text: The Company has established an Enterprise Risk Committee, which is co-chaired by the Company's Chief Financial Officer and Chief Legal Officer, and under that framework has chartered a Cybersecurity Sub-Committee, chaired by the Chief Technology Officer. Both committees include various other members of key senior management. Our Board of Directors (including our Audit Committee through delegation as described below), along with our Enterprise Risk Committee and Cybersecurity Sub-Committee, are actively involved in providing oversight of our cybersecurity program. The role of the Board of Directors in the Company's risk oversight process includes receiving reports and presentations from the Enterprise Risk Committee or other senior management leaders on areas of material risk to the Company, including operational, financial, legal and regulatory, strategic, reputational, cybersecurity and Environmental, Social and Governance ("ESG") related risks and any measures taken to mitigate such risks. In addition, the Board of Directors regularly reviews and discusses areas of material risk at its meetings. In essence, the Board of Directors oversees a company-wide approach to risk management, carried out by Company management. With respect to cybersecurity risk, the Board (through the Audit Committee) periodically reviews information on management's policies and processes related to the Company's cybersecurity and data-protection, including related to monitoring, controlling and mitigating against such risks, and the entire Board receives periodic updates on the Company's cybersecurity risk management processes. There have been no material cybersecurity incidents in the periods presented in this Report.

companyName: JOHNSON OUTDOORS INC

ticker: JOUT


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: Danimer Scientific, Inc.

secItem: Item 1C


text: The Board's Audit Committee oversees risks relating to cybersecurity threats and the steps management takes to monitor and control such exposures. The Company has instituted an Information Security Incident Response Plan ("IRP") which provides a framework to assist the Company in responding to actual or potential cybersecurity incidents. Our IRP includes detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be executed from detection to assessment to notification and recovery, including internal notifications to the Audit Committee as appropriate. These incidents may consist of any actual, threatened, suspected, or reported event or occurrence that may affect the confidentiality, integrity, or availability of Company systems or data, or of any such event affecting a third party that may affect Company systems or data. The objective of the IRP is to facilitate a timely and coordinated enterprise-level response to such incidents to mitigate impact on the Company and its employees, stockholders, customers, business partners, and other stakeholders. The Audit Committee receives regular reporting from senior officers (such as the Chief Information Security Officer and the Director of Risk Management & Insurance) on operational risk and the steps management has taken to monitor and control these risks. Such reporting includes updates on the Company's IRP, the external threat environment, and the Company's programs to address and mitigate the risks associated with the cybersecurity threat environment. The IRP and internal controls around cybersecurity are periodically evaluated by external experts and the results of those reviews are reported to the Audit Committee.

companyName: BRUKER CORP

ticker: BRKR


text: Through the Audit Committee, the Board of Directors is informed of: (i) security initiatives, (ii) existing and emerging cybersecurity risks, including cybersecurity incidents; and (iii) any disclosure obligations arising from any cybersecurity incidents. The Board of Directors oversees our general risk management strategy and the most significant risks facing our business, and is responsible for ensuring that appropriate risk mitigation strategies are implemented.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: At the employee level, we maintain an experienced IT team tasked with implementing our privacy and cybersecurity program and supporting our cybersecurity leader in carrying out reporting, security and mitigation functions. We continuously seek to promote awareness of cybersecurity risk through communication and education of our employee population, and have a mandatory training program which covers privacy and cybersecurity (including phishing tests) and records and information management.

companyName: Gogo Inc.

ticker: GOGO


text: The Company's CCO also plays a vital oversight role in the area of cybersecurity preparedness and the effective implementation of the cybersecurity program. The CCO has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing regulatory compliance risk applicable to the Company.

companyName: Andalusian Credit Company, LLC


text: Our Vice President, Chief Information Security Officer ("CISO") leads a team of information security professionals who have the first line responsibility for our cybersecurity risk management processes and activities. Our CISO has more than 20 years of experience as an information security leader and reports directly to our Executive Vice President, Chief Information and Digital Officer. Certifications of our cybersecurity professionals include, but are not limited to: Certified Information Systems Security Professionals from the International Information System Security Certification Consortium; Certified Information Security Manager from Information Systems Audit and Control Association; and focused training/certifications from security vendors on the applications utilized in the management of the cybersecurity program. The certifications mentioned above are accompanied by multiple years of direct experience in cybersecurity which provide the framework for the team's continuous learning of new technologies, processes, trends, and concepts, with additional training obtained through relevant cybersecurity focused conferences.

companyName: Invitation Homes Inc.

ticker: INVH


text: No unauthorized access to customer, vendor, supplier, joint venture, employee or our data occurred as a result of cybersecurity incidents against us that has had a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under Risks Relating to Our Business in Item1(a) Risk Factors.

companyName: DNOW Inc.

ticker: DNOW


text: Executive Vice President oversees risks of cybersecurity threats and reports quarterly, and as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us. Our Executive Vice President has over ten years of experience with developers of access management, network security and data protection solutions.

companyName: NETWORK-1 TECHNOLOGIES, INC.

ticker: NTIP


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues which may arise in the most timely and aggressive fashion.

companyName: UR-ENERGY INC

ticker: URG


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Management, including the CIO and our Director of Cybersecurity, regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, a third-party risk assessment program, vulnerability management, and on-going cybersecurity projects.

companyName: Worthington Steel, Inc.

ticker: WS


text: Our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO") are responsible for our company's overall information security activities and cyber risk programs. Our CISO reports to the CIO and leads our cyber and data-related incident response activities. Our current CIO and CISO have more than 40 years of combined experience in the digital and information technology field.

companyName: WORLD KINECT CORP

ticker: WKC


text: Our cybersecurity strategy is developed in close collaboration with business stakeholders and is led by our Chief Information Security Officer (CISO). This strategy forms the foundation of our information security programs and supports effective cybersecurity risk management. Cybersecurity risk management is the responsibility of our information security team, which is overseen by our CISO. Our cyber fusion team, a subset of the information security team, is responsible for incident response, endpoint security management, detection engineering, vulnerability management, and threat intelligence. The cyber fusion team partners with technology and business stakeholders to strengthen the resiliency of our systems. Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents pursuant to the escalation procedures in our Cybersecurity Incident Response Plan. As described above, for incidents assessed at elevated severity levels, our CISO, crisis management team and legal team promptly engage a cross-functional incident response team to assess and monitor the incident to comply with applicable legal requirements.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote internal and external resources and designate high-level personnel, including our Chief Financial Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Allakos Inc.


