text: In addition, our cybersecurity framework is crafted to anticipate and address threats before they can cause harm. Our Security Operations Center (SOC) is operational 24/7, utilizing threat detection tools that meet SOCII requirements, guaranteeing an immediate response capability. We implement stringent access control policies to ensure that only authorized individuals can interact with sensitive client data. Our Identity and Access Management (IAM) systems conform to ISO/IEC 27001 standards, offering secure authentication processes that encompass multi-factor authentication (MFA) and role-based access controls (RBAC). These safeguards are essential in preserving the integrity and confidentiality of client information. We also employ Randtronics remote encryption technology to provide security for client data, whether it's in use or at rest. We regularly evaluate and refine our encryption protocols to thwart new cryptographic challenges.

companyName: RenX Enterprises Corp.

ticker: RENX


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information concerning risks related to cybersecurity, see Item 1A. Risk Factors.

companyName: Sow Good Inc.

ticker: SOWG

secItem: Item 1C


text: The Information Security Department, under the leadership of the Chief Information Security Officer, has the responsibility for implementation and monitoring our information security program. The responsibilities of this department include cybersecurity risk assessments, vulnerability management, access reviews for systems and applications, incident response and management, gathering and sharing threat intelligence, monitoring of controls, and overall responsibility for the development of the information security program including relevant policies, procedures, standards and guidelines to enhance data security and mitigate risks. Members of this department include individuals with varying degrees of education and experience, in particular, our Chief Information Security Officer has over twenty years of experience in information technology and risk management, with emphasis on information security and cyber security risk management; throughout his career he has served in different positions including as Information Technology Auditor, Technology Risk Manager, Information Security Program Manager and, since September 2018 as our CISO. He has a bachelor's degree in computer systems analysis and has obtain several relevant certifications, including having completed the EC-Council's Certified Chief Information Security Officer Program and obtaining the Information Systems Auditor and Risk and Information Systems Control certifications from the Information Systems Audit and Control Association, ISACA. Several management committees, including our Executive Management Committee, manage our information security program and meet periodically to review and discuss information security matters. In general, summaries of key matters discussed are reported to the Risk Committee.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: Potential new vendors and existing vendors that are known to have access to sensitive data or our systems are subject to a risk assessment process including the periodic review of independent security audits where available. Existing vendors are monitored via an automated service that rates companies' publicly facing cybersecurity posture and identifies known vulnerabilities.

companyName: Employers Holdings, Inc.

ticker: EIG


text: PGE utilizes the cybersecurity framework established by the National Institute of Standard and Technology (NIST) to manage cybersecurity risk. The NIST Cybersecurity Framework provides the foundation for a comprehensive view of the lifecycle for managing cybersecurity risk.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: Company's processes are designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to services that identify cybersecurity threats, analyzing reports of threats, conducting scans of the threat environment, evaluating threats reported to us and conducting vulnerability assessments to identify vulnerabilities.

companyName: Streamex Corp.

ticker: STEX


text: We have an enterprise-wide cybersecurity risk management approach designed to identify, protect, detect, respond to and manage cybersecurity and information technology risks and threats. This program is integrated into our enterprise risk management (ERM) framework, and the underlying controls leverage recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: OLIN Corp

ticker: OLN


text: Cybersecurity is an important part of our risk management processes and is an area of focus for our Board, Chief Information Officer ("CIO") whom reports directly to the Chief Executive Officer, and management team. Our CIO plays a pivotal role in assessing and managing material risks stemming from cybersecurity threats and is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants. Additionally, given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, our Board of Directors oversees cybersecurity risk management and regularly reviews our cybersecurity strategy and initiatives. The Board receives quarterly and as needed updates on cybersecurity matters from the CIO and management on topics including threat landscape developments, incident response readiness, and program enhancements.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: To date, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for us to be adversely impacted. This impact could result in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. See "Part I —Item 1A. Risk Factors" for further discussion of these risks.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Our share of Bitcoins mined from our pools are initially received by us in wallets we control. We currently sell the majority of the Bitcoin we mine and utilize hot wallets to hold this Bitcoin immediately prior to selling for working capital purposes. We hold any remainder of our Bitcoin in cold storage. Bitcoins we mine or hold for our own account may be subject to loss, theft or restriction on access. Hackers or malicious actors may launch attacks to steal, compromise or secure Bitcoins, such as by attacking the Bitcoin network source code, exchange miners, third-party platforms (including Gemini), cold and hot storage locations or software, or by other means. We may be in control and possession of substantial holdings of Bitcoin, and as we increase in size, we may become a more appealing target of hackers, malware, cyber-attacks or other security threats.

companyName: LM FUNDING AMERICA, INC.

ticker: LMFA


text: Company, at least annually, updates its policies or procedures that could help mitigate cybersecurity risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. The Company has incorporated cybersecurity coverage in its insurance policies; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.

companyName: BriaCell Therapeutics Corp.

ticker: BCTX


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief executive officer and chief financial officer, regularly briefs the board of directors on our cybersecurity and information security posture, and our board of directors is apprised of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Our third -party advisor has performed cybersecurity risk assessments of our information technology security processes and implemented technologies to lessen risk and respond to new risks as they arise. Using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across our networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we require employees to participate in ongoing training and testing programs through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.

companyName: CRAWFORD UNITED Corp


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We have allocated adequate resources and have designated high-level personnel, including our Chief Information Security Officer, to manage the cybersecurity risk assessment and mitigation process.

companyName: MAXLINEAR, INC

ticker: MXL


text: Information Security and Governance Oversight The Vice President of IT is responsible for Li-Cycle's information security program. In this capacity, the executive oversees the enterprise-wide cybersecurity strategy, ensuring the development of policies and standards, the implementation of processes, and the management of architectural elements. The Vice President of IT is responsible for assessing and managing material risks from cybersecurity threats, and is supported in delivering this function with a dedicated internal IT team. The Vice President of IT has over nine years of leadership experience as a Chief Information Officer and Chief Technology Officer, with experience overseeing information security, risk management, and compliance functions. The Cybersecurity Steering Committee convenes no less than quarterly to evaluate and address significant risks stemming from cybersecurity threats.

