecurity incidents are detected. We conduct periodic tabletop exercises, in which different internal and external stakeholders, including from time to time our CEO, Non-Executive Chair, or Board of Directors, participate in a simulated cyber scenario. The purpose of these exercises is to test our security incident response plan, identify weaknesses or gaps, and ensure that all participants are aware of, and familiar with, their roles and responsibilities.

companyName: FOOT LOCKER, INC.


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our information security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes). This training is mandatory for all employees and is supplemented with periodic social engineering tests.

companyName: CORVEL CORP

ticker: CRVL


text: We have not experienced a material data breach or failure of our cybersecurity program. Our business depends on the availability, reliability and security of our and our third party contractors' information systems, networks and data. Various risks arising out of a cyberattack, security breach or a failure on our or our third party contractors' part to maintain an adequate cybersecurity program could adversely affect our business, financial condition, and results of operations. See " Risk Factors – General Risk Factors – Our information technology systems, or those of our third party CDMOs, CROs, specialty pharmacies, third party logistics providers and other contractors, consultants and service providers, may fail or suffer cyberattacks or security breaches, which could result in a material disruption of our or such third party's business or operations, impede our development programs for our product candidates or materially impact our ability to commercialize our products."

companyName: Kiniksa Pharmaceuticals International, plc

ticker: KNSA


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with NeTTronix Technology Solutions who reports to our CFO, to manage the risk assessment and mitigation process.

companyName: BONK, INC.

ticker: BNKK


text: CTO provides periodic briefings for our senior management team on cybersecurity matters, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and cybersecurity threats.

companyName: Beyond Air, Inc.

ticker: XAIR


text: During the third party procurement and contracting process, the Company incorporates due diligence procedures and contract provisions that are designed to align with applicable regulations and industry benchmarks.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: The Audit Committee of our Board includes members with significant experience and/or expertise in technology or cybersecurity, as well as a member with cybersecurity training certifications, and is responsible for the primary oversight of enterprise risk assessment and management pertaining to the financial, accounting, liquidity, market, tax, cybersecurity and other information technology risks facing our company. At its regular meetings, the Audit Committee, which meets no less than four times per year, receives regular reports from our GVP & Chief Counsel, Chief Ethics and Compliance Officer on matters relating to data privacy and compliance, as well as from our Vice President of Risk Management on enterprise risk management, including the activities of our internal audit department surrounding audits and risk assessments of our information security management system, coverage by our insurance carriers for cybersecurity incidents, and our ISO 9001 and 27001 certifications (described above under the heading "Compliance and Certifications" in Part I, Item 1 ("Business") of this Report.

companyName: Rimini Street, Inc.

ticker: RMNI


text: The Board has designated the Audit Committee as the governing committee for the oversight of the Company's material IT cybersecurity risks. The Audit Committee reviews cybersecurity risks through quarterly updates, and the committee monitors the status of ongoing projects to strengthen existing information security controls and practices and mitigate the potential risk of cybersecurity incidents. Quarterly, the Company's Chief Financial Officer (CFO), with support from the expert firm providing Chief Information Officer (CIO) services, presents on material cybersecurity risks and their accompanying mitigation and remediation strategies to the Audit Committee.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: Our management team, led by our CFO, is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through updates by our Director of IT. Our CFO and Director of IT are responsible for assessing and managing risks that may arise from cybersecurity threats. Our CFO has over 10 years of experience managing IT operations including strategy, infrastructure and execution. Our Director of IT has over 20 years of experience in information technology including roles managing operations, compliance, development, applications, information security, support and execution.

companyName: ESCALADE INC

ticker: ESCA


text: As part of the Program, the Company deploys technical and organizational safeguards designed to protect the Company's networks, systems, and data from cybersecurity threats; maintains a threat management program that continuously monitors evolving cybersecurity risks; has established and maintains incident response plans that address the Company's response to a cybersecurity incident; maintains a third-party risk management program that includes a due diligence and ongoing assessment process for service providers based on the risk they present and the adequacy of their safeguards; and provides ongoing education and training to employees regarding information security threats. The Company also conducts periodic penetration testing and tabletop exercises.

companyName: American National Group Inc.

ticker: ANG-PD


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations and contract manufacturing organizations. As part of our vendor security due diligence and to manage cybersecurity risks associated with our use of certain vendors, we perform risk assessments on vendors and may include cybersecurity obligations in our contracts with them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor due diligence involves different levels of assessment designed to help identify cybersecurity risks associated with a provider. For example, we may impose contractual obligations related to cybersecurity on the provider.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors and service providers Education and Awareness: The Adviser provides periodic training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: All material cybersecurity risks, incidents, and responses are to be reported to the CEO as a routine matter. The CEO then reports the information to the Board of Directors.

companyName: Crown Equity Holdings, Inc.

