text: Our cyber risk management program is integrated into our overall risk management system, which includes a cybersecurity risk assessment process, that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee as part of their involvement in managing and overseeing cybersecurity risks.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Managing Material Risks and Integrated Overall Risk Management We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity risk assessment process evaluates our maturity across key areas of cybersecurity, and incorporates industry standard framework considerations, including the National Institute of Standards and Technology. The cybersecurity risk management program employs a multi-layered approach including: • Awareness and training for employees involving phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats; • Evaluation of our technical, administrative, and end-point security, including encryption, firewalls, security scans, and anti-virus systems and logical security controls, along with control policies and active review procedures which strengthen authentication and access protection; • Third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information; • Risk and vulnerability management encompassing both proactive and predictive defenses, which provides opportunities to assess, remediate, and validate; and • Managed detection and incident response, including advanced endpoint protection.

companyName: BuzzFeed, Inc.

ticker: BZFD

secItem: Item 1C


text: Under the IRP, cybersecurity incidents are generally addressed by our Cybersecurity Incident Response Team ("CSIRT"), consisting of our CISO, deputy CISO, director of security operations, senior manager of incident response, and members of the security operations team. Incidents of higher severity are elevated to the CSLT. Under the IRP, if an incident requires the involvement of the CSLT, the CSIRT will regularly update the CSLT on the status of the incident response process. Members of the CSLT primarily, the Chief Operating Officer and CISO, will be responsible for updating the Chief Executive Officer, Audit Committee, and the lead independent director of our Board of Directors. Members of the CSIRT and CSLT, along with the Chief Executive Officer, Audit Committee, and the lead independent director of our Board of Directors regularly participate in cybersecurity incident tabletop exercises and event simulations.

companyName: ADT Inc.

ticker: ADT


text: Our cybersecurity team, led by the CSAO, is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Partnership stakeholders and external advisors. Our cybersecurity team includes the CSAO and IT leadership. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity team includes professionals with deep cybersecurity expertise across multiple industries.


text: Our Board of Directors also has a dedicated Cybersecurity Special Committee that is empowered to manage the Company's response to major cybersecurity incidents and enable the integration of crisis management and business continuity processes. The Cybersecurity Special Committee, led by our Chief Information and Business Services Officer and two Board members (including the Chair of the AFC), consists of executive members from various corporate functions, including information technology, digital operations, corporate affairs, legal, compliance, human resources and finance. Outside cybersecurity experts periodically present to the Board on topics related to information security, data privacy and cyber risks and mitigation strategies.

companyName: COTY INC.

ticker: COTY


text: We implement best-practice security baselines and hardening measures, supported by next-generation security agents EDR for monitoring and automated remediation. Additionally, our Security Information and Event Management (SIEM) system enables autonomous remediation and real-time threat alerting our security team.

companyName: Health In Tech, Inc.

ticker: HIT


text: We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: SEKISUI HOUSE U.S., INC.


text: to Board of Directors discussed above, Mr. Geldenhuys is currently the Company's sole director. Thus, he is either aware or made aware of the Company's material risks from cybersecurity threats. To that extent, the Company is not aware of any material risks from cybersecurity events at this time.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: We have implemented a cybersecurity program to assess, identify and manage risk from cybersecurity threats. This program aims to protect the confidentiality, availability and integrity of our information systems from potential threats. Our cybersecurity risk management program includes, among other things, risk assessments designed to identify threats to our critical systems and information services, and a team comprising IT Security, IT Infrastructure and IT Compliance personnel that administer the program with oversight by senior management.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: On an ongoing basis, we and Cheniere assess our people, processes and technology and, when necessary, adjust the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. We conduct regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance our Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems and security maturity assessments of our corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the board of directors of our general partner participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing and testing of incident response plans. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct our response to cybersecurity incidents.

companyName: Cardlytics, Inc.

ticker: CDLX


text: The Company's Board is responsible for overseeing cybersecurity risk management as part of its oversight of the Company's enterprise risk management framework. The Company's management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, risk management, and compliance. Additionally, our Cybersecurity Committee, which is composed of certain of our executive management, legal and operations leaders, provides sponsorship and guidance to help achieve our management objectives. Our Vice President for IT Data Security ("VP, IT Data Security") reports to our Chief Technology Officer ("CTO") and assists in the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security management systems.

companyName: IBEX Ltd

ticker: IBEX


text: The full Board attends two of the Audit and Risk Committee meetings at which information technology and cyber risk are discussed. Additionally, at least annually, the full Board attends a cybersecurity training from external experts and reviews and discusses our technology strategy with the Chief Information Officer and approves our technology strategic plan.

companyName: MATERION Corp

ticker: MTRN


text: Our VP IT and management team are informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from our internal team; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Information Technology Team will notify our Chief Executive Officer, Chief Financial Officer, General Counsel and other relevant business executives. Our Chief Information Officer will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps.

companyName: Ventas, Inc.

ticker: VTR


text: Our information technology infrastructure includes firewalls, modern endpoint protections, intrusion detection tools and alerts, as well as multi-factor authentication to provide a multi-layered approach to protecting our information technology systems from unauthorized access, use, disclosure, disruption, or destruction. Such applications are regularly monitored and reviewed for adequacy and potential enhancements. We obtain System and Organizational Controls ("SOC") 1 or SOC 2 reports on an annual basis from vendors that host our significant financial applications to aid in our assessment of information security risk amongst our relationships with the host vendors. We also perform access reviews for any of these systems that are subject to Sarbanes-Oxley oversight.

companyName: US NUCLEAR CORP.

ticker: UCLE


text: Our management team, including officers within our IT department, is responsible for assessing and managing our material risks from cybersecurity threats. Our IT department has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and the external cybersecurity consultants we retain. The officers and employees of the Company who manage our IT function and our cybersecurity risk management program have significant experience, individually and collectively, and key members of our IT department hold industry certifications, including multiple individuals who are Certified Information System Security Professionals ("CISSP") and Certified Information Systems Auditors ("CISA"). Overall, we believe we have a team of IT professionals skilled in a range of disciplines related to the design and implementation of our cybersecurity program, as well as in assessing security controls and processes and addressing or remediating emerging threats and findings that are identified.