companyName: Li-Cycle Holdings Corp.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting certain incidents to a cross-functional group responsible for making ongoing assessments of reported incidents. This group is led by our Chief Legal Officer and Chief Technology and Information Officer, and includes members of our standing Disclosure Committee. The Chief Legal Officer is responsible for informing the Audit and Risk Committee regarding certain significant cybersecurity threats and risks, and meets with the Audit and Risk Committee periodically or at special meetings to review and discuss issues. Additionally, our Chief Legal Officer oversees an annual enterprise risk assessment that addresses certain applicable cybersecurity risks, the results of which are presented to the Audit and Risk Committee. We also engage a third party consulting firm to assist with our annual enterprise risk assessment. Our Chief Legal Officer works with the Board, senior management, others at various levels of the organization, and our outside advisors to help identify, assess, and validate the Company's top risks, taking into account past risk mitigation activities and future plans. Under our Cybersecurity Incident Reporting Policy, the Chief Legal Officer is also responsible for communicating to the Audit and Risk Committee the activities of the Company related to the assessments and reporting of potentially significant cybersecurity incidents.

companyName: Dutch Bros Inc.

ticker: BROS


text: During the reporting period of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected us, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. However, we cannot assure you that we will not experience any such threats or incidents in the future. See "Item 1A. Risk Factors" in this Annual Report on Form 10-K, for additional discussion about cybersecurity-related risks.

companyName: American Strategic Investment Co.

ticker: NYC


text: The Board's Risk Oversight Committee has primary oversight responsibility for management's efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. The Risk Oversight Committee receives quarterly cybersecurity reports, including any reportable incidents, and reviews and approves the Information Security Program at least annually or whenever significant changes to the program are made. The full Board of Directors also receives quarterly cybersecurity reports. These updates include information regarding management's ongoing efforts to manage cybersecurity risk and the steps management has taken to address and mitigate the evolving cybersecurity threat environment. The Risk Oversight Committee members are independent directors and have expertise in areas relevant to their responsibilities over cybersecurity, including senior leadership experience in financial services and information technology.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: We engage multiple independent third parties or cyber experts to assess information security programs and practices, including, but not limited to, framework maturity assessments, blind penetration testing, technology health checks, cyber skill and staffing assessments, externally facilitated tabletop exercises, external cyber legal counsel briefings, and strategic assessments. Findings from these assessments are regularly reviewed with management and the ROC. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: We manage our exposure to cybersecurity risk using various methods designed to protect against, detect, and respond to cybersecurity threats. For example, we leverage threat intelligence to identify trends and inform our understanding of the cybersecurity risk landscape. In addition, our cybersecurity team performs regular assessments of our program and conducts penetration testing to identify, evaluate, and remediate potential threats and vulnerabilities. We also engage external resources to support in the design and implementation of certain program elements, and to assist us in the prevention, detection, monitoring, mitigation, and remediation of cybersecurity risks and incidents. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of material cybersecurity incidents, we maintain a documented incident response plan to manage cybersecurity events within our environment. The response plan includes procedures for identifying, containing, and responding to cybersecurity incidents. Our ability to respond to cybersecurity incidents is tested on a recurring basis.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: Our security officer, who reports to our VP of Engineering, and is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, VP of Engineering, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies. Our security officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters. Our security officer collaborates closely and regularly with our external consulting firm who provides a fractional Chief Information Security Officer ("CISO"), which includes a cybersecurity expert with recognized expertise and many years of experience.

companyName: IonQ, Inc.

ticker: IONQ


text: The Company's Board of Directors oversees EastGroup's risk management process. Specifically, the Board of Directors has delegated to the Audit Committee, as reflected in the charter of the Audit Committee, responsibility for periodic review and oversight of the Company's cybersecurity and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to data breaches. The Audit Committee receives periodic updates from the Cyber Risk Committee regarding these topics. Both senior management, including members of the Cyber Risk Committee, and the Audit Committee Chairperson report periodically on cybersecurity risk management to the full Board of Directors. Additionally, management conducts comprehensive risk surveys annually and presents the results of these surveys to the Board of Directors for discussion.

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: Our management team – including our Chief Risk Officer, our Head of Information Technology and our Chief Information Security Officer (CISO) – is responsible for assessing and managing our material risks from cybersecurity threats. The team is primarily responsible for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Risk Officer has nearly 20 years of experience in this role at the Corporation and previously served as a consultant with Ernst & Young LLP's Risk Management and Regulatory Practice, where he assisted financial services and energy trading clients in establishing their risk management infrastructure. Our Head of Information Technology and our CISO each have over 20 years of experience in information technology leadership in oil and gas. Furthermore, our CISO holds a Bachelor of Science in Cyber and Data Security from the University of Arizona and is a Certified Information Systems Security Professional.

companyName: HESS CORP


text: Cybersecurity risks are seamlessly integrated into the Company's broader risk management framework, ensuring a holistic view and prioritized mitigation strategies.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Our CISO regularly reports to senior management on cybersecurity risks and incidents, including the nature of threats, the state of our defense and detection capabilities, incident response plans and employee training activities, as applicable. In addition, as part of the Board's oversight of the Company's risk management program, our CISO provides periodic updates to the Board on the state of our cybersecurity management program in addition to, when needed, ad hoc information about any significant cybersecurity matters and/or strategic risk management decisions.

companyName: Element Solutions Inc

ticker: ESI


text: Board Responsibilities Oversight of risks from cybersecurity threats is shared by the Board of Directors and the FAC. The FAC oversees our cybersecurity program. The ISO provides the FAC with an annual presentation on our cybersecurity program, emerging threats, and the state of LP's cybersecurity maturity. In addition, the ISO provides updates to the FAC no less often than annually with respect to additional information regarding the cybersecurity program.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, the Board believes it is useful and effective for the full Board to maintain direct oversight over cybersecurity matters. In 2021, the Board amended our Corporate Governance Guidelines to specifically mention cybersecurity as an area of Board oversight to reflect this existing practice. The Board receives and provides feedback on regular updates from management, including from the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer, regarding cybersecurity governance processes, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and also discusses any significant cyber incidents, including recent incidents at other companies and the emerging threat landscape.

