text: Third-party engagement processes include risk evaluation across various domains such as cybersecurity, data privacy, supply chain, and regulatory compliance. We are committed to transparently disclosing material and unauthorized cybersecurity incidents involving third-party service providers, considering factors like operational technology system damages, information breaches, and interconnected attacks exploiting vulnerabilities.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our Company, including its business strategies, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, may materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot provide full assurance that our cybersecurity risk management processes will be fully implemented, complied with or effective in preventing or mitigating future cybersecurity risks. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "We depend on secure information technology, and an attack on or a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition and/or results of operations, and could lead to significant financial and legal exposure and reputational harm.", for additional discussion about cybersecurity-related risks.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD

secItem: Item 1C


text: The SERC Committee is responsible for reviewing the overall adequacy of, and providing oversight with respect to, the Company's safety, environmental and regulatory compliance policies, programs, procedures, initiatives and training in light of applicable legal requirements and governmental and industry standards in the jurisdictions in which the Company and its subsidiaries conduct business. We also have several working groups responsible for collaborating on cybersecurity policies and standards. The Global Chief Information Officer and the Global Chief Information Security Officer report to the SERC Committee quarterly on the Company's cybersecurity program, and to the Board of Directors, as necessary. In the event of a cybersecurity incident, our Global Chief Information Officer and Global Chief Information Security Officer, and others serving in similar capacities, will assess the incident and activate an incident response plan. These officers will escalate review of the incident to business unit leaders and/or members of our executive leadership team, as appropriate. We have a cybersecurity program to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company. Our cybersecurity program has a formalized framework that is informed by domestic and international laws, regulations and industry best practices and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, to safeguard the confidentiality, integrity and availability of our information and systems. Our Information Security Program serves as the foundation of our cybersecurity program and our Acceptable Use Policy also provides governance in this area. We partner with other companies, industries and law enforcement to communicate information about the latest cybersecurity threats and leverage threat modeling insights. We conduct cybersecurity assessments against industry cybersecurity frameworks to better enable us to prioritize actions and investments to enhance our cybersecurity capabilities. Our cybersecurity teams work diligently to safeguard Company and customer data by applying layered and defensive mechanisms to proactively provide the security needed to detect and defend against cyber-attacks and to withstand potential impacts. We periodically conduct tabletop exercises and penetration testing to test our defenses. In addition, we provide new hires and employees with cybersecurity training, which is monitored and tracked on an annual basis. We also issue routine phishing campaigns to educate employees on social engineering techniques and informal security awareness exercises are conducted throughout the year.

companyName: UGI CORP /PA/

ticker: UGI


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity and operational risk, he brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO and holds several certifications including ISACA's, CISM and CRISC and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity training program.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: Third Harmonic Bio, Inc.


text: We are a shell company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software in. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with. We may the future determine to engage an assessor(s), consultant(s), auditor(s) or other third party (s) to supplement our processes.

companyName: Allegro Merger Corp.


text: Management's Role in Risk Oversight Our information security team includes our Executive Vice President, Chief Digital & Technology Officer; our Vice President, Chief Information Officer; and our Head of Technology Risk, Compliance and Chief Information Security Officer. Our Executive Vice President, Chief Digital and Technology Officer has over 20 years of information technology experience. She was the Chief Information Officer for key business units at an S&P 500 healthcare company, and was that company's first Chief Information Security Officer, where she led the strategy and execution to secure products, devices, manufacturing systems and information across businesses. She holds a master's degree in computer science and a master's degree in business applications of information and technology. Our Vice President, Chief Information Officer has over 20 years of experience in technology and digital leadership roles at large public companies and holds a bachelor's degree in information systems. Our Head of Technology Risk, Compliance and Chief Information Security Officer has over 20 years of experience in information security, and holds a bachelor's degrees in computer science and biology.

companyName: Zoetis Inc.

ticker: ZTS


text: Education and Awareness The Company also regularly conducts mandatory cybersecurity training for its employees and all new hires are required to take cybersecurity training when they receive their Company computer. Failure to complete the training in a timely fashion results in their system access being suspended until completion. Management also regularly conducts "phishing" exercises to test the effectiveness of our training programs. The results of these exercises are reported to the Audit Committee. Employees also receive monthly newsletters highlighting cybersecurity developments as well as targeted email messages, as appropriate.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: As an important part of our cybersecurity programs, we perform defined due diligence procedures prior to engaging with new vendors. The level of due diligence varies depending on the materiality, level of risk and complexity of the arrangements. The vendors' financial condition, information security programs and regulatory reporting are also typically reviewed and considered prior to entering into a vendor agreement.

companyName: Repay Holdings Corp

ticker: RPAY


text: We have developed an incident response plan to ensure a swift and effective response in the event of a cybersecurity incident. This plan includes predefined roles and responsibilities, communication protocols, and steps to contain and remediate any vulnerabilities that may lead to a breach.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: The Board, through the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee would also receive prompt and timely information regarding any cybersecurity incident that would meet the applicable established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least twice each year, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's Vice President, Information Technology.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other threats or risks. The Audit Committee is primarily responsible for overseeing the Company's risk management processes, which include cybersecurity, global operations, product compliance and other regulatory risks.

companyName: ESCALADE INC

ticker: ESCA


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber security attacks, internal system or service failures, and misappropriation of data or other breaches of information security may adversely impact our business and operations" in Item 1A. Risk Factors.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: We have not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition. However, cybersecurity attacks and other threats to the Company's and our customers', partners', vendors' and other third-parties' systems, networks, products and services could materially affect the Company in the future. See "Risk Factors—Risks Related to our Business—We are subject to information technology, cybersecurity and privacy risks." in Part I, Item 1A.

companyName: ChampionX Corp


text: GoHealth engages with a range of additional third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of its cybersecurity program. Services provided by these third parties include endpoint and network monitoring, vulnerability scanning, penetration testing and security and compliance posture assessments. To mitigate risks associated with third-party sources, the Company requires third parties with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry best practices and to enter into business associate agreements containing contractual provisions with respect to the handling of such information. GoHealth also conducts information security assessments of these third parties prior to engaging with them.

companyName: GoHealth, Inc.