companyName: REDWOOD TRUST INC

ticker: RWT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: Risk assessments are designed to help identify material cybersecurity risks to our critical systems and information.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Our Audit Committee oversees EnLink's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the status and the effectiveness of EnLink's cyber risk management program on a quarterly basis and the Board is also updated on cybersecurity issues on a regular basis.

companyName: EnLink Midstream, LLC


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into the Company's overall risk governance and oversight structures through its "three lines of defense" model for establishing effective checks and balances within the risk management framework. In this model, specific to cybersecurity threats, the first line of defense is Information Security Services (ISS), which is responsible for identifying and implementing cybersecurity controls in accordance with policy requirements and industry best practices, to meet regulatory requirements and to safeguard the business. The second line of defense, Cybersecurity Risk Oversight within the Company's Operational Risk Management group, provides reporting and escalation of emerging risks related to cybersecurity and other concerns to senior management, the ERC, the ISRC, other designated senior operating committees, and the Risk Management Committee of the Board of Directors. The third line of defense, the Company's internal audit function, provides independent assessment and assurance regarding the effectiveness of the Company's governance, risk management, and control processes with respect to cybersecurity threats, and provides challenges and recommendations for improvement.

companyName: US BANCORP \DE\

ticker: USB


text: Our program is regularly evaluated by internal stakeholders and external parties with the results of those reviews reported to the executive leadership team and the Audit Committee, as appropriate. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future incidents. To further preemptively mitigate the potential financial impact of cybersecurity incidents, we maintain liability insurance that includes cyber coverage. However, our insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our insurance may not cover any or all incidents that occur or claims made against us, and addressing an incident or defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations. For more information on our cybersecurity related risks, see the Risk Factors in Item 1A. of this Annual Report.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the National Institute of Standards and Technology Special Publication (SP) 800-53. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and SP 800-53 as a framework to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Stride, Inc.

ticker: LRN


text: Cyber intrusions could seriously compromise our networks and the information stored therein could be accessed, publicly disclosed, misused, lost, or stolen. As such, we have established information security processes and policies using principles from industry recognized cybersecurity frameworks focused on: (i) developing organizational understanding to manage cybersecurity risks; (ii) applying safeguards to protect our systems; (iii) detecting the occurrence of a cybersecurity incident; (iv) responding to a cybersecurity incident; and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: The information technology department, led by the Senior Vice President of Technology and Planning, Chief Information Officer ("CIO"), is responsible for the Company's cybersecurity program. The CIO, along with the certified Information Security Officer and the VP of Information Technology have significant experience spanning over 20 years in information security, infrastructure, and compliance.

companyName: Seneca Foods Corp

ticker: SENEA


text: Company management is responsible for assessing and administering the cybersecurity risk program. Specifically, the Chief Information Officer ("CIO") and the ISO are responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents. The ISO has relevant expertise in cybersecurity, with 18 years of experience managing components of the information technology and information security programs at the Company. The ISO has established expertise and proficiency in cybersecurity, and holds several cybersecurity certifications, including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified in Risk and Information Systems Control (CRISC). The ISO and CIO work closely with other management positions, including the Chief Risk Officer, Chief Financial Officer, General Counsel, President, and CEO to ensure that the Company has effective communication and understanding regarding its cybersecurity risk and related controls.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: The information security program applies to all of the Company's business lines and employees as well as to vendors and other third parties with access to the Company's information systems or its confidential and proprietary information. Whenever we consider a new product or service to offer to our clients, or a new means of offering or providing an existing product or service, or a new back-office process or procedure, the implications to the Company's information security are required to be considered.

companyName: RENASANT CORP

ticker: RNST


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Board. The Incident Response Plan is coordinated through the Chief Operations Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated and tested at least annually.

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: For the year ended December 31, 2024, the Company has not identified any specific risk from a cybersecurity threat that has materially affected, or is reasonable likely to affect, the Company's business strategy, results of operation, or financial condition, other than those described in Item 1A. Risk Factors - Risks Related to Operations.

companyName: LAKE SHORE BANCORP, INC.


text: We describe risks related to cybersecurity threats that could materially impact our business strategy, results of operations or financial condition under the heading "Risk Factors." Material impacts could include loss of access to systems and data, financial costs and reputational harm, among others.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL


text: We have implemented a governance program which facilitates senior management oversight of cybersecurity risk management. An operational risk group comprising senior SHCO Cyber Risk and third-party Cyber Risk professionals together with the IT Infrastructure lead meet monthly to review emerging risks, progress with mitigation of identified risk and prioritization of risk reduction activities. The output from this group is shared quarterly with the Cyber Security Risk Committee ("CSRC") a Board Sub-Committee which comprises the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Technology Officer (CTO), Chief Legal Officer (CLO) and Director of Information Security. The CSRC is responsible for reviewing the top strategic cyber risks, progress against cyber maturity improvement and recommending funding and resource requirements. The CSRC reports twice per year to the Audit Committee. The CSRC is also the body that collectively assesses materiality in the event of a cybersecurity incident and meets as required for this purpose.

companyName: Soho House & Co Inc.


text: A cybersecurity incidence response team comprised of key function heads and personnel, including IT, Finance, Legal, and Human Resources, provides operational support for clarifying and acting on cybersecurity issues, including decision-making around materiality, escalation and disclosure. Our cybersecurity program is principally managed by our Information Security Manager, who reports to our Chief Information Officer. Together, our Information Security Manager and our Chief Information Officer have over 50 years of experience in IT, including developing, implementing, and operating IT controls. Our Chief Information Officer and our Information Security Manager manage cybersecurity risks by continually working to reduce risks, respond appropriately to incidents, and invest in hardening our attack surface to improve our cybersecurity posture. Our GRC platform is designed to provide reliability in identifying, tracking, and mitigating cybersecurity risks. We also engage third party assessors, consultants, and auditors to extend internal team capabilities and support our cybersecurity program, including engaging a cybersecurity service provider that provides 24/7 continuous managed detection and response services.

companyName: Clearfield, Inc.