ticker: CRWE


text: we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Our cybersecurity program includes: • annual compliance training, which includes modules on information security, and provides quarterly phishing simulation exercises to reinforce awareness and enhance cybersecurity practices; • intrusion detection by monitoring network and system activities to detect unusual or suspicious behavior; • access management and access controls which aim to implement "least privilege" access; • protection of sensitive data through "at rest" and "in transit" encryption; • industry-standard monitoring and protection software; • a defined vulnerability management program; • periodic cybersecurity assessments, including with the support of independent third-party consultants; • developing plans for recovering from security incidents and maintaining business continuity in the face of cyberattacks; and • a cybersecurity incident response plan that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents.

companyName: Strategic Education, Inc.

ticker: STRA


text: In addition, our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

companyName: APi Group Corp

ticker: APG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, and privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: The CIO, in coordination with the Chief Executive Officer, Chief Financial Officer, Chief Compliance Officer, Chief Legal Officer, and Chief People Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The CIO has served in various leadership roles in information technology and information security for over 24 years, including serving as the vice president of information technology, with direct responsibility over the cyber security program, for a large publicly-traded company and as the chief information security officer of several large healthcare organizations. The CIO holds a Certified Information Systems Security Professional certification, an undergraduate degree in engineering, an MBA and a PhD in engineering.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: Bain Capital provides information security awareness training to employees, and function-specific security training is also provided (where appropriate based on job function). Bain Capital also engages in phishing campaigns.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: As part of our overall risk management framework, we have processes in place to identify, assess, and manage material risks from cybersecurity threats.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Risk Management Strategy Our business is dependent upon our information technology ("IT") systems, devices and networks to collect, process and store the data necessary to conduct our business and record and report our business and financial information. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our IT systems and protect the confidentiality, integrity, and availability of our confidential and personal data, including with respect to our customers, suppliers, and employees, as well as our intellectual property. TECOGEN INC.

companyName: TECOGEN INC.

ticker: TGEN


text: As part of our cybersecurity risk management procedures, we perform system monitoring and scanning and utilize security tools supported by a third-party managed services provider. We also conduct penetration testing performed by a third-party provider. Employees are enrolled in cybersecurity awareness training courses designed to help them identify cybersecurity concerns and take appropriate actions, and we conduct periodic simulated phishing tests in an effort to further raise cybersecurity awareness and reduce the risk of a successful cyberattack. We have an incident response plan to guide us in responding to cybersecurity incidents, and have conducted tabletop exercises to test the plan. We also take steps to protect against business interruption and conduct annual restoration testing for major systems. In addition, we use a risk-based approach to assessing cybersecurity risks from certain critical third-party vendors. This program aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity practices.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: Our CTO is also responsible for reporting on the status of our information security program and related efforts and processes to Company senior management periodically, and to the Audit Committee on a quarterly basis. In addition, our CTO reports cybersecurity matters to Company senior management and the Audit Committee on an as-needed basis. At each regularly scheduled meeting of our board of directors, the Chair of our Audit Committee provides quarterly updates regarding significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled board meeting (including cybersecurity matters, as and if applicable), as well as timely updates outside of quarterly updates on an as needed basis. Our CTO promptly informs Company management and our Audit Committee (and IAC management) of cybersecurity incidents that meet established reporting thresholds or when otherwise determined appropriate, as well as provides ongoing updates regarding any such incidents until they have been resolved.

companyName: Angi Inc.

ticker: ANGI


text: Incident and Risk Escalation Through Cyber Incident Response Plan Information Security maintains processes for prevention, detection, and mitigation of cybersecurity incidents. The Company maintains a Cyber Incident Response Plan (CIRP) that covers response and remediation processes for managing cybersecurity incidents. The CIRP outlines the cross-functional responsibilities for the Cyber Crisis Team, the Core Team and Extended Core Team during a notification incident. The Core Team consists of the Chief Information Security Officer, Chief Legal Officer, Chief Information Officer, and Director Operational Risk Management to manage the incident. The Extended Core Team consists of other business area leaders who may need to be engaged based on the area of impact. All CIRP incidents are managed through an Incident Commander with communications being escalated to executive leadership as needed, who will then report to the Board. Key Performance Indicators and Key Risk Indicators related to monitoring and detection are presented to Technology and Information Security and Operational Risk Management Committees.

companyName: Independent Bank Group, Inc.


text: We also have a process to evaluate third-party providers, which is designed to understand the potential risks and impact of threats to our supply chains as well as potential privacy risks associated with external data management. This process has multiple components and is designed to assess our providers performance across several domains, including data security, asset management, communications and operations management, access control, business continuity management, financial, and legal compliance.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats and have materially affected or could materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Techpoint, Inc.


text: The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Furthermore, the Company's cybersecurity program is periodically reviewed and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. Our Vice President, Mr. Peng, is designated to manage the risk assessment and mitigation process.

companyName: Zhuoxun Hongtu Inc.