ticker: GOCO


text: Third-party service provider risk management is one of many components of the Company's information security program. The Company and its business units use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties that could adversely impact the Company. This approach may include, but is not limited to, reviewing and assessing providers' cybersecurity maturity, conducting diligence on certain providers' information security programs, and/or imposing contractual obligations on the provider depending on the type and quantity of data involved, the access provided to Company systems, the type of provider and the criticality of outsourced operations.

companyName: Graham Holdings Co

ticker: GHC


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems, and those that we offer to our customers are necessary for the operation of our business. We use these systems, among others, to manage our customer and vendor relationships, for internal communications, for accounting to operate record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Our Cybersecurity and Information Services (IS) department executes and measures the delivery of the cybersecurity program and incorporates the program into the governance and internal controls framework for our Company. We engage third parties such as consultants, auditors and specialists to support, evaluate, and improve the program, and utilize cybersecurity technologies and services to prevent, identify, detect, respond, and recover from cybersecurity threats and incidents. We also maintain a third party continuous monitoring security program to identify, prioritize, assess, mitigate and remediate third party risks, which is part of our overall cybersecurity risk management framework.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: To supplement our own internal processes and controls, we regularly engage consultants and other third parties as part of our Program, including to periodically: • Test our information security defenses and to perform external penetration assessments; and • Review and assess the Program and its maturity We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers and their information systems. As part of these processes, we conduct cybersecurity due diligence around significant third-party service providers who access our information technology systems before their engagement. We require third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations. Additionally, we obtain Type 1 and Type 2 System and Organization Controls ("SOC") 2 reports on an annual basis from vendors that host our significant financial applications to aid in our assessment of information security risk associated with our relationship with the host vendor. If a host vendor is not able to provide a SOC 2 report, we take additional steps to assess information security risk associated with the relationship.

companyName: YUM BRANDS INC

ticker: YUM


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as Dominion Energy's operations, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to Dominion Energy's executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and routine review of our policies and procedures to identify risks and enhance our practices. We engage certain external parties to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: Regular assessments are conducted across our systems, networks, and data infrastructure to identify potential cybersecurity threats and vulnerabilities. These assessments include penetration testing, vulnerability scanning, and red teaming exercises conducted by third-party service providers, which help us to evaluate the likelihood and potential impact of cybersecurity incidents. Feedback from these assessments is incorporated into our systems and procedures through upgrades intended to further improve our security posture.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: The analysis of susceptibility to cyberattack distinguishes between two main types of risk, the first area being the business that relates to the technology and the second, more generally, as relates to the activities of the administration and management and encompasses the corporate records of the Company. In addition, the needs and requirements of cyber security control vary according to whether the person is operating from a mobile phone or a computer. Moreover, issues relating to cybersecurity are overshadowed by the fact that the Company operates from a variety of different offices in different companies; each employee operates using their own personal computer and in most cases this is also used for personal purposes resulting in an enhanced risk of breach from such alternative use. There is no single backup system for all files to preserve corporate records.

companyName: NEXT-ChemX Corporation.

ticker: CHMX


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program, which we have continued to invest in developing. Our corporate cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party vendors and service providers, and facilitating coordination across different business units of the Company. Our corporate cybersecurity risk management program is based on and audited against industry standards, including ISO 27001 for Information Security Management Systems (ISMS) and the automotive industry's Trusted Information Security Assessment Exchange standard.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Monitoring Cybersecurity Incidents The Company's Chief Technology Officer and Technology Consultant are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The Chief Technology Officer and Technical Consultant implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Chief Technology Officer and Technical Consultant will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Strive, Inc.

ticker: ASST


text: We face significant and persistent cybersecurity risks due to the need to protect both our business generally, including our proprietary information and proprietary information of others, our negotiations with both funding sources and potential sellers of intellectual property and the need to protect the confidentiality of information concerning our personnel and others with whom we conduct business. As a company that owns and seeks to enforce intellectual property rights, we face threats from bad actors who seek to disrupt the business of companies that seek to monetize intellectual property rights by commencing litigation as well as others who are engaging in malicious activities for profit, to make a political point or for no particular reason other than creating disruption. Disclosure of certain information as a result of a cybersecurity breach may result is a breach of privacy laws. The substantial level of harm that could occur to us were we to suffer impacts of a material cybersecurity incident requires us to maintain robust governance and oversight of these risks and to implement mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity incidents, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, all of which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: nVent Electric plc

ticker: NVT


text: We rely on IT systems to conduct business, including but not limited to, interacting with customers and suppliers, fulfilling orders, generating invoices, collecting and making payments, fulfilling contractual obligations, communicating with internal and external stakeholders, and maintaining our business and financial records. In addition, we rely on networks and services, including internet sites, cloud and software-as-a-service solutions, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third-parties or their vendors. As a result, the Company is subject to various risks related to vulnerabilities, threats and attacks on these IT systems. See Item 1A, "Risks Related to the Company–"Our business may be subject to system interruptions, cybersecurity incidents and unauthorized data disclosures." under Item 1A. Risk Factors for additional discussion of these risks.

companyName: Sotera Health Co

ticker: SHC


text: In a case where the accused person is not a firm employee, the matter shall be submitted to the Head of IT. The Head of IT may refer the information to law enforcement agencies and/or prosecutors for consideration as to whether criminal charges should be filed against the alleged violator(s).

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing risk, which may make us susceptible to heightened cybersecurity risks. We also depend on third parties to provide certain services, and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to the corruption or misappropriation of our information, though we do not anticipate collecting or storing any significant confidential information related to customers, consumers, employees, or vendors. Because we expect to continue to rely on third parties, we will also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we will have no personnel or processes of our own for this purpose. Our Board is generally responsible for the oversight of risks from cybersecurity threats. In the event of a cybersecurity incident impacting us, our management team will inform our Board of Directors of the details of such incident as well as the measures taken in response to such incident. There can be no assurance that we will have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss.

companyName: NU RIDE INC.

ticker: NRDE


text: Our cybersecurity risk management and strategy processes are led by our cybersecurity risk management team. Our Director of IT has over 30 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Director of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes, including our incident response plan.

companyName: Independence Contract Drilling, Inc.


text: We have developed and maintain a Material Cyber Incident Disclosure Program. The program includes processes for the identification, review and assessment of materiality of cyber events, notification of our senior leadership and Board of Directors of such events, and financial reporting disclosure where applicable. As part of the program, we also engage in due diligence regarding the cybersecurity capabilities of our current and potential third-party vendors in accordance with industry best practices. Under the program, all material cyber incidents will be reported to our Board of Directors. The program is led by our Cyber Event Disclosure Committee, which includes members of our Information Security, Corporate Legal, External Reporting and Enterprise Risk Management teams. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. For all critical third party service provides, we perform a review of the vendor's System and Organization Controls (SOC), which is referred to as a SOC 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to understand and mitigate any additional risks. Our assessment of risks associated with use of third-party providers is part of our overall risk management framework. We have implemented comprehensive cybersecurity initiatives for our employees, including education, training, and testing. These measures are conducted annually to ensure our employees remain up-to-date with the latest security practices, complementing our continuously improving processes and systems.

companyName: REVVITY, INC.

ticker: RVTY


text: Our management team, including our Chief Financial Officer, EVP, Business Affairs and General Counsel and Chief Risk Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes technical and managerial expertise, enabling them to proficiently design, engineer, and oversee the organization's overall security stance. Their capabilities encompass a wide range of skills, including proficiency in Security and Risk Management, Vulnerability Management, as well as expertise in Network Security and Operations, and Security Architecture.

companyName: Hudson Pacific Properties, Inc.

ticker: HPP


text: The risk management process occurs throughout the organization, but is facilitated through a risk management steering committee comprised of senior management whose members meet regularly to identify and address specific significant risks. At least twice a year, management assesses and categorizes key risks based on their potential impact to the Company and the likelihood of the risk occurring as part of Matson's enterprise risk management ("ERM") program. The ERM program includes regular cyber and information security risk assessments conducted by independent, third-party cybersecurity professionals, including assessors, consultants, auditors and penetration testers. Results from these risk assessments, along with remediation recommendations, are provided to executive leadership and the Company's Board of Directors (the "Board"). The Board also consults with outside advisors and experts, when appropriate, to anticipate future threats and trends, and their impact on the Company's risk environment. In addition, the Company utilizes annual third-party audits to test its cybersecurity systems and incident response and remediation plans to help spot vulnerabilities and improve its ability to respond to unexpected events. For more information on Matson's ERM program, see "—Governance " below.

companyName: Matson, Inc.

ticker: MATX


text: In 2021, we suffered a ransomware attack on our information technology systems. This incident did not have a material impact on our business, operations, or financial condition; however, as a result, we began work on certain information technology initiatives earlier than originally planned.

companyName: CENTERSPACE

ticker: CSR


text: These processes are managed and monitored by an outside information technology vendor under the supervision of our Chief Financial Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with our outside information technology vendor on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: BIOVIE INC.

ticker: BIVI


text: We employ cybersecurity intrusion detection systems and continuous monitoring, in order to help defend against unauthorized access. We also employ identity-based access controls and identity authentication requirements. Access to the Company's data is monitored and controlled according to access control policies. Data protection and privacy practices, including data loss prevention, help to safeguard sensitive information. We have also outsourced significant elements of our information technology infrastructure; as a result, we manage independent vendor relationships with third parties who are responsible for maintaining significant elements of our information technology systems and infrastructure.

companyName: Scienture Holdings, Inc.

ticker: SCNX


text: We assess material risks from cyber security threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cyber security in alignment with nationally accepted standards.

companyName: ZION OIL & GAS INC

ticker: ZNOG


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Enterprise Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.

companyName: Tempus AI, Inc.

ticker: TEM


text: The audit committee receives periodic updates on our cybersecurity risks from our information security team, which include biannual presentations on the status of our cybersecurity risk management program by the SVP IS. These reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents, if any. In addition, as needed, management updates the audit committee regarding any material cybersecurity incidents. We have also implemented an annual process for employees to complete security awareness training.

companyName: Blueprint Medicines Corp


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our audit committee of the board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of risks from cybersecurity threats, as outlined in its charter.

companyName: Landos Biopharma, Inc.


text: The Nominating/Corporate Governance Committee receives reports from the Global Chief Information Security Officer ("Global CISO") on the Company's information security program at each regular quarterly Committee meeting. In addition, management updates the Nominating/Corporate Governance Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant. The Nominating/Corporate Governance Committee chair then provides an overview of the information security reports to the full Board at each regular quarterly Board meeting. In fiscal 2024, the full Board also received a briefing from management on our enterprise risk management program.

companyName: DXC Technology Co

ticker: DXC


text: The CISO briefs the Cybersecurity Committee on cybersecurity risks on at least a quarterly basis. These briefings encompass a range of topics, including, as appropriate, key cybersecurity metrics, the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, and incident management reports and lessons learned from cybersecurity events. The Cybersecurity Committee and CISO also maintain a continuous dialogue on potential threats. The Cybersecurity Committee annually assesses MeridianLink's cybersecurity posture and risk management efficacy. The Cybersecurity Committee chair and/or our General Counsel conveys certain cybersecurity updates on the CISO's behalf during board meetings.

companyName: MeridianLink, Inc.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: In connection with regular assessments of third-party service providers, our information protection team performs an assessment of each vendor's information security practices and protocols, including its readiness to protect against and respond to cybersecurity breaches. Third-party service providers are categorized in tiers depending on the significance of their operations to the Company's business processes and risk assessments for vendors in the highest tier are completed periodically. With respect to cyber, we have procedures to verify each service provider's information security controls, and each vendor completes a cyber questionnaire that also addresses their resiliency in the event of an intrusion to their systems. We proactively communicate with suppliers to understand mitigation steps taken when major cyber exposures are identified.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property, and we have experienced an unauthorized release of certain data. However, to date no cybersecurity incidents have had a material impact on our business, financial condition or results of operations, and we are not presently aware of any cybersecurity threats that are reasonably likely to materially affect us. Any significant disruption to our service or access to our systems could result in a loss of customer data and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a material adverse effect on our business, financial condition and results of operations. See "Risk Factors — Cyber-attacks involving our systems and data could expose us to liability or harm our reputation and have a material adverse effect on our business."

companyName: AGILYSYS INC

ticker: AGYS


text: As of the fiscal year ended December 31, 2024, the Company had not experienced any material cybersecurity incidents that have had a significant impact on our operations, data integrity, results of operations, or financial performance.

companyName: Neuraxis, INC

ticker: NRXS


text: For additional information regarding how cyber security threats could materially affect or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see the risk factors captioned "Our success depends on the security and integrity of the systems and products we offer, and security breaches, including cybersecurity breaches, or other disruptions could compromise our information or the information of our customers and expose us to liability, which would cause our business and reputation to suffer," "We rely on information technology and other systems, and any failures in our systems or errors, defects or disruptions in our products and services could diminish our brand and reputation, subject us to liability and have disrupted and could disrupt our business and adversely impact our results," and "If we or a company we acquire sustains cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm, regulatory fines or punishment and other negative consequences" under the heading "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for additional information.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: We incorporate reputable third-party vendors and solutions into our cyber risk management strategies to fortify our cyber defense mechanisms. We collaborate with internal stakeholders across the Company to integrate cybersecurity principles into our operations, including deployment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. We also train our employees during onboarding and annually thereafter on matters including cybersecurity awareness, confidential information protection, and phishing attacks.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: Risk Management and Strategy HMC and its consolidated subsidiaries, including AHFC and HCFI (Honda), have established a management system and standards for information system security in order to minimize the negative impact on its business and business results from the occurrence of cybersecurity incidents. Based on these standards, Honda has implemented security measures in both hardware and software aspects to strengthen the security of its information systems. To address security, including product security, Honda has established a cross-functional system across business and manufacturing systems, software, quality, and other areas.

companyName: AMERICAN HONDA FINANCE CORP


text: Responsibility for cybersecurity matters sits within the Chief Security Office, where it forms the first Line of Defense within Deutsche Bank's Three Lines of Defense model. The Chief Security Officer ("CSO") has delegated authority from the Deutsche Bank Management Board ("Management Board") and reports directly to the Chief Technology, Data, and Innovation Officer, who is a member of the Management Board. The Management Board is accountable for the implementation of the information security framework, with oversight from the Deutsche Bank Supervisory Board. There are multiple mechanisms in place for the CSO to escalate security issues directly to the Management Board if required.

companyName: RREEF Property Trust, Inc.


text: As of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and financial statements.

companyName: LINGERIE FIGHTING CHAMPIONSHIPS, INC.

ticker: BOTY


text: The Corporate Governance and Nominating Committee of the Board is tasked with serving as the Board of Director's primary body to oversee management's risk identification, management and mitigation strategies related to, among other risks, information technology, cybersecurity and data security risks. Management, including the CTO, provides regular reports to the Board covering aspects such as risks, threats, the evolving threat landscape, enhancements to the cybersecurity program, and the preparedness of internal responses.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: The cybersecurity risk management program is led by the Senior Vice President, Information Technology ("SVP of IT"). Our SVP of IT has over 28 years of experience assisting public and privately held companies in a variety of industries, leading several enterprise-wide transformation initiatives to adapt to changing cybersecurity threats. Our SVP of IT reports to the Chief Executive Officer (CEO), who works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes. Our SVP of IT also leads the Security & Risk Governance committee which provides general oversight and assists in the Cybersecurity program when appropriate.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: As indicated above, reports of cybersecurity incidents initially are to be brought to the attention of the IRTC, who determined the extent of involvement of the IRT. The IRT is comprised of the following core members who are to be included in the investigation of all cybersecurity incidents: Information Security Officer - Lead Chief Operations Officer Director of Information Technology Chief Risk and Compliance Officer

companyName: CapStar Financial Holdings, Inc.


text: The Company maintains a cybersecurity risk management program that is designed to enable us to assess, identify, and manage risk associated with cybersecurity threats (the "Cybersecurity Program"). Our Cybersecurity Program is based on the Cybersecurity Framework promulgated by the National Institute of Standards and Technology and other applicable industry standards. It includes the following elements: • Identification and assessment of cybersecurity threats based on periodic internal and external assessments and monitoring, information from internal stakeholders, and external publications and resources. • Technical and organizational safeguards designed to protect against identified threats, including documented policies and procedures, employee training and awareness, and technical controls. • Processes to detect the occurrence of cybersecurity events and incidents, maintenance, and periodic testing of incident response and recovery and business continuity plans and processes. • A third-party risk management program to manage cybersecurity risks associated with our service providers, suppliers, and vendors using a risk-based approach that focuses on cybersecurity risks associated with critical service providers, suppliers, and vendors.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: Incidents, regardless of severity, are evaluated and documented and are shared with the audit committee. In 2023, the audit committee received four updates on matters related to cybersecurity. The process of evaluating and documenting individual incidents, even when not deemed material, assists in determining how previous incidents have or may reasonably likely have a material effect on the company in the future.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: Privacy Officer, in collaboration with the CISO, is required to review the IRP on at least an annual basis, which may include the incorporation of any lessons learned from prior incidents.

companyName: JONES FINANCIAL COMPANIES LLLP


text: Our cybersecurity measures are designed to help protect our information security systems from cybersecurity threats. Our Global Information Security Team is led by our Corporate Vice President and Chief Information Officer ("CIO") and is composed of key functional leaders. Our Global Information Security Team assesses, identifies and manages cybersecurity risks to the Company, including by: • Assessing, identifying and managing cybersecurity risks to our information systems: We assess, identify and manage cybersecurity risks to our information systems, including by: (i) establishing and maintaining a governance structure that includes policies, procedures and processes designed to manage cybersecurity threats and cybersecurity incidents; (ii) conducting ongoing risk assessments, including to identify and assess cybersecurity risks; (iii) developing and implementing an overall risk management strategy, which includes cybersecurity risks; (iv) overseeing, identifying and managing risks from cybersecurity threats associated with our use of third-party service providers and our supply chain; and (v) engaging external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity measures and risk management processes; and • Establishing a program to assess and help mitigate cybersecurity threats: We have established a program to assess and help mitigate cybersecurity threats through: (i) conducting employee training on cybersecurity risks and best practices; (ii) implementing measures to classify and protect data; and (iii) taking steps to be aware of and address new cybersecurity threats, including through the receipt of threat information from third-parties that helps us proactively prevent and detect cybersecurity threats.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: As one of the largest global pharmaceutical sourcing and distribution services companies engaged in helping both healthcare providers and pharmaceutical and biotechnology manufacturers, we are exposed to various cybersecurity threats. These threats include both those typical of companies operating in many industries, like ransomware and denial-of-service attacks, as well as more sophisticated and persistent threats from highly organized adversaries that specifically target the healthcare sector and other critical infrastructure. Our suppliers, third-party vendors, service providers, customers, and other business partners (collectively, our "third-party business partners") are also vulnerable to similar cybersecurity risks, and any cyber incident affecting us and/or our third-party business partners could significantly disrupt our operations. In light of these risks, cybersecurity is a priority for the Company, management, and our Board of Directors (the "Board"), and we believe that it is essential for us to invest substantial resources in our cybersecurity efforts.

companyName: Cencora, Inc.

ticker: COR


text: The Board, in coordination with the CIO and Company management, oversees the Company's CRM process, including the management of risks arising from cybersecurity threats. The Board receives at least a quarterly update on cybersecurity risks, which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board, the CIO and other members of the Company's management team will discuss, at least annually, the Company's approach to cybersecurity risk management.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and the board of directors to ensure the confidentiality, integrity and availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: We align with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we are in the process of implementing a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan will outline communication responsibilities during incidents of all severity levels.

companyName: NEXGEL, INC.

ticker: NXGL


text: While we have not, as of the date of this Report on Form 10-K, experienced a cybersecurity threat or incident that has materially impacted our business or operations, there can be no guarantee that we will not experience such a threat or incident in the future. A material cybersecurity threat or incident could adversely impact our mining and manufacturing operations, our sales or financial and administrative functions, or result in the compromise of personal or other confidential information of our employees, customers, or suppliers. For this reason, we maintain cybersecurity liability insurance to provide additional support, expertise, and resources to help ensure the integrity of our cybersecurity processes through regular reviews and assessments, to provide incident response assistance and expertise, and to provide a level of financial protection in the event of cybersecurity incident related costs and losses. See "Risk Factors - We may be adversely affected by any disruption in, or failure of, our information technology systems, including due to cybersecurity risks and incidents."

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: Sinclair maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and disclosure committee. The program addresses the corporate information technology environment, third-party service providers, and customer-facing products and applications.

companyName: Sinclair, Inc.

ticker: SBGI


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as BREIT. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Engage External Experts on Risk Management To effectively target emerging cybersecurity threats, our information security program engages with a diverse group of third-party external experts, including cybersecurity assessors, consultants, and auditors for cybersecurity risk management. Our partnerships with these third party professionals feature regular audits, assessments, and simulated testing.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: Management and Strategy for identifying and assessing cybersecurity risks management, with the support of CyberTeam, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations. Third-party partners who are in possession of our confidential information are generally required to notify us in the event of a cybersecurity incident within their systems that have, or are reasonably likely to, compromise the security of such information. When appropriate, we enlist CyberTeam to perform a risk and security assessment of the cybersecurity protocols and procedures of critical third-party partners.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: The Company maintains a Security Committee, which is led by the CIO and is comprised of individuals from the Company's IT department – including dedicated security team members with various security certifications. The Security Committee regularly reviews information security program governance and key performance indicators. These reviews typically include the number of events, number of investigations, mean response time, and cyber trends. The Security Committee oversees the Company's security roadmap and ensures the monitoring of information security policies and procedures covering areas such as back-up and retention, acceptable use, disaster recovery, incident management, and passwords.

companyName: Dorman Products, Inc.

ticker: DORM


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, nor are we aware of any cybersecurity risks that are reasonably likely to have, a material adverse impact our business strategy, results of operations, or financial condition. Notwithstanding the extensive approach that we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion of the risks we face from cybersecurity threats, see risk factor titled "Our management information systems and databases could be disrupted by system security failures, cyber threats or by the failure of, or lack of access to, our Enterprise Resource Planning system. These disruptions could negatively impact our sales, increase our expenses, subject us to liability and/or harm our reputation." in Item 1A. "Risk Factors."

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. We adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. We, like any company operating in the current environment, have experienced cybersecurity incidents in the past. However, we have not experienced a cybersecurity event that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors", of this Annual Report on Form 10-K, including the risk factor titled "Security breaches and incidents, loss of data and other disruptions could compromise sensitive information related to our business or protected health information or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."

companyName: Zymeworks Inc.

ticker: ZYME


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the rick factor entitled "If our information technology systems, or those of the third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to, a significant disruption of our product development programs and our ability to operate our business effectively, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."

companyName: IN8BIO, INC.

ticker: INAB


text: We have an internal cybersecurity team, led by our Chief Financial Officer, who is responsible for (i) managing our overall cybersecurity risk-management program; (ii) assessing and managing our risks from cybersecurity threats; and (iii) overseeing retained cybersecurity consultants and providers for additional external expertise. This internal team's experience includes over 30 years in cybersecurity implementation, testing and management.

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: Cyber Security Governance Oversight of cybersecurity infrastructure is managed by members of our management team, including our Chief Executive Officer and Interim Chief Financial Officer. Management works in tandem with a third-party service provider (the "Service Provider") who routinely reviews and updates our antivirus and antimalware software, monitors our intrusion detection system and intrusion protection system and reviews and cleans our corporate email system. Other than engaging the Service Provider prior to our initial public offering, given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.

companyName: Edible Garden AG Inc

ticker: EDBL


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of our corporate risk oversight processes.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is one component of our information security program that guides continuous improvement to, and evaluates these security objectives for our critical systems, data, and operations. Additionally, our cybersecurity risk management program includes a cybersecurity incident response plan. Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

companyName: TERAWULF INC.

ticker: WULF


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Company, Business, and Operations—Cybersecurity risks may cause a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business. ", for additional discussion about cybersecurity-related risks.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: Our Board of Directors has primary responsibility for oversight of our risk management efforts, with support from its standing committees. In particular, the Audit Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to our Cybersecurity Program. As part of its oversight of IT security/cybersecurity matters, the Audit Committee receives cybersecurity updates on a quarterly basis and an IT security/cybersecurity briefing from management, typically including our Chief Information Officer (CIO) and Vice President of Cybersecurity, on at least a semi-annual basis. In addition to this regular reporting, significant cybersecurity threats or incidents may also be escalated on an as-needed basis through our organizational structure in accordance with our incident response process.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Our Response Team is responsible for assessing and managing our material risks from cybersecurity threats, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Response Team includes our President and Chief Operating Officer, our Executive Vice President and Chief Financial Officer, our Director of IT, our Business Systems Manager, our Corporate Controller and our Director of Internal Audit. The Response Team members' relevant experience includes overseeing IT departments, reviewing existing security measures, and implementing solutions to mitigate security risks that may pose threats to a business.

companyName: American Assets Trust, Inc.

ticker: AAT


text: Our Senior Vice President of Information Technology has served in his role since January of 2020 and has managed STORE's Information Technology department since joining the Company in January of 2015. In these roles, he has been instrumental in the evolution and implementation of our business systems and technical infrastructure as well as the development and enforcement of Sarbanes-Oxley (SOX) compliance processes and reporting. Prior to joining STORE, he was the Chief Information Officer for Southwest Network, a non-profit organization for mental and behavioral health services serving the greater Phoenix, Arizona community. He has over 35 years of experience in the information technology industry serving in several technical and leadership positions.

companyName: STORE CAPITAL LLC


text: Our firewalls (intrusion detection systems and intrusion prevention systems) are designed to secure the organization's perimeter complemented by an antivirus and EDR platform designed to detect malware and threats on systems. Web application firewalls are designed to protect external facing applications, while our email security gateway utilizes machine learning and multilayered detection techniques designed to filter malicious emails.

companyName: BCTC IV ASSIGNOR CORP


text: Role of Management Management is responsible for the assessment and management of risk, including cybersecurity risk. The Artisan Risk and Integrity Committee facilitates the annual enterprise risk assessment that identifies and prioritizes the Company's key risks, including cybersecurity risk. The information security governance team also reports to members of senior management the results of its annual cybersecurity risk assessment.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: The Board of Directors maintains oversight responsibility over the enterprise risk management program, including risks related to cybersecurity threats and incidents, and approves the information security program. The Enterprise Risk Committee of the Board of Directors assists the Board in evaluating enterprise risks and performing the Board's oversight responsibilities. As part of our integrated enterprise risk management process, cybersecurity risks and key metrics are evaluated by the Enterprise Risk Committee and reported to the full Board quarterly. In addition, the Enterprise Risk Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks and the overall risk management strategy. Our CISO, in coordination with our Chief Information Officer ("CIO") and Chief Risk Officer ("CRO"), briefs the Enterprise Risk Committee on a quarterly basis, concerning cybersecurity risks, the effectiveness of our cybersecurity risk management efforts, and updates and changes to our cybersecurity risk management program. In addition, the CISO and/or other members of senior management brief the entire Board concerning the cybersecurity risk management program on a semiannual basis and as requested.

companyName: PACIFIC PREMIER BANCORP INC


text: We maintain processes and policies to try to anticipate security risks and facilitate compliance with applicable contractual obligations, regulations, and standards, as well as address any incidents or violations. We focus on continuous improvement and constantly mature our processes to keep pace with the rapidly evolving cybersecurity threat landscape.

companyName: PTC INC.

ticker: PTC


text: Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program on information security. He is also responsible for keeping HGV apprised of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: Our officers and employees and our IT vendors help identify, assess and manage our cybersecurity threats and risks and the unique needs of each of our billboard, surety insurance, broadband and other businesses and the various offices in which we operate. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention, patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.

companyName: BOSTON OMAHA Corp

ticker: BOC


text: In the event of a cybersecurity incident, we maintain a cybersecurity incident response plan designed to govern the actions required for responding to and reporting security incidents involving our information assets, including by escalating certain incidents to members of management, including the Vice President of Information Technology and Facilities and the Head of Cybersecurity. Pursuant to the plan and its escalation protocols, and depending on the nature, severity and other circumstances of each potential cybersecurity incident, designated personnel may be responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis.

companyName: Immunovant, Inc.

ticker: IMVT


text: Cybersecurity Technical Safeguards The Company invests in new information and cybersecurity services and technologies. Technical safeguards designed to protect the Company's information systems from cybersecurity threats include firewalls, continuous threat detection and response system(s), data leak prevention, enhanced email protection, antimalware functionality, and access controls, which are evaluated and improved through periodic assessments and cybersecurity threat intelligence.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Our cybersecurity team is led by our Senior Director of Cybersecurity who has over 15 years of direct cybersecurity experience that includes incident response, security operations and management. This team is responsible for implementing and maintaining corporate and platform-wide cybersecurity, data protection, and third-party risk practices in coordination with our security steering committee, whose members include, our Senior Director of Cybersecurity, professionals working in cybersecurity and product and technology security and representatives from finance, internal audit, compliance and legal. The security steering committee meets quarterly to review our risk profile, threat detection, and remediation strategies, as well as our overall cybersecurity posture and health.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: implementation of a comprehensive cybersecurity policy that encompasses but is not limited to social media, acceptable use (devices, wireless, remote access, internet use), information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; annual cybersecurity training for all employees; employee phish testing and follow-up;

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Our Board of Supervisors is responsible for overseeing our enterprise risk relative to cybersecurity governance through the Audit Committee of the Board, with specific responsibility for overseeing cybersecurity threats, among other things. Our CRT is led by the Senior Vice President of Information Services ("SVP, Information Services"), who reports to the Partnership's CEO and is responsible for assessing and managing material cybersecurity risks and threats, in coordination with the ISBRT and the IMT, and regularly reports to the Audit Committee with regard to the Partnership's cybersecurity governance efforts. The SVP, Information Services has served in this role since 2014, and has more than 28 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: We engage independent third-parties to conduct ethical hacks of key systems, aiding our understanding of control effectiveness and facilitating the implementation of more robust controls. We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity program with industry standards. To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers, potential new vendors with a greater degree of system or data access are subjected to a security vetting process prior to engagement. Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts such as questionnaires.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: As part of our security framework and evaluation of our supply chain risks, we review our service providers' security practices and require appropriate certifications from them. We, and also perform an analysis of controls to manage our third-party security risks.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Range Capital Acquisition Corp.

ticker: RANG


text: As we see increased reliance on information technology in the workplace and our business operations, and an ongoing shift to remote and hybrid work schedules, Urban Edge has employed several measures to mitigate cyber risks. The Cyber Steering Committee is responsible for the risk management program which includes, but is not limited to, identifying cyber risks, the risk severity, risk response and tracking risk remediation. The Cyber Steering Committee meets (i) at least quarterly to review emerging threats, controls, and procedures, (ii) at least annually with the Corporate Governance and Nominating Committee to discuss trends in cyber risks and our strategy to defend our information against cybersecurity incidents, and (iii) promptly following the occurrence of a material cyber incident. In addition to a dedicated information technology and cybersecurity team monitoring our daily operations, the Company engages an independent third-party cybersecurity audit firm to periodically review cybersecurity risks and our Incident Response Program. The third-party firm evaluates our preparedness based on several factors including cyber risk assessment, vulnerability management, disaster recovery, and penetration testing. They also simulate attacks on the Company as part of their audit procedures to gauge if our incident response is repeatable and effective and provide recommendations for areas of improvement. We are in process of implementing a thorough vendor selection criteria and employing ongoing monitoring of our third-party service providers to ensure compliance with cybersecurity standards.

companyName: Urban Edge Properties

ticker: UE


text: Yuanyuan Huang is responsible for implementing cybersecurity policies, programs, procedures, and strategies. Dr. Huang is experienced and qualified because of his education and working experience in related fields.

companyName: STRATEGIC ACQUISITIONS INC /NV/

ticker: STQN


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate such risks. The Board's oversight of major risks, including cybersecurity risks, occurs at both the full Board level and at the Board committee level through the Audit Committee.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Our cybersecurity program includes, but is not limited to: • annual cybersecurity education for all company computer users on relevant policies and standards, best practices at work and at home; • communication processes including how to identify, respond, and report threats or potential vulnerabilities; • protective software installed and configured on Company systems and mobile devices, updated and patched on a regular basis, to provide the highest level of protection against malicious threats; • an established program based on the MITRE ATT&CK framework for dealing with ransomware and other cybersecurity incidents; • regular technical risk assessments of our network, applications and manufacturing facilities, using a combination of trusted suppliers and a dedicated, objective team; • penetration, discovery and vulnerability assessments conducted daily; • mobile threat protection mechanisms and policies; • business continuity plans that are well documented and tested regularly; disaster recovery plans that are also well documented and tested at least annually; and • coverage for non-damage business interruption or liability for data breaches as a part of the Company's combined insurance programs. In addition, in 2023, management conducted ransomware simulation exercises and engaged outside consultants to perform external perimeter penetration testing.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: Cybersecurity Risks We rely on information technology systems and networks to process, transmit, and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers, and employees. We use various information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information, and personal information of our customers, suppliers, and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: urban-gro, Inc.

ticker: UGRO


text: We maintain a materiality assessment process designed to ensure compliance with all applicable securities laws and regulations, including the SEC's cybersecurity disclosure rules. We also consider industry-specific regulations and standards, such as HIPAA for healthcare organizations.

companyName: Health In Tech, Inc.

ticker: HIT


text: Our Corporate Counsel has 20 years of experience in information technology, including cybersecurity, audit, compliance, and cybersecurity. In addition, we have an Enterprise IT Operations Engineer ("Ops Engineer") with requisite knowledge and experience in information technology and cybersecurity, and maintains IT and Ops professional certifications.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Risks from Cybersecurity Threats We have experienced, and may in the future experience, directly or indirectly through our third-party service providers, cybersecurity incidents. While prior cybersecurity incidents have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations, and financial condition. For more information about the cybersecurity risks we face, see "We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss" in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Liberty Energy Inc.

ticker: LBRT


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. The Company may not be able to fully, continuously, and effectively implement information security controls as intended. In addition, information security controls are subject to human error and, no matter how well designed or implemented, only mitigate and do not fully eliminate risks Furthermore, events, when detected by security tools or third parties, may not always be immediately understood or acted upon. For additional information regarding risks to the Company from cybersecurity threats, please see Part I, Item 1A – Risk Factors " We may be adversely impacted by a disruption, failure or security breach of our information technology infrastructure or failure to comply with privacy laws.".

companyName: Sovos Brands, Inc.


text: • Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents. • Coordinating Incident or Crisis Management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents. • Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plans. • Reviewing the Plans at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Risk Committee and Productivity Committee The Company's holding company, AMC, has the following Committees, that convene several times a year: AMC Productivity Committee

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Additionally, for third party vendors providing services to the Company, a security risk assessment is completed during vendor due diligence, before execution of agreements. The assessment evaluates, among other areas, the vendors' data security, access identity, endpoint protection and incident management and response capabilities. Vendors are required to either complete a security questionnaire based on the HIPAA Security Rule requirements or provide evidence of a current Service Organization Control report completed by a third-party, Health Information Trust Alliance certification, or similar security and compliance attestation. These risk assessments are refreshed regularly during the duration of an agreement with the vendor, and the results can be used to influence the vendor to make improvements where weaknesses in their security and compliance measures are identified.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors of Brighthouse Financial, Inc. (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors of Brighthouse Financial, Inc. (the "Board") is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends, tabletop exercises, and other areas of importance. Our board of directors also receives regular technology and cybersecurity updates. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. The Chief Compliance Officer of BHF also regularly reports to the Audit Committee and our board of directors regarding the Company's compliance with applicable regulations relating to cybersecurity.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, product candidates and our broader enterprise information technology ("IT") environment. • A team principally responsible for managing: (a) our cybersecurity risk assessment processes, (b) our security controls, and (c) our response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model. • Threat intelligence that informs our third party IT service provider and us about new vulnerabilities and risks that require timely intervention or remediation. • Cybersecurity awareness training of our employees, incident response personnel, and senior management. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Rallybio Corp

ticker: RLYB


text: As the Board of Directors has yet to establish any committees, Management regularly updates our Board regarding Management's efforts to minimize cybersecurity risks.

companyName: VIVIC CORP.

ticker: VIVC


text: Material Impact on Partnership During 2024, 2023, and 2022, the Partnership did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Partnership, including its business strategy, results of operations, or financial condition.

companyName: CVR PARTNERS, LP

ticker: UAN


text: Our management team, including our Chief Executive Officer, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security consultants; threat intelligence and other information obtained from governmental, public or private sources, including external consultants which may be engaged by us; and alerts and reports produced by security tools deployed in the information technology environment. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.

companyName: HWH International Inc.

ticker: HWH


text: As part of our information technology needs, we have contracted with National Beef to provide certain equipment and services related to telephone systems, servers, network access, desktop and end-user support, and back-office equipment support. Inherent in the services provided by National Beef are its efforts to assess, identify and manage risks from cybersecurity threats related to the specific equipment and services it provides us. We have no independent internal processes for addressing cybersecurity threats and have not integrated any processes provided by National Beef in assessing, identifying and managing risks from cybersecurity threats into our overall risk management system; however, we do receive monthly reports from National Beef on user access changes to our electronic accounting file share folder.

companyName: U. S. Premium Beef, LLC


text: The audit committee of our board of directors is responsible for oversight the Company's cybersecurity risk. On the management-side, our head of information technology is responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining assessors, consultants, auditors, or third parties in connection with the company's cybersecurity program.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Our information security team works closely with key stakeholders, including regulators, government agencies, law enforcement, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.

companyName: TOYOTA MOTOR CREDIT CORP


text: The relevant cybersecurity risk expertise of Duke Energy's management who serve on the ECOG and/or senior management who lead the CIRT and EST is described below.

companyName: PROGRESS ENERGY INC


text: Risk Identification and Assessment We employ structured processes and procedures to identify and assess cybersecurity risks and events. Our CISO oversees a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk. The cybersecurity risk assessment receives input from cross-functional teams across our organization. We also engage various third parties (including penetration testers, auditing firms and managed security service providers) to assist in identifying and assessing material cybersecurity risks.

companyName: Repay Holdings Corp

ticker: RPAY


text: Cybersecurity is an important area of focus for our Board. Our information security risk management program is designed to allow our Board to establish a mutual understanding with management of the effectiveness of our information security risk management practices and capabilities, including the division of responsibilities for reviewing our information security risk exposure and risk tolerance, tracking emerging information risks and ensuring proper escalation of certain key risks for periodic review by the Board of Directors and its committees. As part of its broader risk oversight activities, the Board oversees risks from cybersecurity risks, both directly and through the Finance and Audit Committee of the Board (the F&A Committee). As reflected in its charter, the F&A Committee assists the Board with the management and assessment of privacy and data security risk and is responsible for reviewing and discussing with management privacy and data security risk exposures, including, among other things, the potential impacts of those exposures on our business, financial results, operations and reputation. The F&A Committee also oversees our internal controls over financial reporting, including with respect to financial reporting-related information systems.

companyName: ORACLE CORP

ticker: ORCL


text: Additionally, we engage third-party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we used the NIST CSF as a guide to help us create our cybersecurity policy.

companyName: Highlands REIT, Inc.


text: The Board of Directors exercises direct oversight of strategic risks to the Company. The Board has delegated the responsibility for cybersecurity oversight to the Audit Committee. The Audit Committee's responsibilities include reviewing and discussing with management the strategies, process and controls pertaining to the management of information technology operations, including cybersecurity risks and information security. The Director of Information Technology reports to the Audit Committee annually and more frequently, as needed, on cybersecurity matters, including the cybersecurity threat landscape, key metrics demonstrating the overall management of our cybersecurity risk and risk management program, related key initiatives, enterprise program framework alignment, annual risk mitigation strategy, and review of cybersecurity incidents. Our Board is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging through regular and requested updates on our strategy and evolving threat landscape.

companyName: BROADWIND, INC.

ticker: BWEN


text: Our Corporate Controller reviews the efficacy of our cybersecurity program from time to time as circumstances make appropriate and annually in connection with the annual audit of the Company's financial statements. Our Corporate Controller renders to the auditor a written report regarding IT general controls, including cybersecurity systems, risk assessment and monitoring practices. The auditor reviews the report in connection with its assessment of the Company's internal controls over financial reporting, and advises Company management if the report reveals flaws in the Company's internal controls. Copies of the Corporate Controller's report are also given to the CEO/CFO and made available to members of the Board of Directors. Copies of the auditor's report are delivered to the members of the Board of Directors, which reviews and is responsible to cause a remediation of any material inadequacies in the controls environment.

companyName: Tianci International, Inc.

ticker: CIIT


text: The Company's CISO, in coordination with the CIO, is responsible for leading the Company's cybersecurity program and management of cybersecurity risk. The current CISO has over twenty-five years of experience in information security, and his background includes technical experience, strategy and architecture focused roles, cyber and threat experience, and various leadership roles.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: The audit committee of our board of directors is responsible for overseeing the adequacy and effectiveness of the Company's information security policies and practices, as well as risks related to information security and cybersecurity. At least semiannually, and more frequently depending upon applicable facts and circumstances, our audit committee receives an overview of our cybersecurity threat risk management and strategy processes, which covers topics such as our incident response plan, results from third-party assessments, our cybersecurity risk roadmap and any threat risks, cybersecurity incidents or developments, and our progress towards risk-mitigation-related goals. The audit committee receives information related to the foregoing matters from our Chief Information Officer and Senior Director, Information Security, as well as with representatives from our enterprise risk management committee. Our audit committee also receives an annual information security report, which contains information regarding, among other things, the data security processes and procedures that have been implemented across company business units. In addition, our full board of directors is presented with updates on our cybersecurity threat risk management and strategy processes at least annually.

companyName: LEGALZOOM.COM, INC.

ticker: LZ