ticker: CLFD


text: Internally, our training and awareness program creates multi-layered defenses by empowering associates with knowledge and tools to recognize and respond to security risks. Through role-specific and comprehensive training, we seek to maintain a workforce that actively contributes to the achievement of our cybersecurity goals. Key components of our training program include: • Onboarding Training — All new associates participate in an initial cybersecurity training module at onboarding. This training covers the Company's security policies, data protection standards and foundational security practices helping to ensure that new hires are equipped to meet the Company's expectations pertaining to its security protocols. • Articles — We publish articles on our intranet site for all associates to easily access. These articles highlight emerging threats, industry trends and actionable tips to help associates enhance their personal and professional security posture. We target critical topics such as ransomware, social engineering, data management and the latest threats and best practices. • Phishing Simulations — Our phishing awareness program includes continuous phishing simulations conducted on a routine basis. This program helps associates develop the skills to effectively identify and mitigate phishing attempts. Associates who fail a threshold number of simulations during a calendar year are required to undergo additional training. • Cybersecurity Awareness Month Activities — We have implemented interactive, virtual and on-site awareness activities during Cybersecurity Awareness Month in October. These activities include phishing simulations, articles, lunch and learns and gamification to serve as refreshers on critical security concepts and reinforce our commitment to maintaining a security-conscious culture.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Independent Oversight: The Audit Committee, composed entirely of independent directors under SEC and NYSE rules, oversees our cyber risk exposure and evaluates our risk mitigation strategies. The committee is regularly briefed by our VP, IT Services in depth, and in turn briefs the Board of Directors on any material cyber risks and events.

companyName: SES AI Corp

ticker: SES


text: Xcel Energy has a security risk program in place to identify, assess, manage and report material risks from cybersecurity incidents. As a utility provider, Xcel Energy complies with reliability standards imposed by NERC, including critical infrastructure protection standards related to both cybersecurity and physical security. These standards imposed by NERC, in alignment with the NIST Cybersecurity Framework, are the basis for which Xcel Energy has designed the cybersecurity control framework within its security risk program.

companyName: NORTHERN STATES POWER CO /WI/


text: To ensure the robustness of cybersecurity strategies, the Bank actively collaborates with external experts, including cybersecurity assessors, consultants, and auditors, who provide specialized knowledge and insights. These partnerships include regular audits, threat assessments, and consultations on security enhancements. The Bank's CISO regularly briefs the Risk Committee of the Board of Directors on cybersecurity and information security posture.

companyName: FB Financial Corp

ticker: FBK


text: The Audit Committee receives periodic reports from the CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors receives such reports periodically from the Audit Committee and from our CTO. The board of directors also receive various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Xometry, Inc.

ticker: XMTR


text: In addition, as a key part of the Company's Information Security Program, Truist participates in the federally recognized Financial Services Information Sharing and Analysis Center, as well as other industry organizations and initiatives that promote industry best practices, such as harmonized cybersecurity standards, cyber readiness, and secure consumer financial data sharing.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Our process for integrating cybersecurity risk management into our overall risk management system Our overall cybersecurity and privacy strategy is to protect and enable the business. We aim to protect ours and our customers' information and assets to enable agility in the business. Our GIS manages Unisys' cybersecurity risk identification, assessment, response, remediation and mitigation processes, and interfaces with other departments, including business units, the information technology department and enterprise risk management, to facilitate the risk processes and ensure the policies and procedures established by the GIS are integrated into our overall enterprise risk management system. The GIS's processes also work in tandem with the processes maintained by our Global Privacy Office (GPO). Through our GPO, we deploy functional and business unit-specific approaches to data and privacy compliance. Taking into consideration the processes established by the GIS, our GPO has developed a framework of policies, procedures and other initiatives that are implemented across Unisys to help meet data privacy requirements.

companyName: UNISYS CORP

ticker: UIS


text: Our current cybersecurity risk assessment program consists of processes designed to assess, identify and manage cybersecurity risks, including the use of anti-virus software, multi-factor authentication and risky/suspicious log-in monitoring. We leverage the advice of third-party consultants, including our IT consultant, to help us assess and identify risks from cybersecurity threats, including the threat of a cybersecurity incident, and manage our risk assessment program. Among other things, these providers advise on best practices for safeguarding company data.

companyName: Petros Pharmaceuticals, Inc.

ticker: PTPI


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our board periodically receives presentations and reports from the management team on information regarding the policies, processes and practices that we implement to address risks from cybersecurity threats including, for example, discussion of recent developments, evolving standards, third-party and independent reviews, the threat environment and technological trends. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, the board will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.

companyName: CEVA INC

ticker: CEVA


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: Our Board of Directors and management are actively involved in the oversight of our risk management program, with cybersecurity representing a critical component to ensure alignment with our strategic objectives. The Audit Committee directly oversee and regularly review our cybersecurity program, receiving periodic reports from our Chief Information Security Officer ("CISO") on various matters including risk assessment results, progress of risk reduction initiatives, feedback from external auditors, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: OppFi Inc.

ticker: OPFI


text: Sixth Street has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of enterprise risk management, legal, information technology, and compliance personnel of the Adviser and Lord Abbett, including the CISO, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Lord Abbett Private Credit Fund


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Associate Director of IT, who has over 25 years of technology experience which includes extensive cybersecurity implementation and oversight.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and this evaluation and the management of material risks from cybersecurity threats is integrated into our overall risk management processes. This integration is designed to ensure that cybersecurity considerations are part of our decision-making processes.

companyName: Rekor Systems, Inc.

ticker: REKR


text: Our generating facilities are part of the United States' energy infrastructure system and we face a myriad of cybersecurity threats. As such, cybersecurity is an area of continuous focus and we maintain a comprehensive cybersecurity risk management program with processes in place to assess, identify and manage cybersecurity risks. Our management and oversight of direct and indirect cybersecurity risks and our response to any cybersecurity incident is an integral part of our business.

companyName: OGLETHORPE POWER CORP


text: Our executive leadership team is responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. As part of our cybersecurity risk management system, our incident management teams are responsible to track and log privacy and security incidents across Roadzen platforms and our vendors and other third-party service providers to remediate and resolve any incidents, should they arise. In case there are any incidents, it is promptly reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material shall be immediately escalated for further assessment, and shall be reported to designated members of our senior management. We consult with our counsels as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: Roadzen Inc.

ticker: RDZN


text: We maintain a risk-based cybersecurity program, including various protections designed to safeguard against cyber attacks and manage material information and cybersecurity risks to address the confidentiality, integrity, and availability of our critical systems and information. This program includes: • the implementation of access controls, firewalls and virus detection software; • the establishment (and periodic testing) of our disaster recovery plan, including protecting against business interruption by backing up our major systems; • periodic scans of our environment for vulnerabilities and engagement of third parties to perform penetration testing and assess effectiveness of our information security practices; and • the maintenance of insurance that currently includes cybersecurity coverage.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; customer attrition; and reputational risks. We have implemented several cybersecurity processes, technologies and controls to aid in our efforts to assess, identify and manage such material risks.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Adial's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: ADIAL PHARMACEUTICALS, INC.