text: c. Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. d. Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. e. Conducting subsequent penetration testing and vulnerability assessments, as warranted.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Our Chief Information Security Officer ("CISO") has responsibility for HP's global cybersecurity program, including infrastructure and technology platforms, overseeing governance, regulatory and compliance, operations, strategy, and architecture. The CISO reports to our Chief Financial Officer. This role is responsible for building out a cybersecurity organization that is designed to enable robust security coupled with productivity for more than 70,000 global employees, contractors, and partners. The CISO supports HP's business acceleration and transformation by identifying and managing cybersecurity risks, balancing them with business priorities, and using a contemporary security posture to support HP's position as an industry leader. As part of this, the CISO receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

companyName: HP INC

ticker: HPQ


text: Management Governance Disclosure Our senior management team, which includes our Chief Information Security Officer, or CISO, is responsible for identifying, assessing, and managing material risks from cybersecurity threats, as well as for establishing processes to ensure such risks are monitored and mitigated, with the CISO taking the lead on such matters. Our CISO, who joined Appian in May 2021, brings over 18 years' experience in security and compliance initiatives, including experience in the software-as-a-service and platform-as-a-service cloud industries. We have documented the framework and process for when and by whom senior management is informed and when such information will be reported to the other parties in our Incident Response Guide, which is regularly reviewed and updated by the information security team.

companyName: APPIAN CORP

ticker: APPN


text: Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our third-party service provider. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors periodically reviews our cybersecurity assessment and management policies, as appropriate.

companyName: ACTUATE THERAPEUTICS, INC.

ticker: ACTU


text: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Upland Software, Inc.

ticker: UPLD


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: Key features of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and, information; • an information security program, led by our Chief Technology Officer, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.

companyName: Vroom, Inc.

ticker: VRM


text: Every six months, management discusses cybersecurity risk and reviews our cybersecurity program. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors regarding cybersecurity matters.

companyName: Cardlytics, Inc.

ticker: CDLX


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards. We engage certain third parties to enhance and assist with our cybersecurity oversight, including a 24/7 Security Operation Center, or SOC, that monitors network devices and computer systems in real time. We include confidentiality and data protection provisions in certain contracts with third-party service providers to help protect us and our patients from any related vulnerabilities.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risk.

companyName: CIRTRAN CORP

ticker: CIRX


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: Our Board is aware of the critical nature of managing risks associated with cybersecurity threats. Management works with our Board to establish oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board has delegated to our Audit Committee the primary responsibility for oversight of cybersecurity risks.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: In the event of any concerns or breaches, these are immediately escalated to Paul Riss, ensuring prompt and effective response and mitigation strategies.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Our CTPO is responsible for assessing and managing the Company's material risks from cybersecurity threats, and our CISO reports directly to our CTPO regarding such threats. Our CTPO is informed about and monitors the prevention, detection, mitigation and remediation or cybersecurity incidents through the management of and participation in the Company's Internal Audit team, Incident Response Team and Cybersecurity Task Force, as described above. As discussed above, our CTPO or CISO reports biannually to the full Board and quarterly to the Audit Committee about risks from cybersecurity threats among other cybersecurity related matters. To the extent a material cybersecurity incident occurs, our CTPO and broader management team would inform the chair of our Audit Committee of the nature, scope and impact of the incident, and involve the other members of the Audit Committee or the full Board as necessary to evaluate the risks and determine next steps. Our CTPO has served in this role since 2023 and has more than 20 years of experience in various senior leadership roles involving managing cybersecurity and compliance teams, including as Head of Tech and Digital at Lovevery and as Chief Technology and Product Officer at Zulilly.

companyName: TheRealReal, Inc.

ticker: REAL


text: At Cushman & Wakefield, we believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide annual cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: We have established a documented cybersecurity incident materiality assessment and disclosure program that is jointly managed by our Incident Response, Cybersecurity, and Corporate Legal teams. This program calls for the immediate assessment of potentially material cybersecurity incidents, and the appropriate escalation to our cross-functional Disclosure Committee in order to facilitate the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner and elevated to our Audit Committee or Board, as appropriate.

companyName: Dayforce, Inc.

ticker: DAY


text: We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures within our FORWARD-LOOKING STATEMENTS, discussed in Item 7. MANAGEMENT'S DISCUSSION AND ANALYSIS OF FINANCIAL CONDITION AND RESULTS OF OPERATIONS, of this Annual Report discussed above, given the nature of our current operations and our experience to date, we do not currently perceive cybersecurity as a particularly significant risk to our business. Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties, or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.