companyName: PEPSICO INC

ticker: PEP


text: On a semi-annual basis the cybersecurity team conducts a program performance evaluation with management to assess the continuing suitability, adequacy and effectiveness of the Company's cybersecurity risk management program, including with respect to the fulfillment of cybersecurity objectives and compliance with industry standards, and to recommend changes to the Company's threat modeling, priorities for future risk assessments, policy adjustments in response to newly identified risks or non-compliance, and overall risk acceptance.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Our cybersecurity program is managed by our Chief Information Officer (CIO), whose team is responsible for leading enterprise-wide information technology strategy, policy, standards, architecture, and processes. The CIO provides regular reports to our Board, Chief Executive Officer and other members of our senior leadership team. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Clearwater Paper Corp

ticker: CLW


text: While we have been subject to cyber attacks, the expenses (including penalties and settlements, of which there were none) related to such incidents were immaterial, and the risks related thereto have not been and are not reasonably likely to be material to our business strategy, results of operations or financial condition. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A Risk Factors – "Risks Related to Cybersecurity and Information Technology," which is incorporated by reference herein.

companyName: MARZETTI CO

ticker: MZTI


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our confidential information and data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third parties.

companyName: Caribou Biosciences, Inc.

ticker: CRBU


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Senior Vice President of Information Technology. With over 35 years of experience in the information technology field, he brings a wealth of expertise to his role. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Senior Vice President of Information Technology tests our compliance with standards, remediates known risks and leads our employee training program.

companyName: Matador Resources Co

ticker: MTDR


text: The CIST is supported by experienced and knowledgeable leaders, who each have several decades of experience managing risk at Moog or similar companies, including risks arising from cybersecurity threats. The CIST consists of several centers of expertise comprised of persons with many types of skills and ability, including security operations center analysts, cyber engineers, threat hunters, threat modelers, cyber risk and compliance professionals, and threat and vulnerability management analysts. Members of the CIST maintain cybersecurity credentials, such as Certified Information Security Manager, Certified Information Systems Security Specialist, CompTIA Security+ and cybersecurity Analyst+, EC-Council Certified Ethical Hacker, Computer Hacking Forensic Investigator, and several vendor product certifications including from Amazon Web Services, Microsoft and Qualys.

companyName: MOOG INC.

ticker: MOG-A


text: To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Director of Information Technology ("IT"), who has cross-functional expertise in IT, computer science, cyber security, and more than 20 years of experience. The IT Director leads a team of IT specialists with similar IT and cybersecurity backgrounds. Under the guidance of our IT Head, we develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents;

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: We use third-party service providers, including cybersecurity consultants, to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.

companyName: CalciMedica, Inc.

ticker: CALC


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, please see the section entitled "Risk Factors" as well as Item 9A in this Annual Report on Form 10-K.

companyName: Adicet Bio, Inc.

ticker: ACET


text: Impact of Cybersecurity Threats There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, and the use of artificial intelligence by threat actors engaged in these activities, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. For additional information regarding cybersecurity threats, see 'Item 1A. Risk Factors' of this Form 10-K.

companyName: FASTENAL CO

ticker: FAST


text: As of the date of this filing, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material effect on our business strategy, results of operations or financial condition, but we cannot assure that our business strategy, results of operations and financial condition will not be materially affected in the future by cybersecurity risks or future cybersecurity incidents. Although we have taken and will continue to take significant steps to protect the security and integrity of our information and although we have implemented policies and procedures to enhance data privacy and security, there can be no assurance that our efforts will prevent breakdowns, system failures, breaches of our systems or other cybersecurity incidents or otherwise be fully effective. Any such breakdown, breach or cybersecurity incident could adversely affect our business strategy, prospects, financial condition or results of operations, and any insurance that we may have for cybersecurity incidents may not cover such risks or be sufficient to compensate us for losses that may occur.

companyName: Sotera Health Co

ticker: SHC


text: From time to time, we experience cybersecurity incidents and threats to our systems and information. Through the date hereof, no risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, and we do not believe are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, we cannot guarantee that we will not be materially affected in the future. Cybersecurity threats rapidly evolve and are complex, so we must continually adapt and enhance our processes. As we do this, we must make judgments about where and how to invest resources to most effectively protect ourselves from threats. These are inherently challenging processes, and we can provide no assurance that the processes that we implement will be effective. For more information regarding cybersecurity risks that could impact the Company, see our risk factor disclosures at Item 1A of this Annual Report Governance

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: Company maintains a cybersecurity risk management framework designed to protect the confidentiality, integrity, and availability of its critical systems and information. The Company's cybersecurity risk management is integrated into its overall enterprise risk management program and utilizes similar processes used to identify and address other business risks, including operational, legal, and financial risks. periodically evaluates potential cybersecurity risks and implements measures intended to prevent, detect, and respond to potential incidents.

companyName: Hartford Creative Group, Inc.

ticker: HFUS


text: Incident Response and Recovery Planning—We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident. These plans are tested and evaluated on a regular basis.

companyName: Redfin Corp


text: We have a cybersecurity leadership team comprised of our Chief Information Security Officer ("CISO"), our Global Head of Infrastructure, and other senior leaders on our Information Technology group (" Cybersecurity Leadership Team "). Our Cybersecurity Leadership Team works with third-party service providers to help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our Cybersecurity Leadership Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services. The members of our Cybersecurity Leadership Team, including our CISO, have significant experience in managing and leading cybersecurity teams and in developing and implementing cybersecurity and data privacy systems and processes.