ticker: ADIL


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from multiple external experts and internal teams. Teams of dedicated privacy, safety, and security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership for these teams are professionals with deep cybersecurity expertise across multiple industries, including our Head of Security, who has over twenty years of cybersecurity experience across multiple industries. Our executive leadership team, along with input from the above teams, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: Weave Communications, Inc.

ticker: WEAV


text: Our Board and management recognize the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees.

companyName: Cuentas Inc.

ticker: CUEN


text: Our IT cybersecurity team maintains an incident response plan designed to respond to potential cybersecurity threats, such as security breaches and cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate significant cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We conduct tabletop exercises for tactical response readiness, perform regular security scans of our environment both from an external and internal perspective, as well as work with a qualified third-party vendor to perform penetration tests of our environment. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Any identified risks are included in our overall risk management program, which we validate on a regular basis.

companyName: A10 Networks, Inc.

ticker: ATEN


text: The Global Vice President of Information Technology and Director of Cyber Security work in close partnership with the Company's senior leadership team to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. This collaboration work includes activities in support of the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and to report such threats and incidents to the Audit Committee and others when appropriate.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee of our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Information Security Officer, General Counsel, Chief Compliance Officer and Chief Information Officer.

companyName: DermTech, Inc.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Committee members receive presentations on cybersecurity topics from our Vice President, Information Technology & Facilities, internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.

companyName: 4D Molecular Therapeutics, Inc.

ticker: FDMT


text: The CFO and AVPIT, who has over thirty years of experience in information technology and has both a computer science and information science degree, a re responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. We support our information security program with external resources including cybersecurity software providers and advisors as needed.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Tyler staffs an internal incident response team designed to launch when a potential or suspected security incident is reported to or identified by Tyler. That team is composed of a multi-disciplinary group of Tyler team members, including representatives from the security, privacy, communications, and relevant business unit teams, as well as outside forensic and legal advisors that are called on as needed. The incident response team's goal is to confirm, contain, mitigate, and remediate the incident, as applicable, and conducts a "lessons learned" process when the incident response is completed.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Our Board and Audit Committee oversee risks from cybersecurity threats. Our Audit Committee reviews cybersecurity risks on a quarterly basis and our Board periodically reviews cybersecurity risks as part of its overall risk management oversight and specifically reviews cybersecurity in detail at least annually. Our Board relies on management and its use of the third-party consultants for expertise for assessing and managing our risks from cybersecurity threats. In conjunction with management, our Board considers the nature of the work provided by our operations, the potential impact of a cybersecurity event, costs, potential likelihood of an event, prior events, and benefits in its general oversight of the cybersecurity risk management.

companyName: ORION ENERGY SYSTEMS, INC.

ticker: OESX


text: When detected, suspected cybersecurity threats are escalated to the CIO and incident response team. The CIO then creates a Cybersecurity Incident Response Team ("CSIRT") which, depending on the incident, comprises the incident coordinator, cybersecurity staff, legal counsel and other stakeholders as appropriate. The CSIRT investigates and manages the impact of cybersecurity incidents in accordance with our security incident response procedures. The incident response plan provides for our CIO and our CIO's team to work closely with our Chief Financial Officer, General Counsel and other key stakeholders, as appropriate, to assess the materiality of the incident and any impact to the Company's operations or financial position. Pursuant to the incident response plan and the Company's Disclosure Controls and Procedures, potentially material cyber incidents are escalated to the Company's Disclosure Committee to evaluate, in consultation with the Chair of the Audit Committee of our Board of Directors as needed, whether an incident is required to be reported on a Form 8-K.

companyName: Sotera Health Co

ticker: SHC


text: When a threat is identified in Morgan Stanley's environment, its incident response team follows an incident response plan to evaluate the impact to the Firm and coordinate appropriate remediation. If warranted, the cybersecurity incident will be reported to applicable regulators, authorities, impacted clients or counterparties, as appropriate. The Firm's cybersecurity incident response and remediation processes, including assessing materiality and reporting requirements, are reviewed through tabletop exercises.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Our cybersecurity program is overseen by our Head of Global IT, who is responsible for identifying and managing material cybersecurity risks. Our Head of Global IT oversees our global information security team ( IT Security Team), which is responsible for leading organization-wide cybersecurity strategy, policy, standards and processes and works across relevant operating entities to assess and manage risks from cybersecurity threats. Our Head of Global IT and IT Security Team perform due diligence on the IT security systems and processes of all potential acquisition targets and have processes in place to manage post-acquisition network integration, including requiring all newly acquired companies to meet necessary security standards before they are permitted access into our IT networks or systems. The Head of Global IT's cybersecurity experience includes managing the network, infrastructure security and a cybersecurity team of a global consumer products company with a heavy online presence and with sales of services and goods to the U.S. government. In addition, our IT Security Team consists of employees that have security certifications from reputable cybersecurity training organizations, including CompTIA, and over 20 years of combined infrastructure architecture experience, including PCI, SOC1 and SOC2 level compliance.

companyName: KADANT INC

ticker: KAI


text: Our Global Cybersecurity Operations function is a global team led by our Director of Global Cybersecurity, who reports to our CIO. In turn, our CIO reports to our Chief Executive Officer. The Information Security Council provides additional oversight for assessing and managing cybersecurity risk.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: In the normal course of business, we collect and store sensitive information, including proprietary and confidential business information, intellectual property, information regarding clinical and non-clinical trials, sensitive third-party information and employee information.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: Other key members of management assist our CISO in the oversight of cybersecurity risk management through their membership in the ISSC, which is chaired by our CISO and is comprised of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, President of Direct-to-Consumer, and Global Digital, Privacy Counsel, and our Vice President of Internal Audit. The ISSC reviews and discusses comprehensive quarterly and annual reports from our CISO and the IT security team in order to provide cooperation, collaboration, and consensus driven information security guidance to the IT department and the Company.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: Management considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. The cybersecurity governance committee will oversee the management's implementation of the cybersecurity risk management program.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: We maintain an Information Security Incident Response Plan (the "Response Plan") governing prevention, detection, mitigation and remediation of cybersecurity incidents and threats. The Response Plan includes controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner, with appropriate involvement by our Board. We regularly test the effectiveness of the Response Plan.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: For a discussion of risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors - Risks Related to Our Business - Risks related to the approval, execution, and operation of our projects, particularly with respect to our largest projects, may adversely affect our operations or results of operations, of this Annual Report on Form 10-K.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: CEO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Company's Cybersecurity Risk Management Team is responsible for developing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: GENELUX Corp