companyName: INNSUITES HOSPITALITY TRUST

ticker: IHT


text: Cyber Risk Management Personnel. Through training and compliance programs, the concept that all employees are responsible for the data and critical systems they access is reinforced. The information technology department for the Company has the responsibility to implement cybersecurity controls under the overall guidance of the cybersecurity team. This cybersecurity team includes internal cybersecurity experts that have a combined 55 years of general information technology experience and 37 years of cyber specific related experience. The internal cyber team have obtained various degrees and certificates in network administration, security administration and information system management. The Company also partners with a third-party cybersecurity firm that assists the Company and many other clients in setting direction, implementing cybersecurity technology and supporting the Company's security operations center. The information technology department is led by two directors, one with over 20 years experience in information technology leadership roles at Knife River and the other with 14 years of combined experience in information technology roles at MDU Resources and Knife River. The information technology department, including the cybersecurity team, reports to the vice president of support services, who has 17 years of information technology leadership and operational leadership experience with Knife River and over 30 years of total information technology experience. The vice president of support services reports to the chief executive officer.

companyName: Knife River Corp

ticker: KNF


text: The Audit Committee of the Company's Board of Directors has oversight authority to review the Company's data protection and cybersecurity risk exposure and the steps management has taken to assess and respond to the overall threat landscape, including the strategy management implemented to mitigate the Company's cyber risk exposure. The CISO and CIO report to the Audit Committee on current data protection and cybersecurity matters quarterly, and as may otherwise be needed. The CISO is authorized to report directly to the Audit Committee on the Company's security program and status of cybersecurity risk management efforts. The Chair of the Audit Committee reports these matters, as appropriate, to the Board of Directors.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: Overseeing Third-Party Risk We have processes in place designed to help us identify and oversee cybersecurity risks associated with our use of vendors, service providers, business partners, and other third parties that process our data on our behalf or have access to our systems. These processes include a vendor management policy designed to identify and consider potential risks from third parties as part of the vendor section process, which considers vendor cybersecurity standards and other factors based on the nature of the services that the vendor will provide.

companyName: INSPERITY, INC.

ticker: NSP


text: Risk-based, layered controls – We regularly assess and adjust our technical controls and methods to identify, respond to and mitigate emerging cybersecurity risks and use a layered approach with overlapping controls to defend against cybersecurity attacks and threats to our networks, end-user devices, servers, applications, data and cloud solutions and the data that our customers entrust to us.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board exercises oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are integrated into our ERM program and are based on frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Axe Compute Inc.

ticker: AGPU


text: We utilize third -party cybersecurity firms in various capacities to operate some of these controls, including remote monitoring, cloud-based platforms and services as well as on-premises services. For example, we use third parties to perform a variety of functions for the Company, including, but not limited to cybersecurity audits, targeted ransomware assessment and table-top exercises, internal penetration tests and other internal and external audits. These expert services enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.

companyName: READING INTERNATIONAL INC

ticker: RDI


text: We have developed and implemented a cybersecurity risk management program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, or availability of our information technology systems or any information residing therein. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Bloom Energy Corp

ticker: BE


text: Teams of internal and third-party cybersecurity professionals oversee cybersecurity risk management, which is based on the National Institute for Standards and Technology Cybersecurity Framework: • Identify – Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities. • Protect – Develop and implement appropriate safeguards to ensure delivery of critical services. • Detect – Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. • Respond – Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. • Recover – Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident.

companyName: Prime Medicine, Inc.

ticker: PRME


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our Vice President of Information Technology and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a materially adverse effect on our business, including our business strategy, results of operations and financial condition. However, there can be no assurance that our processes and procedures will prevent or timely detect a cybersecurity incident. For more information regarding risks from cybersecurity threats, see "Risk Factors—Risks Relating to Our Products—Risks Relating to Production and Distribution of Products."

companyName: Cronos Group Inc.

ticker: CRON


text: The Audit Committee of our Board of Directors bears the primary responsibility for oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. Management's oversight is performed through an IT Strategy Committee, a subset of executive management including our Chief Financial Officer, or CFO, and Chief Legal Officer, and relevant functional expertise, including our Senior Vice President, Information Systems, or SVP, IS. Our SVP, IS, is the primary member of the IT Steering Committee charged with responsibility for assessing, monitoring and managing our cybersecurity risks. With over 20 years of experience in information technology strategy and operations, his background includes extensive experience as an IT executive at various companies. At least annually, the SVP, IS, and the CFO provide a comprehensive report to the Audit Committee regarding cybersecurity risk assessments, planned enhancements to our cyber security program, and incident reports and remediation, if any.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: Because it is essential to our operations and business strategy that our website, technology and network infrastructure remain secure, we have processes in place for assessing, identifying, and managing material risks from cybersecurity threats. We have integrated these processes into our cybersecurity risk management program.

companyName: Avinger Inc


text: The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management and have been embedded in the information systems operating procedures and internal controls. Our IT function manages IT operations and continually evolves and enhances our systems to meet the constantly changing digital environment. Periodic cybersecurity risk assessments are performed to identify, assess, and prioritize potential risks to information, data assets, infrastructure and third party vendors. Additionally, a third-party review and testing of the financial controls over IT as part of our Sarbanes-Oxley internal controls testing is performed annually. The Company addresses significant risks through corrective or mitigating actions as necessary.