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: Our current cybersecurity risk assessment program includes identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. The program outlines governance, policies and procedures, and technology we use to oversee and identify risks from cybersecurity threats and is informed by previous cybersecurity incidents we have observed in our industry.

companyName: Pulmatrix, Inc.

ticker: PULM


text: We also engage the assistance of third-party consultants to increase protection of our information and IT systems and network to help secure long-term value for our stakeholders. Services provided by third-party consultants include, but are not limited to: regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; risk scoring of our critical business partners and vendors; and participating in incident response processes.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers, and rely more on cloud-based information systems, the related security risks will increase, and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational of the date of this Annual Report, we are no t aware of any risks from cybersecurity threats, including because of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Kraig Biocraft Laboratories, Inc.

ticker: KBLB


text: The Risk Committee receives prompt information regarding any cybersecurity incident in accordance with our cyber incident response policy and crisis communication procedures. The Risk Committee, in concert with the executive leadership team, evaluate this information and escalates notice to the Board, as appropriate.

companyName: REGAL REXNORD CORP

ticker: RRX


text: We are not aware of any existing cybersecurity threats that would materially affect, or that are reasonably likely to materially affect, our business strategy, results of operations, liquidity or financial conditions. Furthermore, we are not aware of having experienced any significant cybersecurity incidents during fiscal year 2025. Management periodically updates the Board of Directors regarding efforts to minimize cybersecurity risks.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information contained therein.

companyName: Karman Holdings Inc.

ticker: KRMN


text: The Company employs third party risk security vendors to identify, mitigate, and remediate cybersecurity risks; however, we rely on the third parties we use to implement security programs commensurate with their risks, and we cannot ensure in all circumstances that their efforts will be successful. An annual penetration test is performed in April, which is a security test that simulates a real-world threat to the Company's IT network and includes comprehensive "Dark Web" searches of all domain user emails. The test performed by Connection (Data Partner) revealed no current cybersecurity breaches. Scans of the Company's firewall are conducted during the first week of each quarter by third party vendor Contego. Any necessary remediation would also be provided by Contego after the scan, but none has been required. The Company uses SolarWinds with Sentinel One software from Contego to continually monitor technology systems for viruses, malicious software, executable harmful files, and other cybersecurity risks. The Company requires the annual submission of SOC 1 security certificates from our third-party vendors which have access to our financial and sales data. The Company also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity related incidents.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: Profound Medical Corp.

ticker: PROF


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including the Director, IT, Chief Legal and Operating Officer, and Chief Financial and Business Officer. The Chief Legal and Operating Officer and Chief Financial and Business Officer are responsible for providing information on materiality to the Director, IT and producing documentation of known and unknown facts about a cybersecurity incident and factors considered in the materiality assessment. Our Chief Legal and Operating Officer and Chief Financial and Business Officer hold degrees relevant to their areas of expertise and both have over 20 years of experience in their respective fields. The Director, IT is primarily responsible for assessing and managing material risks from cybersecurity threats; they have 23 years of experience in core infrastructure, data infrastructure and analytics, business platforms, and integrations.

companyName: Cidara Therapeutics, Inc.


text: Engineering Manager has over 5 years of experience and holds a bachelor's degree in computer science. The VP of Digital Engineering brings 19 years of expertise in digital transformations across various industries, holding leadership roles at Nordstrom, Walgreens, T-Mobile, and Sony PlayStation, with a Master's degree in Business Administration from the University of Michigan We stay informed by utilizing online SOX and SOC II policy documents We have

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. They periodically review and discuss with management, including the Company's Vice President of Information Technology and Engineering, the Company's significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures. The Board of Directors also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: KEWAUNEE SCIENTIFIC CORP /DE/

ticker: KEQU


text: In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments designed to identify, assess, and manage cybersecurity risks, and to evaluate our overarching information security program and specific incident response procedures. We perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. Although we continue to invest in this diligence regarding our critical vendors, our control over the security posture of our vendors is limited, and there can be no assurance that we can prevent or significantly mitigate the risk of any compromise or failure in the information assets owned or controlled by such vendors.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: Our cybersecurity program has several components, including the adoption of information security protocols, standards, and guidelines consistent with best industry practices; engaging third-party service providers to conduct security assessments and penetration testing; and performing periodic internal audits of our cybersecurity protocols. We employ a risk-based process designed to manage cybersecurity risks presented by third-party vendors that may have access to our sensitive information and/or information technology ("IT") systems. This process may consider the nature of the services provided, the sensitivity and quantity of information processed, the criticality of any potentially impacted IT systems, and/or the strength of the vendor's cybersecurity practices.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: Our audit committee receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery.

companyName: PRECISION OPTICS CORPORATION, INC.

ticker: POCI


text: We have not experienced a material cybersecurity incident, any expenses we have incurred from cybersecurity breaches have been immaterial, and we are not aware of any cybersecurity incidents that are reasonably likely to materially affect our business. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents. However, future incidents could have a material and adverse impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A, "Risk Factors."

companyName: HENNESSY ADVISORS INC

ticker: HNNA


text: Processes for Assessing, Identifying and Managing Risks from Cybersecurity Threats We, like any other organization operating in the biotechnology and pharmaceutical space, are subject to cybersecurity threats. In order to be prepared to respond to a potential cybersecurity threat, we have implemented an Information Technology ("IT") Security Guidelines Policy. Such policy sets forth a framework for management of all Company-managed IT systems and equipment. In connection with such policy, we have also implemented an IT Security Incident Response Plan, which sets forth processes in the event of a suspected cybersecurity incident. The processes set forth in such IT Security Incident Response Plan are part of our overall enterprise risk management system. As set forth in the IT Security Incident Response Plan, we may engage third-party consultants to assist us with the response to any suspected cybersecurity incident. We engage third parties on a periodic basis in connection with our overall enterprise risk management assessment. With respect to third-party service providers that we may engage in connection with our day-to-day operations, we attempt to assess such service provider's processes regarding potential cybersecurity threats in connection with first engaging such service provider.

companyName: PROTHENA CORP PUBLIC LTD CO

ticker: PRTA


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data. discussing issues to be addressed and recommending securities measures to be improved where possible. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: The Board, as a whole, is responsible for risk oversight, including cybersecurity risk. As part of this oversight, the Executive Vice President of Risk, Systems, and IT reports to the Board annually on the status of and developments in the Company's information security policies and processes.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: The Audit Committee of our Board oversees our cybersecurity risk management program and meets on a quarterly basis with our Chief Information Officer (CIO) to review our cybersecurity programs and risks, including (as applicable) assessments and program maturity; evolving cyber risks; status on addressing and/or mitigating cyber risks; any recent cybersecurity or data privacy incidents at the Company and across the industry; and status on any key cybersecurity initiatives. These cybersecurity risks and programs are further reviewed and considered by the Board in connection with the company's overarching enterprise risk program.

companyName: TIDEWATER INC

ticker: TDW


text: We maintain technical and organizational safeguards, including regular employee training and phishing simulations, incident response capability reviews and exercises, cybersecurity insurance, and business continuity mechanisms for the protection of our assets. If faced with a cybersecurity incident, our IT team is trained to focus on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, our IT team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: Our Board has oversight of our strategic and business risk management and is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our Board also oversees risks related to privacy and data use, including overseeing compliance with our comprehensive privacy program. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.

companyName: STARTENGINE CROWDFUNDING, INC.


text: The Company has a Security Incident Response Framework in place. The framework is a set of coordinated procedures and tasks that the Company's Incident Response team, under the direction of the CISO, executes with the goal of ensuring timely and effective resolution of cybersecurity incidents. To maintain the robustness of the framework, from time-to-time the Company conducts cybersecurity tabletop testing exercises.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: The IS Program is designed to provide safeguards for Key's assets through a series of administrative, technical, and physical controls. Key employs a variety of security practices and controls to protect information and assets, including, but not limited to, access controls, vulnerability scans, network monitoring, internal and external penetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emails for malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicated security personnel. As described in more detail in "Risk Management — Overview" in Item 7 of this report and in "Cybersecurity Governance" below, Key employs the "Three Lines of Defense" in its risk governance framework. Assessing, identifying, and managing cybersecurity risk across the organization in support of the IS Program is a cross-functional effort that requires collaboration and direction from all lines of defense – the lines of business and support functions (First Line of Defense), Risk Management (Second Line of Defense), and the Risk Review Group (RRG), Key's internal audit function (Third Line of Defense): • First Line of Defense – Lines of Business and Support Functions. Primary responsibility for day-to-day management of cybersecurity risk lies with the senior management of each of Key's lines of business (LOB) and support functions. The LOB and support functions own and manage the individual processes and procedures that are used throughout the IS Program, implement and manage business-specific security controls, and enforce behavioral controls throughout the management structure. • Second Line of Defense – Risk Management. Risk Management oversees risk and monitors the First Line of Defense controls. Operational Risk Management performs review and challenge of controls, monitors the operational risk profile, and ensures Key operates within its operational risk appetite. Compliance Risk Management provides an independent, enterprise-wide function that focuses on compliance with laws, rules, regulations, and guidance applicable to Key. Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key's customers, employees, and other individuals from who Key collects personally identifiable information. • Third Line of Defense – Risk Review Group. The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program. RRG conducts independent internal audits on Key's LOBs, operations, information systems, and technologies. These internal audits provide an independent perspective on Key's processes and risks. Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance. RRG shares the results of its audits with the LOB management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators.

companyName: KEYCORP /NEW/

ticker: KEY


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: Ceribell, Inc.

ticker: CBLL


text: The board of directors has ultimate oversight of our risk management program and has delegated oversight of that program, including, oversight of cybersecurity, to the audit committee of the board of directors. The S.V.P. of Information Technology presents to the audit committee periodically regarding cybersecurity matters. The Chief Financial Officer and the Chief Legal Officer are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: Role of Management Dow's Information Systems organization is led by Dow's Chief Information and Digital Officer, who reports to Dow's Chief Operating Officer, and is responsible for administration of the cybersecurity and information security framework and risk management, with oversight by the Audit Committee of the Board.

companyName: DOW INC.

ticker: DOW


text: Our board of directors, through its audit committee, oversees our processes for identifying and mitigating risks, including cybersecurity risks. Management will periodically brief the audit committee and/or the board of directors on our cybersecurity and information security policies and plans. Our board of directors will be apprised of cybersecurity incidents deemed to have a moderate or higher business impact, and we will provide updates on management's incident response plan for addressing and mitigating any impacts and risks associated with such an incident. We intend to develop a formal incident response plan, which sets forth the steps to be followed from incident detection and assessment to mitigation, recovery and notification and reporting within our organization and to our board of directors.

companyName: Modular Medical, Inc.

ticker: MODD


text: Mr. Geldenhuys is the sole director and the Company has minimal employees, he is made aware of relevant cybersecurity risks and related updates on an ongoing and real-time basis. To that extent, there have been no critical or time sensitive cybersecurity updates thus far.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: Cyber Risk Management and Strategy We, under the oversight of the audit committee of our board of directors, have implemented and maintain a cybersecurity framework, informed by the Center of Internet Security, or CIS, cybersecurity framework. This includes policies, processes and technologies designed to minimize risks from cybersecurity threats. We maintain oversight of our third-party vendors with access to our information technology resources through the inclusion of contractual security requirements as appropriate.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: Processes for Assessing, Identifying, and Managing Cybersecurity Threats: The Company maintains a fully defined set of documentation for assessing, identifying, and managing material risks from cybersecurity threats. We recognize the risk that cybersecurity threats pose to our operations, and cybersecurity is an integral component of our overall enterprise risk management ("ERM") strategy. Our cybersecurity framework is aligned with the National Institute of Standards and Technology's special publication 800-53 and ISO 27001 and is comprised of the following four main pillars:

companyName: Vertiv Holdings Co

ticker: VRT


text: Our management team, including our Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer has primary responsibility for our overall cybersecurity risk management program and supervises all external cybersecurity consultants. Our Chief Operating Officer has experience supervising and managing company security and privacy departments.

companyName: Biostax Corp.


text: The Board of Directors reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks and is informed immediately of any material cybersecurity incident or threat. Additionally, our Board of Directors receives regular updates on important information security matters from our Chief Information Officer and our Head of our Risk Management Program.

companyName: TETRA TECH INC

ticker: TTEK


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations, contract manufacturing organizations, and other third-party service providers. We review the cybersecurity risks associated with the use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment and due diligence designed to help identify cybersecurity risks associated with a vendor, as well as the imposition of security related contractual obligations on the vendor.

companyName: CalciMedica, Inc.

ticker: CALC


text: Management of cybersecurity risks is an integral part of our overall risk management framework and is essential for safeguarding our business and data. We have developed an information security program to assess, identify and manage material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls drawn from multiple security frameworks are developed, implemented and maintained. Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: Our product cybersecurity officer (PCO), under the direction of our chief technology officer, leads our cybersecurity program for our products and services and is responsible for assessing and managing related cybersecurity risks. Our PCO updates the Special Activities Committee on cybersecurity risks as they relate to our products and services, in addition to updates on product and service cybersecurity incidents, defenses, and mitigation strategies.

companyName: RTX Corp

ticker: RTX


text: In response to the ever-evolving cyber threat landscape, Ball utilizes external experts to support continuous improvement across our cyber program, processes and operations. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on cyber enhancements. In addition, we also augment and extend our cyber team using a select few trusted third-party partners that are integrated as members of our global operations. This provides us with expanded global threat intel and enhances our ability to deliver continuous global cyber operations 24/7.

companyName: BALL Corp

ticker: BALL


text: The information security officer ("ISO") is responsible for cybersecurity under the ITSM and is a licensed Certified Internal Auditor, who has experience with the Massachusetts Division of Banks specializing in information technology examinations. The ISO reports directly to the VP, Operational Risk who was a former Chief Information Security Officer ("CISO") for the United States segment of a multi-national bank. The Chief Operating Officer, who is a member of the executive team and RMC, is a former CISO and holds both a Certified Fraud Examiner and Certified Information Security Manager certification. The Chair of the RMC of the Board also has multiple certifications in information and cybersecurity, including a Certified Information Systems Security Professional certification.

companyName: Provident Bancorp, Inc. /MD/


text: The full board of directors undergoes annual information security and privacy training by our Chief Information Security Officer ("CISO") and our Chief Privacy Officer ("CPO"), which covers, among other matters, our privacy and cybersecurity programs and risks. Our audit and risk committee receives updates, at least quarterly, from our CISO and CPO on significant data privacy and security risks, including any significant incidents, relevant industry developments, threat vectors and significant risks identified in periodic penetration tests or vulnerability scans. The updates also include significant legal and legislative developments concerning data privacy and security, our approach to complying with applicable law, and significant engagement with regulators concerning data privacy and cybersecurity. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Block, Inc.

ticker: XYZ


text: Our security policies and procedures are reviewed and updated regularly to address regulatory, industry, and contractual requirements and recommendations and address new and emerging security threats. We also conduct regular scans of our technical infrastructure and regular penetration audits to check for vulnerabilities and meet our governance and compliance requirements. Training our employees and contractors is crucial to eHealth's governance and compliance requirements. All employees and contractors with access to an eHealth IT system are required to complete security awareness training during onboarding and annually thereafter. Due to the increased inherent risk associated with these roles, developers and privileged users are subject to additional security training requirements.

companyName: eHealth, Inc.

ticker: EHTH


text: Cybersecurity Program Components Astrana Health's cybersecurity program employs a multi-layered approach, incorporating a wide range of policies, technologies, and processes to detect, prevent, and respond to cyber threats.

companyName: Astrana Health, Inc.

ticker: ASTH


text: As part of its role in overseeing risk management, the Committee periodically reports to the Board regarding briefings provided by management and advisors as well as the Committees' own analysis and conclusions regarding cybersecurity risks faced by the Company. The Committee will review with management and the Board, and advise them regarding the following matters, as necessary: • Management's implementation of cybersecurity programs, policies, and procedures and management's actions to safeguard their effectiveness; • The effectiveness of the Company's cybersecurity programs and its practices for identifying, assessing, and mitigating cybersecurity risks across all business functions; • The Company's controls to prevent, detect and respond to cyber-attacks or information or data breaches involving the Company; • Cyber crisis preparedness, incident response plans, and disaster recovery capabilities; • Reports and presentations received from management and the Company's advisors regarding the management of cybersecurity programs and risks, including protection of confidential intellectual property, information, and data.

companyName: JABIL INC

ticker: JBL


text: Consistent with our cybersecurity risk management policies and controls, we have prepared and implemented an incident response plan with several components, including: (i) engagement of a third party security operations center for regular vulnerability scanning and technical monitoring of our systems, (ii) detection and analysis of cybersecurity incidents that present risk of unauthorized access to company assets, including the escalation and triaging of incidents that present acute risks to our business, (iii) containment, eradication and data recovery, and (iv) post-incident analysis. Such incident responses are overseen by leaders from our information technology, finance, legal and compliance teams.

companyName: uniQure N.V.

ticker: QURE


text: We have a comprehensive approach to mitigate cybersecurity risk which primarily focuses on three key elements: • People - security awareness education and readiness-testing throughout the year for employees and contractors; • Process - incorporating "cyber awareness" in our day-to-day processes which includes constant review of alerting and detection to mitigate constant cybersecurity threats, regular review of security posture and security roadmap to ensure alignment throughout the organization, physical and digital asset protection and security vulnerability remediation via preventable and detective measures; and • Technology - investing in industry aligned security technology and threat intelligence capabilities.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting Morgan Stanley ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its stockholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.

companyName: North Haven Net REIT


text: The Board, in coordination with the Audit Committee and Chief Financial Officer, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the Audit Committee include overseeing policies and management systems for cybersecurity matters and reviewing Mexco's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the Audit Committee receive regular presentations and reports on cybersecurity risks that address a range of topics, including developments, technological trends or tools, third party updates, and regulatory standards. Our IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity with our executive officers and cybersecurity personnel.

companyName: MEXCO ENERGY CORP

ticker: MXC


text: Our business is subject to various cybersecurity risks, including but not limited to, unauthorized access to sensitive data, including customer information and medical information, disruption of operations or supply chain due to cyberattacks, theft or manipulation of intellectual property, such as proprietary strains or cultivation techniques, regulatory non-compliance resulting from cybersecurity breaches, including violations of data privacy laws. To address these risks, we have implemented a comprehensive cybersecurity program, which includes, regular risk assessments and vulnerability testing to identify and address potential weaknesses in our systems, deployment of robust access controls and encryption technologies to protect sensitive data, mandatory annual employee training and awareness programs to promote cybersecurity best practices and prevent social engineering attacks, and continual monitoring and incident response procedures to detect and respond to cybersecurity incidents in a timely manner. We also have information security and data privacy policies and procedures in place applicable to our directors, officers, employees, contractors and suppliers. Third parties service providers also contribute to our overall cybersecurity. We engage third parties to support in the design, implementation and ongoing efforts to help identify and mitigate cybersecurity risks.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of Service Providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness and spear-phishing resistance training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a vendor management policy for Service Providers that provide an automated service or system that stores, transmits or processes our Confidential Information.

companyName: Peakstone Realty Trust

ticker: PKST


text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: The Bank's CIO directs the Bank's information security program and our information technology risk management. In this role, in addition to the responsibilities discussed above, the CIO manages the Bank's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CIO is also responsible for the Bank's information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention. Led by our CIO, the Network Team examines risks to the Bank's information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats. Our CIO has worked in the financial services industry for over 20 years and held similar roles at other financial institutions including four years as a Chief Information Officer. Our CRO has over three decades of experience in risk management, and our Network Team collectively has over 19 years of experience in cybersecurity operations.

companyName: Primis Financial Corp.

ticker: FRST


text: We have policies and procedures for identifying, assessing and managing material risks associated with cybersecurity threats. To help protect our IT resources, we have instituted administrative, physical and technical controls and processes and commissioned third-party assessments. The technical defense measures we have implemented are designed to address vulnerabilities that may arise, including from a security control failure. These measures currently involve a combination of artificial intelligence; machine learning computer network monitoring; malware and antivirus resources; firewall systems; endpoint detection and response; cloud service defenses; Internet address and content filtering monitoring software intended to secure against known malicious websites and potential data exfiltration; and a variety of cyber intelligence and threat monitoring sources, which provide ongoing updates, all provided by third parties that we believe are capable of performing the service for which they have been engaged or governmental agencies. When engaging a third party for these types of services and resources, we typically conduct a security review involving, as relevant to the service or resource, discussions with the firm's security personnel, evaluation of auditor reports, and other requested information and documentation.

companyName: KB HOME

ticker: KBH


text: Our Board is responsible for the oversight of the Company's overall ERM program, which includes cybersecurity risks. The Board is briefed at least annually by the Chief Information Officer on the readiness and efficacy of the cybersecurity program. These briefs include a review of the Company's cybersecurity initiatives, key security metrics, business continuity and disaster recovery plans and updates on evolving cyber threats and mitigation plans. These briefs also review significant updates to procedures, policies, and controls used to identify, manage, and mitigate cybersecurity risks. The Board is supported in this oversight by the Audit Committee, which receives regular updates from members of the executive leadership team including the Chief Financial Officer, General Counsel, Chief Information Officer, and the Senior Vice President Internal Audit on emerging cybersecurity risks and issues.

companyName: KORN FERRY

ticker: KFY


text: To date, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation, cause existing customers to discontinue purchasing our products, prevent us from attracting new customers, interfere with our efforts to pursue regulatory approvals for our product candidates, or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. For further information, see "Risk Factors— Cyberattacks and other data security breaches could compromise our proprietary and confidential information, which could harm our business and reputation or cause us to incur increased expenses to address any such breaches. " in Item 1A of this Annual Report on Form 10-K. We have attempted to preemptively mitigate the financial impact of any cybersecurity incident and currently maintain limited cyber liability insurance. However, our cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our cyber liability insurance may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.

companyName: Petros Pharmaceuticals, Inc.

ticker: PTPI


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Additionally, on a quarterly basis, our Audit Committee receives reports from the Chief Information Officer, CSO, and other members of management. As part of its annual assessment, the Audit Committee evaluates significant risks related to our business including cybersecurity risks, and provides such information to our Board of Directors. Our Internal Audit team also reviews our cybersecurity governance and controls annually.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: Our Board of Directors is responsible for oversight of our cybersecurity risks. Cybersecurity risk management is integrated into our broader risk management framework. Our Board meets at least quarterly to conduct a review of matters related to cybersecurity, including an assessment of the cybersecurity threat landscape, cyber risk mitigation initiatives, the status of projects to strengthen internal cybersecurity, and an update on security events during the period. In addition, management will escalate cybersecurity incidents to the Board of Directors between quarterly meetings in accordance with our escalation procedures.

companyName: Moelis & Co

ticker: MC


text: Our cyber risk management framework includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and infrastructure risks; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement due diligence, use of contractual security provisions, and continued monitoring through risk-based periodic audits, as applicable; (4) privacy risk management to ensure regulatory compliance and proactively manage privacy risks across our products and platforms; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response protocols to investigate, contain, and mitigate cybersecurity threats. To strengthen our defenses, we regularly engage third party experts to assess vulnerabilities, provide threat intelligence, and assist in triaging and responding to cyber incidents. We also conduct employee training on cybersecurity awareness, data protection, and threat response to reinforce our security culture.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; violation of data privacy or cybersecurity laws and other litigation; legal and regulatory risk; and reputational risks. We have an enterprise-wide information security program designed to secure our technology infrastructure, networks, data, products and services, and we have implemented several processes, technologies and controls to aid in our efforts to identify, assess and manage related risks. Our Chief Information Security Officer ("CISO") manages this program, in collaboration with our business and corporate teams.

companyName: MSCI Inc.

ticker: MSCI


text: Our Audit Committee is briefed on cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports at least annually, to our Audit Committee and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

companyName: TPG Inc.

ticker: TPG


text: The Company's Board of Directors (the "Board") oversees the Company's overall risk management program, and has assigned oversight of cybersecurity risk management to its Audit Committee. The Audit Committee reviews the adequacy and effectiveness of the Company's cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our and our subsidiaries' management, including our Chief Information Security Officer (the "CISO") on cybersecurity matters, including, but not limited to: Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: KICO's Risk Management Committee, which is comprised of representatives of its technology team, assesses risks based on probability and potential impact on key business systems and processes. Risks that are considered high are incorporated into its overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Risk Management Committee and tracked as part of its overall risk management program overseen by the Corporate Sustainability and Risk Management Committee of our Board of Directors.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: The board, based upon recommendation of management or our external vendors and consultants, evaluates and approves significant investments in cybersecurity technologies, training, and talent. Compliance: Management and the board both play a role in overseeing compliance with relevant cybersecurity regulations and legal requirements. Oversight: Management and the board ensure we have appropriate legal counsel to address cybersecurity-related issues, including breach notification requirements.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: Monitoring Cybersecurity Incidents and Reporting to Board of Directors The CISO regularly informs the CEO, Chief Legal Officer, Chief Information Officer and in-house data privacy counsel regarding cybersecurity risks and incidents to keep senior management abreast of our cybersecurity posture and potential risks facing Workiva. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, to enable it to provide oversight and guidance on any critical cybersecurity issues.

companyName: WORKIVA INC

ticker: WK


text: In order to identify and mitigate cybersecurity threats related to our use of material third-party vendors, we conduct periodic reviews of internal controls of certain third-party service providers to assess their procedures to mitigate material security risks.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: We do not believe that there are currently any known risks from cybersecurity threats that have or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information on the most pertinent risks we may experience from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" – "Our internal computer systems, or those of our collaborators, vendors, suppliers, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs."

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President, Human Resources & IT, who has over 22 years of human resources experience in various industries including in executive roles and has led our IT function since joining the Company. Management is responsible for budgeting, hiring appropriate cybersecurity personnel, and helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy.

companyName: SCYNEXIS INC

ticker: SCYX


text: Our Security Awareness Program includes training that reinforces cybersecurity risk management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program also trains personnel on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all relevant employees globally on a periodic basis, and it is supplemented by firmwide testing initiatives, including quarterly phishing tests. We provide specialized security training for certain employees such as application developers, human resources and finance teams. Finally, our Global Privacy Program requires all relevant employees to take periodic awareness training on data privacy. This privacy-focused training includes information about the relevant laws, confidentiality and security, as well as how to effectively report and respond to unauthorized access to or use of personal information.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief Legal Officer, Executive Vice President and Chief Financial Officer, Executive Vice President of Engineering and Technology, and Executive Vice President of Operations. This team of business leaders works with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified.

companyName: SITIME Corp

ticker: SITM


text: Franklin Templeton and the Advisor recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cyber security procedures. For example, all new hires receive mandatory privacy and information security training. In addition, current employees of the Advisor must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing and trainings that we conduct throughout the year.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. Our audit committee oversees management's policies, programs and procedures related to cybersecurity risk management and reports to the board regarding these efforts. In addition, the audit committee receives briefings from management bi-annually, or more frequently as needed, on material aspects of our cybersecurity program.

companyName: Citi Trends Inc

ticker: CTRN


text: To assess, identify, and manage the risks of cybersecurity threats to our information system, we maintain a cybersecurity program, including policies and controls, which are regularly reviewed through internal and external assessments. We leverage several industry frameworks for adopting and assessing controls, such as HIPAA, the National Institute of Standards and Technology Cybersecurity Framework, and HITRUST. We have an active HITRUST certification and Service Organization Control ("SOC") 2 Type II security compliance that are issued by external entities.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: The CTrO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to help protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CTrO and senior management are able to be informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Committee and Board, as appropriate, based on the severity level of a cybersecurity incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.

companyName: Salesforce, Inc.

ticker: CRM


text: The Company engages external parties, including consultants, computer security firms, and risk management and governance experts, as part of its cybersecurity program. For example, the Company's independent assessor provides a periodic assessment of the Company's risk posture to help identify threats as well as opportunities to enhance safeguards. Annually, the Company's adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company's applicable technological environment. The Company has engaged an independent security assessor to evaluate the Company's cybersecurity program against the Framework. Additionally, the cybersecurity program is subject to regular assessment by internal audit and the Company's external auditors. The Company participates in the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: Material Effects of Cybersecurity Incidents Although we and our vendors regularly experience cybersecurity incidents, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K, as updated by WTW's subsequent SEC filings. The risks described in such filings are not the only risks facing WTW. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect WTW's business, financial condition or results of operations.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Risks from Cybersecurity Threats As of the date of this report, we have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Board of Directors Oversight Our Board's Audit Committee oversees cybersecurity risk.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: Role of Management Our CCO is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CCO works to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: Our cybersecurity program uses a layered strategy, relying on technology and human processes to safeguard our client's data at all layers. We embed controls within our business processes and technology development, starting with design and engineering and extending to operations. Our defense-in-depth strategy utilizes numerous layers of security controls, processes, and procedures across our information systems and networks, including but not limited to, vulnerability management, multi-factor authentication (MFA), identity access management (IAM), endpoint security, mobile security, application security, encryption, network security, web security, and event monitoring and logging. Aspects of our program undergo several independent third-party audits and reviews on a regular basis.

companyName: GARTNER INC

ticker: IT


text: To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide continuous monitoring of our systems as well as threat-detection services. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and include the following components: • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Deployment of Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Development and Periodic Testing of Incident Response and Recovery Planning: We have developed and maintain comprehensive incident response and recovery plans that address our response to cybersecurity threats, and such plans are tested and evaluated on a regular basis. Our periodic testing of these plans includes a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, franchisees and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Implementation of Regular and Mandatory Employee Training and Awareness Programs: We provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip them with effective tools to detect and address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: The Company's cybersecurity program also includes an information security training and awareness program called InfoSafe for all employees. The program includes annual certification to having read and understood the Company's IT Use Policy, continuing education on phishing awareness, regular communications about cybersecurity best practices, and participation in annual events like Cybersecurity Awareness Month. Employees are expected to complete annual cybersecurity training, and compliance is monitored. The Company uses general and targeted phishing simulations to help employees better recognize and respond to potential threats. The training program is further enhanced by cybersecurity experts speaking at educational events. The Company also offers specialized training modules on emerging cybersecurity threats for its software development teams. The Company's IT Use Policy outlines a detailed escalation process under which employees are to immediately report any suspected cybersecurity incident.

companyName: MOODYS CORP /DE/

ticker: MCO


text: Additionally, external partners and products undergo a comprehensive security risk assessment process using our security scorecard tool, which evaluates data security risks and vulnerability maturity. Our teammates participate in an annual online security and compliance training program that includes testing. They are also subject to security awareness communications and random simulated phishing campaigns. Moreover, teammates are required to complete Health Insurance Portability and Accountability Act of 1996 (HIPAA) training every one or two years, depending on their location. In 2024, nearly all Brown & Brown teammates completed ethical conduct training, cybersecurity awareness training, the California Consumer Privacy Act (CCPA) Survey, and the Annual Certification for Insurance Licensees training, which serves as a reminder of the regulatory obligation to report certain changes to the jurisdictions where they are licensed.

companyName: BROWN & BROWN, INC.

ticker: BRO