text: We have established processes and policies for assessing, identifying and managing material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework with our processes focused on: (i) developing organizational understanding to manage cybersecurity risks, (ii) applying safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes. For instance, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection. We have engaged independent consultants and other third-parties to assist us in establishing and improving our policies. We conduct tabletop exercises with outside consultants at least annually to test our processes and policies and use feedback from those exercises to improve our processes. Our senior management and members of the Audit Committee of our Board of Directors participate in those exercises. Our processes and policies include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats and, upon identification, we conduct additional due diligence as a part of establishing those relationships. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. For additional information concerning cybersecurity risks we face, see Item 1A Risk Factors – Information technology failures or data security breaches could harm our business and result in substantial costs.

companyName: PULTEGROUP INC/MI/

ticker: PHM


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CIO who closely coordinates with the Bank's Information Technology team. The Incident Response Plan describes the Bank's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Bank's Executive Management, including the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Risk Officer ("CRO"), and the Board of Directors. We regularly test the Incident Response Plan, including through tabletop exercises, and document lessons learned. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents.

companyName: Primis Financial Corp.

ticker: FRST

secItem: Item 1C


text: Monitoring Cybersecurity Incidents Management is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Management implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, management will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: 1847 Holdings LLC

ticker: LBRA


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our foundational engineering, data security governance, infrastructure security, product security and security operations teams report directly to our CISO and provide regular updates on significant or potentially significant threats and incidents. Additionally, we have an incident response team and an incident response plan that outlines the roles and responsibilities of key personnel, including representatives from information security, compliance, and counsel, that are involved in responding to, remediating and escalating such incidents to the CISO, as appropriate. Our CISO reports directly to our Chief Financial Officer and Chief Operating Officer and indirectly to our audit and risk committee. Our CISO provides updates on significant or potentially significant threats and incidents to our Block Head and leadership team, in addition to the audit and risk committee and our board of directors as appropriate and in accordance with the processes detailed in the prior paragraph.

companyName: Block, Inc.

ticker: XYZ


text: Our business relies on various services from third party service providers that could adversely impact the security of our systems and business. We have implemented processes designed to identify and assess cybersecurity risks associated with our use of third-party service providers.

companyName: VEEA INC.

ticker: VEEA


text: We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. Certain of these systems are managed, hosted, provided or used by third parties, to assist in conducting our business and which have their own cyber security measures in place. We implement generally applicable industry standards and best practices processes for the assessment, identification, and management of material risks from cybersecurity threats to our information technology systems. Our Information Security Coordinator oversees our information security policies and procedures. Our Information Security Coordinator maintains a cyber incident reporting and response process and provides management notifications based on the seriousness of any incident. Our information security policies and procedures are required to be reviewed on a regular basis.

companyName: Onfolio Holdings, Inc

ticker: ONFO


text: The audit committee of the board of directors actively participates in discussions regarding cybersecurity risk exposures and steps taken by management to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with our CTO and CISO the Company's cybersecurity program, including the robustness and efficacy of the overall cybersecurity program, steps taken to enhance defenses and security measures in place and our established plans to identify, detect and respond to potential threats. The audit committee also annually reviews and discusses the ERM process and risk assessment, as well as the Company's cyber insurance coverage. Additionally, the audit committee of the board of directors receives reports and communications from our CTO and our Chief Operating Officer regarding material risks and specific developments related to the changing cybersecurity landscape and the Company's operating, technology and control environment. Such reports may cover topics such as: investments made in our cyber infrastructure; technology projects and initiatives; vulnerability assessments and key findings from external cyber experts; the impact of new cybersecurity-related rules and regulations; changes in the threat environment; and evolving information security standards and market practices. As of December 31, 2024, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: iBio, Inc.

ticker: IBIO


text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. See "—Risk Management and Strategy" above.

companyName: ALIMERA SCIENCES INC


text: Responsibilities of the Board of Directors Our Board provides oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure and the mitigation and remediation of cybersecurity incidents, and our executive officers (including our Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer) are responsible for the day-to-day management of the material risks we face, including cybersecurity risks. Our Board administers its cybersecurity risk oversight function as a whole, as well as through the Audit Committee ("AC"). Our corporate security team informs the Board and AC of certain cybersecurity risks and threats during quarterly meetings and provide materials shared in connection with such meetings, as well as ad hoc updates when there are material developments or changes that may impact cybersecurity risk to the company. Refer to "Item 10. Directors, Executive Officers and Corporate Governance" section of this Annual Report for additional information regarding the AC and other committees of the Board as well as the AC charter.

companyName: Life360, Inc.

ticker: LIF


text: The Board of Directors has responsibility for oversight of cybersecurity risk management. As part of our enterprise risk management program, the Board has established oversight mechanisms that seek to implement effective governance in managing risks associated with cybersecurity threats. In particular, the Audit Committee has been vested with cybersecurity governance mandate that includes defining the Company's cybersecurity strategy and implementation plan, performing regular oversight over Company's cybersecurity landscape, and assessing the impact of material cyber incidents, should they happen.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: Additionally, in Item 1A. "Risk Factors" under the caption "Risks Related to our Business," we discuss forward-looking cybersecurity risks that could have a material impact on us. Our disclosures in Item 1A. "Risk Factors" should be read in conjunction with this Item 1C.

companyName: NuStar Energy L.P.


text: Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management program.

companyName: FOOT LOCKER, INC.


text: Board Oversight and Management's Role Enterprise Cybersecurity. Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Special Activities Committee supports the Board in oversight of classified business cybersecurity, including with respect to company internal information and operational technology systems. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role.

companyName: RTX Corp

ticker: RTX


text: The audit committee of our board of directors is responsible for oversight of the company's programs, policies, procedures, and risk management activities related to information security and data protection. The audit committee meets regularly with CISO to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Management promptly updates our board of directors regarding significant threats and incidents as they arise.

companyName: Sonendo, Inc.

ticker: SONX


text: The Audit Committee selects third-party auditors to conducts cybersecurity audits, penetration tests, and risk assessments. The Committee Chair has expertise in auditing and regulatory compliance within the financial services industry.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and our customers' information, from cybersecurity threats against us, our third-party vendors, and services providers, that may result in a material adverse effect on the confidentiality, integrity, and availability of our information systems.

companyName: Techpoint, Inc.


text: Moreover, our businesses do not involve or represent national infrastructure, the likes of which are common targets of cyber attackers (e.g., energy, oil & gas, transportation, communications, banking and financial systems, etc.). We recognize that cyber threats are a permanent part of the risk landscape and that new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority at Zumiez.

companyName: Zumiez Inc

ticker: ZUMZ


text: Risk Management and Strategy BancPlus' cybersecurity program is integrated into its overall enterprise-wide risk management program and based on guidance established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and applicable regulatory standards, as described below.

companyName: BANCPLUS CORP


text: We have integrated cybersecurity risk management into our overall risk management infrastructure through our enterprise risk management program. The enterprise risk management program, which is driven by our executive leadership, entails a formal process that identifies, assesses, mitigates and manages the risks from both internal and external conditions that could significantly impact the Company and influence our business strategy and performance.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: Our Manager's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: The audit committee of the board of directors is responsible for board-level oversight of cybersecurity risk, and the audit committee reports back to the board of directors about this and other areas within its responsibility. As part of its oversight role, the audit committee receives reporting about our practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from our CFO and through our MSSP.

companyName: NorthStar Healthcare Income, Inc.


text: Parker's cybersecurity program is led by our Digital & IT VP – Infrastructure and Security, who functions as our chief information security officer ("CISO") and has over 25 years of experience in cybersecurity operations, cybersecurity governance and compliance, risk management, operational technology ("OT") and connected products ("IoT") with global Fortune 200 and Fortune 500 companies across diverse industries, such as retail, consumer goods, entertainment and manufacturing. The CISO reports to our CDIO and is supported by and receives regular updates from our dedicated Cyber Security team within our IT function, as well as our IT Risk Council, a cross-functional group that meets regularly to optimize our Digital & IT Risk Management Program and promote alignment with our Enterprise Risk Management program.

companyName: Parker-Hannifin Corp

ticker: PH


text: We recognize the critical importance of cybersecurity in our overall enterprise risk management program. We have developed and implemented a comprehensive and cross-functional cybersecurity risk management program intended to protect the confidentiality, security, and availability of the information we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. Our board of directors and management team monitor and evaluate cybersecurity risk on an ongoing basis.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: We maintain an information security program that seeks to comply with applicable regulatory requirements. The information security team, led by the Chief Information Security Officer ("CISO"), implements appropriate measures designed to safeguard sensitive information and protect our operations and systems against cyber threats. The information security team carries out continuous monitoring and evaluation of Voya's technology and digital infrastructure with the goal of identifying and assessing threats and proactively mitigating potential risks. The CISO and the information security team provide regular updates to Voya's senior management, as further described under Cybersecurity Governance below.

companyName: Voya Financial, Inc.

ticker: VOYA


text: Our Company has adopted an Information Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: The CRO, Chief Information Officer ("CIO") and CISO each have over 15 years experience in managing cybersecurity, information technology and other risk management processes. The following is a summary of the CRO, CIO, and CISO's experience: • The CRO, a member of RGA's Executive Committee, has held various positions in the Company and is responsible for oversight of operational risks, which includes cybersecurity. The CRO has more than 30 years of experience and has held various positions including serving as the Company's Global Chief Risk Officer. In addition to overseeing the overall risk governance structure of RGA's Enterprise Risk Management program, the CRO has extensive experience leading a number of cybersecurity programs at the Company such as enhancing the Company's cybersecurity systems to ensure compliance with Privacy and Security Regulations. • The CIO, a member of RGA's Executive Committee, leads the strategic direction of the Company's information technology resources and management of RGA's global information technology operations. The CIO has held various positions of responsibility at other companies for all aspects of technology and he has deep knowledge in organizational change, digital transformation, core platform and data analytics modernization. • The CISO, who is responsible for implementing the Company's cybersecurity risk management strategy, oversees the Company's global security and privacy teams ensuring broad awareness of emerging risks and cybersecurity threats. The CISO has significant cybersecurity experience including executive management responsibility in cybersecurity, data privacy, operational risk management, and information technology, including regulatory compliance and risk quantification.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • the use of external service providers, where appropriate, to monitor our cybersecurity posture on a 24/7 basis in a co-managed Security Operations Center (SOC); • the design and deployment of a Defense-In-Depth layered technical security implementation leveraging best-of-breed components; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: At every regular meeting of the Technology Committee, the CISO provides the Technology Committee with updates and changes to the state, strategy and risks related to the information security program as well as other security news and topics. Further, the Technology Committee and Audit Committee receive quarterly reports from the Chief Risk Officer regarding our risk exposure related to significant information technology and information security practices.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through required policy review and trainings at the time of hire and periodically during their employment with us.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: The Advisor's Enterprise Information Security Team participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place. These processes are led by the crisis management team as outlined within the crisis management plan.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: Our CISO and CIO regularly advise the Audit Committee on cybersecurity risks and the company's cybersecurity program, including quarterly updates and comprehensive briefings to the Audit Committee annually. During these briefings, our cybersecurity leaders advise the Audit Committee regarding (i) the current threat landscape and related risks; (ii) the Company's security posture and compliance efforts; and (iii) current cybersecurity strategy and recommended next steps to address cybersecurity threats on a risk-adjusted basis.

companyName: Enpro Inc.

ticker: NPO


text: We run a third-party risk management program designed to identify and manage risks, including cybersecurity risks, involving our third-party providers. This includes performing due diligence and assessment of each provider's cybersecurity posture as well as periodic re-assessments.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: The Audit and Risk Committee periodically reviews and discusses with management the Company's policies and internal controls with respect to cybersecurity. Our Senior Group Technology Manager ("SGTM") (who has over 20 years of experience in information technology roles and holds various industry certifications) reports to the Chief Financial Officer and together report to the Audit and Risk Committee periodically on cyber security matters. The Audit and Risk Committee reports through to the Board. In addition to the annual security assessment and penetration test, the SGTM utilizes an Endpoint Detection and Response system which acts as Anti-virus and intrusion prevention system and reports all abnormalities to the SGTM. Essential Eight and Center for Internet Security Control Strategies including patch applications, multi-factor authentication, administrative privileges, application hardening and backups are performed internally via a security consultant with regular updates provided to the SGTM. Reported findings and action items are recorded and assigned to personnel for action.

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: Risks from Cybersecurity Incidents As of December 31, 2024, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. As such, we have not allocated any material capital towards addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this period. The materiality of an incident is determined by a team convened for an incident, according to guidelines set forth in our incident response policy and process documentation. We believe we are adequately insured against losses related to possible information security breaches and we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks Vista's system of internal controls includes consideration of cybersecurity risks. The Company uses technology and control procedures designed to mitigate cybersecurity risks, with our management team working to monitor, identify, assess, and respond to potential cybersecurity incidents that may threaten the Company. The system of controls also focuses on security awareness and training for employees and contractors with access to Company facilities or systems. Company management periodically reviews system and organization control reports (SOC 1, Type 2) for key outsourced information systems to ensure that third-party data processing is subject to appropriate controls and security measures. Cybersecurity risks for Vista include the potential for financial loss, loss of data, and business interruption. Vista maintains technology and non-technology-based system controls, a data backup program, and disaster recovery testing to mitigate these risks.

companyName: VISTA GOLD CORP

ticker: VGZ


text: Our Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board and the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: The Company (or the third parties on which it relies) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement sufficient controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: Typically, we (i) perform periodic tabletop exercises with a company-wide cross-functional team that is facilitated by a third-party expert and is intended to simulate a real-life security incident, (ii) conduct penetration testing as needed and annually conduct Payment Card Industry Data Security Standard testing and firewall reviews, and have periodically engaged a third-party expert to help therewith, (iii) hold annual cybersecurity awareness trainings, and (iv) periodically engage a third-party expert to conduct a review of our information security framework, which helps to identify existing and emerging risks, and mitigate against such risks. These internal efforts and external third-party reviews also support our ability to regularly assess our information security program and framework against emerging risks, market and industry developments and provide opportunities to make adjustments or enhancements when deemed prudent or necessary. To date, there have been no cybersecurity incidents that have materially affected us, or that are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Role of Management Aemetis' cybersecurity initiative is led by its Chief Financial Officer, who is in the unique position of being able to integrate cybersecurity with the financial internal control framework. He is responsible for administration of the cybersecurity and information security program and risk management, using his experience working with information technology and financial control system during a majority of his career, including over 10 years of overseeing the Aemetis information technology and security program.

companyName: AEMETIS, INC

ticker: AMTX


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO and the CISO of the Investment Adviser, manages the Company's cybersecurity program, under the supervision of the Company's Chief Executive Officer. The CCO of the Company oversees the Company's risk management function generally and relies on the Investment Adviser's CISO to assist with assessing and managing material risks from cybersecurity threats. The Investment Adviser's CISO has 23 years of experience actively managing cybersecurity and information security programs for financial services companies with complex and evolving information systems. The Company's CCO has been responsible for this oversight function as CCO of the Company for 10 years and has worked in the financial services industry for over 20 years, during which time the CCO of the Company has gained expertise in assessing and managing risks applicable to the Company.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: The Company has programs in place for the ongoing assessment of cybersecurity threats and risks, has data security programs designed to prevent and detect threats, attacks, incursions and breaches, and processes in place for the management, mitigation and remediation of potential, and any actual, cybersecurity and information technology risks and breaches. The Company maintains a robust vendor management program to oversee and identify material risks stemming from third-party service providers. Information technology staff regularly participates in relevant education opportunities and attends industry events that include cybersecurity matters. The Bank is a member of the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and is a participant in the Federal Financial Institutions Examination Council ("FFFIEC") Cybersecurity Assessment Tool ("CAT"). The Bank has plans to move to a new cybersecurity assessment tool in 2025 as the FFIEC is sunsetting the CAT. Information security training is required for all employees no less than annually.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: Our Information Technology (IT) Management team, among other things, is responsible for conducting risk assessments, designing the Information Security Program to manage identified risks based on information sensitivity and the Company's operational complexity, overseeing service provider arrangements, establishing risk-based response programs for incidents of unauthorized access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program in response to changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).

companyName: BANNER CORP

ticker: BANR


text: Identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise information technology environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry-specific threats; Performing cybersecurity risk assessments to evaluate our readiness if the risks were to materialize; Ensuring risk is addressed and tracking any necessary remediation through an action plan;

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: The IRP includes: • Identifying the incident response team (the "IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. • Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. • Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP. • Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework. Management has formed cross-functional risk and information security committees (the "Security Committees") to initiate, develop, review and implement cybersecurity policies, procedures and training to mitigate cybersecurity risks. Our information technology ("IT") cybersecurity leadership team works closely with our Security Committees and internal audit team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: The Company's Cybersecurity Plan contemplates a Company response to cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Verano Holdings Corp.

ticker: VRNO


text: The Audit Committee assists the Board of Directors in its oversight by staying apprised of our InfoSec programs, strategy, policies, standards, architecture, processes and material risks, and by overseeing response to InfoSec incidents. Our Audit Committee receives from management updates, at least quarterly, on material security risks, including any material incidents, relevant industry developments, threat vectors and material risks identified in periodic penetration tests or vulnerability scans. These updates also include material legal and legislative developments concerning InfoSec, our approach to complying with applicable law and material engagement with regulators concerning IT and InfoSec.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Chief Financial Officer and Chief Executive Officer. This team will be at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach will include regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.

companyName: Idaho Copper Corp

ticker: COPR


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. This includes scanning our internal network and infrastructure at least monthly to enhance security measures and conducting third-party vulnerability testing at minimum on an annual basis to better protect against external attacks. We also use security tools intended to protect our information systems from cybersecurity threats, and to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

companyName: Argo Group International Holdings, Inc.


text: We continually review and update our processes to safeguard our information systems. This includes the deployment of advanced security measures and regular audits. We have implemented multi-factor authentication (MFA) for email and cloud services and implement controls for incoming email to mitigate various cyber-attacks, including phishing attacks, malware, viruses and other security breaches. Additionally, we review and revise, as necessary, our incident response and disaster recovery policies on an annual basis.

companyName: Peraso Inc.

ticker: PRSO


text: The Company's Board of Directors (the "Board") has overall responsibility for the oversight of risk management at L.B. Foster Company, which includes cybersecurity risks. The Audit Committee of the Board (the "Audit Committee"), is responsible for oversight of the Company's Enterprise Risk Management ("ERM") program which provides oversight and governance of all of the Company's operational and financial risks, specifically including risks from cybersecurity threats to the Company. As described below, the Audit Committee receives regular reports and periodic briefings from senior management on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities.

companyName: FOSTER L B CO

ticker: FSTR


text: We have also extended our cybersecurity governance to our operational business executives. Mission critical information assets, those that would cause significant business, customer, or employee impact, are periodically presented by technical leadership to the appropriate senior management executive. This is a formal assessment which describes the underlying cyber posture, mitigation plan, and commitments. In addition, the Company's Privacy and Cybersecurity Steering committee, which is co-led by the CISO and the VP of Product Security and comprised of leaders from the Company's information technology, innovation, legal and internal audit organizations, meets periodically to ensure the overall Cybersecurity Program is progressing against its goals and new risks are operationally prioritized.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: The Company has not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to its business or operations. Nevertheless, there are no assurances the Company will not experience such an incident in the future. Such incidents, whether or not successful, could result in the Company incurring significant costs related to, for example, rebuilding its internal systems, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, risk of customers moving relationships with the Company to another institution, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: All third-party vendors utilized by GXO undergo a cybersecurity assessment at the time of engagement. This assessment scrutinizes the third party's cybersecurity maturity to ascertain the level of risk the third party may present to the systems and data of GXO and its customers. Additionally, these vendors' security maturity is constantly monitored via a third-party service.

companyName: GXO Logistics, Inc.

ticker: GXO


text: Effective management of risks related to the confidentiality, integrity, and availability of information is crucial in an environment of increasing cybersecurity threats and requires a structured approach to establish and communicate expectations and required practices. Northern Trust's cybersecurity and technology risk management program provides the overall structure for identifying, assessing and managing the respective risks in a sustainable manner supported by an organizational structure that reflects support from executive management and includes risk committees comprised of members from across the business. The program is supported by the Cyber and Technology Risk Management Policy approved by the Business Risk Committee. The Cyber and Technology Risk Management Policy and Framework are based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Cyber Risk Institute (CRI) Profile and provide a comprehensive overview of cybersecurity and technology risk management governance activities pertaining to the confidentiality of information, integrity of systems, data and processes, and the availability of business functions that may be adversely impacted. These governance processes, internal controls, and risk management practices, which are part of our enterprise risk management program and processes, are designed to keep risk at levels appropriate to Northern Trust's overall cyber risk appetite and the inherent risk in the markets in which Northern Trust operates. Northern Trust employees are responsible for promoting cybersecurity best practices as well as adhering to applicable policies and standards to safeguard data and business systems. In cases where Northern Trust relies on third-party vendors to perform services, controls are routinely reviewed for alignment with industry standards and their ability to protect information in accordance with Northern Trust's Third-Party Risk Management Program.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: We aim to incorporate and align with industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to identify, assess, manage, and mitigate material cybersecurity risks. These include, among other things, having mechanisms in place to detect and monitor unusual network activity, utilizing vulnerability assessment scans and tools, and conducting external and internal penetration tests and security assessments. We engage a third party expert to assist with numerous aspects of our cybersecurity program, including vulnerability assessment scans, penetration tests and security assessments. Additionally, from time to time, our internal audit function reviews and assesses various aspects of our cybersecurity program. We also engage in threat intelligence monitoring, including monitoring the dark web and zero-day vulnerability and attack information, and have processes in place to assess the potential cybersecurity impact or risk of any identified threats on our company, including potential impacts on our business partners and other parties with whom we share information. We actively engage with industry groups for peer benchmarking purposes and to stay current on best practices. We rely heavily on vendors and other third-party service providers in the conduct of our business operations, and a cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. We have further processes in place to assess the cybersecurity risks associated with our vendors and other third-party service providers, and we require such providers to take appropriate precautions to protect our data and to notify us promptly in the event of any known or suspected data breach or cyber incident.

companyName: Performant Healthcare Inc

ticker: PHLT


text: We have implemented and maintain various information security measures, processes, standards and policies, as applicable, designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, as well as the data of our users, customers, partners and employees ("Information Systems and Data"): • Risk Identification and Assessment. The Engineering Security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various internal resources as well as third-party products and services. For example, depending on the environment, system and data, we use manual and automated tools, including third-party cybersecurity software; subscription reports and services from threat intelligence service providers; scans of the threat environment; audits; and threat assessments. • Risk Management. Depending on the environment, systems and data, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, as applicable to specific environments, systems and data, our Security Incident Response Plan, our Vulnerability Management Policy, data encryption, network security controls and data segregation. • Vendor Management. We also have a vendor management program to manage cybersecurity risks associated with our use of third-party service providers, such as AWS, Oracle and Workday, to perform various functions throughout our business. The program includes risk assessments, security questionnaires and security assessment calls with vendors' security personnel as appropriate. Depending on the nature of the services provided, the characteristics of the affected Information Systems and Data, and the identity of the provider, our process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider and imposing contractual obligations related to cybersecurity on the provider. • Employee Engagement and Education. In addition to the processes and practices described above, we work to empower employees to recognize and respond to cybersecurity risks. For example, we regularly host hackathons, which encourage our Product and Engineering teams to collaborate to test creative ideas, including for security solutions. In addition to keeping employees informed about cybersecurity best practices throughout the year, our IT and Engineering Security teams host "Hacktober" each October to promote security awareness in honor of National Cyber Security Awareness Month. Hacktober consists of activities such as weekly trivia challenges to help educate employees about how they can securely access corporate systems, recognize and report phishing email attempts, and take other actions to protect Yelp. To test employee readiness, these teams also send simulated phishing emails that direct employees to additional training if they engage with the email contents.

companyName: YELP INC

ticker: YELP


text: While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches. Preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks, and the Company may not be able to implement effective preventive measures against cyber security breaches in a timely manner.

companyName: UNITED SECURITY BANCSHARES

ticker: UBFO


text: Our management team views cybersecurity risk management as an important strategic topic. Our cybersecurity strategy utilizes the cybersecurity framework developed by the National Institute of Standards and Technology ("NIST CSF"). The NIST CSF is a voluntary framework of practices to identify, protect, detect, respond to, and recover from cybersecurity risks. Using the NIST CF does not mean that we meet any particular technical standards or certifications, but rather that we use the NIST CSF to help us identify, assess, and manage cybersecurity risks relevant to our business. Using the NIST CSF, we form our cybersecurity plans and prioritize our activities using a risk-based approach which begins with the identification and evaluation of cybersecurity risks and threats that could disrupt our operations, safety procedures and regulatory compliance. Cybersecurity risks and related mitigation efforts are prioritized based on their potential impact severity, likelihood and vulnerability. Risk mitigation strategies include the application of cybersecurity policies and procedures, implementation of technology-based tools and controls, as well as employee training, education, and awareness initiatives. Our cybersecurity risk management includes ongoing monitoring of networks and systems for potential signs of suspicious activity. We track key performance indicators and cybersecurity metrics to evaluate the effectiveness of our cybersecurity safeguards and practices.

companyName: Air Transport Services Group, Inc.


text: Once the Company gathers sufficient information about a high severity incident, it is evaluated for materiality, both individually and in the aggregate with any other incidents, by a management sub-committee comprised of the President, CFO, CIO and General Counsel. This sub-committee may engage or consult with third parties. Criteria used to evaluate materiality include both quantitative and qualitative factors, including, but not limited to, financial loss, risk to reputation and competitiveness, harm to customer or vendor relationships and the potential for litigation or regulatory investigations. Incidents determined to be material will then be communicated immediately to the CEO and then to the Board of Directors after such determination and disclosed in a Form 8-K within the required timeframe upon such determination.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: Despite the Company's efforts, cyber attacks, unauthorized access, security breaches, ransomware, social engineering attacks or other cyber incidents could materially affect the Company and disrupt its business. Potential consequences of a successful cyber attack or cybersecurity incident could include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. While the Company is regularly exposed to such malicious threats, none of these threats, individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this Annual Report on Form 10-K.

companyName: LINDSAY CORP

ticker: LNN


text: We perform a formal risk assessment each year. As part of its risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process described above, including the operation of our incident response plan. As discussed above, these members of management report to the Information Technology Steering Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly. A summary report is provided to the full Board of Directors at least annually.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes, including recent cybersecurity incidents and related responses, cybersecurity testing, activities of third parties, and other similar matters. Our cybersecurity risk management and strategy processes are led by our Data Security Officer, Data Privacy Officer, Chief Financial Officer and General Counsel. Such individuals have collectively over 50 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: We maintain a technology and cybersecurity program, which includes information security, as part of our overall risk management process with the aim that our information systems, including those of our vendors and other third-parties, will be resilient, effective and capable of safeguarding against emerging risks and cybersecurity threats. We endeavor to assure our program is appropriately resourced and to attract and retain expert talent to execute it.

companyName: BIOGEN INC.

ticker: BIIB


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, threat intelligence service providers, forensic investigators, and professional services firms.

companyName: Personalis, Inc.

ticker: PSNL


text: Company believes that its cybersecurity risk is minimal. Its daily sales are recorded through a third-party point-of-sales system which is backed up daily. The Company also prints out a hard copy of the daily sales. The Company's financial information is recorded on a third-party software system and is backed up daily. If the Company were to experience a cyberattack, it would be able to use the prior day's backup and easily recreate information of the day in which there was such an attack. The Company has not experienced a cybersecurity attack as of the date of this Annual Report.

companyName: Sunstock, Inc.

ticker: SSOK


text: Our management team is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing the implementation and maintenance of our cybersecurity policies and procedures and activities carried out in furtherance of those policies and procedures. The Vice President of Information Technology leads our cybersecurity risk management efforts and helps us assess cybersecurity risks, establish priorities, and determine the scope and details of our cybersecurity program. We have identified certain members of management and relevant employees to oversee our cybersecurity incident response and vulnerability management processes.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.

companyName: DevvStream Corp.

ticker: DEVS


text: Our management team, including the Executive Vice President of Technology and Vice President of Infrastructure and Architecture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes knowledge related to information technology, cybersecurity and incidence response, risk management, control analysis and corporate governance.

companyName: Traeger, Inc.

ticker: COOK


text: Our Board of Directors has primary responsibility for oversight of our risk management efforts, with support from its standing committees. In particular, the Audit Committee of our Board assists the Board in fulfilling its oversight responsibilities with respect to our Cybersecurity Program. As part of its oversight of IT security/cybersecurity matters, the Audit Committee receives cybersecurity updates on a quarterly basis and an IT security/cybersecurity briefing from management, typically including our Vice President of Cybersecurity, on at least a semi-annual basis. At least annually, the full Board also receives updates on the Cybersecurity Program and cybersecurity risks. In addition to this regular reporting, significant cybersecurity threats or incidents may also be escalated on an as-needed basis through our organizational structure in accordance with our incident response process.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: The Company has developed a cyber incident response plan to maintain procedures and protocols for responding to incidents. The Cyber Incident Response Team ("CIRT") is comprised of all members of the Company's executive management team, the vCISO and representatives from the technology, operations, accounting, risk management, financial crimes, marketing and retail departments. During an incident response process, the Chief Administrative Officer serves as the incident manager. The Chief Administrative Officer has over 15 years of experience in leadership and management of information technology, cybersecurity, and incident response programs. In this role as incident manager, the Chief Administration Officer, in collaboration with the CIRT and external cybersecurity firms, as necessary, will assess the materiality of the breach following the incident response plan severity scale. This evaluation aims to accurately identify risks and potential operational and business impacts. Materiality determination involves an objective analysis of both quantitative and qualitative factors, including an evaluation of immediate impact on systems and critical infrastructure. The purpose of this cyber incident response plan is to ensure that the Company is prepared to manage operational and/or malicious events which may disrupt critical business processes and/or compromise the confidentiality, integrity, or availability of its data. This cyber incident response plan defines the processes the Company will follow to manage adverse security events. The cyber incident response plan also maintains procedures and protocols to escalate significant cybersecurity matters to the full board of directors and regulators, as deemed necessary. The Company's CIRT performs an annual testing exercise to evaluate its preparation and response plan in the event of an actual cybersecurity event.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: Farmer Mac has implemented a variety of processes, technologies, and controls to aid in its efforts to identify, assess, and manage cybersecurity risks. Farmer Mac's approach includes: • an enterprise risk management program that includes cybersecurity risk assessment and management and is periodically refreshed; • security reviews designed to identify risks from many new features, software, and vendors, including a security operations center to monitor our systems; • a team of trained and experienced security professionals to investigate and remediate cybersecurity incidents; • regular cybersecurity training for all employees and network users to raise and maintain awareness of cybersecurity risks and best practices; • a vulnerability management program designed to identify vulnerabilities in the systems and software Farmer Mac uses; • regular cybersecurity testing, including penetration testing on a periodic basis to allow security researchers to help identify vulnerabilities in Farmer Mac's systems before they mature into real-world cybersecurity threats; • a third-party service provider risk management program designed to identify and mitigate risks associated with third-party vendors and business partners, which includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate; • a threat intelligence program designed to model and research potential cybersecurity threat actors to identify vulnerabilities and anticipate attack vectors before they are exploited; • cybersecurity controls designed to segment access to systems and to limit access to sensitive data; and • patch management controls aimed at reducing system vulnerabilities. These processes vary in maturity across the business, and Farmer Mac works continually to improve them.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: The Board, as a whole, has oversight responsibility for our strategic and operational risks. The Board is responsible for oversight of our efforts to eliminate cybersecurity risks. The Board meets regularly with our Chief Executive Officer and Chief Financial Officer.

companyName: MedWellAI, Inc.

ticker: MWAI


text: Given our company's small size, limited staff, and minimal resources, we have not yet developed or implemented specific cybersecurity risk management programs to safeguard the confidentiality, integrity, and availability of our essential systems and data. Currently, the security of our information is managed by Koichi Ishizuka, our sole officer and director.

companyName: Japan Food Tech Holdings, Inc.


text: The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. Our cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: On July 19, 2024, the Company experienced customer facing systems disruption resulting from the CrowdStrike-caused outage. Upon detecting the event, the Company took immediate steps designed to mitigate the impact of the incident and implement its business continuity plans to restore and support customer operations. The majority of client facing systems were restored within 24 hours and all affected systems were fully restored in fewer than three calendar days.

companyName: Veradigm Inc.


text: Board of Directors The Audit Committee oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in the Company's disclosure controls and procedures. The Company's Head of Information Technology ("Head of IT") provides reports on cybersecurity matters, including material risks and threats, annually or more frequently as appropriate to the Board, including to the Audit Committee.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: Further, as part of our cybersecurity risk management processes, we maintain an incident response plan (IRP) that establishes a set of procedures for reporting and handling cybersecurity events. The IRP delegates to an internal incident response team the initial assessment, investigation and remediation of the event and includes, among other procedures, guidelines for escalation to senior management and engagement with law enforcement. In certain instances, events are escalated to the Cybersecurity Incident Disclosure Subcommittee, which is a subcommittee of the Company's Risk Management Committee (RMC) (discussed further below) and is responsible for, among other things, the accurate and timely disclosure of material cybersecurity incidents under the federal securities laws, including making the materiality determination and approving related securities disclosures.

companyName: Walt Disney Co

ticker: DIS


text: Our IT systems have faced a variety of phishing, denial-of-service and other attacks. Although we have not identified any cybersecurity incidents during the fiscal years covered by this report that have materially affected or are reasonably likely to materially affect our business strategy, consolidated results of operations or consolidated financial condition, we can provide no assurance that our security measures will be successful and therefore we may experience a cybersecurity incident that materially affects our business strategy, consolidated results of operations, consolidated financial condition or reputation, including, but not limited to those described above. For more information about the cybersecurity risks we face, see Item 1A – Risk Factors.

companyName: KB HOME

ticker: KBH


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Advisor routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Advisor and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Advisor uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See " Item 1A–Risk Factors – Our business could suffer in the event our Advisor or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."

companyName: Franklin BSP Real Estate Debt BDC


text: Risk Management and Strategy City Office REIT recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: City Office REIT, Inc.


text: We have experienced, and may in the future experience, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition to date, and although our processes are designed to help prevent, detect and mitigate the impact of such incidents, we cannot guarantee that a future security incident would not materially affect our strategy, results of operations or financial condition. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this 10-K.

companyName: COMSCORE, INC.

ticker: SCOR


text: Our Director of Information Technology has thirty years of experience in information technology, which includes the past nineteen years managing Intrepid's information technology infrastructure, business applications, compliance programs, and cybersecurity systems. Although our management team and Audit Committee receive information regarding our cybersecurity program and help assess our strategy based on their knowledge of our business and industry, no member of the management team or Audit Committee has technology or cybersecurity expertise. Certain members of the Audit Committee have experience with cybersecurity programs and implementing cybersecurity procedures as leaders of businesses and through their service on other boards. Risks from cybersecurity threats have not materially affected our company, including our business strategy, results of operations, or financial condition. While we believe our approach to cybersecurity is reasonable, given the rapidly evolving nature of cybersecurity incidents, there can be no assurance that the controls we have designed and implemented will be sufficient in preventing future incidents or attacks.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: Suppliers that have access to, host, or transmit The Cigna Group data are contractually required to comply with our Security Policies and Standards. Additionally, suppliers may be subject to periodic security audits or risk assessments, which include security questionnaires, security capabilities and maturity assessments, controls evidence reviews, application vulnerability assessments, public internet presence monitoring, and alignment reviews with service-specific industry standards (e.g., NIST, ISO, HIPAA, and Payment Card Industry standards). Follow-up activities are performed as needed to discuss observations, track issues and ensure remediation plans are completed to maintain compliance. Contracts with suppliers also include critical security requirements including right to audit, technology requirements, key performance metrics and service levels, and hiring practices including background checks for those who have access to The Cigna Group's network.

companyName: Cigna Group

ticker: CI


text: The ISO is responsible for overseeing a company-wide information security strategy, including policy, standards, architecture, and processes, and managing many of the security services that run on personal computers and servers. The Audit Committee meets with the ISO at least annually to review and discuss the Company's cyber risks and threats, incident responses, technology, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: The Trust relies on the Sponsor to engage external experts, such as cybersecurity assessors, consultants, and compliance professionals, to review the cybersecurity measures and risk management processes. These third parties are engaged on an as-needed basis, with some hired on an ongoing basis as managed service providers.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management efforts are led by our Information Technology Director, who oversees our cybersecurity activities and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our ISMS. The Information Technology Director reports to the audit committee of our Board with respect to emerging cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. Our Information Technology Director and our Chief Financial Officer are ultimately responsible for the implementation of our cybersecurity risk management processes. To facilitate effective oversight, they hold discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging cybersecurity risks. They have experience managing enterprises relying on technology and business systems with cybersecurity risks and consults with trusted advisors where appropriate.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: The information technology systems we rely upon to effectively manage our business data, communications, supply chain, order entry and fulfillment, and other business processes are subject to risk from security breaches and other significant disruptions. Such breaches and disruptions may occur through breaches by our personnel or by intrusions over the Internet, malware, computer viruses, attachments to e-mails or by persons with whom we have commercial relationships. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See "Item 1A. Risk Factors— We are subject to cyber security risks and may incur increasing costs in an effort to minimize those risks".

companyName: Freshpet, Inc.

ticker: FRPT


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. As such, the Company engages third-party consultants and independent auditors to conduct penetration tests, cybersecurity risk assessments, external audits, and program development and enhancement where applicable.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: Based on the information available as of the date of this Annual Report on Form 10-K, we believe that risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, there can be no guarantee that we will not be the subject of future successful cybersecurity attacks, threats or incidents that may materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in "Item 1A Risk Factors" of this Annual Report.

companyName: Enact Holdings, Inc.

ticker: ACT


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management is required to update the Committee where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: Effect of Cybersecurity Threats As of the effective date of this filing, the Company is currently not aware of any known or potential cybersecurity threats that are reasonably likely to materially affect the Company's business strategy, results of operations, or financial conditions. Although the Company believes it has implemented sufficient security measures to protect against cyber-attacks, unknown cyber incidents could materially disrupt the Company's operations or compromise sensitive information.

companyName: SpartanNash Co


text: Our information security program encompasses policies and controls aimed at mitigating cybersecurity risks, including an incident response plan that includes procedures for assessing and responding to cybersecurity incidents. However, we acknowledge the presence of both known and unknown risks, alongside vulnerabilities within our security program. Continuous improvement efforts are integral to enhancing our information security program and overall risk management endeavors.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: One of the key functions of our board of directors is risk oversight, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly and through the audit committee.

companyName: VERU INC.

ticker: VERU


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee biannually reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports its findings to the full Board of Directors. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the heads of the IT Security and Internal Audit departments on a regular basis, typically biannually. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks, also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal Officer, may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.

companyName: SYNAPTICS Inc

ticker: SYNA


text: Management's Role in Cybersecurity Risk Management. Our management is responsible for assessing and managing our material risks from cybersecurity threats. The CISO, CTO, and Chief Ethics, Compliance and Risk Officer work collaboratively across the company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CTO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee and Compliance and Quality Committee when appropriate.

companyName: agilon health, inc.

ticker: AGL


text: We provide periodic mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. We additionally publish an internal newsletter on a monthly and ad-hoc basis for enterprise-wide consumption to promote awareness of trends in cybersecurity threats and attack techniques.

companyName: BOYD GAMING CORP

ticker: BYD


text: Members of senior leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan. Additionally, all employees are required to complete annual information security and privacy training, which are reviewed and updated annually. They also receive ongoing security awareness education via informational emails, talks and presentations, and resources available on our intranet.

companyName: DROPBOX, INC.

ticker: DBX


text: The Corporation leverages regular assessments to identify current and potential threats and vulnerabilities within the Corporation's environment, using vulnerability scanning tools, penetration testing, system management tools, and process and procedural reviews. The Corporation conducts a variety of assessments throughout the year, both internally and through third parties.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CISO holds industry-recognized cybersecurity certifications, including having held Certified Information Systems Security Professional (CISSP) certification.

companyName: FLEX LTD.

ticker: FLEX


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from the Health Information Sharing and Analysis Center and other governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Oscar Health, Inc.

ticker: OSCR


text: Flywire recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our and our client's data.

companyName: Flywire Corp

ticker: FLYW


text: We perform specific cybersecurity risk assessments, which are informed by our ongoing vulnerability assessments, external penetration testing and cybersecurity maturity assessments, among other items. Additionally, cybersecurity and IT is also an element of the ERM assessment performed by management on an annual basis, with quarterly reassessments, under the supervision of the Audit Committee and Board of Directors.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: Additionally, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and reports cybersecurity incidents that reach designated thresholds to senior management and, if necessary, to the Governance and Nominating committee. Our CISO has been with the Company since 1997, has held numerous roles in information technology and has led the information security program since 2016. Our CITO, to whom the CISO reports, has been with the company since 2017 and has served as the Company's CITO since 2023.

companyName: TYSON FOODS, INC.

ticker: TSN


text: The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: Processes for the Identification, Assessment, and Management of Material Risks from Cybersecurity Threats Although Global Payments is unable to eliminate all risks associated with cybersecurity threats, and we cannot provide full assurance that our cybersecurity risk management processes will be fully complied with or effective, we have adopted policies and procedures that are designed to facilitate the identification, assessment, and management of those risks, including any such risks that have the potential to be material.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Our cybersecurity risk management program applies information and direction from industry-recognized cybersecurity frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 (CSF), specifically the NIST 800-171, the Department of Defense Cybersecurity Maturity Model Certification (CMMC) Level 2, Sarbanes Oxley (SOX), and Services Organization Controls (SOC) 2. Third-party risk is managed through vendor assessments and SOC 2 report requests, designed to ensure that our partners adhere to strict cybersecurity standards.

companyName: Genasys Inc.

ticker: GNSS


text: Our Board of Directors is responsible for overseeing cybersecurity risk, primarily through the Audit Committee. Cybersecurity reviews by the Audit Committee and the Board of Directors are scheduled to occur at least quarterly and annually, respectively, or more frequently, as deemed necessary or advisable. Such presentations to the Audit Committee and Board of Directors, as applicable, are made by our COLO and Global CISO, utilizing performance metrics established by CDRM and reported through the ERM framework, and address topics such as cybersecurity threats, incidents, risks, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, and regulatory developments. At times, the Audit Committee may receive additional cybersecurity risk reviews from other members of management and/or internal cybersecurity experts on certain of our key business segments and products. The Audit Committee regularly reports to our Board of Directors regarding the committee's oversight of such cybersecurity matters. Additionally, the COLO and Global CISO may provide ad hoc updates to the Board of Directors and/or the Audit Committee if necessitated by a security incident or other significant developments.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares reporting channels and governance processes that apply across the risk management program to other legal, compliance, operational and financial risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). A dedicated Office of the CISO, which reports to the CIO, is responsible for developing enterprise-wide cybersecurity strategy, architecture, policies, processes, and controls, and is directly responsible for our cybersecurity program. Our cybersecurity team members have extensive information technology and program management experience. The CIO and/or CISO personnel regularly inform the Chief Executive Officer (CEO) and other members of senior management about the program, best practices, current cybersecurity threats, the risk landscape, and mitigation approaches.

companyName: BRUNSWICK CORP

ticker: BC


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: We do not have any in-house servers or systems. An integral part of our cybersecurity is the security built into this third-party software operated by large corporations such as Microsoft. Our control system, therefore, includes the review of annual Service Organization Controls reports in order to annually assess the controls of these software systems. To date, we have not experienced any material cybersecurity incidents.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: Our Vice President, Cybersecurity has extensive experience assessing and managing risks from cybersecurity threats, including more than 20 years of experience in information technology and information security positions; serving in information technology leadership positions at the Company for more than 7 years; and has other significant experience in the areas of risk management, information technology and information security, including the following industry certifications: MCSE, MCDBA and CISSP.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: The Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: e. Review and approve new, and modifications to existing, information security policies for which the ISSB has been designated approval authority by the ERM Committee. Existing information security policies are reviewed at least annually.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Employee Awareness and Training: We implement comprehensive cybersecurity and data privacy training programs to enhance employee awareness of cyber risks and reinforce secure operational practices.

companyName: Korth Direct Mortgage Inc.


text: For the fiscal year ending June 30, 2025, the Company had no cyber events requiring disclosure on Form 8-K, Item 1.05 as required under the Securities Exchange Act, Regulation S-K, Item 106.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Although we take reasonable and effective measures to ensure the protection of any data that is stored, processed, or transmitted through our systems, we know that attackers have the means, motives, and opportunities to attack. As of the date of this filing we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In addition, we maintain controls and procedures that are designed to ensure prompt escalation of critical cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. Please refer to "Item 1A. Risk Factors" for further information about the material risks associated with various cybersecurity threats.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: The Cybersecurity Committee responsibilities include: • reviewing our enterprise cybersecurity strategy and framework, including our assessment of cybersecurity threats and risk, data security programs, and our management and mitigation of cybersecurity and information technology risks and potential breach incidents; • reviewing any significant cybersecurity incident that has occurred, reports to or from regulators with respect thereto, and steps that have been taken to mitigate against reoccurrence; • evaluating the effectiveness of our cyber risk management and data security programs measured against our cybersecurity threat landscape; • assessing the effectiveness of our data breach incident response plan; • reviewing and assessing our information technology disaster recovery capabilities; and • reviewing our assessment of cybersecurity threats and risk associated with our supply chain and actions we are taking to address such threats and risks.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Depending on the results of the assessments and the sensitivity of the respective environments and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident response plan, vulnerability management standard, disaster recovery and business continuity plans, risk assessments, encryption of certain data, segregation of certain data, network security and access controls in certain environments, asset management, systems monitoring in certain systems, vendor risk management program, employee training, penetration testing, and cybersecurity insurance.

companyName: Sprinklr, Inc.

ticker: CXM


text: Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity risk management program is embedded in its three lines of defense model.

companyName: ECA Marcellus Trust I

ticker: ECTM


text: A cybersecurity incident may be detected in a number of ways, including, but not limited to, through automated reporting mechanisms, network and system indicators, intrusion detection systems, internal investigations, employee reports, law enforcement reports, or other third party notification. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Company maintains a security operations center with round-the-clock monitoring, and the CIO receives regular reports on industry activity.

companyName: UNITED STATES STEEL CORP


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information and maintaining operational resilience. We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: Recognizing the importance of continuous security awareness, the Company provides comprehensive employee training. This includes mandatory cybersecurity and fraud training at onboarding, monthly email phishing tests, and annual computer-based training.

companyName: California BanCorp \ CA

ticker: BCAL


text: Before purchasing third-party technology or other solutions and partnerships that involve exposure to the Company's assets and electronic information, our Information Security and Privacy team undertake due diligence to assess any key data privacy or information security risks.

companyName: TripAdvisor, Inc.

ticker: TRIP