ticker: GNLX


text: Security Awareness and Training – The Company established a security awareness program that focuses on individual employees' impact to the overall security strength of the company. Through web-based and in-person training, surveys, and published literature, the Company continuously makes employees aware of the vital role they play in protecting both the Company and customers' data. Phishing exercises are also periodically conducted to improve employee knowledge of and response to security threats. Specialized web-based training covering Payment Card Industry ("PCI"), Health Insurance Portability and Accountability Act ("HIPAA") and Federal Tax Information is also required and tracked for employees who have access to that data.

companyName: CINCINNATI BELL INC


text: We recognize the importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and working to ensure the safety and efficacy of our products. We evaluate and monitor cybersecurity risk as part of our overall enterprise risk management program, which considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. In addition, the risk oversight responsibility of our Board of Directors and its committees is supported by our cybersecurity risk assessment program, which include policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies, to our Board of Directors and personnel that are responsible for risk assessment. These policies also govern the security of our products and the protection of customer and patient data, provide for vulnerability remediation, regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. To identify, assess, and manage material cybersecurity risks, our team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's Cyber Security Framework and HIPAA. Our cybersecurity risk assessment program provides the underlying basis for the activities of our team to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.

companyName: ACCURAY INC

ticker: ARAY


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Investment Manager.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: The February 2023 ransomware attack also resulted in the unauthorized release of sensitive personal information of certain of our current and former employees that has required remediation expenditures by our company, including, without limitation, expenditures to scan the leaked files to identify the specific individuals impacted and the scope of the sensitive personal information, and expenditures to notify and provide free credit monitoring to our employees and certain former employees and other individuals.

companyName: B&G Foods, Inc.

ticker: BGS


text: Our internal information security team oversees and works collaboratively with various information security service providers. Our cybersecurity program incorporates external guidance and expertise through the use of third-party service providers to assist in the identification, assessment and management of risks specific to cybersecurity threats, including vendors providing threat intelligence, risk mitigation, dark web monitoring, external scanning and scoring, threat and reputation monitoring, forensics, cyber-insurance, advisory services and legal counsel.

companyName: GENTEX CORP

ticker: GNTX


text: Trulieve recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of the data we produce and collect.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. These services include Web Application Penetration Testing, Infrastructure security testing, NIST assessments, third party partner due diligence audits, consultant engagements, incident response preparedness, and vendor security review. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, in connection with the services they provide to us, and to promptly report any suspected breach of its security measures that may affect us.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Security Competencies The Information Security Program oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. This level of competency is attained through regulatory examination, scheduled audits, internal risk assessments, security scanning of assets, and annual testing. We participate in annual programs including the FFIEC Cybersecurity Assessment Program which measures and defines our inherent risks and the maturity of our preparedness. This process is overseen by our IT Committee and presented to the Board of Directors.

companyName: River Financial Corp

ticker: RVRF


text: The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the Board. The cyber incident response plan also stipulates management assessment materiality of the threat or incident for the purposes of public disclosure.

companyName: Federal Home Loan Bank of New York


text: Our cybersecurity and risk management program encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. We regularly educate and share best practices with our employees to raise awareness of cybersecurity threats creating a culture where everyone shares responsibility to help protect our sensitive data and information. All employees are regularly provided cybersecurity training and involved in phishing prevention campaigns to raise awareness. Our identity and access management program involves access controls for least privileged access and additional authentication methods. We have many cybersecurity systems including firewalls, intrusion detection systems, continuous monitoring by a full-time Security Operation Center to defend against unauthorized access. Incident response exercises are performed using our response and ransomware playbooks ensuring our readiness to response to cybersecurity events. We have a risk management program for our critical third-party vendors focusing on mitigating risks from external sources. Those third-party applications are monitored and access is reviewed including evaluating System and Organization Controls reports. We have an AI governance council and approval process who key activity is to review, evaluate risk of AI technology.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: Our CISO has worked for over 30 years in information technology, including the areas of infrastructure, security and application architecture. In the last 15 years, he has worked in security for healthcare, pharmaceutical and technology companies, the last six years as CISO. He earned his Bachelor of Science in Electronic Engineering from Universidade Federal do Rio de Janeiro in Brazil.

companyName: NEVRO CORP


text: Among other things, the Company's privacy team actively develops and implements policies designed to comply with the requirements of privacy laws in the countries where the Company operates. Working with Internal Audit and the CIO, the privacy team assesses the nature and potential severity of privacy risks within DaVita and guides the organization in taking steps to help mitigate such risks. The CPO or CLO provides periodic updates to the Audit Committee on the status of the privacy program. The Audit Committee also oversees the Company's negotiation of any cybersecurity insurance. Currently, the Company maintains a cybersecurity risk insurance policy providing coverage for certain cybersecurity breaches among other specified risks.

companyName: DAVITA INC.

ticker: DVA


text: The cybersecurity risk management program is led by the Senior Vice President, Information Technology ("SVP of IT"). Our SVP of IT has over 28 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our SVP of IT reports to the Chief Executive Officer (CEO), who works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: Management of cybersecurity risks is a component of our overall risk management strategy. We rely on information technology, communication networks, enterprise applications, accounting and financial platforms, and related systems in the operation of its business. Our operations also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data. Our cybersecurity risk management strategy is designed to support us in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents with the intention of protecting the confidentiality, integrity, and availability of such systems and data.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: Annually, as part of Xcel Energy's enterprise risk program, an integrated cybersecurity risk identification and assessment is completed across Xcel Energy's business, including generation, transmission, distribution and fuel storage facilities, information technology systems and other infrastructure or physical assets as well as information processed in our systems (including systems hosted by third parties) that could be affected by cybersecurity incidents. This analysis includes the impact, likelihood, timeframe and controllability of cybersecurity risks and is presented to the Board of Directors. Management monitors and reviews the results of this analysis, integrating them into the enterprise risk assessment processes and implements appropriate mitigating actions as needed.

