text: We have developed detailed policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats as a part of our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications or requirements, however, we do use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: VirnetX Holding Corp

ticker: VHC


text: We have implemented a Data Protection Policy, or the DPP, in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of our information, data and assets, and to manage identified material cybersecurity risks. The DPP was prepared using relevant guidance issued and technology standards that are used across various industries. It applies to all entities who are using our equipment and resources, including but not limited to, employees and temporary workers. Our Senior Director, Information Technology, is a certified information security officer (CISO). He is primarily responsible for implementing and overseeing the DPP and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX

secItem: Item 1C


text: The Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full board of directors regarding its activities.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: Our enterprise risk management includes a comprehensive cybersecurity risk management program with policies, standards, processes and practices based on recognized industry standards and frameworks such as the National Institute of Standards and Technology (NIST), Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls.

companyName: Crane NXT, Co.

ticker: CXT


text: Our IT Security Steering Committee, which is led by our Chief Financial Officer, is composed of various members of our organization, including our VP of Software Engineering and Director of Information Systems and Security. The IT Security Steering Committee is involved in oversight of cybersecurity risk. The IT Steering Committee exercises this function through our IT Security Team, which includes our Director of Information Systems and Security and our VP of Software Engineering who collectively have over 40 years of experience. The IT Security Team is responsible for the administration of our cyber program and works with various vendors and external providers to test and monitor for vulnerabilities and threats. We also engage our employees in our cybersecurity efforts through a process for employees to complete annual security and awareness training.

companyName: Markforged Holding Corp


text: Our senior vice president, chief information officer, vice president, CISO, and vice president, chief product security officer have each served in various roles in IT and information security for over 20 years. These individuals' knowledge and experience along with the culture and talent of the corporate IT security team organization are instrumental in developing and executing our cybersecurity strategies. The CISO meets with senior leadership to review and discuss the cybersecurity program, including emerging cybersecurity risks, threats and industry trends.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "Risk Factors - Risks Related to Our Industry" included elsewhere in this Annual Report on Form 10-K.

companyName: TENAX THERAPEUTICS, INC.

ticker: TENX


text: We manage risks from cybersecurity threats through our overall enterprise risk management process. Management has created an information security program, which encompasses a dedicated information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. We "proactively" assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include internal audits, external audits, penetration tests, and engagement of third parties to conduct analyses of our information security program.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on their risk profile.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: We have developed and implemented a cybersecurity risk management program designed to protect critical assets, scale with business growth, identify and mitigate threats, and enable us to conduct our business securely. The program's design applies concepts from the frameworks of the National Institute of Standards and Technology ("NIST") as guidelines, incorporating their applicable principles while adapting certain elements to align with our specific operational needs and objectives. The program and other cybersecurity processes have been integrated into our overall risk management framework.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: To date, risks from cybersecurity threats have not materially affected us and we do not currently believe any risks from cybersecurity threats are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition. For further information, see "Item 1A. Risk Factors," under "Our business and operations would suffer in the event of computer system failures, cyber-attacks or deficiencies in our cyber-security."

companyName: ORAMED PHARMACEUTICALS INC.

ticker: ORMP


text: The CISO works closely with the legal and compliance organizations, as well as the relevant business units, to help ensure broad oversight of and compliance with legal, regulatory, and contractual cybersecurity requirements. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of work experience within the Southern Company system. The CISO receives reports on cybersecurity threats from a variety of sources both internally and externally on an ongoing basis and regularly reviews risk management measures implemented to identify and mitigate cybersecurity risks. Briefings to the Board on cybersecurity matters include annual briefings to the Audit Committee and the Operations, Environmental, and Safety Committee in addition to briefings to the BSRC at each of its regular meetings (at least five times annually).

companyName: SOUTHERN CO GAS


text: With respect to incident response, we have adopted a Cybersecurity Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the National Institute of Standards and Technology framework and focuses on four phases: • preparation and prevention; • detection and analysis; • containment, eradication and recovery; and • post-incident remediation.

companyName: DocGo Inc.

ticker: DCGO


text: is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Company's overall risk management processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: We employ processes and tools for assessing, identifying, and managing material risks from cybersecurity threats. These processes and tools are intended to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our processes and tools include procedural and technical safeguards, response plans, and reviews of our policies. We employ experienced information technology personnel to deploy and oversee these safeguards and to consult with members of our senior management team, including our Chief Executive Officer and our Principal Financial Officer and Principal Accounting Officer, regarding cybersecurity matters when appropriate. Our Audit Committee is provided an opportunity during each quarterly meeting to inquire regarding material cybersecurity threats, deficiencies, and other issues in discussion with members of management. We provide all employees and consultants with cybersecurity and prevention training.

companyName: XBiotech Inc.

ticker: XBIT


text: Board oversees the Company's cybersecurity risks management and reviews management reports on material cybersecurity risks and issues on an as-needed basis. The chief executive officer (the "CEO") and the chief financial officer (the "CFO") are responsible for discussing material cybersecurity incidents or threats with specific constituencies before sign-off, ensuring thorough review of information and disclosures. The CEO and CFO are also responsible for assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident, maintaining oversight of the disclosure in the periodic reports (including our annual reports on Form 10-K) of the Company.

companyName: Singularity Future Technology Ltd.

ticker: SGLY


text: We annually purchase cybersecurity risk insurance policies that would help defray the costs associated with a covered cybersecurity incident if it occurred.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Cybersecurity risk management is an important part of our overall risk management efforts. We maintain a cybersecurity program that is comprised of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we monitor cybersecurity vulnerabilities and potential attack vectors to company systems. We, directly and through our third-party service providers, maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess, identify and mitigate risks from cybersecurity threats. We and our third-party service providers conduct regular testing of these controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster recovery plan.

companyName: Salamander Innisbrook, LLC


text: Measures We Take to Monitor and our Procedures for Responding to Data Breaches or Cyberattacks We have made investments to address data and cybersecurity risks. These investments include our use of continuous third-party security monitoring of our network perimeters, advanced persistent threat group monitoring to keep us informed of emerging serious threats, standardization of our network security architecture which separates business and supervisory control and data acquisition (SCADA) networks, and security information and event management software systems.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Our Board has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee charter. Our Head of IT provides periodic updates to the Audit Committee regarding our cybersecurity risk management program, including information about cybersecurity risk management governance, as well as status updates on plans intended to enhance the overall cybersecurity posture of our company, as applicable. In the event of a cybersecurity incident, we have established a process for escalation to the Audit Committee as well as our Board, as appropriate.

companyName: Aura Biosciences, Inc.

ticker: AURA


text: Upon the occurrence of a cybersecurity incident, whether identified internally or through third-party cybersecurity notifications, we assess the incident's criticality and potential materiality and disclosure. This evaluation considers various factors, including service availability, operational impact, reputational consequences, regulatory and legal implications, data sensitivity, and direct financial impact. The CISO continuously monitors these criteria to determine the incident's potential impact, individually or in aggregate. We have established escalation procedures to promptly inform senior and executive management, the Board (or relevant subcommittees), and regulators, based on the incident's criticality and materiality.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: network security controls, system monitoring, incident detection and response, incident response policy, disaster recovery and business continuity plans, vulnerability management policy, penetration testing, encryption of data, data segregation controls, employee training, physical security cyber insurance, vendor risk management program, risk assessments, implementation of security standards/certifications, access controls, dedicated cybersecurity staff, and asset management, tracking and disposal.

companyName: Confluent, Inc.

ticker: CFLT


text: The underlying controls of the cybersecurity risk management program are based on recognized best practices consistent with National Institute of Standards and Technology, or NIST and Cybersecurity Framework, or CSF. We have invested and continue to invest in risk management and information security and data privacy measures in order to protect our systems and data, including employee training, organizational investments, incident response plans, and technical defenses. The cost and operational consequences of implementing, maintaining, and enhancing data or system protection measures could increase significantly to overcome intense, complex, and sophisticated global cyber threats.

companyName: CHARLES & COLVARD LTD


text: The Chief Information Officer provides briefings on cybersecurity threats and related risks to the Chief Executive Officer on a regular basis. Our Chief Information Officer has had responsibility over cybersecurity, data privacy and classification, incident response, disaster recovery, and business continuity in a number of positions in the field of information technology. The Chief Information Officer oversees and tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: Stran & Company, Inc.

ticker: SWAG


text: At Ingevity, we recognize the paramount importance of cybersecurity in safeguarding sensitive information. We are aligned with industry standards, such as the ISO 27001 cybersecurity framework. Our comprehensive cybersecurity program is led by a team of diverse, highly skilled professionals, and we invest in modern technologies, including artificial intelligence and machine learning, to fortify our defenses. We continue to collaborate with local, state and federal agencies and peers in the chemical manufacturing industry to identify the latest threats and implement effective defenses to protect our employees and customers.

companyName: Ingevity Corp

ticker: NGVT


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected us or our business strategy, results of operations, financial condition and/or cash flows. Moreover, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, financial condition and/or cash flows. See Item 1A, Risk Factors above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third party providers.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Our Interim Chief Executive/Chief Financial Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: Business Continuity and Incident Response. The Company has established and maintains comprehensive business continuity, disaster recovery, and incident response plans that address the Company's response to cybersecurity incidents, among other events that require resilient response. We conduct periodic tabletop exercises and other testing of these plans to enhance incident response preparedness for potential disruption to technology we rely on in our business.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our audit committee has been designated with the responsibility of overseeing our technology and information security, including cybersecurity, policies and practices, and the internal controls regarding information security. Our CTO provides quarterly updates to the audit committee on these topics, as well as cybersecurity risk exposure and steps taken to monitor and mitigate such exposure. The board of directors receives reports from management on our information security and cybersecurity matters on an annual basis. In addition, our incident response process provides that our audit committee is notified in the event of a material cybersecurity incident.

companyName: Coursera, Inc.

ticker: COUR


text: As part of the information security program, Prudential conducts periodic exercises with independent outside advisers to assess the effectiveness of its program and it internal response preparedness. Prudential regularly engages with the broader security community and monitors cyber threat information.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: Through Horizon's enterprise risk management framework and reporting functions, the Board, its Committees and Management assess and manage cybersecurity risks created by cybersecurity threats. Horizon's Vice President, Information Security and Audit Information Security officer ("Information Security Officer") provides an annual Information Security Program report to the Board and as needed when cybersecurity risk is elevated. Horizon's Senior Vice President, Senior Technology Officer is a member of the Cyber Security Committee and reports on cyber security risks at each meeting a minimum of three times a year. The Senior Vice President, Senior Technology Officer reports to the Executive Vice President, Senior Operations Officer, who also is a member of the Cyber Security Committee. For independence, the Information Security Officer reports to Horizon's Senior Vice President, Senior Auditor and Compliance Officer. Horizon's risk escalation framework requires progressive escalation of cyber security risks to Management and its Committees, then to Board Committees and, ultimately, to the Board.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: Like many companies, we face a number of cybersecurity risks in the day-to-day operation of our business. Although to date these risks have not materialized into any instances or series of instances that have had a material adverse effect on our business or otherwise caused material harm to the company, we have, on occasion, experienced cybersecurity threats to our data and information systems, including phishing attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "If we fail to meet the requirements to adequately maintain the privacy and security of personal data and business information, we may be subject to adverse publicity, litigation and significant expenses" in Item 1A Risk Factors.

companyName: Zumiez Inc

ticker: ZUMZ


text: While we have experienced, and expect to continue to experience, cybersecurity threats, we did not experience any material cybersecurity incident in the year ended December 31, 2023. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional information regarding cybersecurity risks, see "Risk Factors - Risks Related to Cybersecurity and Technology".

companyName: Finwise Bancorp

ticker: FINW


text: Vice President of Network Security is a Certified Information System Security Professional (CISSP) with over 10 years of experience in managing IT and cybersecurity operations.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: The Company accounts for cybersecurity risk as a part of the Company's overall business strategy and planning. The Board's Audit Committee, which oversees all matters related to risk management and, in particular, the security of and risks related to the Company's information technology systems, receives regular reports on the Company's cybersecurity risk management efforts from various senior officers of the Company. The Company also has a corporate cybersecurity risk Steering Committee, which is a cross-functional group comprised of both senior management and other key business unit leaders that provides input to senior management on the Company's cybersecurity risk program.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: We also incorporate intelligence sharing about emerging threats through collaboration with other companies in our industry, consultants and public-private partnerships with government intelligence agencies, such as the Arizona Cyber Threat Response Alliance ("ACTRA") and NCTA-The Internet and Television Association ("NCTA").

companyName: Cable One, Inc.

ticker: CABO


text: We review our cybersecurity technology stack and budget allocation by risk and review against the cyber threat landscape to ensure we are spending the right dollars to reduce the highest risk at that time.

companyName: Warner Music Group Corp.

ticker: WMG


text: We have not experienced any cybersecurity incidents that have been determined to be material in the past, however, like other medical device companies, we have experienced cybersecurity incidents and may continue to experience them in the future. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, Governance

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. WEC Energy Group's cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the United States Department of Energy to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of WEC Energy Group's security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, WEC Energy Group has established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: In November 2022, Kroll conducted a security maturity assessment of our security system. To perform its assessment, Kroll met with members of our key staff and requested to review documents including, but not limited to, our policies, procedures, past security assessments and penetration tests, documentation regarding network architecture, security road maps and plans. The Century Communities Information Security Team have been working with Kroll to identify potential deficiencies in each category and work to close the identified gaps. With Kroll's assistance, we have implemented several industry leading solutions, policies and practices to close those findings and matured Century's defense and resiliency postures. We also have developed an Information Security Incident Response Policy which has been peer reviewed by Kroll. Additionally, we have retained Kroll to assist us in conducting tabletop exercises to evaluate our incident response plan and response capabilities, most recently in September 2023.

companyName: Century Communities, Inc.

ticker: CCS


text: There can be no assurance the Company will not experience material effects from security breaches in the future. As cyber threats develop and grow, the Company may need to make significant further investments to protect data and its infrastructure, including the implementation of new computer systems or upgrades to existing systems, deployment of additional personnel and protection-related technologies, engagement of third -party consultants, and training employees. See Item 1A - Risk Factors above for additional discussion of various cybersecurity risks.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program. Regular cybersecurity risk assessments are conducted, leveraging both internal and external sources of information to drive alignment on initiatives aimed at enhancing security controls. We maintain a cybersecurity incident response plan that identifies the activities and escalation processes to be implemented upon detection of a cybersecurity incident, and we regularly test and evaluate the effectiveness of such plan.

companyName: OppFi Inc.

ticker: OPFI


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to prepare for the incident, while complying with potentially applicable legal obligations and mitigate damage to our business and reputation.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: We intend to leverage the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we will develop a formal, documented process to assess the data protection practices of certain third-party vendors that may handle sensitive information on our behalf.

companyName: Cannaisseur Group Inc.

ticker: TCRG


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: Safehold Inc.

ticker: SAFE


text: We consider the management of cybersecurity risk in our overall enterprise risk management program. See "Item 7. Management's Discussion and Analysis - Enterprise Risk Management" for further discussion of the program.

companyName: AVISTA CORP

ticker: AVA


text: Processes for Assessing, Identifying and Managing Cybersecurity Risks We are continuously assessing and adopting new processes, systems and resources in an effort to make our business safer from cybersecurity threats. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with our employees and third-party customers and service providers. We also collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary information for our business and that of our customers, suppliers, investors and other stakeholders.

companyName: ANTERO RESOURCES Corp

ticker: AR


text: The Audit Committee receives data protection and cybersecurity reports quarterly from our Chief Information Officer, which the Audit Committee shares with the full Board of Directors. The Board of Director's responsibility is to monitor our risk management processes by understanding our material risks and evaluating whether management has reasonable controls in place to address those risks. The involvement of the Board in reviewing our business strategy is an integral aspect of the Board's assessment of management's tolerance for risk and what constitutes an appropriate level of risk. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to certain risks to the Audit Committee. As such, the Audit Committee is responsible for reviewing our risk assessment and risk management policies. Accordingly, management regularly reports to the Audit Committee on risk management, and in turn, the Audit Committee reports on the matters discussed at the Committee level to the full Board. The Audit Committee and the full Board focus on the material risks facing us, including operational, technology and cybersecurity, reputational, market, credit, liquidity and legal risks, to assess whether management has reasonable controls in place to address these risks.

companyName: BJs RESTAURANTS INC

ticker: BJRI


text: Primerica has processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats which are integrated into Primerica's enterprise risk management system. Primerica's enterprise risk management and internal audit functions conduct regular assessments and audits of risks from cybersecurity threats and report the results to the Board of Directors at least quarterly. The Board considers cybersecurity risk as part of its business strategy, risk management, and financial oversight.

companyName: Primerica, Inc.

ticker: PRI


text: Related to Cybersecurity Risks engage a managed services provider, which includes virtual chief information officer (vCIO) services, to assist us with the identification, monitoring and management of risks from cybersecurity threats. Our managed services provider reports on our cybersecurity posture periodically to our management team and audit committee. We have also formed an IT Steering Committee, whose members include cross functional representatives from our management team as well as our managed services provider, to review our cybersecurity program initiatives and related program metrics. The Committee is also charged with identifying and implementing improvements that strengthen our risk mitigation systems.

companyName: Vivani Medical, Inc.

ticker: VANI


text: Our Vice President of Finance and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Vice President of Finance and representatives from our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: monitoring of Company computer and information systems for potential malware, ransomware and other malicious activity, and remediation of identified issues, including mitigation of identified risks and containment and elimination of any malicious software; mandatory cybersecurity training as part of new employee onboarding along with required annual employee cybersecurity re-training; monitoring of systems and network infrastructure by security information and event management application;

companyName: Cyclo Therapeutics, Inc.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of certain data, network security controls on certain networks, data segregation, Wi-Fi segregation, access controls for certain environments, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: • Identity Access Management support and governance • Security Architecture oversight and guidance • Governance, Risk and Compliance ("GRC") functions such as third-party risk management, cybersecurity policies, training, and awareness • Annual and independent penetration testing and vulnerability scanning activities conducted by trusted third parties • Transition services provided by our Former Parent, as part of the Spin, effective June 2023 and through the exit of the transition service agreement Third party risk management, including, but not limited to, the following: • Periodic third party reviews and assessments measuring cybersecurity services capability and maturity.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: incident reports and issued identified from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our regularly scheduled board meetings, the IT Manager regularly communicates with senior staff regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the board, ensures the board's oversight is proactive and responsive. The board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: The Company's enterprise Information Security department is primarily responsible for monitoring and managing the Company's ISP, under the supervision of Old National's Chief Information Security Officer ("CISO"). The Information Security department's responsibilities generally include cybersecurity risk assessment, identification and implementation of preventive measures, incident response, vulnerability assessment, threat intelligence, identity access governance, and business continuity and resilience.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: The Bank's Information Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with the Gramm-Leach-Bliley Act and the interagency guidelines issued thereunder, and applicable laws.

companyName: Federal Home Loan Bank of New York


text: CBIZ maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, which is integrated into the Company's enterprise risk management system, includes the development, implementation, and maintenance of security measures and controls, as well as policies and procedures governing the operation of these security measures and controls.

companyName: CBIZ, Inc.

ticker: CBZ


text: To date, we have not experienced any cybersecurity incidents that materially affected our business strategy, results of operations or financial condition.

companyName: INSPIRE VETERINARY PARTNERS, INC.

ticker: IVPR


text: This Board committee meets quarterly and receives information concerning cyber risk activities, including cyber risk assessments and incident reporting. The Board also receives an annual report covering cyber risk from the Chief Information Technology Officer. Controls over cyber risk are reviewed throughout the year by internal audit activities and third-party assessments whose reports are reviewed by the Board's Audit Committee.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Our Board of Directors administers its cybersecurity risk oversight function directly through our Audit and Finance Committee ("AFC"). Our AFC has primary responsibility for overseeing our risk management practices, programs, policies, and procedures related to data privacy, data protection, and cybersecurity. The AFC reviews and evaluates the processes utilized by management to identify and assess the material internal and external risks that may affect the Company's business. Our AFC regularly discusses with management, Company legal counsel, and the internal audit department the Company's major risk exposures. This includes potential financial impact on the Company and the steps taken to monitor and control those risks. Reviews with management are done annually which includes a summary of legal and regulatory compliance matters and risk management activities, including a review of the Company's cybersecurity program. Additionally, our AFC oversees the process by which our Board of Directors is informed regarding the risks facing the Company and coordinates with the Company's legal counsel to ensure our Board of Directors receives regular risk assessment updates from management.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: Our CIO holds an undergraduate degree in Computer and Electrical Engineering and has served in various roles in information technology for over 25 years, including serving as either the chief technology officer or chief information officer for two large public companies and a technology start-up.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO and Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: T Series Middle Market Loan Fund LLC


text: Our information security function, which is led by our Vice President and Head of Information Technology, known as our Head of IT, and supported by our security management, risk management, and legal teams, helps identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, coordinating with law enforcement concerning threats, internal and external audits, leveraging internal and third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.

companyName: Silence Therapeutics plc

ticker: SLN


text: Cybersecurity Risk Management and Strategy Riley Permian recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, harm to our employees, suppliers or industry partners, intellectual property theft, fraud, extortion, and violation of data privacy or security laws. We use a risk management framework based on applicable laws and regulations, and informed by industry standards and industry-recognized practices for identifying and managing cybersecurity risks within our operations, infrastructure, and corporate resources.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: The Enterprise Risk Management Committee ("ERMC") is responsible for overall risk governance and management across Tompkins. As such, the committee reviews cyber risk exceptions, emerging risks, minutes from the TISC meetings, and reports on the health and risk associated with the Program. The ERMC is comprised of senior leadership team members as well as critical subject matter experts with risk management experience. The ERMC reports information about risk to the Audit and Risk Committee on a quarterly basis. The ERMC is chaired by the Director of Enterprise Risk Management and the Chief Risk Officer, who oversees the governance of enterprise-wide Risk Management program(s).

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: As part of our cybersecurity risk management program, we maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business. Further, all personnel are required to undergo cybersecurity training during onboarding and, thereafter, on an annual basis to reinforce the Company's information security policies, standards and practices.

companyName: Phreesia, Inc.

ticker: PHR


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: We also involve external cybersecurity experts to assess our cybersecurity program, risk management, and relevant internal controls. In addition to our cybersecurity programs and policies, the Company also purchases a cybersecurity risk insurance policy to limit its exposure to cybersecurity incidents.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: We are committed to protecting our intellectual property, customer and employee data, and the information technology systems critical to keeping our customers, employees, contractors and others aligned and allowing our operations to function properly. Our Board of Directors and its committees are involved on an ongoing basis in the oversight of our material enterprise-related risks, including cybersecurity risks. Our processes for oversight of cybersecurity-related risks are fully integrated into our overall enterprise risk management program, which is led by our General Counsel. We assign a member of our executive management team to report material information to our Board of Directors regarding each of our most significant enterprise risks. We have identified a separate risk for enterprise cybersecurity. The Audit Committee, in consultation with the Chief Information Officer, provides primary oversight for cybersecurity risk for the company.

companyName: MARCUS CORP

ticker: MCS


text: Our cybersecurity policies and practices are regularly reviewed and updated in order to align with evolving threats and regulatory requirements to help ensure the Company complies with relevant laws and regulations and proactively manages cybersecurity risks.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Risk Management and Strategy our business operations, we use information technology, enterprise applications, communications tools, cloud network solutions, and related systems to manage our operations, including to manage our building systems, vendor relationships, accounting and recordkeeping, and communications, among other aspects of our business.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Our operations are dependent upon information systems that support our business processes. In the ordinary course of our business, we collect and store certain confidential information such as information about our business partners, investors, contractors, vendors, and suppliers.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: Our cybersecurity program interfaces with other functional areas within our company, including but not limited to, our company's business segments and information technology, legal, risk, human resources and internal audit departments, as well as external third -party partners, to identify and understand potential cybersecurity threats. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the " C-ROC "), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.

companyName: Blue Owl Capital Corp II


text: third-party cybersecurity consultants, who conduct periodic penetration testing and vulnerability assessments to identify potential weaknesses in our systems and processes; and periodic cybersecurity training for our workforce.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Our Senior Director of Information Technology (IT), internal IT, information security and legal functions, and third-party service providers (collectively, Cybersecurity Team) help identify, assess and manage our cybersecurity threats and risks. Our Cybersecurity Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment. The Cybersecurity Team uses various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, scanning the threat environment, evaluating our and our industry's risk profile, maintaining policies designed to coordinate our efforts with law enforcement to respond to threats, internal and external audits, conducting threat assessments, conducting third party threat assessments, and conducting vulnerability assessments.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: The Audit Committee receives reports, briefings and presentations from senior management, including our Head of Cybersecurity, at periodic committee meetings, including, on a rotating basis, in-depth presentations on specific areas of risk and regular enterprise risk management updates. In addition to our scheduled meetings, our Global Incident Response Plan ensures that significant developments or incidents, even if immaterial to us, are reviewed regularly by a cross-functional team to determine whether further escalation to the Audit Committee is appropriate, ensuring the committee's and the Board's oversight is timely and responsive. Our Global Incident Response Plan also includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Wayfair Inc.

ticker: W


text: No cybersecurity incident during the year ended December 31, 2023, or prior, resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations. The scope of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information.

companyName: SSR MINING INC.

ticker: SSRM


text: The responsibility for managing and assessing material risks from cybersecurity threats lies with the Company's IT Steering Committee, which met five times during 2024. The IT Steering Committee is made up of five members of senior management having legal or corporate finance backgrounds. The committee also includes one lead representative of the third-party IT management and security service providers utilized by the Company to mitigate cybersecurity risks as discussed above. Information regarding cybersecurity risks and mitigation efforts is reported periodically by the IT Steering Committee to the Company's chief executive officer, chief financial officer, and Audit Committee. The Audit Committee is primarily responsible for the Board of Directors ' oversight of cybersecurity risks. The Company created and hired a new role in early 2025, Vice President of Information Technology and Cybersecurity, which is expected to enhance the management and oversight of cybersecurity.

companyName: Ramaco Resources, Inc.

ticker: METC


text: Our cybersecurity governance framework includes oversight by the Audit Committee of the Board, which reviews the effectiveness of the Company's management of cybersecurity, data privacy and other data- and technology-related risks, controls and procedures. The CISO reports regularly to our Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our ISMS program is regularly evaluated by external experts with the results of those reviews reported to senior management and the Board. The Audit Committee and, as appropriate, the Board, also receives prompt and timely information regarding any high severity cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Vimeo, Inc.


text: Our Information Security Officer is accountable for managing the information security department and executing the information security program. The information security department is responsible for cybersecurity risk assessments, alert monitoring, incident response, vulnerability assessment, threat intelligence, identity access governance, and third-party information security risk management. The department consists of information security professionals with varying levels of education, experience and certifications. Our information security department is further supported by our first line of defense, the Information Technology department and a third-party managed service security provider.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: Threats from Third Party Service Providers Our processes also address cybersecurity threat risks associated with our use of third-party software and system providers. Third-party risks are included within our enterprise risk management assessment program, which is discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.

companyName: GLAUKOS Corp

ticker: GKOS


text: Alcoa has implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to a security risk assessment prior to engagement to determine if they meet defined levels of security capabilities. Our master services agreements with third-party service providers generally carry a number of security requirements, including audit rights for the Company. After engagement, third-party service providers are subject to audits in which contract owners within Information Technology Automation Solutions (ITAS) validate that any certifications a vendor had upon engagement are maintained throughout the life of the agreement.

companyName: Alcoa Corp

ticker: AA


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management, regarding phishing, malware and other cyber risks; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, disrupt service to clinical trial sites, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Regular assessments and testing of our cybersecurity safeguards are conducted by independent third-party cybersecurity experts. Our internal audit department additionally conducts regular audits to assess management's processes and controls employed to identify and manage material cybersecurity risks. We use a variety of layered applications to alert us to suspicious activity.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: We have identified, and as a result monitor, cybersecurity as an enterprise risk of the Company. We have an Information Security Steering Committee that meets quarterly to review the cybersecurity threat landscape, current risks, incidents and program management. We routinely assess the cybersecurity threat landscape, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: Our cybersecurity risk management processes are integrated into our overall risk management system through our risk management committee structure. These committees have processes to help facilitate appropriate and effective oversight of cybersecurity risk, including tracking and reporting of cybersecurity risks and remediation plans. The Technology Risk Committee, which is a standing subcommittee of the Operational Risk Committee, is responsible for the oversight of policies and practices relating to the identification, assessment, measurement, monitoring and management of our technology and information security risks. The Technology Risk Committee is chaired by our Chief Technology Officer and members include our Chief Information Officer, Chief Information Security Officer, and administrators of key business systems. The Technology Risk Committee reports regularly to the Operational Risk Committee, which reports to the Executive Risk Committee, which includes our Chief Executive Officer and other executive officers. Through this committee reporting structure, management is informed about and monitors the information security program and its management of cybersecurity risks and incidents.

companyName: SANDY SPRING BANCORP INC


text: Impact of Cybersecurity Events In the fourth quarter of 2023, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or would reasonably be likely to materially affect Graybar, including our business strategy, results of operations or financial condition.

companyName: GRAYBAR ELECTRIC CO INC


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, threat intelligence service providers, and professional services firms.

companyName: Personalis, Inc.

ticker: PSNL


text: We use advanced threat detection tools and technologies to identify potential cybersecurity risks. This includes continuous monitoring, intrusion detection systems, and anomaly detection mechanisms, to promptly identify any unusual activities or security breaches. Threat intelligence sharing with industry partners helps ensure we stay informed about the latest cybersecurity threats.

companyName: LITHIA MOTORS INC

ticker: LAD


text: We have implemented a risk-based approach, guided by Federal Information Processing Standards Publication 199, to identify, classify, and appropriately assess the range of cybersecurity threats that could affect our business and information systems. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: We engage assessors, consultants, or other third parties for supplemental cyber monitoring and assessment of cybersecurity policies and controls in support of the risk assessment. We contractually require key and/or relevant third-party service providers to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Depending on the severity of the suspected breach these reports may be among the information supplied to our Chief Information Officer.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: urban-gro adheres to the NIST Cybersecurity Framework 2.0, which provides a set of standards, guidelines, and best practices to manage cybersecurity-related risks. We have developed and documented our systems disaster recovery plan, which outlines the roles, responsibilities, and procedures for restoring our critical systems and data in the event of a cyber incident. We have also crafted over 12 internal policies to help maintain a secure environment, such as our information security policy, our data classification policy, our incident response policy, and our password policy. We regularly conduct phishing simulations, vulnerability scans, penetration tests, and audits to test the effectiveness of our controls and backups, and to identify and remediate any gaps or weaknesses in our cybersecurity posture.

companyName: urban-gro, Inc.

ticker: UGRO


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers and we continually monitor cybersecurity threat risks identified through such diligence.

companyName: Talkspace, Inc.

ticker: TALK


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: The Company takes measures designed to mitigate risks associated with third-party vendors that have access to confidential information or provide business critical functions. Through its vendor management program, the Company screens these third-party vendors to assess their data security protocols both prior to initial engagement and periodically thereafter for compliance with the program standards. The Company seeks contractual obligations from third-party vendors to notify it in the event of a cybersecurity incident, and monitors threat intelligence reports as well as current reports of SEC-registered vendors and their sub-service providers that have access to confidential information or provide business critical functions for cybersecurity incidents.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Both the CRO and ISO provide routine reports to various management committees and at the Board level—namely the ACR Committee and the Board of Directors—regarding the overall status of the Information Security Program. Such reporting encompasses various aspects, such as risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents or violations and Management's responses, and recommendations for changes to the Information Security Program. The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. Additionally, the Board of Directors' Corporate Governance/Nominating Committee considers information technology and cybersecurity expertise when assessing potential director candidates, to help ensure the Board of Directors has the capability to appropriately oversee Management's activities in these areas.

companyName: First Financial Northwest, Inc.


text: follow a practical approach to Cyber Security governance. Cyber Security governance is handled primarily within the IT team and reported directly to the CEO or any affected key management personnel as appropriate.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: Unauthorized access: Unauthorized access could be due to password theft, malware attacks, employee involvement, or hackers. Preventing unauthorized access is a top priority within our cybersecurity protocols.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: Our cybersecurity risk management program includes the monitoring of our systems and networks for vulnerabilities, threats and, intrusions; coordination of our response to cybersecurity incidents; the training for our management and employees on new and developing risks and threats. Finally, our cybersecurity risk management program includes procedures to facilitate that information regarding cybersecurity incidents are shared with the Board to enable assessments related to disclosure and notice requirements to be timely and correctly made.

companyName: ExcelFin Acquisition Corp.


text: Our cybersecurity risk management program, thus, includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; a written cybersecurity incident response plan;

companyName: Endeavor Group Holdings, Inc.


text: Our Chief Information Security Officer (CISO), who reports directly to the CTO, is responsible for day-to-day assessment and management of cybersecurity risk. Our CISO has over 20 years of experience in various roles related to information security and related technology, including previously serving as Vice President of Information Technology and Senior Vice President of Information Technology at other companies, and holds a Bachelor of Science in Math and a Master of Business Administration in Computer Information Systems and Information Technology. The CISO's responsibilities in prior roles at large, global fintech and healthcare companies has included initiatives to identify and reduce cybersecurity vulnerabilities.

companyName: NCR Voyix Corp

ticker: VYX


text: First, we assess if the risk is related to our overall cybersecurity program, business continuity, privacy compliance, or financial risk. Second, we designate a strategy for each identified risk, including acceptance, avoidance, transference, and mitigation.

companyName: Rubicon Technologies, Inc.


text: Integration into Overall Risk Management System or Processes Our risk management systems and processes comprise numerous components, including published policies and procedures, risk detection systems, tools, and protocols (automated and human), internal and external independent auditing, management committee review, defined lines of communications, employee training, engagement of outside advisors and experts, assessment and utilization of both commercial and self-insurance opportunities, customer contract standardization where possible, legal review of vendor engagements and new products for regulatory compliance, regular operations reviews with the Chief Executive Officer and Risk Committee. E2open utilizes the foregoing systems and processes to best ensure effective management of our risks and associated cybersecurity threats. The EVP reports to the Risk Committee at least quarterly on the status of our Cyber Risk Program.

companyName: E2open Parent Holdings, Inc.


text: We engage third parties in connection with our risk assessment processes. These service providers assist us to monitor, enhance and test our safeguards. We oversee and identify risks from cybersecurity threats associated with the use of a third party service provider in the same way as any other situation with regard to potential cybersecurity threats.

companyName: Applied UV, Inc.

ticker: AUVI


text: The Company is not aware of any cybersecurity risks, including as a result of any cybersecurity incidents during 2023, that have materially affected or are reasonably likely to materially affect it, including its business strategy, results of operations, or financial condition. Third parties with access to sensitive data or systems are subject to due diligence and ongoing monitoring.

companyName: Employers Holdings, Inc.

ticker: EIG


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: As a regulated financial institution, we have designed our cybersecurity program based on the requirements of the Gramm-Leach Bliley Act of 1999 ("GLBA") and the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool. Our processes for identifying, assessing and managing material risks from cybersecurity threats includes reliance on the FFIEC Cybersecurity Assessment Tool as well as recurring audits and assessments of our cybersecurity program and controls. In addition to the above, we periodically (and at least annually) conduct an overall inherent cybersecurity risk assessment based on threats, the likelihood of the threats, and the potential impact of these threats to the Company. We conduct this assessment by reviewing industry-recognized breach reports, identifying the top threats, calculating the likelihood and impact of these threats, and thereby determining our overall inherent risk. We then use the Cybersecurity Assessment Tool to establish a risk profile. Based on the risk profile, the FFIEC Cybersecurity Assessment Tool recommends a program maturity level, which we use to determine whether we have the requisite minimum security controls in place that are effective. This control evaluation then helps us to determine our cybersecurity residual risk and whether we need to implement any additional controls. In addition to using FFIEC Cybersecurity Assessment Tool, we evaluate the robustness and effectiveness of our cybersecurity program both internally and externally with periodic internal risk assessments, and internal and third-party audits. We also use third party assessments to simulate threat actors to test and evaluate our cybersecurity controls and the effectiveness of our overall program. As part of our cybersecurity program, we have developed an incident response plan based on industry-standard cybersecurity frameworks, with procedures for responding to and remediating a cyber-incident, which also includes a process to activate our business continuity plan, if necessary. We also review and test our incident response plan through simulations and assessments. Furthermore, we employ recurring security awareness training for employees and produce recurring security awareness material for our customers.

companyName: HOPE BANCORP INC

ticker: HOPE


text: The Board Technology Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to the overall role of technology in executing the business strategy of the institution, including but not limited to major technology investments, technology strategy, operational performance and technology trends that may affect customers. The Board Technology Committee meets regularly and receives reports from the CTO and ISA on cybersecurity and information technology risks. The Board Technology Committee reports to the Board of Directors through Committee minutes. The Board's Audit Committee also has oversight responsibility for audits related to information technology, security and information technology governance.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: The CISO, CIO, and certain members of their management team who are involved in implementing the Company's cybersecurity program possess expertise in cybersecurity risk management. Our CISO and CIO each have many years of experience in designing and implementing cybersecurity frameworks and working to mitigate cyber threats. Among other qualifications, certain members of the CISO's and CIO's management team also have certifications as a CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager).

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: Finally, the IRP is also supported by a full curriculum of training for engineering and non-engineering employees that is drafted and administered under the supervision of our Director of Security. Importantly, these training sessions include several modules and quizzes for both technical and non-technical employees to assist our employees in comprehensively understanding the importance of data security to our stakeholders and our business and the various ways they can promote a security environment throughout our Company.

companyName: ContextLogic Inc.


text: Our cybersecurity risk management program includes: • physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third-party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services, and broader enterprise IT environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

companyName: Coinbase Global, Inc.

ticker: COIN


text: Vendor Management In providing our products and services, we make extensive use of third-party vendors and applications. We onboard material vendors through a vendor review process, which includes a security assessment and a determination of what is required (for example, policies, procedures, technical controls, or physical controls) in an effort to securely configure any interaction with them. Vendors providing certain services may be subject to greater scrutiny, including reviews of any relevant certifications and/or independent testing of their products or systems. Certain vendors are reviewed annually in an effort to assess continued compliance with their obligations to us, and as relevant, the risk that they pose to our cybersecurity posture. Such reviews typically depend on the nature of the data and/or systems that these vendors may have access to or with which they otherwise interact.

companyName: Life360, Inc.

ticker: LIF


text: Our Chief Technology and Product Officer, who possesses a 20-year track record in product development and engineering, eight years of which consist of overseeing technology, including the oversight of information security systems, reports directly to our Chief Executive Officer. This extensive experience spans both public and private companies.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: Our Board of Directors ("the Board") is responsible for oversight of our information security program. The Audit Committee, Enterprise Risk Committee, and the Information Technology Leadership Team support the Board in the oversight of our information security program and are focused on cybersecurity and data privacy risk, including compliance with all applicable laws and regulations, incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.

companyName: Mistras Group, Inc.

ticker: MG


text: We design and evaluate our program based on industry recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: Incident Response Procedures The Company's cybersecurity incident response plan is a critical component of the overall cybersecurity strategy. This plan outlines the procedures and actions to be taken in the event of a cybersecurity incident to minimize impact and ensure a swift recovery. Key elements of the Company's incident response plan include: • Incident discovery and confirmation: the Company has established clear protocols for identifying and reporting suspected cybersecurity incidents. Employees are trained to recognize potential incidents and report them immediately to the Company's IT security team. • Incident assessment and classification: upon receiving a report of a potential incident, the Company's IT security team conducts a thorough assessment to determine the nature and severity of the incident. Incidents are classified based on their impact and risk level. • Containment and continuity: once an incident is confirmed, the Company takes immediate steps to contain and mitigate its impact. which may involve isolating affected systems, applying security patches, or implementing other remedial actions. • Eradication and recovery: after containment, the Company works to eradicate the root cause of the incident and restore affected systems to normal operation, which includes evicting threat actors, removing malware, repairing vulnerabilities, and validating system integrity. • Communication and reporting: the Company maintains clear communication channels to keep all relevant stakeholders informed throughout the incident response process, which includes internal communication with employees and external communication with customers, regulators, and other parties as necessary. • Post-incident review and improvement: following the resolution of an incident, the Company conducts a post-incident review to identify lessons learned and areas for improvement, which helps enhance incident response capabilities and prevent future incidents.

companyName: LINDSAY CORP

ticker: LNN


text: We rely on information technology and data to operate our business and advance our pipeline of product candidates. Our critical information technology includes computer networks, third-party hosted services, communication systems, software and infrastructure and our critical data includes confidential, personal, proprietary and sensitive data (collectively, Information Assets). Accordingly, we maintain a process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our Information Assets and mitigate harm to our business.

companyName: BioCardia, Inc.

ticker: BCDA


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our systems and data. We use third-party service providers to assist us from time to time with the identification, assessment, and management of material cybersecurity risks. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers, as well as other third-party suppliers and business partners, which may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating cybersecurity threats or incidents, and such threats or incidents may have a material adverse effect on us. While ISG maintains cybersecurity insurance, the costs related to cybersecurity threats or service disruptions to both ISG and our clients may not be fully insured. For more information regarding the risks we face from cybersecurity threats, see the risks identified under "Risks Related to Data, Cybersecurity and Confidential Information" found in "Part 1A, Risk Factors" of this Annual Report on Form 10-K.

companyName: Information Services Group Inc.

ticker: III


text: Like any other technology company operating in today's environment, we have experienced cybersecurity incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors – Risks Related to Our Business, Operations, and Industry – Cybersecurity attacks and incidents and other vulnerabilities could subject us to costly damages, claims and expenses, harm to our reputation or competitive position, or disrupt our operations and business."

companyName: COHERENT CORP.

ticker: COHR


text: The Board is responsible for overseeing the Company's enterprise risk. The Security Council reports to the Board on cybersecurity risks. In addition to our ongoing ordinary course cybersecurity oversight procedures, we also have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and the Board informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Security Council, executes in the event of a cybersecurity incident that is designed to provide timely and accurate information flow, escalation for remediation and consideration of public disclosures, and resolution of cybersecurity incidents. Our cybersecurity framework includes periodic compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we seek to validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits. We also conduct annual cybersecurity tabletop exercises, with the intent of validating our IR policies and procedures.

companyName: Skillz Inc.

ticker: SKLZ


text: We have experienced cybersecurity attacks in the past and may experience attacks in the future, potentially with more frequency or sophistication. Although past attacks have not materially impacted our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors — Risks Relating to Business Continuity, Cybersecurity and Privacy and Data Protection."

companyName: Paramount Global


text: We have integrated cybersecurity risk management as part of our company-wide culture. The measures undertaken include, but are not limited to, monthly cybersecurity training for all employees and frequent communication to all employees on the importance of cybersecurity measures.

companyName: H2O AMERICA

ticker: HTO


text: KIMBERLY-CLARK CORPORATION - 2024 Annual Report Cybersecurity risk management is included within our overall enterprise risk management program which is overseen by our Global Risk Oversight Committee ("GROC"). The GROC is composed of executive officers and other senior leaders and coordinates with other risk assurance functions, including internal audit and compliance. The GROC receives regular briefings concerning cybersecurity risks and risk management processes.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. We have an enterprise risk management framework that is designed to identify, measure, control, monitor and mitigate risks across various aspects of our business and operations, including, credit, interest rate, liquidity, operational, regulatory compliance, strategic, reputational, and legal risks. As we rely and continue to increase our reliance on technology and given the constant state of cyber threats, information security or cybersecurity is a significant component of our enterprise risk management framework. Our Chief Information Security Officer, a key member of our risk management organization, who has overall responsibility, accountability, and ownership for this cybersecurity component, reports directly to the Chief Risk Officer and periodically presents reports to the Risk Committee of our Board of Directors.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: Board of Directors oversees our risk management process, including cybersecurity risks. The Audit Committee oversees our enterprise risk assessment. The Audit Committee's meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity. Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program.

companyName: Lightstone Value Plus REIT III, Inc.


text: In addition, our Vice President, Information Technology, who has more than 20 years of industry experience and over 25 years of experience with the development, training and controls of effective global enterprise cybersecurity programs, oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes (i) reviewing our enterprise risk register, (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program, (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our Vice President, Information Technology in implementing our cybersecurity program and internal reporting, security and mitigation functions.

companyName: Transocean Ltd.

ticker: RIG


text: The Risk Committee of the Board of Directors receives regular reports on cybersecurity from the CISO. The CISO is responsible for the design and execution of the Security Program, which is supported by the governance structure defined within the Risk Framework. The CISO reports as necessary to executive management, the Risk Committee of the Board and the Board of Directors on cyber and information security issues and the effectiveness of the Company's cyber and information security program. The Risk Committee of the Board and the Board of Directors receive the results of the Company's annual cybersecurity risk assessment. Aligned with leading industry standards, including the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework, the Security Program is built upon a foundation of policies, standards and procedures, which leverage the National Institute of Standards and Technology standards, to help safeguard customer information and reduce the risk of cyber incidents and breaches. The Security Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks.

companyName: M&T BANK CORP

ticker: MTB


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: In addition, we have a cybersecurity disclosure committee ("Cybersecurity Disclosure Committee") which receives updates on an as needed basis from our security organization regarding cybersecurity incidents. The Cybersecurity Disclosure Committee includes our CIO and senior representatives from finance, controllership, internal audit, investor relations, and legal teams. In the event of a cybersecurity incident, the Cybersecurity Disclosure Committee meets to assess the incident for materiality and required disclosure.

companyName: Symbotic Inc.

ticker: SYM


text: The Company recognizes the importance of being able to effectively respond to and manage cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of its information systems, data or network resources.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: The Company also maintains a robust Vendor Risk Management program to manage risks related to third -party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments with respect to the appropriate safeguarding of sensitive information.

companyName: Provident Bancorp, Inc. /MD/


text: A security team led by our Chief Information Officer principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;

companyName: Shake Shack Inc.

ticker: SHAK


text: We also consider cybersecurity, along with other business risks, within our enterprise risk management framework. Our assessment, identification and management of cybersecurity and data privacy risks are reported as part of our regular enterprise risk assessments, security audits and risk management programs. In addition, we leverage recognized consulting firms to conduct application security and penetration testing assessments annually. We also require employees with access to information systems, including all corporate employees, to undertake cybersecurity training and compliance programs annually.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: The Audit Committee of the Board of Directors oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from Pillar's Director of Information Technology regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, a detailed incident response plan is in place for contacting authorities and informing key stakeholders, including management. We do not believe we are reasonably likely to be materially affected from cybersecurity threats, including as a result of previous incidents.

companyName: TRANSCONTINENTAL REALTY INVESTORS INC

ticker: TCI


text: SLB maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company’s enterprise risk management system and addresses both the corporate information technology environment and customer-facing products.

companyName: SLB LIMITED/NV

ticker: SLB


text: We take a risk-based approach in implementing and maintaining various information security processes designed to identify, assess and manage material risks from threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials, products in development, and proprietary technologies ("Information Systems and Data").

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: We implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our customers and outfitters.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: We recognize the critical importance of protecting our information technology ("IT") systems and the data of our employees, customers, patients, and partners. We have an enterprise-wide cybersecurity program designed to identify, detect, investigate, protect, and respond to cybersecurity risks.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact on us, see the cybersecurity risk factor within "Item 1A. Risk Factors" in this Form 10-K.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: Through its role in providing oversight for the Company's ERM framework, the Risk Committee of the Kemper Board of Directors (the "Risk Committee") provides oversight of the Company's information security program. On a quarterly basis, management discusses Kemper's information security program, cybersecurity risks, and related developments with the Risk Committee. The Risk Committee periodically reviews and evaluates information security and cybersecurity risks and provides oversight of events that have been escalated as a part of the incident response plan.

companyName: KEMPER Corp

ticker: KMPR