text: Like other large multi-national corporations, we regularly experience cybersecurity incidents, and we expect to continue to be subject to such incidents. To date, there have not been any previous cybersecurity incidents that materially affected us. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors - We are dependent on sophisticated information technology and if we fail to effectively maintain or protect our information systems or data, including from data breaches and cybersecurity events, our business could be adversely affected.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Information Security department. Our Chief Technology Officer and Vice President of Cybersecurity work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response vulnerability management processes include reporting to the Cybersecurity and Privacy Committee for certain cybersecurity incidents.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Management's oversight Cleco maintains a cybersecurity program overseen by its Chief Administrative and Sustainability Officer, EMT, and Audit Committee that uses a risk-based methodology to support the security, confidentiality, integrity, and availability of information. This program is integrated within Cleco's enterprise risk management program, which utilizes the Enterprise Risk Management Committee to collaboratively manage and advance enterprise-wide risk management processes. Cleco's Disclosure Committee, which is comprised of EMT and the Chief Accounting Officer, is the means in which cybersecurity matters are assessed for disclosure requirements. Cleco's EMT sets enterprise risk strategies and makes risk-informed decisions that include the assessment and response to cybersecurity risk. In March 2024, management began engaging in quarterly discussions with the Audit Committee regarding incidents of any magnitude experienced during the quarter, strategies and significant risk exposures, as well as the measures implemented to monitor and control these risks. These discussions may include the results of internal and third party risk assessments and audit results, and management's plans to improve its cybersecurity posture using a risk-based approach.

companyName: Cleco Corporate Holdings LLC


text: In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our Chief Compliance Officer ("CCO") no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN


text: We do not believe that there are any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. See "Security breaches and other disruptions could compromise our information and expose us to liability, which could cause our business and reputation to suffer." in "Item 1A. Risk Factors" for additional information.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: Senior management of many departments in the Company also engage in an annual tabletop exercise in order to test incident preparedness, review the effectiveness of the Playbook and maintain effective coordination in the event of a security incident.

companyName: ROBERT HALF INC.

ticker: RHI


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) approach, which is subject to oversight by our BOD. Our cybersecurity policies and practices are aligned with relevant industry standards.

companyName: PFIZER INC

ticker: PFE


text: Review. Occurs after the event has been resolved. The priority in this phase is to review the investigation/response process and update the above steps based on the lessons learned.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: The ISSC's responsibilities encompass: • Review and approval of the ISP-related documents, including policies, strategies, plans and risk assessments; • Monitoring of control statuses and program gaps, including findings from audit reports and assessments; • Participation in program assessments, such as risk and business impact assessments; • Providing input on mitigation of current issues and threats; • Reporting, at least quarterly, to the Enterprise Risk Management Committee on ISSC activities and risk impacts on the Risk Appetite Statement. • Reporting, at least annually, to the Board on the status of the ISP, covering compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: The Audit Committee of our Board of Directors is responsible for oversight of risks from cybersecurity threats. At a management level, our cybersecurity risk management program is led by our Chief Technology and Innovation Officer who has over 20 years experience providing business and information technology, or IT, process consulting and regulatory compliance services, including founding a cyber-security consulting and regulatory compliance firm, and whose certifications include Big 4 SOX Global Subject Matter Specialist, Certified Public Accountant and Certified Information Systems Auditor. Partnering with our Chief Technology and Innovations Officer is our Vice President Cyber Security, who has over 30 years of IT technical and IT business process experience, has been an IT and cyber security leader for multiple financial services companies and has certifications including training in Ethical Hacking, serving as the local IT Sector Chief for the Federal Bureau of Investigation's, or FBI, InfraGard Program, FBI Secret Clearance for all IT related incidents/cybersecurity initiatives, and FBI Citizens Academy Alumni. Collectively, our cybersecurity team consists of 11 professionals with an average cybersecurity tenure of 17 years and certifications including CISSP, AWS Trainer, AWS Architect, Okta administrator, Splunk administrator, CCNP and CCDA, Microsoft Security, Compliance and Identity, Azure CompTIA Security+ and Splunk, information systems auditor, Red Hat Enterprise Linux certification, among other degrees, certifications and work-related experience. Members of our cybersecurity team deliver regular updates to our Chief Technology and Innovation Officer and Chief Administrative Officer and General Counsel.

companyName: Mid-America Apartments, L.P.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms, including outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and in the case of a realized threat, forensic investigators.

companyName: Kronos Bio, Inc.


text: Risk Governance: The Company's cybersecurity program utilizes a cross-functional approach to addressing cybersecurity risks and engages in discussions with the Board (or a committee thereof) and our executive officers accordingly on an as-needed basis. The Company's cybersecurity processes are implemented to help ensure that the Company's cybersecurity practices are aligned with the Company's overall ERM standards and practices. The Company has formed a Cyber Risk Oversight Committee ("CROC") to oversee the Company's cybersecurity program. Our CROC, in turn, communicates any unresolved risks to the Company's Enterprise Risk Committee ("ERC") and the ERC interacts with the Board, the Audit Committee and executive management on a regular interval, or more frequently (if necessary) in regard to such risks. Currently, the CROC is comprised of representatives of our IT department as well as senior leadership, including a majority of the direct reports to our Chief Executive Officer ("CEO"). The ERC is comprised of our Chief Legal Counsel, Senior Director of Global Risk Oversight and various heads of regional or global business units and corporate functions, including but not limited to, IT, finance, accounting, legal, and human resources.

companyName: Vertiv Holdings Co

ticker: VRT


text: The cybersecurity team meets frequently to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. In the event of a cybersecurity incident, we have developed an incident response plan which is designed to "respond, restore, and resume" operation of our information systems and platforms. Our incident response plan also governs our immediate response to attacks, including detection, notification, escalation, assessment, and remediation efforts. The cybersecurity team routinely tests the incident response plan across the organization to validate the procedures for appropriately assessing and escalating risks and incidents. Our cybersecurity team may also coordinate its incident response efforts with external advisors and key stakeholders if necessary.

