text: We are a global company built on the trust of our customers, employees and business partners, and one of the primary ways we maintain that trust is by respecting privacy rights and safeguarding their information. We believe security is at the center of any strong data privacy program and maintaining cyber-readiness and managing cybersecurity risk continue to be areas of critical focus for us. We have in place an enterprise risk management (ERM) program designed to identify and assess the greatest existing and emerging risks that could impact our business, including cybersecurity and data privacy risks. As a part of our ERM process, we have developed a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. We follow widely-accepted security standards to help guide our decisions and minimize cybersecurity risks. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined policies and procedures for responding to such security incidents, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement.

companyName: Capri Holdings Ltd

ticker: CPRI


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. Based on our review of past cybersecurity incidents, we believe that all such incidents were addressed promptly and effectively. In the last fiscal three years, we have not experienced any material information cybersecurity incidents and the expenses we have incurred from any cybersecurity incidents were immaterial. See Item 1A, "Risk Factors" of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN

secItem: Item 1C


text: We use these risk assessments to design, implement, and maintain appropriate safeguards that are intended to mitigate identified risks, address any shortcomings in our existing safeguards, and regularly check how well our safeguards work. Our information technology ("IT") department is primarily responsible for evaluating, overseeing, and handling our cybersecurity risks to manage the process of risk assessment and mitigation. We have established a cross-functional IT Security Steering Committee that oversees the management of our cybersecurity risks and execution of any mitigation efforts.

companyName: 89bio, Inc.


text: Cyber Risk Management and Strategy We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. To help manage these risks, we engage and rely on external experts and an information technology managed services provider. Our managed services provider's information security analysts and IT security specialists offer us advice on technology, infrastructure, management, and productivity in relation to our information technology capabilities.

companyName: SWK Holdings Corp

ticker: SWKH


text: A dedicated team of technology professionals works throughout the year to monitor all matters of risk relating to cybersecurity. We completed our ISO 27001 Information Security Management certification project culminating in a primary and secondary audit against the standard. We expect to complete the final remediation and updates to policies and procedures and achieve our certification in March 2025. Additionally, we operate and are compliant under the following provisions: HIPAA attestation for the HIPAA Security Rule and the Health Information Technology for Economic and Clinical Health Act (HITECH) Breach Notification requirements.

companyName: JOINT Corp

ticker: JYNT


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Accordingly, we address these risks by implementing and maintaining processes, and technologies designed to prevent, detect, and mitigate incidents that could pose cybersecurity risk. We are equally subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; interruption of business activities and activities of our customers, violation of privacy laws and other litigation and legal risk; and reputational risk. In adopting our risk assessment and management program, we are committed to safeguarding our systems and data.

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: The Technology Committee of the Board of Directors oversees cybersecurity risks and receives cybersecurity reports from our CISO and regularly conducts in-depth cybersecurity discussions. Our CIO and CISO have extensive experience in the areas of cybersecurity and risk management. Our CISO has more than 20 years of experience in Information Technology, including cybersecurity leadership roles. Our CIO, who oversees the cybersecurity team and reports directly to our Chief Executive Officer, has over 20 years of experience in information technology strategy, services, operations, risk and cybersecurity for large global enterprises.

companyName: SYSCO CORP

ticker: SYY


text: The Audit Committee of the Board of Directors oversees SLB’s cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of SLB’s cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the SLB Board of Directors, at least annually, as part of the Company’s corporate risk mapping exercise.

companyName: SLB LIMITED/NV

ticker: SLB


text: On a quarterly basis, our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) report to the Audit Committee on our Information Security program, including presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, security initiatives, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and vendors; recent cybersecurity-related developments; strategic activities; and the execution of our cybersecurity awareness training. In turn, the chair of the Audit Committee reports out to the full Board on a quarterly basis regarding these matters, among other matters addressed by the Audit Committee.

companyName: Burlington Stores, Inc.

ticker: BURL


text: We engage third-party security experts, assessors, and consultants, as appropriate, to assess our cybersecurity risk management processes; support our ongoing certification efforts; help identify areas for continued focus, improvement, and compliance; and support incident response functions, to the extent necessary, all of which support our cybersecurity program. From time to time, we conduct third-party-administered, as well as internally administered, tabletop exercises, which simulate cybersecurity threats, to assess our existing cybersecurity infrastructure and incident response processes. We also periodically conduct offensive security assessments and vulnerability tests, and continuously monitor our computing environments to gain visibility into our security posture and detect vulnerabilities, abnormalities, or signs of compromise. In addition to monitoring risks from threats to our own assets, we administer third-party risk management practices that endeavor to help identify and manage supply chain and vendor risk arising from some of our key suppliers and other service provider organizations. We do so in a variety of ways, such as gathering information on third parties' cybersecurity programs and controls, performing due diligence, undertaking cybersecurity reviews and/or audits, and/or mandating certain contractual requirements, such as notification of cybersecurity incidents.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: We have integrated cybersecurity risk management into our broader risk management framework through various mechanisms, including (i) our updates to the Cyber Committee, which was created by the Board in 2016 and meets at least quarterly, (ii) our annual enterprise risk management update to the Board, and (iii) our information technology and security related internal controls, including vulnerability management programs.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: For the 2024 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, see Item 1A. "Risk Factors," including the risk factor titled "An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, or result in financial losses."

companyName: BANK OF HAWAII CORP

ticker: BOH


text: The Information Security Officer and Chief Technology Officer regularly report to the Director Risk Committee, Audit Committee and the Board regarding cybersecurity and related threats and trends, changes, control effectiveness and residual risk, the areas where our cybersecurity program may be improved and improvements made to address and remediate issues.

companyName: First Foundation Inc.

ticker: FFWM


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We have business continuity plans that we continuously review and update in line with our evolving applications architecture.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: The corporate information security organization has implemented a governance structure and process to assess, identify, manage and report cybersecurity risks. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats and mitigate those threats in a timely manner. In addition to developing and implementing pre-existing third party frameworks, we have implemented our own practices and customized controls tailored to the Patrick enterprise environment. We believe this approach enhances our defense in depth stance while increasing our ability to identify, contain and manage cybersecurity risks.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: Our policies and procedures collectively help execute a risk management approach designed to account for cybersecurity threats specifically targeting us, as well as those that may arise from our engagement with business partners, customers, service providers and other third parties. For example, our third-party risk management policy is designed to help enable timely and effective identification, measurement, and management of third-party risks throughout the lifecycle of such relationships, which includes planning, due diligence and third-party selection, contracting, risk-based monitoring, and termination. We also assess, identify, and manage cybersecurity and technology risks associated with our merger and acquisition activities. See "Governance" below for more information.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: The Company also conducts regular cybersecurity training for employees to ensure they are aware of potential cybersecurity threats and understand the role they play in maintaining the Company's defenses. The Company also monitors evolving regulations and standards to ensure that the Company's practices align with industry best practices and legal and regulatory obligations.

companyName: EVgo Inc.

ticker: EVGO


text: As a member of both the GRCC and the ISC, the CISO briefs the Audit Committee on the information security program, major risks and any cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors, at least annually, as part of Criteo's enterprise risk mapping ("ERM") program.

companyName: Criteo S.A.

ticker: CRTO


text: Although BancPlus has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business, financial condition or results of operations, there can be no guarantee that it will not experience such an incident in the future. There can be no guarantee that BancPlus' policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. For additional information regarding the risks the Company faces from cybersecurity threats, please see the risk factor titled "Unauthorized access, cyber-crime and other threats to data security may subject BancPlus to regulatory action or penalties, require significant resources, harm BancPlus' reputation, and otherwise cause harm to its business" included in Part I, Item 1A. Risk Factors of this report.

companyName: BANCPLUS CORP


text: Our cybersecurity risk management program is under the direction of IT manager, who has a master's degree in IT management. The IT manager receives reports from our cybersecurity team on the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Massimo Group

ticker: MAMO


text: The board of directors has delegated oversight of the Company's cybersecurity risk management program to the Audit Committee, including responsibilities for reviewing and discussing cybersecurity risks, implementing risk management programs, controls and procedures, and performing high level reviews of the threat landscape.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, refer to Item 1A. Risk Factors of this Annual Report on Form 10 K.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board carries out its risk oversight and management responsibilities by monitoring risk directly as a full Board and, where appropriate, through its committees. The Board has delegated to the Audit Committee the responsibility to oversee the integrity of the Company's information technology and cybersecurity risks and to assess the risks and incidents relating to cybersecurity threats. While our Board and Audit Committee oversee cybersecurity risk, management, through the CIRT, is responsible for the implementation and management of cybersecurity risk management systems and processes and for the communication of incidents to senior management and the Audit Committee.

companyName: Ecovyst Inc.

ticker: ECVT


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Rumble On maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition. No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition.

companyName: RideNow Group, Inc.

ticker: RDNW


text: The Company's cybersecurity program prioritizes vulnerability management, risk reduction, detection, and prevention to help protect against material risks from cybersecurity threats to its information systems. The Company periodically conducts internal and third-party cybersecurity risk assessments and penetration tests and incorporates relevant findings and recommendations into its overall cybersecurity strategy, as appropriate. Through these assessments, the Company develops targeted strategies intended to address the most significant cybersecurity risks.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: The underlying controls of our information security program are based on regulatory guidance, recognized best practices and industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. Our Corporate Information Security Officer and our Chief Information Officer, to whom the Corporate Information Security Officer reports, as well as key members of their teams, regularly collaborate with peer banks, industry groups and others to consider cybersecurity trends and best practices. The information security program is periodically reviewed by these individuals and their teams with the goal of addressing evolving threats and conditions. Our enterprise information security team consists of information security professionals with varying degrees of education and experience who are generally subject to professional education and certification requirements. In addition, our team leverages managed security service providers to supplement the Company's internal skillsets and capabilities.

companyName: Ameris Bancorp

ticker: ABCB


text: Truist provides ongoing development and education to its directors with respect to cybersecurity, including presentations at Board meetings on special topics, such as updates on cybersecurity legislation and regulation. The Board also conducts a cybersecurity tabletop exercise at least every other year to simulate Truist's analysis and response to hypothetical cybersecurity incidents. In addition, Truist provides directors with a Board Cybersecurity Handbook that provides details on key Truist practices, resources, and protocols relating to cybersecurity protection, response, and preparedness. Finally, as required by the Gramm-Leach-Bliley Act, the Board receives an update at least annually on Truist's Information Security Program.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity events to members of management depending on the circumstances. Key members of management, including representatives from information technology ("IT"), operations, legal, finance, risk management and internal audit, serve on the Company's senior security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and certain cybersecurity incidents are escalated to the Company's executives. In addition, the Company's incident response processes include potential reporting to the Audit Committee of our Board of Trustees for certain cybersecurity incidents.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: Robert Duhart, Senior Vice President, Cloud Security and Head of Global Information Security is responsible for the day-to-day identification, assessment and management of the information security risks we face. Our Senior Vice President, Cloud Security and Head of Global Information Security has extensive experience in managing cybersecurity and has served in various leadership roles in information technology and cybersecurity at several large public companies, the U.S. Department of Defense and the Federal Bureau of Investigation. Most recently, he served as the Chief Information Security Officer, eCommerce and Deputy Chief Information Security Officer at a major retailer. Our Senior Vice President, Cloud Security and Head of Global Information Security earned a master's degree in technology management from George Mason University – Costello College of Business, and a Chief Information Security Officer Executive Certificate from Carnegie Mellon University – Heinz College of Information Systems and Public Policy.

companyName: ORACLE CORP

ticker: ORCL


text: While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the committee. Our policy is for the Board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets reporting thresholds, as well as ongoing updates regarding any such risk.

companyName: Expion360 Inc.

ticker: XPON


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors, "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences", in this Annual Report on Form 10-K.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: 3. Training and Screening of Employees – The Company provides all Information Security policies to new hires. In addition, new hires are required to complete security awareness training which contains cybersecurity principles. Employees must also complete annual security awareness training, with additional and dedicated cybersecurity training for employees with access to more data and systems. As a part of hiring employees and contractors, background checks are performed that involve varying levels of depth depending on the employee's or contractor's level of data and system access.

companyName: QUINSTREET, INC

ticker: QNST


text: • Guidance regarding incidence response, business continuity and disaster recovery program, strategy and testing. • Oversight and guidance on vendor risk management processes and individual vendor profiles. • IT strategy advice. • Monitoring the relationship with our information technology managed services provider. • Technical, policy and procedure recommendations.

companyName: LXP Industrial Trust

ticker: LXP


text: Our Board of Directors, with assistance from the IT Steering Committee, oversees cybersecurity. Our Board of Directors receives reports as needed, but no less than biannually, from management on various cybersecurity and IT topics, including trends, data security policies and practices, cybersecurity incidents, current and projected threat assessments, regulatory developments and ongoing efforts to protect, detect and respond to critical threats. Our IT Steering Committee, which is responsible for cybersecurity management oversight, includes members of management such as our Chief Executive Officer, our Chief Financial Officer, and our Vice President of Information Technology. The IT Steering Committee periodically reviews and confers with management risk issues associated with cybersecurity and policies and controls intended to alleviate those risks.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: The CIO leads our global information technology organization and has nearly 30 years of information technology leadership experience, including acting as CIO at two cloud-based technology providers. The Chief Technology Officer has over 20 years of experience leading product management, engineering, and operational teams at global organizations, including at a fraud management and information security company. The Senior Vice President of Research and Development has more than 25 years of information technology experience, including at another publicly traded technology company. Our CISO reports to the CIO and is responsible for leading our information security organization and overseeing our information security program. The CISO has over 20 years experience in information technology and security, including serving as Chief Information Security Officer at another cloud-based technology provider. Team members who support our cybersecurity risk management program have relevant education and experience in the fields of cybersecurity, risk management, security architecture, data protection, application security, audit, compliance, incident response, identity governance and governance of enterprise information technology.

companyName: OneSpan Inc.

ticker: OSPN


text: The Company has a cybersecurity training program that requires all employees with access to the Company's networks to participate in regular and mandatory training on how to be aware of, and help defend against, cybersecurity risks. Also, the Company regularly tests the efficacy of its training efforts as well as its systems to assess vulnerabilities to cybersecurity risks, including tabletop incident response exercises.

companyName: BrightView Holdings, Inc.

ticker: BV


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. In March 2020, we experienced a ransomware attack in which cybercriminals were able to access our information technology systems. While we isolated the source of the attack and restored normal operations with no material day-to-day impact to us or our ability to access our data, we believe confidential information was stolen. We believe it is possible that the ransomware attack could lead to the disclosure of our trade secrets or other intellectual property, or could lead to the exposure of personal information of our employees. The release of any of this information could have, but is not reasonably likely to have, a material adverse effect on our business, operations, business strategy, results of operations or financial condition. The March 2020 ransomware attack has not, but it is possible that it could, result in legal claims or proceedings, regulatory investigations or actions, and other types of liability under laws that protect the privacy and security of personal information, including federal, state and foreign data protection and privacy regulations, violations of which could, but is not reasonably likely to, result in significant judgements against us, penalties and fines. For more information, see the section titled "Risk Factor—Risks related to our intellectual roperty, information technology and data security—If we or our critical third-party providers experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."

companyName: 10x Genomics, Inc.

ticker: TXG


text: In 2023, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. There can also be no guarantee that our policies and procedures under our cybersecurity risk management program will be properly followed in every instance or that those policies and procedures will be effective. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: Karat Packaging Inc.

ticker: KRT


text: Our Senior Director of Information Security (the "SDIS"), who holds a graduate degree in cybersecurity and several industry leading cybersecurity certifications, is responsible for our overall information security program including strategy, security engineering, cyber threat detection, and response. The information security team managed by our SDIS contains certified cybersecurity professionals with broad experience and expertise in cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance, among other areas. The information security team continually evaluates our cybersecurity posture, which aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) industry standard, and makes on-going investments in our networks, in addition to performing regular testing of our environment.

companyName: Regional Management Corp.

ticker: RM


text: Further, pursuant to our CIRP, we may engage third-party support to enable an effective and timely response to a significant cybersecurity incident. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We obtain Systems and Organization Controls ("SOC") 1 and SOC 2 reports, as applicable, from our third-party service providers which assess those entities' controls to cover security, availability, integrity, confidentiality and privacy. Any applicable findings of this third-party assessment are analyzed by the appropriate employees and further action is taken as needed.

companyName: Valaris Ltd

ticker: VAL


text: The CSIRT is responsible for incident reporting and response. The action steps taken, beyond notification, are typically accomplished with the assistance of the IT department. The Head of Information Technology or CSIRT team member will work with the appropriate personnel to respond to the incident (following written guidelines) and to ensure concurrent documentation of the same. Should a breach occur at a third party that has a material impact on Monroe Capital, the CSIRT must be notified.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: We require our associates to receive annual training on our information security policies. This may include, but is not limited to, training regarding information classification and handling, data privacy, physical security, phishing, malware and ransomware, social engineering, identifying and reporting information security incidents, and secure credit card handling, as well as additional topics based on job roles and responsibilities. We also maintain written information security policies and procedures that apply to the entire Company and third parties who handle our data or have access to our information technology systems. These policies and procedures establish the framework for our information security program and cover topics such as acceptable use of information systems, security risk management, access management, audit and logging, patching, and security requirements for numerous technologies. These policies and procedures are reviewed at least annually, updated as necessary and integrated into employee training programs and our contracting process. We are also subject to the Payment Card Industry Data Security Standard and we perform an annual self-assessment according to the requirements set forth by the Payment Card Industry Security Standards Council.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: The underlying processes and controls of our cyber risk management program are designed based on standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Skye has an annual assessment performed by a third-party specialist of its cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes significant cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists develop a risk mitigation plan to address identified risks and, where necessary, remediate potential issues identified through the annual assessment process.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: We design and assess our program based on various cybersecurity frameworks, such as the NIST and the CIS, and align our security program closely to the NIST Cyber Security Framework. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: A cybersecurity group within GATX's IT department, led by the Global Head of IT Security, works collaboratively across the Company to administer a program designed to protect the Company's information systems and information from cybersecurity threats and to execute processes in accordance with the Company's incident response plan. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams and the cybersecurity group, the Global Head of IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and reports such threats and incidents to the Audit Committee when appropriate. The CIO has over 25 years of experience in information technology, including over 17 years managing the cybersecurity function and resources. The Global Head of IT Security has over 15 years of experience in information technology and information security, including 10 years of leadership roles within the information security domain, and holds certifications in cybersecurity and risk management.

companyName: GATX CORP

ticker: GATX


text: Crane has not experienced a material third-party security breach, but recognizes the inherent cyber risks associated with relying on third-party vendors such as cloud service providers, software vendors, data processors, and IT service providers with access to company information, systems, or processes. Crane is committed to managing these risks responsibly and transparently and has an active process in place to assess and reduce that risk, including performing due diligence on third-party vendors before onboarding and evaluating and assessing their cybersecurity policies, procedures, incident response plans, and relevant certifications (e.g., SOC 2, ISO 27001, etc.). We continuously monitor publicly available information about our third-party vendors for reports of security incidents and fully investigate any reports for impact to Crane systems or information and take appropriate measures to limit the impact to Crane in the event of a third-party security incident.

companyName: Crane Co

ticker: CR


text: Our approach consists of best practice standards, policies, and processes for identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats. Our cybersecurity goals are to leverage industry-wide recognized standards, such as The National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: VOXX International Corp


text: Lastly, at least annually, the CISO reports directly to our Board of Directors the overall status of the cybersecurity program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, system failures, interruptions or cybersecurity breaches are discussed as are management's responses and any recommendations for program changes.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: The Information Security team proactively reports, on a company-wide basis, the status of cybersecurity initiatives and risks, along with various assessments of our information security programs and the emerging threat landscape. We also perform periodic assessments and audits internally and also leverage third party experts, and the results of such assessments and audits are reported directly to senior leadership. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards and regularly monitor the effectiveness of our safeguards. We also actively engage with key partners, vendors, customers, industry participants, government entities, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures, especially around self-driving / autonomous vehicles. We work to identify, assess, and oversee risks from cybersecurity threats associated with third-party service providers, including, where appropriate, by contractually requiring third-party service providers to promptly inform us of incidents impacting their systems that could result in access to, loss, or unavailability of Aurora's data. In addition, prior to engagement, we conduct thorough security assessments of all third-party service providers that handle confidential Aurora information or connect to Aurora computing environments. Such assessments include analysis of the service providers' data handling practices and the security of their integrations with Aurora's systems. This approach is designed to mitigate risks related to cybersecurity threats originating from third-parties.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: Management believes the Company has adequate processes and systems to maintain the confidentiality of its communications and records. However, given our current business plan and lack of significant operations and employees, management does not believe that cybersecurity threats constitute a material risk for the Company. The Company currently does not have formal processes for assessing, identifying and managing risks from cybersecurity threats to the Company directly or through third-party service providers. We do not engage assessors, consultants, auditors or other third parties in connection with cybersecurity. The Company has not experienced any cybersecurity incidents to date.

companyName: DEEP FISSION, INC.


text: We recognize the importance of identifying and managing cybersecurity risks and have integrated cybersecurity risk management into our overall risk management processes. We have implemented processes to identify, assess, detect, evaluate, and mitigate ongoing security threats to our information technology systems and data as well as those of third parties upon which we rely.

companyName: IonQ, Inc.

ticker: IONQ


text: Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of Morgan Stanley's Board of Directors (the "MS Board") and the Operations and Technology Committee of the MS Board ("BOTC").

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: The Company engages third-party cybersecurity consultants and auditors who help the cybersecurity team in identifying, assessing, and managing material risks from cybersecurity threats, including by evaluating and enhancing the Company's cybersecurity posture. The Company also engages third-party service providers to perform a variety of functions throughout its business. The Company performs due diligence before engaging with certain third-party service providers designed to evaluate the service providers' cybersecurity practices, including their security policies, incident response capabilities, and data protection measures (as evidenced by third party certifications including ISO 27001 and SOC II reports); including specific cybersecurity requirements in contracts with certain third-party service providers, such as regarding security standards, data protection, and incident reporting as applicable; and monitoring and auditing certain third-party service providers' cybersecurity practices and compliance with contractual obligations. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, the Company's vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Willdan Group, Inc.

ticker: WLDN


text: Cyber Risk Management and Strategy We rely on information technology systems that we or our third-party providers operate to process, transmit and store electronic information in our day-to-day operations. To help protect against risks from cybersecurity threats to these systems, we have implemented cybersecurity processes in accordance with our risk profile and business that are informed by a recognized cybersecurity industry standard.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for the oversight of risks from cybersecurity threats, if any. Information regarding any cybersecurity incidents would be shared with our board of directors or audit committee to enable assessments related to disclosure and notice requirements. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Oklo Inc.

ticker: OKLO


text: Our cybersecurity program is aligned with the NIST-Cybersecurity Framework (NIST CSF v2), which provides a structured approach to inform, design, and evaluate our program. Consistent with this framework, we have established cybersecurity policies, standards, and processes designed to manage cybersecurity risks, including risks from cybersecurity threats associated with the Company's use of third-party service providers. Key elements of our cybersecurity program include: employee cybersecurity training, including required annual certification; identification of potential vulnerabilities through external threat intelligence feeds, scanning of our technology environment, and vendor and third-party risk assessments; an incident response plan and team that is intended to allow rapid management, response, and appropriate communication of cybersecurity incidents; and a cybersecurity operations center with support from a third party managed service provider (MSSP) to respond to threats and incidents.

companyName: Catalent, Inc.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with finance, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and email notifications.

companyName: AXT INC

ticker: AXTI


text: Currently, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: The Board, in coordination with the Audit Committee, oversees our risk management process. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, the Audit Committee discuss our approach to cybersecurity risk management with the Head of IT.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: The Board has overall oversight responsibility for our cybersecurity risk management; however, it delegates cybersecurity risk management oversight to the audit committee of the Board (the "Audit Committee"). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: Management & Strategy We manage information security risk through, and as part of, MetLife's Information Security Program (the "Program"), which institutes and maintains controls for the systems, applications, and databases of the Company and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology, and is managed by MetLife's CISO, in collaboration across lines of business and corporate functions. Our Board of Directors oversees the Program.

companyName: METLIFE INC

ticker: MET


text: We execute a holistic approach to our standards, policies, practices, and processes for identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats, all of which are integrated into our overall risk management program. Our cybersecurity program is informed by industry-wide recognized standards, such as The National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: Our information security program is managed by our Chief Security Officer and VP of Security Engineering ("CSO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, technologies, and processes. Our CSO's primary responsibility includes assessing, monitoring, and managing our cybersecurity risks. With over 24 years of experience in the field of cybersecurity, our CSO brings a wealth of experience to her role. Her background includes extensive experience as an enterprise CSO, and she is well recognized within the industry. Her in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. In partnership with our Chief Information Officer ("CIO") who leads our Governance Risk and Compliance ("GRC") function, our CSO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee security training program.

companyName: JFrog Ltd

ticker: FROG


text: In the last three fiscal years to date, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. While we have significant security processes and initiatives in place, we may be unable to detect or prevent a breach or disruption in the future. For more information about cybersecurity-related risks, please see Item 1A. "Risk Factors" of this Form 10-K. See "Item 1A. Risk Factors" of our Annual Report on Form 10-K for the year ended May 31, 2021, for information regarding the 2017 NotPetya cyberattack at TNT Express.

companyName: FEDEX CORP

ticker: FDX


text: Our CISO provides a report to the Audit Committee on cybersecurity quarterly, or more frequently if circumstances warrant, including relevant cybersecurity incidents impacting the Company and on topics related to information security, data privacy and cyber risks and mitigation strategies. In addition, outside experts periodically present to the Board on cybersecurity.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: During the year ended December 31, 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material adverse effect on our operations, business strategy, operating results, and financial condition. For more information regarding cybersecurity risks that we face and potential related impacts on our business, see the section titled "Risk Factors" in Part I, Item 1A of this Report.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: The IT Security Team consists of five members, led by the Company's VP of IT, and focuses on the Company's overall data and cybersecurity. The PCI Compliance Force consists of six members, is led by the Company's Chief Technology Officer, and focuses on the Company's compliance with PCI standards. Both teams hold regular meetings to discuss and report on, as applicable, meaningful cybersecurity risks, threats, incidents, and vulnerabilities, and changes in and compliance with industry data and cybersecurity standards. The teams also develop and oversee mitigation and remediation activities within their areas of responsibility. The teams, in conjunction with senior management, work to ensure that the Company is meeting requirements of applicable regulations and that the Company's third-party vendors are also meeting compliance requirements. The teams are also tasked with the development and maintenance of business continuity plans, security policies and procedures. The Company's Emergency Management Team, which consists of seven members and is led by the Company's Chief Executive Officer, has developed business incident response runbooks designed to guide operational staff with a set framework for response and mitigation to cybersecurity incidents and threats.

companyName: CoreCard Corp

ticker: CCRD


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include audits, internal assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Enova International, Inc.

ticker: ENVA


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy currently include:

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: We are at risk for cybersecurity breaches and incidents, including as a result of third-party action, employee, vendor or contractor error, cyberattacks (including from nation states and affiliated actors) and other forms of hacking, malfeasance, ransomware, and other malicious software, or other factors. If our security controls are breached or circumvented, or unauthorized or inadvertent access to, modification to, or processing of customer, employee, or other confidential data otherwise occurs, our software solutions may be perceived as insecure, or may become unavailable or inaccessible to our end users. As a result, we may lose existing customers or fail to attract new customers, our business may be harmed, and we may incur significant liabilities. These and other risks could affect BlackLine, including our business strategy, results of operations, or financial condition. For more detailed information about these and other cybersecurity risks, please see Part I, Item 1A, "Risk Factors", including the risk factor entitled "If our security controls are breached or unauthorized, or inadvertent access to customer, employee or other confidential data is otherwise obtained, our software solutions may be perceived as insecure, we may lose existing customers or fail to attract new customers, our business may be harmed and we may incur significant liabilities."

companyName: BLACKLINE, INC.

ticker: BL


text: Our Manager maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Company's and the Manager's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Incident Response Plan: The Company has developed and maintains an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Annual testing is conducted to determine the effectiveness of the incident response plan, and maintenance of backup and protective systems is performed as needed.

companyName: DallasNews Corp


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize. We conduct these risk assessments directly and also periodically engage third -party providers to support these processes.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Software and Infrastructure Engineering, Compliance and Legal teams. These individuals have prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: TrueCar, Inc.


text: Our Cybersecurity Program also includes an incident response process that is overseen by our Vice President of Cybersecurity and supported by an internal team of cybersecurity specialists, with involvement from business, legal and senior management as appropriate. In the event of a cybersecurity incident, a technical cybersecurity team investigates and addresses the threat, while a cross-functional team assesses the incident to inform criticality determinations and response efforts, including escalations of the incident to senior management as appropriate.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: The Chief Information Security Officer, in coordination with our Chief Financial Officer, Chief Accounting Officer, certain members of the Company's legal team and certain third-party service providers ("Cybersecurity Risk Management Team"), is primarily responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks. Through our Cybersecurity Risk Management Team, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example manual and automated tools, conducting scans of threat environment, use of external intelligence feeds, internal and third-party threat assessments and evaluating our industry's risk profile, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, and conducting red/blue team testing and tabletop incident response exercises.

companyName: Confluent, Inc.

ticker: CFLT


text: The audit committee receives regular reports from management, including our Chief Technology Officer ("CTO") and Senior Director of Information Security. These reports encompass a broad range of topics, such as our cybersecurity risks, the current cybersecurity landscape and the status of ongoing cybersecurity initiatives. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity.

companyName: FIGS, Inc.

ticker: FIGS


text: Our Cybersecurity Incident Response Plan ("IRP"), which generally aligns with NIST's guidance, provides management with a standardized framework for responding to an actual or potential cybersecurity threat or incident. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP also specifies the use of third-party experts for legal advice, consulting and incident response, as appropriate. The IRP undergoes at least annual tabletop exercises, where the Incident Response Team and relevant business and functions drill our response to a simulated cyber incident. The results of these drills are used to identify areas for improvement in our processes and technologies.

companyName: Xylem Inc.

ticker: XYL


text: The Global Head of IT is the management position with primary responsibility for the development, operation, and maintenance of our information security program. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Company's IT infrastructure are appropriately secured and managed. It also encompasses ensuring that all employees are educated in IT best practices around incident management and security, ensuring the security of the internal and external IT systems, as well communicating to senior management and planning for future IT strategy and IT security.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: The Crisis Incident Management Team, which includes members of the executive management team, the CIO, CISO, and other senior executives across the Company, is alerted as appropriate to cybersecurity incidents, as well as other crises, such as natural disasters and outages. This team also periodically oversees tabletop drills on various cybersecurity incidents.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: Our CISO holds a degree in information systems design and analysis and advanced degrees in telecommunications and information technology management. He has over 25 years of experience leading Information Security teams and over a decade as a senior leader within Information Security.

companyName: Federal Home Loan Bank of Indianapolis


text: Cybersecurity Risk Oversight and Risk Assessment We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: BOISE CASCADE Co

ticker: BCC


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes.

companyName: Pharma-Bio Serv, Inc.

ticker: PBSV


text: Our Chief Information Officer, Chief Executive Officer, Vice President of Human Resources and Vice President of Operations help identify, assess and manage the Company's cybersecurity threats and risks. They will identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of the threat environment, evaluating threats reported to us, internal and external audits, conducting threat assessments for internal and external threats, third-party threat assessments and conducting vulnerability assessments to identify vulnerabilities.

companyName: SunPower Inc.

ticker: SPWR


text: Our information security program is overseen by our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"), in consultation with our Chief Privacy Officer as needed. We employ a layered defense-in-depth system, which includes the use of continually evolving technologies to assess and protect the security of our enterprise-wide applications and Systems, our intellectual property and proprietary and other information and the data and personal information of our customers and employees; monitoring of our technology environment; performing regular security audits and vulnerability assessments; and regular cybersecurity and privacy training for our employees. We engage consultants and other third parties to conduct independent security assessments of our information security program and to provide us with information on new and developing threats and tactics. We have established processes to oversee and identify risks and cybersecurity threats associated with our third-party service providers. Pursuant to our information security and privacy policies and corresponding training, our employees and third-party vendors are instructed to notify our information security team as soon as they become aware of a suspected cybersecurity incident. We have a cybersecurity incident response plan to manage our response to potential and actual cybersecurity incidents. The plan includes procedures to assess the potential impact of an incident on the Company. When an incident meets certain criteria, the CISO and members of the information security team timely notify members of senior management, including our CTO and General Counsel, and under certain circumstances, the Audit Committee. All incidents are reviewed periodically with senior management.

companyName: Paramount Global


text: NEE operates U.S. critical infrastructure for XPLR. There have been cyberattacks and other physical attacks within the energy industry on energy infrastructure such as substations, gas pipelines and related assets and there may be such attacks in the future. In addition, the advancement of artificial intelligence has given rise to new security risks. Although there have been no cybersecurity incidents or threats with a material impact on NEE's nor XPLR's business strategy, results of operations, or financial condition, NEE's information technology systems could fail or be breached, and such systems could be inoperable, causing NEE and XPLR to be unable to fulfill critical business operations. The disclosures herein should be reviewed with the risk factors included in Item 1A.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: The Company's Senior Vice President and Chief Information Officer ("CIO"), who reports to the Company's Chief Executive Officer, is responsible for the operation of the Company's information security program. Our CIO is an IT veteran with over 25 years of experience in building and maturing cyber programs for large public companies. The CIO is supported by an internal team of certified security analysts that work in conjunction with leading security operations managed service providers to manage detection and response.

companyName: Dorman Products, Inc.

ticker: DORM


text: Our Board of Directors oversees the company's cybersecurity risk-management program. Management reports at least quarterly to the Board on matters related to CFC's security operations, potential threats, industry-wide trends and any other related information requested by the Board. The reports include information on material cybersecurity incidents, if any, and management actions to protect CFC. Upon the occurrence of a material cybersecurity incident, the Board of Directors will be promptly notified so it may properly evaluate such cybersecurity incident, including management's remediation plan. In addition to the regular cybersecurity program reports, the Board monitors cybersecurity risk and program effectiveness through internal audit and our enterprise risk management reporting framework. On an annual basis, our Chief Information Officer ("CIO") and Director, Information Security, provide the Board an overview of the company's technology strategy and planned activities to continually improve the cybersecurity program, as well as threats and cybersecurity incidents. Further, on at least an annual basis, the Board of Directors reviews management reports concerning the disclosure controls and procedures in place to enable CFC to make accurate and timely disclosures about any material cybersecurity incidents.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: The Company provides mandatory initial and annual training thereafter for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices. We also work to educate our customers about the importance and understanding of their role in protecting their identities and the privacy of their information. We consider customer education regarding the use of electronic convenience products to be especially important due to the Bank's increased exposure to loss related to these products if procedures are not followed.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: We manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessment, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.

companyName: ADDENTAX GROUP CORP.

ticker: ATXG


text: Our Incident Response Team, in coordination with external advisors, is responsible for responding to and managing cybersecurity incidents pursuant to our Incident Response Plan. It includes our Cybersecurity Team, our Chief Executive Officer and other Company personnel as appropriate based on the nature of the incident.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: Our Incident Response Program and Plan describes the major phases of an incident management lifecycle which includes the preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Qualys' 24x7 Cybersecurity Fusion Center and CSIRT conduct Incident Response Plan testing and training on a periodic basis through tabletop exercises or simulated attack scenarios. This testing appraises our readiness to respond to such scenarios and tests the completeness and accuracy of the incident response plan. The Cybersecurity Fusion Center and CSIRT teams drive these exercises to participants via various cyber security incident scenarios in the form of multiple injects. Exercise participants primarily consist of members from various Qualys departments such as security operations, IT operations, network operations, and other departments depending on the selected scenario.

companyName: QUALYS, INC.

ticker: QLYS


text: The CCDC directly oversees information technology and information security risks through regular meetings, reports from management on information technology, cybersecurity, and related risk assessments, and incidents disclosed by third-party service providers as applicable. If a cybersecurity threat is identified, our Vice President of IT or other reporting individuals will immediately inform our IT service desk and notify our CIO. Once the threat has been analyzed, our CIO will inform our General Counsel of any security incidents. The General Counsel will report on the incident, as appropriate, to the CCDC, our CEO, President and CFO, and to the Board, either at the next scheduled meeting or on a current basis, depending on the severity of the incident.

companyName: Gold.com, Inc.

ticker: GOLD


text: The Company's Chief Technology Officer ("CTO") oversees the Company's information technology programs and investments. The Company's CTO has over 30 years of information technology experience. The Company's Compliance and Security Officer, who oversees the Company's information security programs, has over 10 years of experience and reports to the Chief Operating Officer. The Compliance and Security Officer is designated as the program coordinator responsible for coordinating and overseeing the Information Security Program.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Our standard agreements with third parties may include, among other provisions, compliance requirements, data protection standards, audit rights, and security incident notification requirements. A dedicated email account and hotline is in place for third parties to report security incidents. The email account and hotline are monitored 24/7/365 by our Global Security Operations Center. Notice of a third-party security incident could trigger the activation of our incident response plan, as further described above.

companyName: HERBALIFE LTD.

ticker: HLF


text: We recognize the potential cybersecurity risks inherent in our relationships with third parties. To address this, we are implementing a comprehensive third-party risk management program designed to identify and oversee such risks. This program will rely on key elements, including risk assessment, due diligence, contractual provisions, and ongoing monitoring, to identify and mitigate impacts from high-risk third parties and specific risks. We will utilize security risk assessment questionnaire tools to identify high-risk third parties, enabling us to proactively and effectively assess and mitigate potential security vulnerabilities.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Our CISO is informed of cybersecurity incidents by the cybersecurity team's security operations center, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. We have an established process governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident, including for our evaluation of materiality. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and Board of Directors.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: With oversight from the Board, the Audit Committee is primarily responsible for assisting the Board in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: The Company maintains insurance as part of its cybersecurity risk mitigation strategy to provide protection against certain potential losses arising from certain cybersecurity incidents.

companyName: Xylem Inc.

ticker: XYL


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Cipher Digital Inc.

ticker: CIFR


text: Next, we perform certain controls and processes in order to protect against the identified risks. In connection with this phase, we do the following: • Maintain controls and processes over access to our networks and computer systems including: (i) approval and restriction to appropriate personnel as well as ensuring powerful privileges are restricted and segregated to select information technology employees; (ii) utilize a password manager to protect encrypted passwords of power users; (iii) disable system and physical access of terminated employees in a timely manner; (iv) utilize two-factor authentication for remote access to the network; and (v) segregate internal network through the use of internal firewalls; • Maintain physical security at our data center and backup recovery location including door access control system with surveillance; • Block data intrusion to maintain confidentiality and integrity of our data via the following: (i) capacity of our servers and networks have an automated monitoring system; (ii) patch management controls on our key software including monitoring resources for patch criticality and reported issues as well as running vulnerability scans; (iii) change logs are kept and updated on all of our key software; (iv) all major changes to hardware and infrastructure devices are performed and approved prior to production migration; (v) remote access is fully encrypted for all users; and (vi) internal firewalls are used to limit access to sensitive systems and applications; and • Maintain controls and processes relating to payments we make to third parties by using a combination of internal controls around the setup, maintenance and archiving of records to reduce fraud and erroneous payments.

companyName: FIRST INDUSTRIAL LP


text: Security incidents are reviewed by the CISO and the information security team as soon as they are discovered or reported. The initial review of a security incident is conducted immediately, in order to appropriately determine the severity and urgency of the event. Key stakeholders and any technical owners of the impacted systems or processes are included in the incident review process and are brought in immediately in the case of potentially critical incidents. All phases of the review process are led by the CISO or another member of the security team, as appropriate.

companyName: MAGNITE, INC.

ticker: MGNI


text: The Company continuously monitors its information systems to proactively assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. The Company's process for identifying and assessing material risks from cybersecurity threats operates alongside the Company's broader overall risk assessment process. The Company's Computer Security Incident Response Team immediately investigates system alerts that may indicate the presence of a cybersecurity threat or incident and escalates information regarding the threat or incident as necessary to address it in a timely manner. The Company also maintains a computer security incident response plan with formalized workflows and playbooks. The computer security incident response plan, among other things, provides for inter-departmental coordination and management of cybersecurity threats or incidents to quickly assess the impact, mitigate risks to information systems, and work to resolve vulnerabilities. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems, test our systems infrastructure, and suggest improvements. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. Senior management meets regularly with the Company's risk-management team and internal and external auditors to evaluate the effectiveness of the Company's systems, controls, and management processes with respect to cybersecurity risks. The results of key assessments are reported in summary to our Board of Directors periodically.


text: Our CIO reports regularly to the executive team, providing updates on cybersecurity strategies, current threats, and long-term planning. Additionally, the CIO provides an annual cybersecurity update, presenting an overview of significant cybersecurity risks and their potential impact on internal controls.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and work with a third party managed service provider to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We and our third-party partners employ a range of tools and services, including regular network and endpoint monitoring and protection, audits, vulnerability assessments, and penetration testing, to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Principal Executive Officer and Principal Financial Officer.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: Our supplier community (including suppliers of IT services and other third-party service providers) plays a large role in Qualcomm's success, and we believe in engaging with our suppliers to help them protect against cybersecurity threats. We operate a supplier cybersecurity assurance program, which is integrated with our procurement processes and supported by the relevant groups within the legal organization, to assess and attempt to mitigate potential cybersecurity risks across our supplier community commensurate with their cybersecurity risk. Specifically, based on a risk classification of the supplier, our third-party risk management process includes steps such as the evaluation of a supplier's security controls, posture and maturity as well as the identification and treatment of cybersecurity-related risks.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees. The CISO is a member of the Company's Corporate Operations group and reports to our Chief Information Officer, who in turn reports to our Chief Operating Officer. Our CISO has cybersecurity experience spanning more than two decades. Prior experience includes senior security roles in large government agencies and Fortune 200 companies. He has spoken at area colleges and various industry events about information security. He holds a degree in electrical engineering, is a graduate of banking school, and maintains several industry certifications.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: The ongoing management of material risks from cybersecurity threats includes promoting security awareness throughout the Company, such as quarterly employee training, ongoing monitoring for cybersecurity threats and vulnerabilities, incident response planning, and data backup and retention and recovery readiness in accordance with our global business resilience planning policy and program. We have in place a comprehensive Security Incident Response Plan that outlines the policies and procedure to be followed in the event of an incident, including escalation and communication procedures.

companyName: StoneX Group Inc.

ticker: SNEX


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: The Company relies extensively on various information systems and other electronic resources to operate its business. In addition, nearly all of the Company's customers, service providers and other business partners on whom the Company depends, including the providers of the Company's online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of the Company's business, as a financial services provider, and the Company's relative size, make the Company and its business partners high-value targets for these bad actors to pursue. See Item 1A. Risk Factors—Operational, Strategic and Reputational Risks of this Form 10-K for additional information.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Our management team, with the assistance of our external service providers, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises the cybersecurity activities of both our internal personnel and our retained external cybersecurity consultants.

companyName: CADIZ INC

ticker: CDZI


text: We face cybersecurity risks as a result of the variety of networks and systems we must defend against cybersecurity attacks; and the level of harm that could occur if we suffer impacts of a material cybersecurity incident. We are committed to robust oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. In the year ended June 30, 2025, we did not experience a material "cybersecurity incident" as such term is defined in Item 106(a) of Regulation S-K. However, we have experienced two such material breaches in the past (see Form 10-K for the year ended 2023) and there can be no guarantee that we will not experience such incidents in the future. Such incidents could result in us incurring significant costs related to implementing threat protection measures, and the possibility of such incidents could result in additional costs in defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, cybersecurity threats are constantly evolving, increasing the difficulty of successfully defending against them or implementing adequate preventative measures. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable, we remain potentially vulnerable to known or unknown threats. In some instances, we may be unaware of a threat or incident or its magnitude and effects for some time. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" of this Annual Report for more information on our cybersecurity risks and product vulnerability risks.

companyName: BION ENVIRONMENTAL TECHNOLOGIES INC

ticker: BNET


text: Our cybersecurity risk management processes have been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. We identify our enterprise risks through each member of our management team, along with counsel from our internal auditors and attorneys and we present an assessment of our enterprise risks to our board of directors on an annual basis. Our information technology management plays an integral part in the identification and communication of cybersecurity risks to our management team. COMSTOCK RESOURCES, INC.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: We intend to work with outside counsel and third-party service providers in the near term to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.

companyName: Avenir Wellness Solutions, Inc.


text: Effects of Cybersecurity Risks on the Company To date, we are not aware of having experienced a material compromise of our systems or networks from a cybersecurity incident. However, we routinely identify attempts to gain unauthorized access to our systems. Additionally, some of our vendors and business partners have experienced compromises of their information systems, including systems that we use. On February 21, 2024, Change Healthcare, a subsidiary of UnitedHealth Group that acted as an intermediary for processing of our payment claims for all payors, notified us of a cybersecurity incident affecting some of its systems. In response to the incident, both we and Change Healthcare severed those business service connections between our systems and Change Healthcare's. We promptly conducted forensics on our systems based on the shared information regarding this Change Healthcare incident and did not identify any compromise or unauthorized access of our systems or networks. However, the incident did affect our ability to submit any claims for payment for a period of time until we implemented alternative modes for submissions. We have not identified any compromise or unauthorized access of our systems or networks, and the temporary disruption to our submission of claims did not materially affect our business strategy, results of operation or financial condition.

companyName: Encompass Health Corp

ticker: EHC


text: Key elements of our cybersecurity risk management program include but are not limited to, risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment;

companyName: TAITRON COMPONENTS INC

ticker: TAIT


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining limited access to our information and systems, and we could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. See also "Item 1A. Risk Factors — Operational Risks."

companyName: ORION ENERGY SYSTEMS, INC.

ticker: OESX


text: Third Party Risk Management The Company has implemented a vendor management procedure to identify, evaluate, and oversee cybersecurity risks posed by third parties, including vendors, service providers and external users of the Company's information systems, as well as third party systems that collect, store or otherwise interact with Company information. The Company conducts vendor assessments to review third party security measures, as well as adherence to relevant industry information security standards.

companyName: Telesis Bio Inc.


text: The Board of Directors is responsible for overseeing risk for the Company and has delegated to the Audit Committee responsibility for overseeing the cybersecurity risk management strategy for the Company. The Audit Committee reviews how we are executing against our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol. The Audit Committee receives regular updates on cybersecurity risks from our CIO. The Audit Committee also regularly receives updates on efforts regarding data loss prevention, regulatory compliance, data privacy, threat and vulnerability management, cyber-crisis management, and other topics as applicable. Additionally, management provides the Audit Committee with a cybersecurity dashboard, which the full Board of Directors can access as well.

companyName: SHYFT GROUP, INC.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and we work to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain.

companyName: CapForce Inc.

ticker: OPGN


text: Chemours recognizes the critical importance of maintaining a cybersecurity program to provide a secure and reliable computing environment protecting our information, systems and assets and to enable our digital transformation goals. Our cyber and information security program (the "Program") is based upon standards published by the National Institute of Standards and Technology ("NIST") in their Cybersecurity Framework. The goals of our Program are: • identifying, preventing, and mitigating cybersecurity threats to the Company; • preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; • protecting our intellectual property; • maintaining the confidence of our customers, business partners and other stakeholders; and • providing appropriate public disclosure of cybersecurity risks and incidents, when required.

companyName: Chemours Co

ticker: CC


text: e. Reviewing the IRP at least annually, or whenever there is a material change in the Corporation's business practices that may reasonably affect its cyber incident response procedures.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: In the event of an incident, we intend to utilize our ICT and follow our detailed incident program and processes, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying relevant functional areas, as well as senior leadership and the Board, as appropriate.

companyName: Northwest Natural Holding Co

ticker: NWN


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We have not been faced with any penalties or settlements related to cybersecurity.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. This multi-faceted approach to cybersecurity includes physical, administrative, and technical safeguards. During the year ended December 31, 2024, the Company utilized the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), to assess and report to the Company's executive management and Board of Directors on the current maturity of operational and procedural controls for securing and safeguarding the Company's information technology assets. The Company will continue to utilize the NIST CSF to evaluate its cybersecurity controls. In addition to the NIST CSF, the Company also completed third-party technical testing of its information technology systems architecture.

companyName: Veris Residential, L.P.


text: The board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk management, including cybersecurity. The Audit Committee receives an annual comprehensive report from the Company's President and Chief Financial Officer ("CFO") and Vice President ("VP") of IT Operations and Strategy covering the Company's cybersecurity posture, incidents, if any, and risk mitigation efforts, and receives ad hoc reporting of any material cybersecurity incidents.

companyName: DallasNews Corp


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Information Officer (CIO), who has 30 years of information technology experience and 15 years of cybersecurity experience, who oversees our information security program and is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer and other executive officers are responsible for setting budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Mission Produce, Inc.

ticker: AVO


text: The Audit Committee bears the primary responsibility for the board of directors' oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: CHUY'S HOLDINGS, INC.