companyName: XCEL ENERGY INC

ticker: XEL


text: Furthermore, we engage third-party vendors to support our cybersecurity program. Prior to onboarding, we review the cybersecurity risk profile of third party vendors to ensure that they employ appropriate safeguards to comply with our internal standards and current industry regulations. We classify IT service providers according to their risk and independently audit their security controls on a recurring basis based on the types of services provided and the extent and type of data accessed or processed by a third-party vendor. Furthermore, in certain instances, we include contractual provisions in our agreements with such vendors to implement best practices with respect to data and cybersecurity, as well as to provide us with rights to assess, monitor, audit and test such vendors' cybersecurity programs and practices and to mandate notice requirements in the event of a breach. We also closely monitor and manage third-party access to our internal systems and data.

companyName: TaskUs, Inc.

ticker: TASK


text: Rapidly evolving cyber techniques and increased cybersecurity threats against energy and critical infrastructure companies have raised the level of risk across our industry in recent years. Greater use of technology and digitization in operations has delivered benefits to our business, while also opening the industry to new vulnerabilities in corporate and operational systems. The energy industry remains subject to evolving cybersecurity threats and actors, including criminals, terrorists and nation states and through insiders and third-party breaches.

companyName: SOUTHWESTERN ENERGY CO


text: To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company.

companyName: RYTHM, Inc.

ticker: RYM


text: Our Executive Director of Information Technology/Information Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets as related to cybersecurity.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Risk Management and Strategy A.Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats The Company has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. The Company's cybersecurity risk management is integrated into and embedded in its overall enterprise risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Churchill Capital Corp IX/Cayman

ticker: CCIX


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.

companyName: INVO Fertility, Inc.

ticker: IVF


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and while additional measures are continually deployed to mitigate risks and protect our systems, the risk of a breach continues to increase. To address this increased risk we are continually enhancing our Disaster Recovery and Business Continuity capabilities enabling system and data recovery and reducing the overall length our systems would be unavailable for normal operations.

companyName: COLUMBUS MCKINNON CORP

ticker: CMCO


text: HCL will deliver the managed security services to ORIX USA from its Offshore Management Center (OMC) and Cybersecurity Fusion Centers (CSFC) providing 24x7 operations that cover ORIX USA's cybersecurity landscape including network security, email security, endpoint security, data security, application security, cloud security, privileged access management, vulnerability management, cybersecurity incident response, cybersecurity third-party risk, cybersecurity awareness training, phishing simulations and identity and access management.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: As previously disclosed, during March 2021, we experienced a systems outage that was caused by a cybersecurity incident. We engaged leading forensic information technology firms and legal counsel to assist our investigation into the incident and we restored our systems. Despite these actions, we experienced delays and disruptions to our business, including brewery operations, production and shipments. This incident caused a shift in production and shipments from the first quarter of 2021 to the balance of fiscal year 2021. In addition, we incurred certain incremental one-time costs of $ 2.4 million for the year ended December 31, 2021, related to consultants, experts and data recovery efforts, net of insurance recoveries. See also Part I—Item 1A Risk Factors for the following risk: Cybersecurity incidents impacting our information systems, and violations of data privacy laws and regulations could disrupt our business operations and adversely impact our reputation and results of operations.

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: As part of our day-to-day management of our business, we perform ongoing monitoring of ITI for access violations to our IT systems, weaknesses, changes or other threats. (III)

companyName: Coda Octopus Group, Inc.

ticker: CODA


text: We have a continuous monitoring program to detect and respond to potential cybersecurity threats in real-time. Log data from our technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events, as well as analyzes them. If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response. These alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.

companyName: Phillips 66

ticker: PSX


text: While the Board of Directors is ultimately accountable for risk management, the Audit Committee oversees management's processes for identifying, implementing, and mitigating cybersecurity threats. On at least a quarterly basis, the Vice President of Information Security provides the Audit Committee with updates regarding the Company's ongoing cybersecurity program. These updates regularly cover the latest in the Company's evolving approach to managing cybersecurity risks, reviewing key metrics on the effectiveness of the program, and discussing recent developments, key strategic initiatives, the current threat environment, and outcomes from specific evaluations and tests. Additionally, to ensure appropriate knowledge and oversight of cybersecurity risks, the Audit Committee Chair holds a CERT Certificate in Cybsersecurity Oversight from the CERT Division of the Software Engineering Institute at Carnegie Mellon University, which he earned in January 2024.

companyName: BUCKLE INC

ticker: BKE


text: Management and Strategy recognize the critical importance of maintaining the safety and security of our systems and data and have implemented a holistic process for overseeing and managing cybersecurity and related risks. We depend on the accuracy, capacity, and security of our information technology systems and those used by our third-party service providers. To protect the confidentiality, integrity, and availability of our critical systems and information, we have developed and implemented a cybersecurity risk management program that includes a cybersecurity incident response plan. Our cybersecurity risk management program covers our business and was crafted following frameworks established by the National Institute of Standards and Technology. While using these frameworks guides our approach to identifying, assessing, and managing cybersecurity risks relevant to our business, it does not imply compliance with any specific technical standards, specifications or requirements. The program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. In addition, our program emphasizes the maintenance of controls and procedures for the prompt escalation of certain cybersecurity incidents, conducting cybersecurity risk assessments, regularly assessing and deploying technical safeguards, establishing incident response and recovery plans, and providing relevant privacy and cybersecurity information to employees to enhance awareness and response to cybersecurity threats.

companyName: Motorsport Games Inc.

ticker: MSGM


text: Management Oversight Our cybersecurity governance program is led by the Senior Director of IT Operations. The Senior Director of IT Operations and members of our internal IT team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Specifically, management analyzes the following: a.effectiveness of (i) the Company's overall cybersecurity risk management, (ii) management's procedures for identifying, measuring, and reporting on cybersecurity risk, and (iii) the incorporation of cybersecurity risk considerations into corporate strategy; b.the Company's cybersecurity risk profile and risk tolerance;

companyName: MANNATECH INC

ticker: MTEX


text: Our Board of Directors (our "Board") is responsible for risk oversight, and may delegate specific areas of oversight to committees of the Board, which report to the full Board. The Audit Committee of the Board in turn is specifically charged with reviewing cybersecurity risk management and the steps management takes to monitor, control and mitigate such risks. In connection with such review, the Audit Committee receives quarterly reports from the Chief Technology Officer on, among other things, the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In addition to the quarterly reports, the Audit Committee performs an annual review of the Company's cybersecurity program. The annual review consists of a summary of all systems, processes and staffing in place to mitigate a cybersecurity incident using the NIST framework as a guideline.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.

companyName: ASP Isotopes Inc.

ticker: ASPI


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Charging Robotics Inc.

ticker: CHEV


text: TEP regularly conducts internal evaluations and testing of its design and operational effectiveness of security controls and is subject to external independent cybersecurity audits including those associated with the NERC Critical Infrastructure Protection standards. TEP engages third-party services to provide consulting on best practices to address new challenges. TEP participates in regular cybersecurity roundtable discussions with peer cybersecurity professionals to review current threats and opportunities, lessons learned, and best practices. TEP's Compliance Program Management Office provides additional ongoing internal oversight of response to cybersecurity regulation. Third-party cybersecurity risk is addressed through vendor risk management processes and includes technology reviews and contractual specifications. Third-party risk management is designed to reduce risk associated with the use of third-party providers.

companyName: TUCSON ELECTRIC POWER CO


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients and clinical trial participants, sensitive third-party information and employee information. To protect this information, we use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impacts. We establish incidence response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition.

companyName: CORCEPT THERAPEUTICS INC

ticker: CORT


text: Leadership and Governance. Led by our Chief Information Security Officer ("CISO"), we have a team of skilled internal and external cybersecurity professionals. Our Board of Directors ("the Board") has oversight of our cybersecurity and risk management programs. The Board receives at least semiannual updates from the Chief Information Officer and CISO on cybersecurity matters and our risk management program, and periodic updates from external cybersecurity experts on the overall risk landscape. We have implemented processes for continual monitoring of our information systems, including the deployment of advanced security measures and system audits to identify potential vulnerabilities. If a cybersecurity incident were to occur, we are equipped with an incident response plan that includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Additionally, our cybersecurity team regularly meets with our executive management leadership team to provide updates on our cybersecurity risks and incidents ensuring management is keenly aware of any potential threat.

companyName: Ingevity Corp

ticker: NGVT


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's overall cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's (and each operating company's) information security strategies to ensure its effectiveness. The Company's management reports to the Audit Committee as part of every quarterly scheduled meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad enterprise risk management program.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: Our information security function is led by our Vice President, Cybersecurity (our "Information Security Team"), and is supported by our Chief Technology Officer, our Chief Legal, Privacy and Compliance Officer and legal department, our Vice President, Head of Information Technology, and our cybersecurity incident management team. Our Information Security Team is tasked with identifying, assessing and managing our cybersecurity threats and risks. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting risk assessments, coordinating with law enforcement concerning threats, conducting internal and external audits and threat assessments for internal and external threats, obtaining third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and tabletop incident response exercises.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Our management is responsible for identifying, assessing, and managing our exposure to cybersecurity risk. Management identifies and assesses risks through its cross functional ERM committee that is responsible for: Facilitating risk conversations with cross-functional leaders and teams

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Role of the Board of Directors and Committees The Board of Directors maintains an active role in the oversight of material risks. The Board of Directors utilizes its various Committees to oversee certain key risks, and has delegated responsibility to the Audit Committee for oversight of the Company's enterprise risk management process and information security risk management program. Management, with oversight from the Zoetis Board of Directors, is responsible for the Company's assessment and management of exposure to risk. The Audit Committee of the Board of Directors is also responsible for oversight of compliance with disclosure requirements under applicable laws and regulations, and would be consulted prior to the disclosure of any material cybersecurity incident.

companyName: Zoetis Inc.

ticker: ZTS


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats The Company's day-to-day risk management is under the direction of Jason J. Bundick, the Company's Executive Vice President, Chief Compliance Officer, General Counsel and Secretary. Jason Osbeck, the Company's Senior Vice President of Information and Technology, is responsible for day-to-day cybersecurity risk management under the direction of Mr. Bundick. Mr. Osbeck has served in this role at the Company since 2012.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: The Company's Security and Privacy Steering Committee meets on a regular basis and provides oversight of our security and privacy programs inclusive of defining the security strategy, reviewing risks and risk management strategies, and program performance. The committee is chaired by the VP of Security and comprises a broad selection of Senior Management leaders within the organization. This facilitates enterprise-wide collaboration in aligning cybersecurity objectives with organizational goals.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: For a discussion of our risks related to cybersecurity, see the section titled, "Item 1A. Risk Factors – Risks Related to our Operations – Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."

companyName: Quanterix Corp

ticker: QTRX


text: The Vice President, Information Security and Audit Information Security Officer has 28 years as an IT Professional, with the last 9 as the cybersecurity leader for Horizon Bank with an education background in Technology. He has achieved numerous certifications throughout his career including the Microsoft Certified Systems Engineer (MCSE) and Certified Novell Engineering (CNE 5/6) and has demonstrated a continued commitment to excellence and has attained certification as a Certified Information Systems Security Professional (CISSP) issued by ISC2 in 2022. Through continuous learning and professional development, the Information Security Officer has honed his expertise in cybersecurity frameworks, threat detection, incident response, and risk management. He also serves as a member of the Indiana Bankers Association (IBA) Cyber Security Committee and attends numerous industry training sessions including those put on by Microsoft, FS–ISAC, SANS Institute. HORIZON BANCORP, INC.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: The materials presented to our Board and Audit Committee include updates on our data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Board and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer ("CISO"). Material cybersecurity threat risks are also considered during separate Board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters.

companyName: Workday, Inc.

ticker: WDAY


text: We foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training to enhance awareness and readiness against potential cyber threats. Certain roles require additional role-based, specialized cybersecurity training, such as tabletop exercises to ensure proactive preparation and effective coordination in the event of a security incident. We engage a third-party to conduct annual tabletop exercises in order to rehearse our incident response plan, as well as to identify and prioritize opportunities for improvement within our cybersecurity program and associated security controls, through a customized simulation specifically tailored to our current environment, processes, and procedures. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. Our IT security team reviews and updates such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: Our Chief Financial Officer provides periodic briefings to the board of directors regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cyber security systems testing, and activities of third parties.

companyName: VERU INC.

ticker: VERU


text: Information Security Policies and Procedures As part of the Program, the Company has adopted Information Security Policies and Procedures ("ISP") that utilize concepts set forth in the NIST Special Publications and Internal/Interagency Reports and other industry-accepted guidance.

companyName: PJT Partners Inc.

ticker: PJT


text: The Company engages outside experts as needed to supplement in-house expertise with industry-leading experts for incident response and recovery, digital forensics, penetration testing, and outside counsel specializing in cybersecurity matters. To mitigate cybersecurity risks and threats arising from the Company's use of third-party service providers, the Company conducts proactive diligence on certain service providers' information security programs to help meet the Company's baseline cybersecurity standards as set by the CISO under the Information Security program.

companyName: Walgreens Boots Alliance, Inc.


text: As part of our cybersecurity risk management program, we have planned "tabletop" exercises designed to simulate various cybersecurity threats or intrusions and help identify gaps in our preparedness, and help provide clarity in how to respond to any potential incidents. These exercises are designed to test the working level and senior leadership level, including participation by Executive Leadership Team. All employees are required to take mandatory cybersecurity training courses throughout the year. We execute simulated phishing exercises and provide direct feedback to employees who fail such simulations to help them understand how to recognize phishing attempts. Our overall program is designed to help us prevent and effectively respond to cybersecurity incidents.

companyName: Spirit AeroSystems Holdings, Inc.


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Periodically, the Audit Committee receives an overview from our Head of Information Technology of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: If a materiality assessment is required, the CISO will report such incident to the Chief Legal Officer who will then determine in consultation with other persons as appropriate, without unreasonable delay, whether the incident is material to the Company. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, on an individual basis and in the aggregate for multiple and/or a series of incidents. While ADT has not experienced a material direct data breach within its infrastructure, a material breach would likely be the result of external and/or internal threats and vulnerabilities to data, systems, websites, and/or products, including ransomware threats, email fraud, phishing attacks, data breaches, and customer product compromises including the theft of data and/or funds.

companyName: ADT Inc.

ticker: ADT


text: We employ a multi-layered approach to data security and data privacy. This approach begins with our information security program, which leverages National Institute of Standards and Technology, SP 800-53. Our program includes policies and standards that delineate requirements for the implementation and on-going maintenance of our information systems as well as security responsibilities for all personnel. We review these policies and standards periodically and update as needed. We have processes to oversee the maintenance and enforcement of our information security policies and educate personnel on their responsibilities. We maintain a "defense-in-depth" model, which employs multiple layers of protection for the Company. Among other things, we perform external and internal risk assessments, penetration testing, vulnerability scanning, secure code development and monthly security awareness training (including phishing awareness tests) for all personnel.

companyName: Enact Holdings, Inc.

ticker: ACT


text: We leverage a structured process framework based on ISO 27001 to minimize cyber risks and facilitate continuous improvement. We adhere to the principle of least privilege when provisioning access to systems, seeking to limit potential abuse of system privileges by internal or external threats. We train our employees annually in cybersecurity awareness and responsibilities and we engage them throughout the year with phishing awareness exercises, additional focused training, and messaging about current and persistent threats. Employees with privileged access to systems are further trained in security-by-design principles, centered on best practices for securely developing and managing software systems.

companyName: KORN FERRY

ticker: KFY


text: As a high-profile global media and information services company with a wide array of digital products and services, the Company is subject to risks associated with cybersecurity threats. The Company has developed and implemented a cybersecurity program designed to manage these threats, including the assessment, identification and management of cybersecurity risks, and related protection, response, mitigation and recovery efforts. The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company's Chief Information Security Officer ("CISO"), who reports directly to the Company's Chief Technology Officer ("CTO"), and supported by designated business information security officers at the Company's business units. The Company's cybersecurity program is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leverages a defense-in-depth approach to managing cybersecurity risk. The governance, principles and framework for the program are set forth in the Company's Global Cybersecurity Governance Principles Framework and are complemented by a set of global cybersecurity policies designed to promote secure cyber and data practices among Company personnel. The Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via an online training system, steering committees, newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams. In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, identity and access management, multi-factor authentication, encryption, endpoint detection and response, email, application and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.

companyName: NEWS CORP

ticker: NWSA


text: Our Chief Information Security Officer periodically reports to the Board and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CISO on our cybersecurity risks, including briefings on our cyber risk management program and any cybersecurity incidents. Board members also receive periodic presentations on cybersecurity topics from our CISO or our Chief Technology Officer.

companyName: Playtika Holding Corp.

ticker: PLTK


text: We operate through our subsidiaries and affiliate and receive services through our intercorporate services agreement (ISA) with Contran (see Note 15 to our Consolidated Financial Statements). We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility, and availability of company data stored, processed, or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: NL INDUSTRIES INC

ticker: NL


text: Allstate conducts risk and control assessments to proactively identify cybersecurity threats impacting the organization's business processes. The Company conducts enterprise threat-based risk assessments for multiple aspects of the business, including applications, infrastructure, environments and business processes. Allstate documents the identified risks, tracking them based on potential impact and the likelihood of them occurring.

companyName: ALLSTATE CORP

ticker: ALL


text: There are also several Management committees that are responsible for oversight of the Information Security Program. These include: • Information Security Committee; and • Risk Management Committee.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: As a publicly traded company, we recognize the critical importance of effective cybersecurity risk management to safeguard our operations, protect sensitive information and ensure the trust of our customers and stakeholders.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: Our Board of Directors oversees an enterprise-wide approach to risk management, including risks related to information systems and cybersecurity, and each Board committee has primary risk oversight responsibilities aligned with its areas of focus. At each regular meeting of the Board, the Board receives and considers reports from each of its committees, and such reports provide additional detail on significant risk management issues as appropriate, including cybersecurity. The CRCC is the committee that has primary oversight responsibility for the Company's information systems and management of cybersecurity and receives reports from our Senior Vice President and Chief Information Officer (CIO) and Chief Information Security Officer (CISO) that includes reviews of our information systems strategy, technology investments, cybersecurity risks and incidents, and third-party risk management, as well as an annual evaluation of the Company's cybersecurity status. The Board's Audit Committee has oversight responsibility of our internal controls, assurances and financial risks. The Audit Committee is provided with copies of materials presented to our CRCC by our CIO and CISO and receives reports from our CIO regarding topics including integration or implementation of new financial systems and key controls and governance designed to address cybersecurity risks associated with the use of such new financial systems.

companyName: AMGEN INC

ticker: AMGN