companyName: FRANKLIN COVEY CO

ticker: FC


text: The Information Security Program is based on regulation and guidance established by agencies, including but not limited to, the Federal Financial Institutions Counsel ("FFIEC") and the FDIC. The Information Security Program begins with risk assessment. At least annually, the Company's Information Security team completes an information security risk assessment in accordance with regulatory guidance. While cyber threats are included in the overall information security risk assessment, a targeted cybersecurity risk assessment is also completed, utilizing the FFIEC Cybersecurity Assessment Tool ("FFIEC CAT"). The FFIEC CAT specifically assesses the maturity and effectiveness of the Bank's cybersecurity programs. In addition to the FFIEC CAT, the Bank partners with internal and external auditors to conduct various assessments throughout the year to identify, manage, and mitigate cybersecurity risks. The assessments conducted include but are not limited to: vulnerability assessments, penetration testing, social engineering, and onsite security assessments. Risk assessments consider size and complexity, are formally documented, and adapt to changes in the technology and organizational environment. Management and the Board of Directors use risk assessment data to make informed risk management decisions based on a full understanding of the risks. Management and the Board also consider the results of these assessments when overseeing operations. A strong, high-level risk assessment process provides the foundation for more detailed assessments within the functional risk management areas, as well as improves policy and internal control decisions across the organization.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: To date, we have not identified any indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. However, as discussed more fully under "Item 1A. Risk Factors", the sophistication of cyber threats continues to increase and we cannot assure that our systems and processes will be successful, that we will be able to anticipate or detect all cyberattacks or other breaches, that we will be able to react to cyberattacks or other breaches in a timely manner or that our remediation efforts will be successful.

companyName: LanzaTech Global, Inc.

ticker: LNZA


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under "Item 1A. Risk Factors".

companyName: Powerfleet, Inc.

ticker: AIOT


text: Although management is responsible for the firm's day to day cybersecurity operations, the Board of Directors ("the Board") oversees the firm's cybersecurity program. The Board does not delegate this responsibility to a committee, nor does the Board identify a cybersecurity expert to consider the firm's activities and make recommendations or provide advice to the Board. Instead, many of our directors have significant technology experience gained through their prior work experience and through their positions on other boards of directors, all of which provides the Board with insight and practical guidance in overseeing the firm's technology and operations as well as our continuing investment in and development of our cybersecurity program.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: We have developed and implemented a cybersecurity framework intended to identify, assess, monitor and manage risks from cybersecurity threats to the security of our information, systems and network using a risk-based approach. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although our framework takes into account the particulars of our business and our diverse network of terminal operations and therefore does not meet all the technical standards, specifications or requirements under the NIST. Additionally, the Company follows IT General Controls that were implemented to adhere to Sarbanes-Oxley internal controls.

companyName: TransMontaigne Partners LLC


text: An incident response plan ("Incident Response Plan") aligned with best practices articulated by the National Institute of Standards and Technology ("NIST") governs the Company's response to cybersecurity incidents. This Incident Response Plan outlines how the Company detects, analyzes, contains, eradicates, recovers, and performs post-incident activities in the event of a cybersecurity incident. It also contains an internal, risk-based escalation framework designed to ensure that all relevant individuals are promptly informed of any cybersecurity incident and dictates procedures for determining whether a cybersecurity incident is material without unreasonable delay.

companyName: ENVIRI Corp

ticker: NVRI


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: leverage the NIST incident handling framework and our MSPs to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident;

companyName: TMC the metals Co Inc.

ticker: TMC


text: Conduct periodic vulnerability assessments and mitigate vulnerabilities for our systems and processes that include sensitive data Conduct regular security awareness trainings and phishing simulation attacks Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident and Perform periodic gap analyses to review our cybersecurity controls for gaps and implement the closure actions.

companyName: 5&2 Studios, Inc.


text: Our VP of IT and our Director of IT Operations are responsible for assessing and managing risks from cybersecurity threats. Our VP of IT and Director of IT Operations each have over 20 years of experience in information technology, with cybersecurity comprising a significant role in their experience. The VP of IT and the Director of IT Operations are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents as a function of their management of our cybersecurity program.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires/conducting due diligence in connection with onboarding new vendors and ongoing reviews / due diligence with key third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third party providers.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Our CPO has over 8 years of experience serving as a Global Data Privacy Officer and practicing law specializing in data privacy among other areas.

companyName: UNISYS CORP

ticker: UIS


text: Our board of directors, with assistance from the audit committee, oversees the Company's management of risks arising from cybersecurity threats. The audit committee regularly reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the audit committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including certain IT leadership and our legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The audit committee also reports to the board of directors at least annually on cybersecurity matters.

companyName: Leslie's, Inc.

ticker: LESL


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1.A Risk Factors—Information Technology Risks."

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: The Company provides annual mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. The Company also conducts monthly "phishing" email testing for every employee and provides remedial follow-up training when necessary.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis, we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify and manage material risks.

companyName: VAPOTHERM INC


text: Board of Directors The Corporate Risk Committee of our Board of Directors oversees our information technology systems, including information security, compliance and privacy. Additionally, the Audit Committee of our Board of Directors oversees adequacy and effectiveness of our controls and procedures, including those designed to assess, identify and manage material risks from cybersecurity threats and incidents. Further, at least once per quarter, our CIO and/or CISO report on cybersecurity matters to the Corporate Risk Committee, and updates are provided to our Board of Directors at regular board meetings. The CIO also provides updates annually or more frequently as appropriate to our Board of Directors. Our ERM team reports annually on the company's risks to our Board of Directors, which includes progress related to mitigation activities and risk conditions.

companyName: CHS INC

ticker: CHSCP


text: Our CFO is responsible for hiring appropriate personnel, retaining third-party information technology service providers, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel and approving budgets. Our IT manager and our third-party information technology service provider are together responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: We manage these known risks by using internal security controls designed to align with standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), and the Center for Internet Security ("CIS"), and by engaging third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Our maturity in these controls varies by control type and by business.

companyName: JUNIPER NETWORKS INC


text: Our cybersecurity function, led by our Cybersecurity Manager and supported by our Chief Information Officer ("CIO") and third-party service providers, helps identify, assess, and manage the Company's cybersecurity threats and risks. This group identifies and assesses cybersecurity threats by monitoring and evaluating our threat environment using various methods including: using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external cybersecurity audits, engaging third-party threat assessments, conducting vulnerability assessments, leveraging external intelligence feeds, and completing third-party red/blue team exercises and tabletop incident response exercises.

companyName: PetIQ, Inc.


text: Our ISM regularly engages with other members of our executive management team to discuss cyber risk, including the Chief Executive Officer, Board of Directors, Executive Committees, among others, as well as the audit committee of our Board. Our executive management team has the appropriate expertise, background, and depth of experience to manage risk arising from cybersecurity threats. Executive management has also participated in cybersecurity tabletop exercises to test our cyber response playbooks.

companyName: MediXall Group, Inc.

ticker: MDXL


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer ("COO"). Our COO, assisted by our Senior Vice President for Operations, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our COO and Senior Vice President for Operations are responsible for reviewing security assessments and other security-related reports.