companyName: DATA I/O CORP

ticker: DAIO


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors and Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our Information Security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.

companyName: ThredUp Inc.

ticker: TDUP


text: The Company utilizes the following guidelines and frameworks to develop and maintain the Information Security Management Program: Federal Financial Institutions Examination Council ("FFIEC") Information IT Examination Handbooks, FFIEC Cybersecurity Assessment Tool ("CAT"), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), 12 CFR Appendix B to Part 30 - Interagency Guidelines Establishing Standards for Safety and Soundness Gramm-Leach-Bliley Act ("GLBA") 501(b).

companyName: LAKE SHORE BANCORP, INC.


text: Role of the Board of Directors Our Board has delegated responsibility for overseeing our technology, cybersecurity and data privacy programs and controls to the Audit Committee. The Audit Committee evaluates the adequacy of the Company's technology and cybersecurity (including data protection) programs, with the CTO. The CTO provides periodic updates concerning the Company's technology and cybersecurity programs (including data protection) to the full Board on an annual basis.

companyName: Sterling Check Corp.


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, including SOC-2 and ISO 27001, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program to allow security researchers to help identify vulnerabilities in our systems before they mature into real-world cybersecurity threats. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.

companyName: DROPBOX, INC.

ticker: DBX


text: Our President & COO and our Director, Systems & Security each have extensive experience in the information technology area. In particular, our Director, Systems & Security has over twenty years of professional experience in the information security area, including as a result of his service as a director of security, a security architect, and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Cybersecurity is a critical component of the Company's ERM program. The Company has established an information security framework to help safeguard the confidentiality, integrity, and availability of information assets and ensure regulatory, operational, and contractual requirements are fulfilled. The Company's cybersecurity program is focused on the following key areas:

companyName: BADGER METER INC

ticker: BMI


text: The Company's cybersecurity risk program is supervised by members of our executive team and administered by internal information technology leadership with the assistance of third-party experts, including consultants and a computer security firm. The Audit Committee and the Board of Directors receive periodic reports on the Company's actions to respond to the cyber security incidents and the overall cyber risk environment. In accordance with our Security Incident Response Plan ("SIRP"), the Audit Committee is to be promptly informed by management of cybersecurity incidents with the potential to have a material impact on the Company, its financial results, or its information systems.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: In the event of a potential or actual cybersecurity event, the Director of IT immediately notifies general counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition.

companyName: Shimmick Corp

ticker: SHIM


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: CPI Card Group Inc.

ticker: PMTS


text: The Board is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The CEO and CFO report on cybersecurity matters, including material threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: Our Board oversees our enterprise risk management activities. The Board receives periodic updates on our cybersecurity risk management program as well as regular updates and education on relevant legislation and trends related to cybersecurity. Our Audit Committee assists the Board in its oversight role and receives regular reports from management on the Company's information systems and cybersecurity program. Several members of our Board's Audit Committee have expertise and experience in cybersecurity, and one director is the President of a major cybersecurity services provider.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. Our information technology risk committee is comprised of senior managers in our information technology, loan origination, loan servicing, accounting, and legal groups that meet monthly to review information security risks and the development and implementation of policies and procedures and other controls to mitigate cybersecurity and other information security risks. Our CISO provides a report to our management risk committee on the activities of the information technology risk committee, which committee, in turn, reports regularly to the full Board on its activities.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: This program has a multi-tier risk management structure that includes regular reviews of laws, policies, vulnerabilities, and resource levels to address risks facing our organization. Such risks include operational, intellectual property theft, fraud, risks that have potential unfavorable impacts on our employees and/or patients, and violation of data privacy or security laws.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on their risk profile.

companyName: Plymouth Industrial REIT, Inc.


text: Ramaco uses third parties to manage its information technology ("IT") infrastructure. The Company's process for assessing, identifying, and managing material cybersecurity risks includes the following activities, all of which are performed or assisted by third parties with considerable experience providing managed IT and security services or IT assurance services:

companyName: Ramaco Resources, Inc.

ticker: METC


text: In the event of a potentially material cybersecurity incident, the Company's incident response plans establish escalation protocols for relevant IT leaders and functional leaders within Enterprise Risk Management, Legal, Compliance and Internal Audit to engage management as appropriate.

companyName: BERKLEY W R CORP

ticker: WRB


text: At this time, the Company does not have formal processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our approach to cybersecurity is currently informal and primarily reactive, involving basic security measures such as: Basic Security Software: We use standard antivirus and anti-malware software for protection against common threats. Password Policies: Simple password policies are in place to protect access to our systems.

companyName: T3 Defense Inc.

ticker: DFNS


text: engagement with external service providers to evaluate, enhance, or support our security measures; and an incident response plan outlining specific procedures for managing cybersecurity incidents;

companyName: NexMetals Mining Corp.

ticker: NEXM


text: The Board provides oversight for the Information/Cybersecurity Program and related matters, including risks associated with cybersecurity threats. The Board receives periodic updates from Lord Abbett's CISO regarding the overall state of the Adviser's security program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Lord Abbett Private Credit Fund


text: Our procedures for assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is evaluated as a component of our broader enterprise risk management program, identified in our risk register and monitored and managed more specifically by our Corporate Security Incident Response Team (CSIRT); (2) the security function works with the CSIRT to help prioritize our risk management processes and help mitigate cybersecurity threats that we believe are more likely to lead to a possible material impact to our business; (3) our ISO evaluates material risks identified from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors (the "Audit Committee"), which reviews and discusses with senior management our overall risk assessment and management.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Integration with Overall Risk Management: Cybersecurity risks are seamlessly integrated into the Company's broader risk management framework, ensuring a holistic view and prioritized mitigation strategies.

companyName: LANDMARK BANCORP INC

ticker: LARK


text: The Cybersecurity Team reviews the integrity of services provided by vendors engaged to support the Company's cybersecurity efforts using the same methods as are used to evaluate the services provided by other vendors engaged to support the Company's regular business operations.

companyName: CONTINENTAL RESOURCES, INC


text: Management is not aware of any material security breaches on its Information Systems and risks from cybersecurity threats have not previously materially affected us. Certain of our vendors have experienced cyberattacks in the past and the threat and development of cyberattacks is continuous. It is impossible to say with certainty whether the Company's efforts will prevail in a coordinated attack on its Information Systems. Currently we expect the risks from cybersecurity threats will continue, but are not reasonably likely to materially affect us mostly due to our profile and not because our defenses are impenetrable or the efforts of criminals will not become more sophisticated. A cybersecurity attack on our systems could have a material negative impact upon our business, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards, and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing, and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients, and business partners; and (v) providing appropriate public disclosure of cybersecurity risks, and incidents when required.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management and have been embedded in the information systems operating procedures and internal controls. Our IT function manages IT operations and continually evolves and enhances our systems to meet the constantly changing digital environment. Periodic cybersecurity risk assessments are performed to identify, assess, and prioritize potential risks to information, data assets, infrastructure and third-party vendors. The Company addresses significant risks through corrective or mitigating actions as necessary.

companyName: DATA I/O CORP

ticker: DAIO


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Manager's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Manager about any information security incidents that may pose a material risk to the Manager. The Manager contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: The DPIRC is responsible for implementing, reviewing and revising cybersecurity policies and directives, as well as overseeing the protection, detection and response capabilities of cybersecurity resources. In addition, the DPIRC promotes, endorses and validates Vista's cybersecurity risk posture, reviews industry best-practices, provides strategic direction for cybersecurity matters and oversees cybersecurity training programs. The DPIRC is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, Vista's cybersecurity risk program and the operation of the Incident Response Plan and Business Continuity Plan and works in coordination with Vista's internal information technology departments to, among other things, implement, review and revise the policies underlying its cybersecurity program. Additionally, Vista's Enterprise Risk Committee receives quarterly information security updates from the Vista CISO.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: The CIRT determines whether a cybersecurity incident warrants escalation to the CIMT. In the event of a cybersecurity incident, the IRP describes processes to detect, analyze, contain, eradicate and remediate such incident. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Conducting risk assessments to validate our cybersecurity policies, practices, and tools; • Employing appropriate next generation firewalls, endpoint detection and response (EDR) software, identity and access management (IAM), multifactor authentication (MFA), virtual private network (VPN), account change monitoring, encryption, patch management, web content filter, spam filter and reporting, and security information and event management (SIEM) software; • Conducting regular vulnerability scans of our IT and OT infrastructure; • Obtaining and applying vulnerability patches appropriately; • Conducting penetration tests and assessing recommended corrective actions; • Requiring employees to complete a security awareness training program; • Conducting regular phishing simulations and tabletop exercises to test familiarity with cybersecurity policies and procedures; and • Reviewing and evaluating developments in the cyber threat landscape.

companyName: Coterra Energy Inc.

ticker: CTRA


text: o Periodic Updates: The board receives periodic updates from management, responsible staff and the Audit & Risk Committee regarding the Company's cybersecurity posture, incidents, and risk management efforts.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: In addition, the Company's RMC, a management level committee that includes, among others, the Chief Financial Officer and Chief Legal and Compliance Officer, oversees and supports the Company's ongoing efforts to identify, assess and prioritize, manage and monitor the Company's enterprise risks, including risks related to privacy and cybersecurity, and periodically reports certain discussions to the Company's Chief Executive Officer and Audit Committee. The RMC's Cybersecurity Incident Disclosure Subcommittee, whose members include the members of the RMC, the CISO and lead securities counsel, is tasked with assessing significant events for materiality, related timely and accurate disclosure under the securities laws and, as appropriate, escalating such events to the Audit Committee and the Board of Directors.

companyName: Walt Disney Co

ticker: DIS


text: Management's Assessment and Response to Material Risks from Cybersecurity Threats Our information security team and its leadership have primary responsibility for assessing and managing cybersecurity risks, within the scope of the overall ERM Committee. Such individuals collectively have over 80 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Cybersecurity threats are reported to management through robust and documented incident reporting processes. Our ERM Committee is comprised of Information Security, Legal, Treasury and other key executive stakeholders. The committee meets on a quarterly basis or as necessary to assess and respond to enterprise risks, including cybersecurity. The ERM Committee reports updates to the Board of Directors when appropriate and at least on an annual basis.

companyName: LITHIA MOTORS INC

ticker: LAD


text: In developing our cybersecurity incident response plan and assessing the maturity of our cybersecurity threat program, we utilize the National Institute of Standards and Technology Cybersecurity Framework (NIST). We use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We make it a practice to continually review the maturity of our program, utilizing the NIST standards and leveraging the feedback of both external advisors and third party threat intelligence tools in an effort to continuously improve our program in relation to evolving cybersecurity threats in our industry.

companyName: ATN International, Inc.

ticker: ATNI


text: To date, the Company has not experienced any material cybersecurity incidents and we are not aware of any cybersecurity risks that are reasonably likely to materially affect the Company. For additional information about the Company's cybersecurity risks, please see Item 1A. Risk Factors.

companyName: MARATHON OIL CORP


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Company's and client's information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: We employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at key third-party vendors, service providers or customers or otherwise implicating the third-party technology and systems we use. The Company maintains cybersecurity risk insurance as part of its protection against potential losses arising from a cybersecurity incident.

companyName: Innovex International, Inc.

ticker: INVX


text: The representatives of our third-party IT firm and cybersecurity compliance consultant who lead our cybersecurity risk management and risk assessment process have experience in managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: The cybersecurity threat environment is volatile and dynamic, requiring a robust and dynamic framework to reduce and mitigate cybersecurity risk. Cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Cybersecurity risks are identified as part of our Enterprise Risk Management Program and regular cybersecurity assessment and planning. We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage cybersecurity risks. We engage with industry groups for benchmarking and awareness of cybersecurity best practices. We monitor internal and external cybersecurity developments that may affect our systems and our supply chain partners' systems, and have procedures to assess those issues for potential cybersecurity impact or risk.

companyName: Qorvo, Inc.

ticker: QRVO


text: We have implemented processes that are intended to govern, manage and reduce cybersecurity risks. We maintain a global incident response plan and disaster recovery management plan, each designed to protect against, identify, detect, respond to and recover from an incident. These plans anticipate an array of potential scenarios and provide for the assembly of a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that may be composed of both company personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. We regularly conduct exercises to help ensure the plans' effectiveness and our overall preparedness.

companyName: AbbVie Inc.

ticker: ABBV


text: Oversight of Third-Party Service Providers. We use third-party service providers to support our operations and many of our technology initiatives, including third parties that house financial or sensitive information. Our technology acquisition policy and our internal controls framework require us to obtain and review attestation reports regarding these third-party service providers and their sub-service processors or providers and their internal controls, complementary user entity controls and contractual obligations, including those specific to cybersecurity. We evaluate cybersecurity risks associated with our use of third-party service providers, which may include a review of a service provider's cybersecurity posture or a recommendation of specific mitigation controls. We determine and prioritize service provider risk based on potential threat impact and likelihood and these risk determinations determine the level of due diligence and ongoing compliance monitoring required for each service provider. We have independent validation and assessment capabilities from our cyber insurance provider (Resilience). Each year we select several third-party suppliers for evaluation, analyze resultant reports, and mitigate risks associated with the vendor as needed.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Our IT Infrastructure & Security Operations team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging managed security service providers and other third-party security software and technology services. In addition, we institute processes and technologies for the monitoring of security alerts from internal parties and external resources, including from information security research sources. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.

companyName: REPLIGEN CORP

ticker: RGEN


text: The responsibilities of the Company's Board include oversight of our risk management processes. The Board has two primary methods of oversight. The first method is the ERM process through which the Board receives regular reports from management regarding the most significant risks facing the Company. The second is through the functioning of the Board's committees. The Audit Committee assists the Board in its oversight of the Company's information security program, including cybersecurity and data privacy risks and controls. Our CISO provides reports on the Company's cybersec urity program to the Audit Committee, which includes all members of the Board, on a quarterly basis. In addition, our Internal Audit function regularly audits our technology and cybersecurity programs and reports to the Audit Committee on its findings.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: Our CTO and CISO manage our cybersecurity strategy. Our CTO has over 13 years of experience in information security and risk management and reports directly to our President and Chief Executive Officer. Our CISO has over 10 years of experience in information security and risk management, including at a federal law enforcement agency, and has a Master of Science degree in Cybersecurity.

companyName: STEELCASE INC


text: While the Corporation believes its cybersecurity program to be appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures we are taking prove to be insufficient or if our proprietary data is otherwise not protected, see "Item 1A. Risk Factors: Operational and Other Factors -- Cybersecurity" in this report.

companyName: EXXON MOBIL CORP

ticker: XOM


text: On average, the other Corporate Information Security team members have over a decade of cybersecurity experience and hold over 100 industry-leading certifications in cybersecurity. For most of these certifications, there is a continuing professional education requirement to maintain a consistent level of learning by completing certain professional activities, such as attending conferences and workshops, completing online training courses, and participating in professional association meetings, throughout the certification cycle to maintain an active credential. Further, each employee is responsible for an effective cybersecurity defense which is enforced with mandatory cyber awareness training, periodic newsletters, and security updates.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform PepsiCo during contracting and vendor selection processes. Additionally, when third party risks are identified, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked and periodic monitoring is conducted for third parties in order to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a successful material cyberattack, the Company has established well-defined response procedures to address cyber events that do occur. The program provides for the coordination of various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to assess for potential disclosure, comply with potentially applicable legal obligations and mitigate brand and reputational damage. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures.

companyName: PEPSICO INC

ticker: PEP


text: Risk Assessment and Management The Company is increasingly dependent on the use of complex technology and systems to run its operations and support its strategic objectives. These technologies and systems include, among others, the Company's website and reservation system; flight dispatch and tracking systems; flight simulators; check-in kiosks; aircraft maintenance, planning, and record keeping systems; telecommunications systems; flight planning and scheduling systems; crew scheduling systems; human resources systems; and financial planning, management, and accounting systems. Additionally, the Company must receive certain confidential or personal information related to its Customers and Employees to run its business, and the Company's operations depend upon secure collection, processing, retention, and transmission of such information. Therefore, the performance, reliability, and security of the Company's technology infrastructure and information systems are critical to the Company's operations and initiatives.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: As of the date of this Report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor included in the section entitled "Item 1A. Risk Factors" in this Report.

companyName: RYVYL Inc.

ticker: RVYL


text: To date, risks from cybersecurity threats have not materially affected our Company or our business strategy, results of operations, or financial condition. However, if we were the subject of a significant cyber-attack or security breach in the future, it could materially affect our Company, as discussed in further detail under "Item 1A. Risk Factors— Risks Related to the Business of the Company—A security breach or a cyber-attack could adversely affect our results of operations and financial condition."

companyName: Finance of America Companies Inc.

ticker: FOA


text: The CISO and his related team perform regular assessments and vulnerability tests and work with other third-party service providers to perform penetration testing and periodic cyber maturity assessments on our behalf through our Enterprise Risk Management ("ERM") framework. Our CISO and related team work with our VPAA and third-party managed service provider to manage IT troubleshooting and user experience. Additionally, along with our own relationships, we benefit from the extensive third-party service provider relationships of our CISO, which may be used to assist with cybersecurity containment and remediation efforts.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: In order to respond to the threat of security breaches and cyberattacks, we have developed and maintain a cybersecurity risk management program that is designed to protect and preserve the confidentiality, integrity and continued availability of our systems and information. Our cybersecurity risk management program also includes a cybersecurity incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incidents. The maturity of our cybersecurity program is assessed annually. We use the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Our business depends on numerous complex information systems. Any failure to maintain these systems, a network disruption, or breaches in data security could cause a material adverse effect on our business", which is incorporated by reference into this Item 1C.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: Our CISO is responsible for advising on the strategic and operational processes related to our cyber risk management program. Our CISO has over two decades of cybersecurity experience, has served on a cybersecurity advisory board for a university, and is a Certified Information Systems Security Professional.

companyName: AlTi Global, Inc.

ticker: ALTI


text: Assessment of Cybersecurity Risk The Company assesses the potential impact of risks from cybersecurity threats on an ongoing basis, and how such risks could materially affect the Company's investment strategy, operations and financial condition. As of the date of this Annual Report, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company. However, future incidents could have a material impact on our business strategy, results of investment activities and operations, or financial condition. For additional information about these risks, see "Item 1A. Risk Factors".

companyName: First Eagle Private Credit Fund


text: The Chief Security Officer ("CSO") is the senior-most security professional responsible for the implementation of the Company's cybersecurity, product security, and corporate/physical security programs, and reports to the CFO. The CSO also recommends to the Company's executive management regarding the Company's cyber risk mitigation priorities. The Company's current CSO has served in that role for Zebra since 2018. He is a recognized leader in the field of cyber security with over 14 years of global executive cybersecurity experience.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA