text: We have developed and implemented an enterprise-wide cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access; protection of confidential, personal, or sensitive information; cyber threat detection, assessment, and response; and continuous improvement of our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged approach to address cyber threats and incidents that includes implementation of various industry best practices, proactive monitoring of our IT systems, ongoing employee training, and regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: Board Oversight of Cybersecurity Risks The Company's Board of Directors is primarily responsible for overseeing the Company's management of cybersecurity risks. The Company's CCO, consults with the Advisor's CTO and COO to develop cybersecurity updates that the Company's CCO, along with the Advisor's CTO, delivers periodically to the Board of Directors on topics including: • Updates on the Advisor's cybersecurity program as it impacts us. • The effectiveness of the Company's cybersecurity program. • Current and emerging cybersecurity threats. • Significant cybersecurity incidents impacting the Company and its operations.

companyName: 5C Lending Partners Corp.

secItem: Item 1C


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Board receives regular reports from management about the prevention, detection, assessment, mitigation, and remediation of cybersecurity risks and incidents, including analysis of material security risks or information security vulnerabilities. Our Audit Committee directly oversees our Information Security Program. The Audit Committee is composed of Board members with a broad range of expertise, including risk management, technology, and finance experience, which provides them with the necessary qualifications to effectively oversee cybersecurity risks. The Audit Committee receives on a quarterly basis, or as needed, comprehensive updates from management on cybersecurity risks, including risk assessments, cybersecurity maturity assessments, progress of risk reduction initiatives, enhancements to cybersecurity programs and initiatives, business continuity planning, PCI compliance, any relevant internal or industry cybersecurity incidents, and compliance with regulatory requirements and industry standards, as applicable.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: Our risk management approach and processes for cybersecurity extend to assessing and managing risks from cybersecurity threats associated with our use of third-party service providers, by employing vetting processes, including the conducting of security assessments and monitoring activities, to verify that third-party service providers adhere to our policies and contractual requirements.

companyName: ROSS STORES, INC.

ticker: ROST


text: The Board has ultimate oversight of cybersecurity risk and our CISO provides periodic reports and updates concerning our cybersecurity program to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Cybersecurity reports to the Board generally occur at least annually, with updates as deemed necessary by our CISO, senior management, or as required by our Incident Response Plan. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information network and data security, assessments of the information security program, and the emerging threat landscape.

companyName: Trinseo PLC

ticker: TSEOF


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any notable incidents with lesser impact potential.

companyName: Beachbody Company, Inc.

ticker: BODI


text: Our management team, in conjunction with third-party IT and cybersecurity service providers is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team have prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our Audit Committee assists management in oversight and administration of our cyber risk management program.

companyName: AIM ImmunoTech Inc.

ticker: AIM


text: Our Company Board plays a role in overseeing risks associated with cybersecurity threats. The Audit Committee of the Board has been provided specific responsibility for overseeing the Company's risk management of cybersecurity. The Audit Committee has appointed a member of the Audit Committee to receive certified cybersecurity training so he can provide specialized guidance to the Board and Company.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Cybersecurity risk is a key operational risk facing the firm, and measures to address such risk are an important component of the firm's overall Enterprise Risk Management ("ERM") program. As part of our ERM program, we have implemented and maintain a program to identify, assess, and manage risks arising from cybersecurity threats ("Cybersecurity Program"). Our Cybersecurity Program seeks to mitigate cybersecurity risk and associated legal, financial, reputational, regulatory and/or operational risks by protecting our clients, associates, and services through a comprehensive, cross-functional approach. Specifically, our Cybersecurity Program is focused on preserving the confidentiality, integrity, and availability of information, enabling the secure and uninterrupted delivery of financial services, and protecting the firm and the safe operation of our technology systems. Further, we consider cybersecurity risks in our business strategy decisions, including in our business continuity planning and in connection with our acquisition activity. We seek to continually adjust our Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory requirements.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Despite our diligent efforts to secure our systems and data, we acknowledge that no cybersecurity measures can completely eliminate the risk of cyber incidents. The evolving nature of cyber threats means that we must continually adapt our cybersecurity strategies to address new and emerging risks.

companyName: AppTech Payments Corp.

ticker: APCX


text: Assessing, identifying and managing cybersecurity-related risks are also integrated into our overall enterprise risk management ("ERM") process. Cybersecurity-related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM annual risk assessment is presented to the Board, with additional reporting during the year to the Nominating, Governance and Risk Committee.

companyName: INSULET CORP

ticker: PODD


text: Notwithstanding our defensive measures and processes, the threat posed by cyber–attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. See Item 1A. Risk Factors for further discussion of risks related to cyber security. HORIZON BANCORP, INC.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail a series of questions. These questions are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.

companyName: FNB CORP/PA/

ticker: FNB


text: Our information security function and our Vice President of Information Technology help identify, assess and manage the Company's cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: As part of our overall risk management strategies, we also conduct cybersecurity trainings for personnel at all levels and in all departments.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – We may be subject to information technology system failures, network disruptions, cyber-attacks or other breaches in data security." in this Form 10-K.

companyName: PHX MINERALS INC.


text: Through the RAP, which is a tool in our ERM program, we identify and assess cybersecurity risks at an operating company level, evaluating the likelihood and potential impact of a risk universe encompassing finance, human capital, operations, information technology, legal and regulatory compliance, and strategy. Risks are individually analyzed from both inherent and residual perspectives, considering existing controls and mitigation processes in place. The businesses leverage the results from the assessment process to identify and implement efforts to further mitigate risks. Progress on mitigation projects is monitored and regularly reported to leadership as part of the RAP. In addition to our ERM and RAP, we have a cybersecurity program led by our Chief Information Officer ("CIO"), who reports to our Chief Financial Officer. Our current CIO has over 20 years of experience with large global companies where he worked extensively in providing strategic IT leadership and management in the areas of digital transformation, cybersecurity, risk management and ERP implementation. Our CIO oversees our Information Security department, chairs the Vontier Information Security Executive Committee ("VISEC"), which includes cross-functional leaders from finance, internal audit, information security, information technology, and legal and corporate affairs, and works with the businesses to conduct enterprise product security assessments, perform penetration testing and advance our cybersecurity policies and procedures. We have developed information security policies and standards informed by the NIST Cybersecurity Framework, an internationally recognized framework; and we engage with third parties on our incident response processes, cybersecurity maturity assessment, as well as on our cyber security awareness, data security governance and vendor cyber risk management. Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Additionally, we review our cybersecurity maturity assessment on an ongoing basis to measure the Company's ability to detect, protect, respond and recover from a cyber incident.

companyName: Vontier Corp

ticker: VNT


text: The Company's Vice President of IT, Randall Anderson, in coordination with the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Company maintains a cyber incident response plan to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. The response plan covers preparation, detection and analysis, containment and investigation, notification (which may include timely notice to the Board if deemed material or appropriate), eradication and recovery, and incident closure and post-incident analysis. The Company retains a third-party cyber security firm to leverage in the event of a cyber security incident. The Company's response planning is reviewed annually and kept up to date with industry developments. The scope of this plan is enterprise-wide and includes the Company's business units and subsidiaries. Through ongoing communications with management, the Company's Vice President of IT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item IA,, "Risk Factors - "A breach of our IT or physical security systems, or violation of data privacy laws, may cause us to incur significant legal and financial exposure and adversely affect our operations."

companyName: FLEX LTD.

ticker: FLEX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including outside legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: For many vendors for the Company, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports, to support our assessment of our vendors' security practices. In collaboration with the National Association of Broadcasters, North American Broadcasters Association, and risk management vendors, we are also working to assemble broadcaster-specific guidelines for information technology vendor selection.

companyName: GRAY MEDIA, INC

ticker: GTN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, data encryption, network security controls, employee training, access controls, physical security, systems monitoring, and asset management, tracking, and disposal.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: The Company maintains a governance structure to address cybersecurity risk, which involves the Board, the Audit Committee, the Company's Director of Information Technology, and a dedicated Incident Response Team.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: While we have not yet experienced any material impacts from a cyber attack, any one or more future cyber attacks could materially adversely impact the Company, including a loss of trust among our customers and consumers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands. In addition to the risk management processes identified above, Whirlpool also maintains active knowledge security and data privacy programs. Leveraging policies and governance, ongoing training and awareness as well as strong controls and systems-based approaches, these programs help ensure that Whirlpool confidential information is protected and that the company complies with applicable data privacy and data protection laws in all countries where we do business.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Our Board of Directors' Audit Committee is responsible for overseeing our cybersecurity risk management and strategy. The Company's Director of IT Operations reports to the Audit Committee and other members of management on at least a quarterly basis on cybersecurity risks. These reports provide a comprehensive view of the Company's cybersecurity program, including recent developments, cybersecurity strategy, ongoing assessments of the Company's security posture and cyber threats and risks, results of third party audits and testing, policy and procedure updates, security upgrades and initiatives, risk mitigation strategies, and employee training programs. Under the Company's cybersecurity Incident Response Plan, the Audit Committee and executive management also receive prompt information regarding any incidents that may meet established reporting thresholds, as well as ongoing updates regarding any such incident until it has been fully resolved.

companyName: Telesis Bio Inc.


text: Our CISO's team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. The CISO receives ongoing updates from his team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: AECOM

ticker: ACM


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: We have used a cybersecurity threat defense system to address both internal and external threats. This system encompasses various levels, including network, host and application security and incorporates systematic security capabilities for threat defense, monitoring, analysis, response, deception and countermeasures.

companyName: Ezagoo Ltd

ticker: EZOO


text: Given the limited nature of its operations and reliance on third-party service providers for professional services, the Company has concluded that it is not materially exposed to cybersecurity threats. To date, the Company has not experienced, nor does it anticipate, any cybersecurity incidents that would materially affect its business, financial condition, or results of operations.

companyName: CANNABIS SUISSE CORP.

ticker: CSUI


text: Our approach to cybersecurity begins with our desire to maintain strong governance and controls to effectively manage and reduce security risks. Security begins with our "tone at the top", where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. The cybersecurity program is led by Crane's Chief Information Security Officer, who provides periodic updates to the Audit Committee of our Board of Directors, annual updates to the full Board of Directors, and regular reports to the executive management team about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. The entire Board of Directors ultimately is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks, including cyber risks. The Company maintains cyber risk and related insurance policies as a measure of added protection.

companyName: Crane Co

ticker: CR


text: We assess the security of our networks, websites, and systems with automated vulnerability detection services from a provider that is validated by the NIST, based on the Security Content Automation Protocol ("SCAP") standard. We perform an annual review of our efforts to manage risk with controls that align with and map to key compliance frameworks, such as NIST and the ISO 27000 series of regulations. We perform quarterly IT risk assessments that include cybersecurity risk assessments focused on action plans developed through annual reviews. We also respond to risks as they are discovered real-time. We are guided by an Information Security Incident Response Policy and corresponding Information Security Incident Response Procedure we implement when handling IT security incidents.

companyName: ALAMO GROUP INC

ticker: ALG


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Callaway Golf Co

ticker: CALY


text: We have adopted a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents. The plan specifies the process for identifying, validating, classifying, documenting, and responding to cybersecurity events as well as determining whether reporting of an event is appropriate under regulatory standards. The plan also includes a materiality assessment framework that sets forth procedures to support our assessment of whether a security incident is "material" under the federal securities laws. Internal reporting and escalation protocols are in place to ensure the involvement of the CISO, other senior leaders, and the Audit Committee, as appropriate. Under the plan, we regularly conduct tabletop exercises to test our preparedness and our incident response process, and we provide ongoing training.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Report: Establish and monitor an incident response approach requiring our Chief Financial Officer to report to us, the full Board of Directors, and legal counsel any cybersecurity concerns or events.

companyName: Kun Peng International Ltd.

ticker: KPEA


text: To date, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation, interfere with the progress of our clinical trials, interfere with our efforts to pursue regulatory approvals for our product candidates, or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. We have attempted to preemptively mitigate the financial impact of any cybersecurity incident and currently maintain a cyber liability insurance policy. However, our cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations. For further information regarding risks from cybersecurity threats, please refer to "Item 1A. RISK FACTORS—Risks Related to Our Business".

companyName: Pulmatrix, Inc.

ticker: PULM


text: We assess the integrity of our information technology and cybersecurity platforms to help ensure proper safety measures are implemented. We understand the extensive responsibility associated with safeguarding our systems and data. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include:

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See "Risk Factors – We face risks associated with perceived or actual security breaches through cyberattacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems or those of our critical service providers."

companyName: KILROY REALTY CORP

ticker: KRC


text: We continually seek to improve our cybersecurity posture, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts as needed to evaluate the efficacy of our security measures. We engage reputable third-party tools and products to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: FIS remains focused on making additional strategic investments in information security to protect our clients and our information systems from risks from cybersecurity threats. This includes both capital expenditures and operating expenses on hardware, software, staff and consulting services. These investments in the past have been and are reasonably likely to continue to be material to our results of operations. Further, notwithstanding our investments and other processes and efforts described above and elsewhere in this Annual Report on Form 10-K, we cannot guarantee that FIS will not be the subject of a cyberattack that would have a material effect on its financial condition or results of operations. See "Risk Factors" in Item 1A.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: Risk Management and Strategy one of the elements of our overall risk management program, we focus on the following key areas: Technical Safeguards: We have commenced to implement technical safeguards, including but not limited to firewalls, anti-malware functionality and access controls.

companyName: AVAX ONE TECHNOLOGY LTD.

ticker: AVX


text: Our ISO and Management Committees are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist our Information Security Team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our ISO oversees the implementation of and the processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the Information Security Incident Response Plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.

companyName: River Financial Corp

ticker: RVRF


text: Risk Management and Strategy Liberty Broadband's corporate level Information Technology ("IT") and cybersecurity functions are provided by Liberty as part of the services agreement described in Part I, Item 1. "Business." Through the services agreement, we participate in Liberty's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate headquarters, as detailed below. GCI operates its own cybersecurity function with oversight from Liberty Broadband.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: The Company engages in the occasional assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. The results of such assessments, audits and reviews are reported to management and the Board when necessary, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: As a key supplier to in the semiconductor ecosystem, security and risk management of our technology systems and processes is critical to ensuring our ability to serve our customers without interruption.

companyName: ENTEGRIS INC

ticker: ENTG


text: Incident Monitoring and Response. We have 24x7 security cybersecurity monitoring, which utilizes both third-party cybersecurity experts and leading tools to monitor activity in our information systems. We also maintain an incident response plan and playbooks that define our response to a cybersecurity incident, including a cross-functional incident response process that includes key stakeholders such as senior leaders and legal, and leverages our technological resources and third-party service providers. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to leadership when appropriate pursuant to internal guidelines governing the reporting of such events.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Reporting to Board of Directors The VP of IT Security, in his capacity, regularly informs the CIO, Chief Financial Officer ("CFO") and other executive team leaders of aspects related to cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors where appropriate.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: The response plans referenced above define a cross-functional cyber incident response team (the "CIRT") that includes members of senior management, including the CISO and CIO, among other skilled employees. The CIRT plays an important role in the detection, mitigation, and remediation of cybersecurity incidents and in informing relevant members of management and the audit committee on cybersecurity threats and events. Select members of the CIRT actively participate in regular technical readiness exercises. Moreover, our executive officers participate in annual crisis tabletop exercises and attack simulations to prepare for a swift, effective, and thorough response to a potential cybersecurity incident.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: We are aware of the increasing risks associated with third-party service providers and have implemented processes to oversee and manage these risks. Prior to engaging with third-party providers, Ball conducts thorough security assessments and also performs ongoing monitoring to ensure compliance with our cybersecurity standards. Third-party cyber incidents follow our incident response plan and processes, including full assessment and remediation. Our oversight of third-party cyber risk aids our ability to lessen and mitigate impacts related to data breaches and other security incidents originating from third-parties.

companyName: BALL Corp

ticker: BALL


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and public cloud providers, as well as various third-party suppliers that support our manufacturing and development processes. We use certain vendor management processes to manage cybersecurity risks associated with our use of these providers, which includes reviewing the written information security programs of certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: As part of our overall enterprise risk management strategy, our cybersecurity processes seek to help the Company prevent or mitigate potential cybersecurity incidents, and to detect and remediate them quickly when they occur. To achieve this, the Company uses a broad selection of security tools and methodologies to assess, identify and manage material risks from cybersecurity threats.

companyName: SEMTECH CORP

ticker: SMTC


text: Our information security team maintains an extensive governance network, including formal relationships with other organizations within Accenture through our Situation and Action Committee, which includes representatives from our Markets and Services and the legal, information technology, corporate services and sustainability, data privacy and business resilience services teams. In addition, our cyber incident response efforts are overseen by a cross-functional leadership team including our CISO, our General Counsel and our Chief Marketing Officer.

companyName: Accenture plc

ticker: ACN


text: We engage with external resources to contribute to and provide independent evaluation of our cybersecurity practices, including a periodic assessment of our cybersecurity program that is performed by a third party. Our cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. Our management team, through consultation with our Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO"), and the Audit Committee of our Board, use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify cybersecurity threats and protect against, detect, respond to and recover from cybersecurity incidents.

companyName: Marathon Petroleum Corp

ticker: MPC


text: We continually seek to update our IT security, encompassing end-user training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting, and engagement with third-party experts to evaluate the efficacy of our security measures. We engage reputable third parties to assist in the monitoring, protection, detection, and potential remediation of cybersecurity threats and incidents. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity preparedness. Risks from cybersecurity threats, including as a result of previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, have not materially affected, and are not currently viewed as reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: Jack Henry relies on third-party service providers to deliver services and products to our clients, and we evaluate and attempt to mitigate the cybersecurity risks associated with the use of these third-party service providers. We conduct evaluations and risk assessments of third-party service providers prior to engagement and on an ongoing periodic basis to ensure our standards for security are maintained. Our strategic risk management committees review and address any identified risks.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of IT systems and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.

companyName: Sabine Pass Liquefaction, LLC


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, including through attending educational programs and monitoring alerts from third-party vendors and government agencies. The CISO implements and oversees processes for the regular monitoring of our information systems. In the event of a cybersecurity incident, the CISO is equipped with a written incident response plan.

companyName: Brookdale Senior Living Inc.

ticker: BKD


text: The CyTOC receives regular updates from our CISO, Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, and other members of management on risks related to these matters. Specific topics may include updates to FedEx's cyber risks and threats, the status of existing or new strategies and associated projects intended to strengthen FedEx's information security systems, assessments of FedEx's cybersecurity program, and the emerging threat landscape. The CyTOC also receives regular updates on key metrics related to our cybersecurity-related risks. The results of the IT risk management process are also presented annually to the CyTOC. Additionally, members of the CyTOC participate in certain of the simulation exercises conducted by management. The Chair of the CyTOC briefs the full Board on certain of these matters. In addition, the Board periodically receives cybersecurity updates directly from management. Separately, through our ERM program, risks appropriate for Board-level awareness, including with respect to cybersecurity, are communicated to the Board and its Audit and Finance Committee at least annually, while significant risks are reported on a quarterly basis.

companyName: FEDEX CORP

ticker: FDX


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Emeren Group Ltd


text: Through a combination of these technical, procedural, and educational measures, our program is designed to detect and respond to cybersecurity threats effectively and thereby safeguard our business operations and sensitive information.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. On an annual basis, management provides the Audit Committee with an overview of our cybersecurity threat risk management and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk mitigation related goals, our incident response plan and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also receives materials, including a cybersecurity briefing, indicating current and emerging cybersecurity threat risks and describing the Company's ability to mitigate those risks.

companyName: AMEDISYS INC


text: As of the date of this report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For a discussion of the risks and uncertainties that cybersecurity incidents may have on us, see "Risk Factors: Information systems failure or disruption, due to cyber terrorism or other actions, may adversely impact our business and result in financial loss to the Company or liability to our customers" in this Form 10-K.

companyName: Ingersoll Rand Inc.

ticker: IR


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems. For example, third parties conduct assessments, such as vulnerability scans, penetration testing, and overall risk assessments, and third-party tools are utilized to identify potential vulnerabilities. The Company employs a variety of processes to address cybersecurity threats related to third-party technology and services, including privacy, solution and vendor risk assessments, imposition of contractual obligations, and performance monitoring. The Company also currently relies on services provided by Kellanova, under the Transition Service Agreement.

companyName: WK Kellogg Co


text: The Company has a dedicated cybersecurity incident response team, overseen by Cybersecurity Leadership, which is responsible for managing and coordinating the Company's cybersecurity incident response plans and efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks potentially material cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, government agencies, regulators, law enforcement, vendors, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board as appropriate. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide training for the participants and to help the Company assess its processes and capabilities in addressing major cybersecurity incidents.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: DFIN engages assessors, consultants, auditors and specialized third parties to enhance the Company's cybersecurity posture. These collaborations provide evaluations, audits and insights to fortify DFIN's resilience against evolving cyber threats. The DFIN Cybersecurity Program is based upon industry leading frameworks, which include International Standardization Organization ("ISO") 27001, Control Objectives for Information Technology (COBIT). The Company's technologies and software must also comply with domestic and international regulatory and legal requirements. Ensuring that these technologies and software comply with those regulations is a key focus of the Company's efforts. DFIN has cyber incident response partners that conduct penetration testing and other exercises throughout the year whereby cybersecurity controls effectiveness is evaluated and reported to management. DFIN engages a third-party auditor to ascertain its cybersecurity risk management effectiveness as a part of its enterprise ISO 27001 certification process. The ISO 27001 certification process is highly proscribed and covers cyber risk management methodology, risk assessment and risk treatment. DFIN has adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and engages a consultant to periodically assess the Company's NIST CSF profile and maturity.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: The Board of Directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, mitigation, and preparedness for recovery of any such incidents whether perpetrated on the Company or our stakeholders. The Risk Oversight Committee of our Board has direct oversight of our management of cybersecurity risks.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: Our Senior Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to maintain awareness of cybersecurity risks, including email, web, and data security. The Senior Director of Information Technology has over 25 years of experience designing, implementing, and running information technology and cybersecurity programs and processes using the National Institute of Standards and Technology, or NIST, Framework.

companyName: Syros Pharmaceuticals, Inc.

ticker: SYRS


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics. In addition, management oversees and identifies such risks from cybersecurity threats associated with our use of third-party service providers and works collaboratively with our third-party providers to test our systems security processes and prevent, monitor, detect, mediate and remediate cybersecurity threats and incidents, and will report such threats and incidents to the Audit Committee when appropriate. The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: Role of Management We have established a management-level Risk Committee, that is led by the Chief Legal Officer, and also includes the Chief Information Officer and Chief Financial Officer, as well as certain of their respective Team Members. The Risk Committee meets on at least a quarterly basis to review enterprise risks, including with respect to cybersecurity, as applicable. Enterprise risks, including cybersecurity risk, are briefed to the Audit Committee on at least a quarterly basis by our Chief Legal Officer in coordination with the Chief Information Officer and Chief Financial Officer, or through general updates. In addition, our cybersecurity team, led by the Chief Information Officer, works cross functionally with our legal and other business functions to provide cybersecurity training and, as appropriate, manage cybersecurity risks and incidents.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: At least annually, the Board of Directors, either directly or through the Risk Committee, reviews our technology strategy with the CIO; reviews our information security program with the CISO and the CTRO; and approves our information security policy and program. In addition, the Risk Committee and the Board of Directors participate in periodic cybersecurity education sessions.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are not advanced. None of our personnel are trained specialists in cybersecurity; we rely on off-the-shelf" security software. We have not conducted employee training regarding cybersecurity or conducted internal tests or simulations. Nonetheless, we believe that, due to the nature and status of our business, our cybersecurity position is currently satisfactory for our situation. We do not believe that cybersecurity risks have materially affected (or are reasonably likely to materially affect) us.

companyName: AIxCrypto Holdings, Inc.

ticker: AIXC


text: We did not experience a material cybersecurity incident during the year ended December 31, 2024, which has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the possibility of future cybersecurity incidents, as well as cybersecurity and technology risks more generally, could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. See "Item 1A. Risk Factors – Cybersecurity and Technology Risks" for more information.

companyName: Red Violet, Inc.

ticker: RDVT


text: Identity and Access Management ("IAM") – Littelfuse has implemented user authentication controls on its systems, devices, data, and applications. In addition, multi-factor authentication is implemented for all personnel who remotely access or have privileged account access to Littelfuse systems and networks.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Capital Corporation (the "Company") has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of House Hanover, LLC (the "Investment Adviser") and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations. Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: Material Effect from Cybersecurity Threats To date, no known cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, due to our limited cybersecurity measures, we acknowledge that our company could be at higher risk of material impact from cybersecurity threats.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: The CIO/CISO has over 20 years of cybersecurity and technology experience and has previously held Chief Information Security Officer positions at a large public retail company, as well as at a public technology company and services organization. The CIO/CISO has an undergraduate degree in Management Information Systems. Members of our cybersecurity team have broad experience in security functions in various industries. Our Chief Executive Officer, Chief Financial Officer and General Counsel each hold degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: PENTAIR plc

ticker: PNR


text: Information security and data privacy are the foundation of our cybersecurity program. We have a dedicated team of members of management in cross functional roles devoted solely to our cybersecurity strategy, design, implementation, monitoring and continuous improvement. The cybersecurity team collaborates with both internal and external parties in the delivery of network security, anti-malware, email security, endpoint security, detection/alerting, application security, data security, identity and access management, incident response, cybersecurity awareness, vulnerability management, and IT risk and threat intelligence. The cybersecurity team is also responsible for informing management of material events and key developments and coordinating with other teams in information technology, legal and privacy, as appropriate for analysis and compliance with legal and contractual obligations. Certain state laws and regulations impose privacy obligations, as well as obligations to provide notification of security breaches in certain circumstances.

companyName: HireRight Holdings Corp


text: Changes are tracked and documented in a change tracking system, and we retain past versions of source components and supporting documentation. Testing is performed in an environment other than the production environment, and user acceptance testing is performed by an independent person not responsible for development, modification, or configuration of applications, programs, or system code. Errors are identified, logged, and resolved.

companyName: Clene Inc.

ticker: CLNN


text: We employ a defense-in-layers approach in our cybersecurity program that includes various processes to identify, assess, prioritize, manage, and report on cybersecurity risks that could result in loss or other adverse consequences to Pure Storage. We maintain a variety of channels designed to identify risks, including risks associated with our use of third-party service providers, such as by conducting vulnerability assessments, reviewing audit findings, discussing with key stakeholders, and analyzing security incidents and reports from our employees and others.

companyName: Everpure, Inc.

ticker: PSTG


text: We have implemented a variety of physical security controls to protect our offices and assets from unauthorized access, tampering and environmental hazards. We utilize a combination of third party logging, intrusion detection and penetration systems to monitor our information systems for anomalous and suspicious activity in support of our security objectives and incident management plans.

companyName: Repay Holdings Corp

ticker: RPAY


text: Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from our employees, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment, which also includes findings from our automated vulnerability scanning tools, are used to regularly update our security protocols, develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment. These updates and initiatives are then reported to our Board and members of management. While there is no documented process for cataloging all digital assets and data, all information is backed up and saved automatically in our Google Suite.

companyName: Vado Corp.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have a third-party risk management and assessment program designed to help protect against the misuse of information technology, data, and systems by third parties and business partners generally requiring third-party service providers to complete a security risk assessment, with certain high priority third-party providers undergoing annual risk assessments to determine if they have experienced any changes that could impact their security risk. If any critical risks are identified, we may perform a compliance audit of the third-party to further document findings and to recommend corrective actions.

companyName: TechTarget Holdings Inc.


text: Our CISO oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats, including aligning programs with industry standards, conducting tabletop exercises, providing education/training and taking other preventive measures. Our CISO coordinates with legal counsel and third party experts to assess and manage material risks from cybersecurity threats. Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. Our CISO or a delegate informs the IRT of cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The CISO, in collaboration with legal counsel, is primarily responsible for advising our chief executive officer ("CEO") and chief financial officer ("CFO") regarding cybersecurity disclosures in public filings. The CISO also notifies the Audit Committee chair of any material cybersecurity incident.

companyName: CHS INC

ticker: CHSCP


text: The Company utilizes third-party service providers to perform a variety of functions to assist in operating its business. The cybersecurity risks associated with the use of certain providers are covered under a vendor management process. Depending on the nature of the services provided and the sensitivity and/or quantity of information processed, the vendor management process may include reviewing cybersecurity practices of these providers, contractually imposing obligations on the provider, inspecting independently audited reports, and/or conducting its own security assessments of their services.

companyName: ULTRALIFE CORP

ticker: ULBI


text: Our Chief Information Officer joined the Company over 25 years ago and has expertise across a wide array of information technology and systems, with experience leading a large array of different functions within the global information technology organization. He has led our information technology Operational Performance and Reliability Committee for the last eight years, which reviews and provides continuous improvement processes and technology across infrastructure, information security, architecture, application and end user performance. He has application development leadership experience across all functions, including the policies and controls that govern both application development and implementation of packaged software.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: As discussed in the "Item 1A. Risk Factors – Privacy, Cybersecurity, Technology, and Data Protection Risks", we face certain ongoing risks from cybersecurity threats and recognize the critical importance of effective cybersecurity risk management in today's interconnected digital landscape. As part of our commitment to safeguarding our operations, sensitive data, and stakeholder trust, we have implemented robust cybersecurity practices and governance.

companyName: ICF International, Inc.

ticker: ICFI


text: In the near-term our cybersecurity risk management program will include a third-party risk management process for service providers, suppliers, and vendors.

companyName: Erasca, Inc.

ticker: ERAS


text: The CISO has been at Williams for over 25 years. During that time, he has held a variety of IT positions at multiple levels in the organization ranging from network engineering to application development, project management as well as several IT Manager and Director roles. He has had oversight of our cybersecurity and risk management programs since 2017. Active in government and private sector partnerships, he is currently serving as the outgoing Chair of the Oil & Natural Gas Subsector Coordinating Council and recently acted as the Chair of the Interstate Natural Gas Association of America security committee.

companyName: NORTHWEST PIPELINE LLC


text: We have also extended our cybersecurity governance to our operational business executives. Technical leadership periodically presents an assessment of mission critical information assets, those that would cause significant business, customer, or employee impact to the appropriate senior management executives. This is a formal assessment which describes the underlying cyber posture, mitigation plan, and commitments. It ensures that the cybersecurity program in the business unit is progressing against its goals and new risks are operationally prioritized. In addition, the CISO meets with leaders from the Company's legal, IT, and internal audit organizations to ensure alignment with privacy, regulations, legal compliance and audit plans.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: The CISO, the Vice President, Engineering – Security, Compliance and Trust, or the Director of Engineering Security and Compliance also issues an annual written report to the board of directors on the Program and material cybersecurity risks.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: The CDO has over 30 years of information technology experience, including at several Fortune 500 companies and including experience with cybersecurity initiatives that address governance, operational practices, cyber-awareness and technology. The CISO has over two decades of information technology risk management experience, including experience with information security testing at several Fortune 500 companies. The CDO holds an undergraduate degree in electrical and electronics engineering, a master's degree in computer science and a master's degree in business administration, and the CISO holds an undergraduate degree in electrical and computer engineering.

companyName: DOVER Corp

ticker: DOV


text: Although we have not, as of the date of this Report, experienced a cybersecurity incident that materially affected our business, financial condition and results of operations, we can provide no assurance that we will not experience a material cybersecurity incident in the future.

companyName: Nexalin Technology, Inc.

ticker: NXL


text: For our the third-party property managers that manage a significant portion of our properties, we conduct periodic reviews of the policies and procedures they have established to detect, contain, eradicate, and restore systems in the event of a major disruption.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: If the type of incident or the threat created by the incident necessitates a full-scale response by the IRT, the CISO notifies a team of network and security engineers, security analysts, and Windows / Unix / Linux systems administrators (collectively, the IT Security and Engineering Teams).

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: The Board of Directors has oversight responsibilities regarding cybersecurity risk. At regularly scheduled meetings (at least quarterly), in addition to such additional interactions as may be necessary in specific circumstances, our Chief Executive Officer, CTIO and CISO update the Board on emerging cybersecurity risks and developments impacting Nordstrom.

companyName: NORDSTROM INC


text: These response plans also set forth the processes for internal reporting of a substantive unauthorized occurrence. The CSO reports such matters to the CIO and CCO, who is responsible for convening a team of cross-enterprise leaders to ensure comprehensive responsiveness to an occurrence. This group also analyzes unauthorized occurrences affecting CNA's or third parties' IT systems or sensitive information, and directs the activities of CNA in responding to such incidents.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. The cybersecurity risk management system involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from consultants, cybersecurity assessors, auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to Mr. Blattner, our designated member of our Board of Directors.

companyName: Dominari Holdings Inc.

ticker: DOMH


text: Risks that could affect us are an integral part of Cheniere's Board and Audit Committee deliberations throughout the year. Cybersecurity risks are integrated into Cheniere's enterprise risk assessment process, which is reviewed by Cheniere's Board at least annually. Cheniere's Board has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while Cheniere's Audit Committee has been delegated the authority to oversee and periodically review the security of Cheniere's information technology systems and controls, including programs and defenses against cybersecurity threats. Cheniere's Audit Committee discusses with Cheniere's management its cybersecurity risk exposures and the steps Cheniere's management has taken to mitigate such exposures, including its risk assessment and risk management policies. On a quarterly basis, Cheniere's cybersecurity leadership team updates Cheniere's Audit Committee on the overall status of its cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.

companyName: Cheniere Corpus Christi Holdings, LLC


text: The Company engages a third-party IT consulting firm and conducts an annual IT audit to test our risk management processes.

companyName: Epsilon Energy Ltd.

ticker: EPSN


text: The Company's Audit Committee holds oversight responsibility over the cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with executive management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. The Company prepares a quarterly report from the Chief Operating Officer and the CISO which includes updates on the Company's current cybersecurity maturity, progress on the Company's previously mentioned multi-year cybersecurity plan, strategy updates to combat changes in the threat landscape, education of employees and executive management on cybersecurity awareness, enhanced cybersecurity defenses, incident response programs and regulatory reporting obligations. The Audit Committee delivers a summary of these reports to the full Board of Directors on a quarterly basis. Furthermore, the Board of Directors receives a direct report from the CISO on no less than an annual basis, with interim reports provided when appropriate or necessary.

companyName: Veris Residential, L.P.


text: Our board of directors considers cybersecurity risk management as part of its general oversight function. The audit committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Climb Bio, Inc.

ticker: CLYM


text: Internal Cybersecurity Team The Company's internal information security organization (Internal Cybersecurity Team), led by our Executive Vice President and Chief Information Officer (CIO) as well as the Assistant Vice President and Chief Information Security Officer (CISO), is responsible for coordinating all aspects of the Company's electronic information security systems, including prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as implementing, monitoring, and maintaining our enterprise-wide security strategy, standards, architecture, policies, and processes. Our CIO reports directly to our Chief Executive Officer, our CISO reports to our CIO, and reporting to our CISO are our Deputy Chief Information Security Officer (Deputy CISO) and other experienced information security personnel responsible for various parts of our business. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. When the Company learns of a cybersecurity incident at a third-party service provider, the Company's respective department contacts maintain communication with the third-party service provider and communicate any cybersecurity incidents to the CISO.

companyName: UNION PACIFIC CORP

ticker: UNP


text: The CISO's organization monitors, manages and works to identify and assess, cybersecurity risks through various technologies, resources, processes and policies that are regularly updated to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. Our global cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework and is certified to the ISO 27001 global standard on Information Security Management. Our cybersecurity program is closely integrated with our QMS under the ISO 13485 standard. Our program utilizes layered defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. Among other things, this includes ongoing systems monitoring with support from a managed detection and response service provider and other third-party vendors to augment our monitoring and response capabilities, as well as a standardized incident response program with incident response team members participating in regularly scheduled management reviews and tabletop exercises. Our CISO and CIO conduct regular cross-functional management reviews of our programs, including with members of senior leadership. All employees and those contractors of the Company with access to our information systems receive annual cybersecurity awareness training, and we have integrated cybersecurity and data protection topics into our Code of Conduct. All critical information systems have a written business continuity plan that is exercised at least annually. The entire program is audited annually by both internal and third-party auditors.

companyName: HAEMONETICS CORP

ticker: HAE


text: Our cybersecurity policies and procedures include the controls and technology we use to identify, assess and respond to cybersecurity threats and incidents. These policies and procedures also focus on identifying vulnerabilities in our internal and external environments and remediating those vulnerabilities. To combat cybersecurity risk, we focus on proactive procedures such as patch management and emphasize the importance of cybersecurity across our organization through quarterly trainings, which include best practices and participation in simulated phishing exercises to strengthen employee vigilance.

companyName: POOL CORP

ticker: POOL


text: Risk Management and Strategy Cyberattacks, computer malware, viruses, social engineering (including phishing and ransomware attacks), and general hacking are becoming more prevalent and more sophisticated in our industry. To mitigate the adverse impact of these threats to our business, we take a comprehensive approach to cybersecurity risk management and make proactively securing our systems and the data customers, employees, partners, and other stakeholders entrust to us a top priority. Our Board and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. See "Risk Factors — Risks Related to Our Intellectual Property and IT Systems" for a more comprehensive description of cybersecurity-related risks. We have devoted significant financial and personnel resources to implement and maintain security measures to mitigate these risks and meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. While in the last fiscal year, we did not identify a cybersecurity threat or incident that resulted in a material adverse impact to our business, results of operations, or financial condition, there can be no guarantee that we will not experience or have not experienced such an incident.

companyName: Jamf Holding Corp.

ticker: JAMF


text: We focus on further building cybersecurity resiliency throughout our value chain. We perform risk management via an industry third-party risk management service provider for all critical vendors, partners, and systems (including third-party hosted information systems) meeting our risk management policy criteria, to minimize the likelihood and impact of malicious cybersecurity incidents. During the onboarding phase, our cybersecurity team under the direction of the Sr. Director Information Security, Compliance, and Privacy, performs a technological risk assessment on, and utilizes certain tools to detect external risk posed by, the vendor, partner and/or system. Vendors identified as posing elevated risk are escalated to senior management for informed risk tolerance determination. Following the onboarding phase, the cybersecurity team continuously monitors risks related to the vendor, partner and/or system. All third-party cybersecurity incidents are tracked though the third-party service provider and are communicated to our cybersecurity team upon discovery. We prioritize our mitigation of cybersecurity risks based on relative likelihood and severity (e.g., critical risk, high risk, low risk) and document a mitigation plan that details a resolution timeline.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Our Board of Directors addresses Onity's cybersecurity risk management as part of its general oversight function. The Risk and Compliance Committee of the Board of Directors is responsible for overseeing Onity's overall risk management processes, including cybersecurity-related risks, and receives periodic updates from the Chief Information Security Officer (CISO) concerning Onity's significant cybersecurity threats and the processes Onity has implemented to address them. The Chair of our Risk and Compliance Committee and our Lead Independent Director have each received training and certification from the National Association of Corporate Directors Cyber-Risk Oversight Program.

companyName: ONITY GROUP INC.

ticker: ONIT


text: Cybersecurity threats haven't significantly impacted our operations, and we don't anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures.

companyName: DIH HOLDING US, INC.


text: These mitigation measures are detailed in the Company's InfoSec Roadmap. Progress against this Roadmap and potential incidents are reviewed with management and the Company's Audit Committee. Our InfoSec team tests relevant controls and maintains industry standard attestations, including reports prepared by an independent AICPA-accredited auditor.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: Our CIR Process is a formalized approach following the NIST framework for evaluating cybersecurity incidents and prioritizing response efforts based on established criteria. The key components of the CIR Process include: • Cybersecurity incident prioritization • Timelines and communications protocols, including establishing reporting thresholds pursuant to which incidents are escalated within the Company, and, where appropriate, reported promptly to the Cyber Review Committee, the Audit Committee Chairman, the Chief Executive Officer and Chief Financial Officer, and the Board of Directors • Procedures related to our Cyber Review Committee described below • A formalized methodology for evaluating the impact of cybersecurity incidents The Cyber Review Committee ("Cyber Committee") is a sub-committee of our Disclosure Committee comprised of our Chief Accounting Officer; Senior Vice President of Information Technology and Engineering; CISO; general counsels; Vice President – Investor Relations; Director – Risk Management & Insurance; and Vice President – Global Security & Administration. Pursuant to the CIR Process, cybersecurity incidents classified as high priority are reported to the Cyber Committee. The Cyber Committee's responsibilities include: • providing feedback and direction to our information technology teams on incident investigations • coordinating other departments, consultants, and advisors as needed • communicating with our executive officer team, Disclosure Committee, independent auditor, and the Chair of the Audit Committee • initiating the materiality determination methodology and assessing materiality of incidents (quantitative and qualitative) • based on materiality analysis, making a recommendation to the Chief Executive Officer and Chief Financial Officer that an incident should be deemed material

companyName: Helmerich & Payne, Inc.

ticker: HP


text: Our security team is responsible for our overall information security strategy, including policy, security engineering, operations and cyber threat detection and response. Our security team has extensive experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes. Employees outside of our security team also have a role in our cybersecurity defenses, and they are given training which we believe improves our cybersecurity.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Orchestra has implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes assessment of vendors during the selection/onboarding process, internal controls and security standards of vendors, compliance with service level agreements, review of SOC 1 reports on an annual basis and a regular review of vendor contracts.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools, processes and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our IT Security Operations team administers and monitors the prevention, detection, mitigation, and remediation of potential cybersecurity risks. This team leverages both Bio-Techne's internal IT resources, including its personnel, as well as managed security service providers and other third-party security software and technology services, as well as through other means. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Our Board has delegated primary responsibility to oversee the management of risks related to information technology use and protection, including cybersecurity and data privacy, to the Audit Committee, while retaining oversight of management's overall approach to risk management. The Audit Committee receives regular reports regarding our cybersecurity risks through two annual briefings by senior management, including our Chief Information Security Officer ("CISO") and head of data privacy, and additional periodic updates as appropriate. At each Board meeting, the chairperson of the Audit Committee and the Corporate Secretary report on the Audit Committee's activities, including risk management, which provides an opportunity to discuss significant cybersecurity risks with the full Board.

companyName: Under Armour, Inc.

ticker: UAA


text: Material risks from cybersecurity threats are assessed and managed by a dedicated team comprised of internal and external IT professionals experienced in cybersecurity threat risk management, who ultimately report to our chief operating officer. Our chief operating officer has extensive strategic and operational experience at several life sciences companies, leading a wide range of business functions, including IT. Our technology team leader has over 20 years of experience with IT and cybersecurity risk management, having served in senior executive-level IT positions at multiple Fortune 500 companies and companies within the life sciences industry.

companyName: LeonaBio, Inc.

ticker: LONA


text: We rely upon technology and information systems to support our mining exploration business. These systems may be susceptible to cybersecurity risks including, but not limited to, external attackers, malware, viruses, and unauthorized access to our information technology ("IT") systems. We have invested in cybersecurity controls and processes to address these threats and reduce the risk of future breaches and cyber-attacks. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems, and those of our vendors, to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: The Company uses the National Institute of Standards and Technology Cybersecurity framework ("NIST CF") for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We utilize Payment Card Industry Data Security Standards, and other applicable standards, laws, and regulations. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, and security event monitoring and security awareness. Certain processes involve the use of third parties.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Cybersecurity risk management for the Company is undertaken both through dedicated cybersecurity risk management processes and within the Company's overall Enterprise Risk Management program, which is overseen by the Audit and Risk Committee of the Company's Board of Directors.

companyName: AUTOLIV INC

ticker: ALV


text: Infrastructure; Network and Physical Security Our IT infrastructure is secured and continually monitored using a number of tools to effect physical and logical security. We strictly regulate and limit access to servers and networks. Network access is controlled by the network firewall and restricted by stringent access control lists. We also employ (i) network and endpoint intrusion prevention and detection throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our management of potential cybersecurity issues and vulnerabilities, and (iii) a seasoned process for managing and installing patches for third-party applications.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Our Enterprise Risk Management (ERM) team leads this risk management process, and evaluates risks to the enterprise on short, intermediate and long-term bases. Our ERM team reports to our ERM Committee, a group comprised of members of senior management who meet on a regular basis to oversee the performance of these risk management functions. We assess risks using a probability-magnitude lens, with shorter and intermediate term risks generally given greater weight. We prioritize mitigating activities on shorter and intermediate term risks, but also use risk analyses and oversight to proactively incorporate mitigating activities into our long-term strategy. The ERM process reflects a Company-wide effort designed to identify, assess, manage, report and monitor enterprise risks and risk areas. This effort includes the Company's Enterprise Risk Services (Internal Audit), Sarbanes-Oxley (SOX), Compliance Audit, legal and IT Security teams, among others. The identification and evaluation of cybersecurity threats and risks is integrated into this ERM process.

companyName: DAVITA INC.

ticker: DVA


text: All Other segment HEI does not have an information technology (IT) or cybersecurity risk management (CRM) department, including the resources or expertise, to manage IT/CRM-related matters and processes. HEI relies on Hawaiian Electric to provide most of its IT/CRM-related services pursuant to a Service Level Agreement (SLA), amended, as of November 30, 2023 between HEI and Hawaiian Electric. HEI also employs third party cybersecurity consultants to assist in managing CRM-related matters. The SLA outlines specific services that Hawaiian Electric provides to HEI, which includes support on all IT/CRM-related matters, IT service desk support, electronic file storage and backup, hardware and software installation, inventory and maintenance, standard networking and telecommunication support, and other various IT/CRM matters, including periodic reporting to HEI's Board of Directors and CWG. Refer to Hawaiian Electric's cybersecurity discussion for more information.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Our internal audit team conducts security controls testing and provides independent validation that such controls are operating effectively on systems in scope for various regulatory and compliance requirements. Our regulatory compliance team uses third-party external auditors to perform independent testing against all systems in scope for our regulatory and customer- driven compliance obligations. The audit cadence aligns with regulatory and customer-driven needs. The scope of our audits includes all systems that store, transmit or process data. We also perform periodic third-party risk assessments, vulnerability testing, system and cloud security assessments against our information technology systems.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: The Company primarily manages risks for cybersecurity threats associated with its third-party service providers through evaluations and assessments during vendor selection, contract negotiations and contract renewals. We have introduced a third-party vendor risk management solution and professional service to survey and monitor the Company's critical vendors at on-boarding and on a reoccurring basis.

companyName: Century Communities, Inc.

ticker: CCS


text: To mitigate the threat to our business, we take a comprehensive, cross-functional approach to cybersecurity risk management. Our management team is actively involved in the oversight and implementation of our risk management program, of which cybersecurity represents an important component. At least annually, we conduct a cybersecurity risk assessment that evaluates information from internal stakeholders and external sources. The results of the assessment inform our alignment and prioritization of initiatives to enhance our security controls. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which follow frameworks established by the National Institute of Standards and Technology (NIST). These include, among other things: security awareness training for employees; mechanisms to detect and monitor unusual network activity; services that identify cybersecurity threats; conducting scans of the threat environment; evaluating our industry's risk profile; utilizing internal and external audits; conducting threat and vulnerability assessments; and containment and incident response tools. We also actively engage with industry groups for benchmarking and awareness of best practices. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: Our program includes regular risk assessments, vulnerability management, access controls, incident response planning, and employee training and awareness programs. We also work closely with third-party service providers to ensure that they are meeting our cybersecurity standards.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: • Materiality Committee, which is led by the CIO, Controller and Chief Accounting Officer, and Deputy General Counsel. The Cybersecurity and Risk Management Team informs the Materiality Committee of Severity 1 incidents and the Materiality Committee is then responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company's business strategy, results of operations or financial condition. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the Materiality Committee is required to immediately report the incident to the Disclosure Committee and Audit Committee. • Audit Committee, which is comprised of independent directors, oversees the Cybersecurity and Risk Management Team and the team's implementation of its Cybersecurity Risk Management Program. The Audit Committee receives quarterly updates regarding cybersecurity risks and/or policy. In addition, the Materiality Committee updates the Audit Committee, as necessary, regarding any material cybersecurity incidents. • Disclosure Committee, which is led by the Chief Legal Officer and Chief Financial Officer. The Disclosure Committee is informed of potentially material threats and incidents by the Cybersecurity and Risk Management Team and Materiality Committee and the Disclosure Committee is responsible for the preparation, review and filing of any disclosure required by applicable law.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: We employ governance, risk, and compliance (GRC) tools to manage cybersecurity risks and maintain business continuity and disaster recovery plans to prepare for potential disruptions. Our employees receive cybersecurity awareness training upon hiring, with additional training provided on a regular basis.

companyName: STAR GROUP, L.P.

ticker: SGU


text: In the past two years, the Company does not believe that it has experienced any material cybersecurity incidents, nor any material costs related to immaterial cyber incidents. Although we have a comprehensive process for the prevention of material cybersecurity incidents as discussed, we cannot provide assurance that our results of operations and financial condition and business strategy will not be materially impacted from cybersecurity risks in the future. For more information on our cybersecurity related risk and potential effects on the Company of a material cybersecurity breach, see under "General Risk Factors" in "Item 1A. Risk Factors"

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: While we have not experienced any data breaches during the year, our online banking platform was targeted in the beginning of the year by threat actors who created malicious look-alike phishing sites. The Bank did not suffer losses as a result of these attempted attacks and due to efforts made to improve our security posture, the attack efforts have significantly subsided and remained at a stable low-level for the remainder year. We continue to monitor and look for ways to enhance security, safeguard customer data, ensure the continuity of our operations, and mitigate any risks associated with potential cybersecurity events.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Our Chief Financial Officer, in conjunction with our information security team and third-party consultants, is primarily responsible to assess and manage our material risks from cybersecurity threats.

companyName: Allakos Inc.


text: As discussed within "Item 1A, Risk Factors", we rely on service providers to process sensitive business information. As part of our risk management program, we have implemented a process to conduct a security review of third-party service providers, including through vendor questionnaires and contractual-related security requirements, as appropriate. In addition, we engage third-party experts, including external legal counsel and cybersecurity advisors, to assist in our identification and management of cybersecurity risks as needed. We have established an incident response process to assess, respond, and report in the event that a cybersecurity incident is detected. Management has also assembled a committee and an escalation protocol in connection with evaluating cybersecurity incidents for any potential disclosure obligations arising from such incidents.

companyName: Toast, Inc.

ticker: TOST


text: Our Information Security Management System ("ISMS"), the foundation of our security framework, is designed to protect critical assets (including our users' personal information) and assess, identify, manage and mitigate material risks from cybersecurity threats.

companyName: Bumble Inc.

ticker: BMBL


text: As part of our risk management process, cybersecurity risks and mitigations are evaluated by senior leadership and presented to the Board of Directors.

companyName: PROCYON CORP


text: Central to our governance approach is the active involvement of our Audit Committee, which plays a vital role in overseeing the Company's cybersecurity strategy. Alta's Audit Committee is a subset of our Board of Directors, which maintains oversight of our strategic direction regarding cybersecurity.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.

companyName: TCW Direct Lending VII LLC