companyName: EMERSON RADIO CORP

ticker: MSN


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk appetite with our strategic objectives. Our risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security ("IS") Officer leads our cybersecurity program, reporting directly to the Chief Risk Officer ("CRO") and provides reports and updates to the information Technology ("IT") Committee, and the Board of Directors monthly or more frequently as required.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: Our Head of IT directly reports to, and meets periodically with, our Chief Legal Officer to discuss and review our cybersecurity risk management processes, with input from the Company's MSP and vCISO, as appropriate.

companyName: Disc Medicine, Inc.

ticker: IRON


text: The Company's Audit Committee is also responsible for overseeing cybersecurity risk and are informed in a timely manner of any incidents considered potentially serious, together with details on the prevention, detection, mitigation and remediation of such incidents.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: Our Cybersecurity Risk Management Program ("RM Program") is aligned with the National Institute of Standards and Technology Cybersecurity Framework and other industry best practices. The RM Program is designed to identify, assess and mitigate material cybersecurity risks.

companyName: MCKESSON CORP

ticker: MCK


text: At the management level, our Chief Information Security Officer ("CISO") leads the team responsible for implementing, monitoring, and maintaining information security, including data protection practices across our business. Our CISO receives reports on cybersecurity threats from both our internal personnel and external partners on a regular basis. Our Chief Operating Officer and Chief Administrative Officer receive regular reports from our CISO on the cyber program and measures implemented by the Company to identify and mitigate cybersecurity risks. Our CISO works closely with our Company's legal team to ensure compliance with legal and regulatory cybersecurity requirements. Our CISO has over a decade of cybersecurity and risk management experience and holds CISA, CISM, and CISSP certifications as well as a bachelor's degree in Business Information Systems.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: protect against anticipated threats or hazards to the security or integrity of such information; and to, use of, or transfer of such information, thereby protecting the Company, its employees, and customers from potential harm or use a variety of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises, to enhance our cybersecurity posture. Our incident response plan is comprehensive, detailing procedures for preparing for, detecting, responding to, and recovering from cybersecurity incidents. This plan includes processes for triaging, assessing the severity of, escalating, containing, investigating, and remediating cybersecurity incidents, while ensuring compliance with relevant legal obligations.

companyName: Outdoor Holding Co

ticker: POWW


text: Our approach to information security follows a defense-in-depth methodology in which security is embedded throughout the system architecture. Technical controls rely on proven technologies, such as network-based intrusion detection systems, next generation firewalls with advanced threat detection, secure server networks, demilitarized zones, and endpoint detection and response capabilities. Security techniques, such as encryption at rest and encryption in transit, are used to incorporate relevant practices. We undergo annual third-party security assessments such as security control compliance reviews, incident response exercises, penetration testing, and red team drills to maintain the effectiveness of the security program.

companyName: ICF International, Inc.

ticker: ICFI


text: Our Board of Directors considers cybersecurity risk as part of its risk management function and has delegated to the Enterprise Risk Committee oversight and governance of the technology program and the information security program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Enterprise Risk Committee reviews our cybersecurity risk profile on a quarterly basis. Additionally, our CISO and our Chief Information Officer provide quarterly reports to the Enterprise Risk Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: The Board of Directors is responsible for oversight of cybersecurity risk. Our Chief Financial Officer and Chief Executive Officer are the members of management responsible for managing and assessing our cybersecurity practices and have recently (subsequent to December 31, 2023) commenced reporting on such practices and risks. The plan for the future is that they will continue to report to the Board on cybersecurity at least quarterly. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe our controls are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: AEMETIS, INC

ticker: AMTX


text: Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our customers, partners, and employees, including the importance of managing cybersecurity risks, and we have integrated these policies and procedures into our overall risk management systems and processes. While everyone at our company is expected to play a part in managing cybersecurity risks, our board of directors, as discussed in more detail under "—Governance" below, through delegation to the cybersecurity committee of the board of directors (the cybersecurity committee), and key members of our senior management team, are involved in the oversight of our information security program. Our information security program is based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards, and is integrated into our overall enterprise risk management program. We utilize an overarching framework to address enterprise information security governance, which seeks to protect information assets and systems against attacks and incidents while establishing appropriate security as a priority for our information technology infrastructure and throughout the product development process. Our information security team, including a "red team" of dedicated engineers, and certain cross-functional employees routinely assess material risks from cybersecurity threats, and assess and update our cybersecurity risk management program in response to emerging trends and changes in our operations. We also engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.

companyName: BILL Holdings, Inc.

ticker: BILL


text: In the event of a suspected or threatened cybersecurity incident, the CISO determines whether to activate the Company's Cyber Incident Response Team ("CIRT"), composed of different subject matter experts from applicable domains such as network, infrastructure, and application areas in order to evaluate the technical issues relative to the incident. The CIRT is overseen by the CISO. If necessary, the CIRT may engage third-party cybersecurity experts to evaluate and/or remediate the incident. If and when the CIRT is activated, the CISO will inform the Company's Chief Information Officer (CIO). In the event that the CIRT confirms that the incident relates to a cybersecurity incident or compromise of MGIC's computer systems, the CISO will notify the General Counsel, who will advise the Chief Executive Officer ("CEO"), who is a member of the Board of Directors. In addition to advising the CEO, the General Counsel will also convene an established committee whose members include the General Counsel, Chief Financial and Risk Officer, Senior Vice President of Investor Relations, and Chief Accounting Officer in order to determine if the event is a material cybersecurity incident so as to trigger an Item 1.05 filing on Form 8-K. If a determination is made that the event is material, or if the CEO or General Counsel otherwise determines it advisable, the CEO or General Counsel, or a delegate thereof, shall notify the Chairman of the Board, Lead Independent Director, and Chairpersons of the Board's Business Technology and Transformation Committee (the "BTTC") and Audit Committee.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: During fiscal 2025, Oracle experienced cybersecurity incidents that, to date, have not had a material impact on our business, including our business strategy, results of operations or financial condition.

companyName: ORACLE CORP

ticker: ORCL


text: As part of its oversight responsibilities over the Company risks and controls, the Board ultimately is responsible for overseeing our cyber and information security risks. The Board has delegated this responsibility to its Risk Committee. At each quarterly meeting of the Risk Committee, our CISO reports to the Risk Committee regarding security testing, training, audits, key cybersecurity metrics, and our efforts to identify, prepare for, prevent, and respond to critical threats. The Risk Committee receives regular updates on the status of our information security program, penetration testing results, infrastructure assessments, threat environment, security operations, operational events, vendor and supply chain security, and application/data security. On an annual basis, the CISO presents a cybersecurity program update to the Risk Committee.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: We foster a shared responsibility for the Company's cybersecurity with all of our employees, conducting periodic phishing simulation campaigns and providing regular, mandatory cybersecurity training to enhance awareness and readiness against potential cyber threats. Certain roles require additional role-based, specialized cybersecurity training, such as tabletop exercises to ensure proactive preparation and effective coordination in the event of a security incident. We engage a third-party to conduct annual tabletop exercises in order to rehearse our incident response plan, as well as to identify and prioritize opportunities for improvement within our cybersecurity program and associated security controls, through a customized simulation specifically tailored to our current environment, processes, and procedures. To protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. Our IT security team reviews and updates such policies and procedures to adapt to evolving cybersecurity landscapes, industry best practices, and regulatory and statutory updates. Our CISO conducts thorough reviews of these updates at least annually to ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity" for more information on the Company's cybersecurity-related risks. Governance.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: We have implemented processes for overseeing, identifying and managing material risks from cybersecurity threats and have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level and that cybersecurity risk remains a key component of management activities, including continuously assessing, identifying, and managing material risks from cybersecurity threats.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by the REIT Manager's Chief Compliance Officer and Cyber Security Committee ("CSC"). The REIT Manager's Chief Compliance Officer has 17 years of experience in regulatory compliance, risk management, and cybersecurity governance, with expertise in implementing and overseeing security policies in financial and REIT sectors. [The CSC is composed of professionals with backgrounds in information security, IT risk management, and data protection, ensuring a well-rounded approach to cybersecurity oversight.

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within its Engineering organization, and overseen by its chief information security officer. Goldman Sachs' chief information security officer and senior management within its Technology Risk and Operational Risk, as well as its management personnel overseeing the Cybersecurity Program, all have substantial relevant expertise in the areas of information security and cybersecurity risk management. This program is designed to identify, assess, document and mitigate threats, establish and evaluate compliance with information security mandates, adopt and apply our security control framework, and prevent, detect and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight and challenge of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.

companyName: Goldman Sachs Real Estate Finance Trust Inc


text: We also maintain processes to address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our systems or data or facilities that house such systems and data. Cybersecurity considerations affect the selection and oversight of these third-party service providers. We perform diligence on these third parties and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that we believe could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and be subject to certain obligations related to their cybersecurity practices.

companyName: Bakkt, Inc.

ticker: BKKT


text: Such processes include the use of traffic monitoring tools, as well as training users to detect, report, and prevent unusual behavior. We also employ monitoring mechanisms to help us detect and respond to cybersecurity threats. We conduct regular assessments and testing of the effectiveness of these controls, including security audits, incident response planning, and regulatory compliance assessments. We seek to foster cybersecurity awareness and responsibility throughout the organization by regularly providing our employees with training on cybersecurity practices.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the Principal Financial and Accounting Officer. Our Principal Financial and Accounting Officer and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the board of directors committee responsible for certain cybersecurity incidents.

companyName: Turnstone Biologics Corp.


text: Our cybersecurity organization is led by our CISO. Our CISO leads a global team to develop our strategic cybersecurity priorities and execute operational plans. He has over 25 years of cybersecurity experience in the healthcare, finance and telecommunications industries and in government. Prior to his role at Kenvue, our CISO spent over ten years at J&J in cybersecurity, and he retired from the United States Air Force Reserves in 2018 as a Lieutenant Colonel, where he had responsibility for cybersecurity. He is a Certified Information Systems Security Professional and holds a Masters in Telecommunications Management from the University of Maryland, University College. The members of the cybersecurity organization have decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and rely on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants.

companyName: Kenvue Inc.

ticker: KVUE


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: Additional information about cybersecurity risks we face is discussed in Part I, Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology systems and infrastructure used by us, Hess or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.

companyName: Hess Midstream LP

ticker: HESM


text: The Director of Information Technology is responsible for overseeing the information security program as well as members of the Information Technology department that execute our program with oversight by members of our senior leadership team. These members of our Information Technology department have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance and systems. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: The Cybersecurity Team engages third-party vendors to assist with managing endpoint security, managing the Company's security operations center, providing threat detection and response capabilities, monitoring certain operational technology and control system environments, and providing threat detection and vulnerability identification and remediation services. Additionally, the Company is a member of the Oil and Natural Gas Information and Analysis Center. This center provides the Company with information regarding threats to the oil and gas industry and threats reported by other industry participants. Finally, the Cybersecurity Team periodically engages with the cybersecurity-related guidance of other third parties such as law enforcement, industry trade groups and vendors.

companyName: CONTINENTAL RESOURCES, INC


text: Regular briefings are provided to the Audit Committee by management, regarding the cybersecurity risk landscape and any significant cybersecurity incidents. These updates are then relayed to the full Board as deemed necessary by the Audit Committee. Our management team also receives regular internal briefings.

companyName: KALTURA INC

ticker: KLTR


text: The Company leverages a combination of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Center for Internet Security (CIS) Critical Security Controls as the scale against which to assess its information security program and invest in its ability to proactively defend against security risks within its environment. Domino's conducts annual risk assessments, both internally and through the use of third parties, to evaluate the effectiveness of its security controls and identify new threats and vulnerabilities and appropriate controls to mitigate risks and supplements these regular assessments with ongoing monitoring. Additionally, Domino's participates in ongoing and periodic assessments of its external platform and applications to include running a responsible disclosure program to ensure that vulnerabilities that are discovered can be reported and appropriately remediated. Domino's has been certified as compliant with the Payment Card Industry Data Security Standard ("PCI DSS") standards and has several dedicated teams of specialists within its information security department that routinely conduct internal and external vulnerability and penetration assessments in accordance with both PCI DSS and industry accepted practices. This team keeps the Company's management informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents and leads the Company's processes to oversee and identify risks from cybersecurity threats associated with the Company's use of its third-party service providers. The Company additionally has established and maintains a dedicated Security Operations Center (SOC) team that is responsible for quickly identifying and treating events that could pose risk to its technology environments and that has a documented incident response plan in place, which is periodically tested, reviewed and updated as appropriate. The Company trains its team members through annual cybersecurity awareness training, phishing simulations and periodic communications about timely cybersecurity topics and threats.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Our Information Technology (IT) Department and Legal Department work together and are jointly responsible for developing and coordinating our enterprise-wide cybersecurity policy and strategy, including managing our cybersecurity risk management processes. The VP of IT and the General Counsel report to the Company's senior leadership team on progress towards specific cybersecurity objectives.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: Our Chief Information Security Officer, with oversight from the Chief Technology Officer and Chief Operations Officer, is primarily responsible for assessing and managing cybersecurity risks. Our Chief Information Security Officer has extensive cybersecurity knowledge and skills gained from over 25 years' experience in the field. Our Chief Information Security Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: FOOT LOCKER, INC.


text: As of December 28, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: UnitedHealth Group Incorporated ("UHG") recently widely-announced that they had experienced a cybersecurity incident in which a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare (owned by UHG) information technology systems. Through filings on Form 8-K, press releases and conference calls, UHG is providing regular updates on its assessment of this cybersecurity incident, including, without limitation, its remediation and service restoration activities. The Company's Cybersecurity Committee and its respective members are monitoring UHG's cybersecurity incident for any potential impact it may have on the Company and its various constituencies.

companyName: Cano Health, Inc.


text: As a provider of SaaS solutions and an extensive user of a variety of technology services, we are subject to numerous risks from cybersecurity threats that have and could adversely affect us; however, to date none have materially affected us or our business strategy, results of operation or financial condition. Cybersecurity threats are ever-present and continuously evolving and we have and will continue to expend considerable resources to deliver solutions that are designed to comply with the stringent security and technical regulations and practices applicable to financial institutions and financial services providers and to safeguard our solutions and information systems against cybersecurity threats. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors." We have implemented a risk-based approach to identify and assess the cybersecurity threats that have and could affect our business and information systems, which approach is incorporated into our overall enterprise risk management program. Our enterprise risk management program includes a formal, enterprise-wide inventory, categorization and assessment of risks, including risks associated with cybersecurity threats, overseen by the Risk and Compliance Committee, or RACC, of our Board of Directors, and managed by our dedicated Chief Risk Officer, or CRO, and an Enterprise Risk Oversight Committee consisting of a cross-functional representation of senior leaders including our Chief Information Security Officer, or CISO. Our CRO has over eight years of senior risk management experience at large technology organizations, following a 20-year career in the U.S. Army. Our enterprise risk management team works in partnership with our dedicated security, information technology, compliance, internal audit, and third-party risk management functions, which collectively rely on a variety of internal resources and processes, as well as third-party consultants, auditors and applications, to identify, assess and manage cybersecurity risks, including cybersecurity threats related to third-party providers on which we rely. Our enterprise risk management function also extensively consults with senior management across our organization in identifying, assessing and managing risks.

companyName: Q2 Holdings, Inc.

ticker: QTWO


text: As cyber criminals continue to become more sophisticated through evolution of their tactics, techniques and procedures, we, UHS and our third-party property managers have taken, and will continue to take, additional preventive measures to strengthen the cyber defenses of the collective networks and data. Protecting data, which includes information related to clinical and financial data, and communications with patients, tenants, payers, vendors and other third parties is a primary area of focus for us, UHS, and our third-party property managers. Given the critical nature of this information, certain cybersecurity risk management programs were implemented to assess, identify, and manage risks associated with cybersecurity threats as identified in Item 106(a) of Regulation S-K.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: As part of our overall risk management strategy, we leverage a defense in depth philosophy, which includes, but is not limited to, additional end-user training, layered technology defenses, identifying and protecting critical assets, strengthening monitoring and warning systems and engaging industry and subject matter experts. We regularly test defenses by performing simulations and exercises at both a technical level and by reviewing our operational policies and procedures with third-party experts. At the management level, our cybersecurity team regularly monitors alerts and meets to discuss industry threats, trends and remediation tactics. The cybersecurity team also regularly prepares a cyber report that includes metrics and compliance performance, collects data on cybersecurity threats and risks and conducts an annual risk assessment, which it uses to assess and refine Conduent's overall security posture. Furthermore, we receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity associations, as well as conduct periodic external penetration tests and gap testing to assess our processes and procedures and the ever-changing threat landscape. We have created and continually update, as required, a detailed incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification and which we implement in the event of a cybersecurity incident.

companyName: CONDUENT Inc

ticker: CNDT


text: The Company regularly reminds its team members and contractors of the importance of handling and protecting customer and employee data. The Company provides all its team members with dedicated cybersecurity awareness training annually and, conducts monthly phishing simulation testing and other cybersecurity awareness campaigns (e.g., intranet articles, cybersecurity awareness month).

companyName: Sleep Number Corp

ticker: SNBR


text: The Adviser is fully committed to protecting the Company's systems and information as well as the information of the clients and professionals it serves.

companyName: Antares Strategic Credit Fund


text: Ashland maintains a similar risk-based approach to its third-party vendor management program including identifying and overseeing cybersecurity risks that such third parties may present. As part of this program, the Company, imposes additional scrutiny for vendors that may handle personally identifiable information data or trade secrets.

companyName: ASHLAND INC.

ticker: ASH


text: The Audit Committee, in addition to the Company's General Counsel and Chief Compliance Officer, oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee and General Counsel and Chief Compliance Officer on the effectiveness of the Company's cyber risk management program, generally on a quarterly basis. In addition, cybersecurity risks will be reviewed by the Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. In addition, we have implemented procedures over certain areas such as access on/off boarding and account management to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See " Item 1A. Risk Factors " for more information.

companyName: PHOTRONICS INC

ticker: PLAB


text: Any new organization or party that we show interest in establishing a relationship with the Bank will/may require the potential to share or access confidential client information must go through a series of guidelines for qualification prior to releasing information or implementing services. These procedures are in place in order to demonstrate our commitment to safeguarding confidential information while documenting due diligence. New third parties are assessed through our pre- engagement process. The next level of engagement involves a Risk Dependency Assessment, to determine the vendor's Tier Level and a full due-diligence review of policies and independent audits of Critical Vendors as defined in policy.

companyName: River Financial Corp

ticker: RVRF


text: Our risk management program also assesses risks associated with third-party service providers. Such providers are subject to an onboarding process and may be reevaluated periodically, such as upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, our service providers adhere to mutually agreed upon security requirements, controls and responsibilities.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: Our board of directors, through its Audit Committee, maintains oversight of risks, including cybersecurity risks, and receives an update from the Director of IT Security and the Chief Information Officer (CIO) at each quarterly committee meeting. The Audit Committee also reports to the full board on cybersecurity matters as part of its regular report out after each meeting. The Audit Committee Chair is immediately informed of any breach that could be more than de minimis and is kept apprised of any resulting investigation and is briefed on the substance of any Form 8-K filing related to a material cybersecurity incident.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: During the last fiscal year, 2023, the Company did not encounter any material cybersecurity incidents, nor did it incur any notable expenses as a result.

companyName: SPAR Group, Inc.

ticker: SGRP


text: To help protect client information and Tyler data, Tyler leverages both internal and external resources, including third-party assessments and threat intelligence services, to work to identify and respond to information security risks. For example:

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: O ur management team is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Boundless Bio, Inc.

ticker: BOLD


text: We have implemented an Enterprise Risk Management ("ERM") program, managed by members of senior management, to identify, assess and monitor key risks that are aligned with our strategic and business objectives. Our policies and processes are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We apply NIST best practices in how we implement security and privacy controls. We use NIST to define our practice in conducting risk assessments as well as to define our approach in managing internet of things ("IOT") device security. We have identified various cybersecurity risks that could adversely affect our business, results of operations and financial condition, including violation of privacy laws; intellectual property theft; fraud; business interruption or ransomware; harm to customers or employees; and other legal and reputational risks.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: Cybersecurity risks related to third parties are managed as part of our System and Services Acquisition Policy, which sets forth the procurement, risk management, and contracting framework for managing third-party relationships commensurate with their risk and complexity. Our program sets guidelines for identifying, measuring, monitoring, and reporting the risks associated with third parties through the life cycle of the relationships, which includes planning, due diligence and third-party selection, contracting, ongoing monitoring, and termination. Our program includes the identification of third parties with risks related to information security. Third parties that access, process, collect, share, create, store, transmit, or destroy our information or have access to our systems may have additional security requirements, depending on the levels of risk, such as enhanced risk assessments and monitoring, and additional contractual controls. We also conduct reassessments of our third-party risk, using a risk-based approach to determine frequency. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing, and retention of user data, as well as compliance with appropriate security terms.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Item 1A—Risk Factors" in Part I of this Annual Report on Form 10-K, including the risk factor captioned, "Significant disruptions of information technology systems or actual or alleged breaches of data security could adversely affect our business."

companyName: CERUS CORP

ticker: CERS


text: In addition, all CIM employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.

companyName: CIM Opportunity Zone Fund, L.P.


text: Incident response planning - We have an incident response plan that sets forth a structured process and approach for how we assess, respond to, and remediate cybersecurity incidents. Under the plan, our CISO, the Information Security Office, and any incident response team that may be formed, work with our legal team, our privacy office, and any other applicable internal teams and external resources to address and communicate about incidents to key stakeholders, including the Board and its Cybersecurity Committee. We review and test the plan from time to time to enhance management and Board preparedness in the event of a potential cybersecurity incident and to identify areas of continuous improvement.

companyName: Dynatrace, Inc.

ticker: DT


text: Additionally, our management team's internal cybersecurity risk management and strategy processes are supported with third party consultants with extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board of Directors, Nominating and Corporate Governance Committee and Audit Committee, as the case may be, on any appropriate items.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Our cybersecurity program has several components, including the adoption of information security protocols, standards, and guidelines consistent with industry best practices; engaging third-party service providers to conduct security assessments; performing periodic internal audits of our cybersecurity protocols. We adhere to the National Institute for Standards and Technology (NIST) SP 800-171 and Cybersecurity Maturity Model Certification (CMMC) 2.0 frameworks, which provide a set of standards, guidelines, and best practices to manage cybersecurity-related risks.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: We believe cybersecurity is critical to advancing our 21st Century Security vision and enabling our digital transformation efforts. As an aerospace and defense company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, that target the defense industrial base and other critical infrastructure sectors. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we are a leader in the information security field, and we expend considerable resources on cybersecurity.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: Our system includes procedural and technical safeguards, response plans, and reviews of our policies. We engage various external entities, including consultants, to improve and enhance our cybersecurity oversight. We provide all employees and consultants with cybersecurity and prevention training including timely and relevant topics covering social engineering, phishing, mobile security, and data protection and the need for reporting incidents and suspicious events immediately.

companyName: Lomond Therapeutics Holdings, Inc.


text: The Company's CISO is responsible for developing and managing the cybersecurity program, including security incident response, remediation, and setting security policy and standards required by applicable law or regulation. The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA") and Certified Data Privacy Solutions Engineer ("CDPSE") certifications. The security team holds multiple certifications including but not limited to CISSP, CRISC, CCSFP, and AWS CP, a bug bounty hall of fame member, and a range of experience with different firms. The CISO is informed by the cybersecurity team about the prevention, detection, mitigation, and remediation of cybersecurity incidents through general communications, and reporting. The cybersecurity team is made aware of security risks and incidents by various means including our SIEM, assessments, audit, threat feeds, and security team connections and network.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: Our company recognizes the importance of safeguarding sensitive customer information. Therefore, the Board of Directors recognizes that the protection of this information ranks as one of our highest priorities. The Board of Directors is responsible for reviewing and approving the ICSPP and ICSRP at least annually and monitoring material risks facing our company.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: A comprehensive cybersecurity program is critical to achieving our business goals. Like all companies in today's world, we face a multitude of cybersecurity threats that range from ransomware, and denial-of-service, to attacks from more advanced nation state actors, and even insider threats. Likewise, our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business operations and financial performance. These cybersecurity threats and related risks make it imperative that we expend considerable resources to safeguard our organization's assets and to prevent service disruptions or minimize the impact should an incident occur. Our processes for assessing, identifying, and managing material risks from cyberecurity threats are described below. These cybersecurity risk managment processes are integrated into our overall risk management system.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: Governance and Personnel The Audit Committee of our Board of Directors provides oversight of our cybersecurity program. The committee receives annual briefings from IT management on:

companyName: Guerrilla RF, Inc.

ticker: GUER


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, and external audits. Cybersecurity risks are integrated into our overall enterprise risk management process. To defend, detect and respond to cybersecurity incidents, we, among other things: perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.

companyName: CITIZENS, INC.

ticker: CIA


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, have not materially affected our business to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: Our Cybersecurity risk management methodology includes: • risk assessments designed to help identify material Cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • individuals, including employees and external third-party service providers, who are responsible for managing our Cybersecurity risk assessment processes, our security controls, and our response to Cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • a Cybersecurity incident response plan that includes procedures for responding to Cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: JFB Construction Holdings

ticker: JFB


text: To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises with leaders, stakeholders, subject matter experts and certain executives that are developed in partnership with external security experts. These events are designed to exercise and engage some of the most critical areas of cybersecurity incident response and preparedness through an interactive/evolving, simulated scenario. In addition to these internal measures, the effectiveness of components of our overall cybersecurity program is frequently evaluated by external third parties, which includes work performed over various levels of control assessments for specific business lines and core processes. These include Health Information Trust Alliance for health care data security, PCI DSS for payment security and System Organization Controls 2 for information security and related controls for specific business lines and core processes. We also perform an annual maturity assessment and benchmark our security controls to identify opportunities to strengthen our cybersecurity program.

companyName: Cigna Group

ticker: CI


text: The Company's management team is responsible for implementing and managing the Company's cybersecurity risk management program. The management team regularly reviews the Company's cybersecurity risks and adjusts the program as needed. Risk data analyzed includes summary and detailed data from monitoring and protection systems along with remediation reports to help ensure the constant evolution of the program.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Our Senior Vice President of Information Technology has more than 20 years of cybersecurity experience, is an active Certified Information Systems Security Professional, and trained in assessing and managing cyber risks.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, for example, an incident response plan and team, data encryption, risk assessments, network security and access controls, physical security, asset management, tracking, and disposal, systems monitoring, employee training including tabletop exercises and other simulated cybersecurity threats, and cybersecurity insurance. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls ("SOC") reports of such third-party service providers when onboarding the provider and annually thereafter. We also maintain proper essential information sharing and access controls, aiding in the secure exchange of information between us and our third-party service providers.

companyName: Origin Materials, Inc.

ticker: ORGN


text: We describe whether and how risks from identified cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity incidents, cyberattacks and other information technology failures could result in loss of data, compromise of confidential information, and adverse effects to our business, financial results and our ability to continue operations," which disclosures are incorporated herein by reference. In the last three fiscal years, we have not experienced any material cybersecurity incidents.

companyName: DermTech, Inc.


text: Our information security function, supported by members of our IT department and our third party IT service providers, helps identify, assess and manage our cybersecurity threats and risks. This team helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats and analyzing such reports of threats and actors, conducting scans of our threat environment, evaluating threats reported to us, conducting vulnerability assessments, and working with third parties to conduct certain tests of our environment.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: BancPlus recognizes the critical importance of assessing, identifying, and managing material risks from cybersecurity threats and safeguarding the security of its banking operations and data, including protecting its customers' information. As described in more detail below, BancPlus has established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats (collectively, the "cybersecurity program"). The Company has devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and have made significant investments to maintain the security of the Company's banking operations and data and cybersecurity infrastructure.

companyName: BANCPLUS CORP


text: Prevention and Preparation As noted above, we utilize our MS Provider for cloud-based information technology services. This third-party solution includes 24/7 monitoring and is built to the NISI/ISO framework. We also engage a nationally recognized public accounting firm to perform periodic cybersecurity assessments, which entail performing a qualitative current state evaluation of our cybersecurity program in line with specific domains within the recognized third party framework. In addition, we take the following preventative measures: • We engage a third party to perform internal and external penetration tests on an annual basis. • We require multi-factor authentication for our network and primary applications. • We utilize geolocation-based blocking.

companyName: LXP Industrial Trust

ticker: LXP


text: Although we take cybersecurity risks seriously, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Quantum Computing Inc.

ticker: QUBT


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal IT Audits, IT security, governance, risk, and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.

companyName: Toughbuilt Industries, Inc


text: We have not encountered any cybersecurity threats or incidents that have had a material impact on our business. We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. See "Risk Factors– Risks Related to our Operations - Our information technology, or IT, infrastructure, and our network has been and may be impacted by a cyber-attack or other security incident as a result of the rise of cybersecurity events."

companyName: CHARLES & COLVARD LTD


text: deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and systems necessary, the use of third-party security experts if and when an incident is detected are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.

companyName: VIVIC CORP.

ticker: VIVC


text: The Company also trains employees to understand their role in attempting to protect the Company from cybersecurity attacks. Our information security training program for employees includes computer-based training at hire, annual follow-up training and acknowledgement of our information security policies, regular internal communications, and testing to measure the effectiveness of our information security program. For example, we conduct regular phishing awareness campaigns designed to emulate current threats and provide immediate feedback and, as necessary, additional training or remedial action.

companyName: Wingstop Inc.

ticker: WING


text: Cybersecurity threats and cybersecurity incidents could adversely affect our business and disrupt our operations. Cybersecurity incidents include an intentional attack or unintentional event allowing unauthorized access to systems impacting the confidentiality, integrity and/or availability of our information sources. Cybersecurity threats are any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or the information therein.

companyName: PROCYON CORP


text: Risks from Cybersecurity Threats Despite our security measures, our information technology and infrastructure may remain vulnerable to disruptions, including as a result of attacks by increasingly sophisticated intruders or others who attempt to cause harm to, or otherwise interfere with the normal use of our systems. We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to our information systems and computer networks, and we could in the future experience similar attacks. On October 11, 2023, we announced that we had experienced disruptions in our Information Technology (IT) infrastructure and applications resulting from a cybersecurity incident. We identified unauthorized activity in our IT systems and took immediate steps to stop, remediate and investigate such activity. We also notified relevant law enforcement. The incident, which caused disruption of our business operations for approximately three days, has been resolved due to steps we took to address the incident. As a result of our ability to restore our operations within three days, we were able to fulfill our backlog of orders caused by the operational disruption within one week, and therefore, we experienced no material financial impact to our business.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: Our governance structure is designed to ensure effective oversight and management of cybersecurity risks: • The Board of Directors is actively engaged in overseeing cybersecurity matters, receiving regular briefings and ensuring alignment between cybersecurity strategy and overall business strategy. • A dedicated committee oversees cybersecurity governance, assessing policies, practices and risk mitigation strategies and ensuring alignment with industry best practices. • Our executive leadership team actively participates in the development and execution of cybersecurity strategy, reinforcing the importance of cybersecurity at the highest levels of the organization. • IT and Cybersecurity reports to the Chief Administrative and Information Officer (CAIO) who provides updates to the dedicated committee.

companyName: DNOW Inc.

ticker: DNOW


text: The CISO and Chief Legal Officer ("CLO") are key members of management responsible for strategic cybersecurity leadership. They lead tactical threat assessment, keep an updated risk register and develop and maintain governance and procedures. The CISO reports to the CFO and presents at least annually to the Audit Committee and the full board of directors on cybersecurity processes. The CLO reports to the CEO, and to the Audit Committee and the full board of directors with regard to significant cybersecurity incidents, as further described below. Our CLO has specific training in cybersecurity awareness and holds a certificate of Cybersecurity Governance for the Board of Directors from the Massachusetts Institute of Technology Sloan School of Management.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD