text: Oversight of Cybersecurity Risks Our board of directors and audit committee have primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Certain members of the Sculptor cybersecurity team periodically report to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters. Such reporting includes updates on Sculptor's cybersecurity program as it impacts us, the external threat environment, and Sculptor's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Sculptor's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: Sculptor Diversified Real Estate Income Trust, Inc.


text: Our Board of Directors has established governance protocol over risk management, including general oversight of information technology security and cybersecurity risk. The Audit Committee is central to the Board's oversight of cybersecurity risks and is primarily responsible for this domain. The Audit Committee actively participates in discussions with management, external experts and amongst themselves regarding cybersecurity risks. The Audit Committee is comprised of Board members with broad expertise, including technology, risk management and finance, enabling them to effectively oversee and govern cybersecurity risks. One Audit Committee member is certified under the National Association of Corporate Directors Certificate in Cyber-Risk Oversight Program.

companyName: ROCKY BRANDS, INC.

ticker: RCKY

secItem: Item 1C


text: We are dedicated to upholding our commitment to our customers, partners, and employees to manage cybersecurity, privacy, and data protection and security risk. Our approach involves various tools, processes, technologies, and controls to identify and manage such risks.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a lead IT person principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: For a discussion of our cybersecurity-related risks, see Part I, Item 1A of this Annual Report on Form 10-K under the heading "Risk Factors."

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Peabody's global cybersecurity department is responsible for overall cybersecurity strategy, policy, operations and cybersecurity incident response. Team members who support the Company's cybersecurity program invest in ongoing skills development including maintaining industry recognized certifications such as the ISC2 CISSP, GIAC GCIH, Comp TIA Security+, as well as platform specific certifications focused on Peabody's current cybersecurity infrastructure.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: The third-party risk management program evaluates cybersecurity risks and information systems of third parties at onboarding and on an ongoing basis. Processes include evaluating reports and/or performing assessments of a third party's information systems leveraging cybersecurity frameworks such as International Organization for Standardization (ISO) ISO 27001, Cybersecurity Framework (CSF) published by the US National Institute of Standards and Technology, as well as evaluating reports issued by a third party's auditors developed under the attestation standards issued by the American Institute of Certified Public Accountants (AICPA). We integrate risk mitigation into additional onboarding requirements to address identified risk factors, such as developing service level agreements and minimum required information security performance expectations to enable cybersecurity threats and incidents to be managed within applicable industry or regulatory standards. We require contracts of third parties to incorporate industry and regulatory standard clauses requiring reporting to us of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and shareholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.

companyName: North Haven Net REIT


text: The Bank also maintains Incident Response policies and procedures that are invoked in the event of a security breach or incident and which provide, among other things, guidance for the purpose of managing and executing the appropriate level of communication to executive management, the Board of Directors, government agencies, and/or the Finance Agency.

companyName: Federal Home Loan Bank of Dallas


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.

companyName: TrueBlue, Inc.

ticker: TBI


text: Company maintains cyber risk management designed to preserve the security of data and technology infrastructure. On annual basis we conduct assessments to identify cyber risks and have developed plans on how to address any such risks for remediation of vulnerabilities.

companyName: PORTSMOUTH SQUARE INC

ticker: PRSI


text: Cybersecurity Risk Management Personnel Seaboard's information security program and the Information Security Team is led and managed by a dedicated Director of Information Security (the "IS Director"). The IS Director, whose experience includes over seven years in information security leadership roles and relevant certifications, brings appropriate expertise to Seaboard's information security program. The IS Director's experience and knowledge are crucial to the ongoing development and execution of Seaboard's information security program.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Within management, the Chief Information Officer or Information Technology Director, as applicable, of our business units are primarily responsible for assessing and managing our material risks from cybersecurity threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.

companyName: Cryoport, Inc.

ticker: CYRX


text: We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures in Item 1A of this Annual Report on discussed above, given the nature of our current operations and our experience to date, we do not currently perceive cybersecurity as a particularly significant risk to our business. Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties, or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.

companyName: BranchOut Food Inc.

ticker: BOF


text: Managing Material Risks and Integrated Overall Risk Management Rhinebeck Bank has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our internal risk management team works closely with our IT department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including ongoing education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: External Engagement The Company engages with third-party organizations to conduct regular assessments of compliance, controls, and overall risk management strategies, ensuring a comprehensive approach to cybersecurity. Quarterly vulnerability assessments are performed on external and internal systems, as well as a larger annual audit of system security and compliance.

companyName: i-80 Gold Corp.

ticker: IAUX


text: As of the date of this report, we have not experienced any current or past cybersecurity incidents that resulted in a material effect on our business strategy, results of operations or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For more information about the cybersecurity risks we face, see the risk factor in Item 1A entitled "We rely on complex information systems to manage our manufacturing, distribution, sales and other functions. If our information systems fail to perform these functions adequately or if we experience an interruption in our operations, including a breach in cybersecurity, our business, financial condition and results of operations could be materially adversely affected."

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Brent Winn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Winn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2020. Mr. Winn currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Winn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any serious cybersecurity incidents to our Board.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: To prepare to respond to incidents, the Enterprise Risk Management Committee periodically reviews and updates our cyber Incident Response Plan ("IRP"). The IRP provides a framework to address potential and actual cybersecurity incidents to include assessment to recovery by our Incident Response Team and notification to the appropriate management and board committees and regulatory agencies. The Incident Response Team is comprised of representatives from various departments including Information Security, Information Technology, Risk Management, Legal, Operations, Marketing and Accounting. Our Information Security Officer manages the IRP and coordinates with senior level management and multiple areas of the company in execution of the plan. While we have experienced cybersecurity incidents, we have not, to our knowledge, experienced an incident materially affecting, or reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: In 2024, we did not identify any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or that are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches may materially affect our business strategy, results of operations or financial condition. For additional discussion of potential risks regarding cybersecurity, please see the information contained in Risks Related to Business Interruptions and Cybersecurity Incidents in Part 1A of this Form 10-K.

companyName: Air Transport Services Group, Inc.


text: 3.Risk Prioritization: Following the assessment phase, we prioritize identified risks based on their potential impact on our operations, data integrity, confidentiality, and reputation. This risk-based approach allows us to allocate resources effectively and focus on addressing the most significant threats first.

companyName: NewtekOne, Inc.

ticker: NEWT


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—The failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Our cybersecurity program addresses potential risks, implements processes to support our cybersecurity program and respond to potential cyber incidents. Our cybersecurity program is managed by our senior management with support from a third-party that provides relevant expertise, certifications and skills in cybersecurity. Quarterly risk assessments are performed and incorporated as part of our overall enterprise risk management process, which is overseen by our Board of Directors. The third-party provider provides regular data protection and cybersecurity reports to our senior management who then provides regular reports to the Audit Committee and the Board of Directors. These reports include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.

companyName: SOUTH 8 ENERGY, LLC


text: Our Information Security Officer ("ISO") is responsible for implementing, supervising and maintaining the WISP, including the implementation of prevention measures. The ISO reports directly to the Chief Technology Officer, who is also our Chief Information Security Officer ("CISO"). The CISO establishes the company-wide system security plan and defines the parameters of users' access privileges. The CISO has worked in information technology and communications services for over 30 years, starting as a contractor at the Defense Advanced Research Projects Agency of the Department of Defense, managing the design and operation of the DARPA IT network, as the Network Operations Manager. At DARPA, the CISO oversaw the desktop computers, servers, local area networks, and Internet access, including edge security from 1992 to 1998. Since then, the CISO has managed customer network integrations for commercial satellite services at Hughes and at KVH. The CISO also developed a managed security service offering at KVH based on Fortinet technology.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: The Audit Committee is responsible for providing governance and oversight over the Company's operational cybersecurity program, risk management and incident response on behalf of the Board. On a periodic basis, management will report the results of any risk assessments, including the evaluation of any cybersecurity risks, and the actions that the Company has taken to mitigate these risks. This includes assessing the measures and controls in place to mitigate cybersecurity risks and providing oversight of the response of any significant cybersecurity threats and incidents.

companyName: USA Rare Earth, Inc.

ticker: USAR


text: a. Low (1 – 2.99) = Risk level acceptable and no further action deemed necessary b. Medium (2 – 5.99) and High (6 - 9) – implement risk management to reduce the risk to an acceptable level 5. Risk Communications- Results of the risk assessment are communicated to appropriate levels of management. Report includes the identified risk and vulnerability summaries. Updates will include treatment plans and status updates.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Our cybersecurity program is focused on the following areas: • Governance: We leverage multiple cybersecurity frameworks (e.g., ISO 27001 and NIST CSF) and regulatory requirements to form our Information Security Management System (ISMS), which is defined through policies and standards. Policies are applicable to all employees globally. These policies are reviewed periodically to ensure they remain relevant. For additional information regarding governance of our cybersecurity program, see the sections below entitled "Board Oversight of Cybersecurity Risks" and "Management's Role in Assessing and Managing Cybersecurity Risks." • Technical Safeguards: We deploy technical and procedural measures to protect our technology and data. Protection measures include, but are not limited to, network firewalls, network intrusion detection and prevention, penetration testing, attack surface management, vulnerability assessments and remediation processes, threat intelligence, anti-malware and access controls, plus data loss prevention and monitoring. • Security Awareness / Training: All employees are required to adhere to our Standards of Business Conduct, which identifies an employee's responsibility for information security. We provide annual cybersecurity training for all employees, as well as enhanced role-specific information security training for certain employees. In addition to this training, security awareness articles are disseminated periodically throughout the year. We also sponsor a "Cyber Security Awareness Month" in October each year and conduct regular phishing detection and response exercises. • Incident Response Plans: We maintain and update incident response plans that address the life cycle of a cyber-incident and routinely evaluate the effectiveness of such plans. Incident response plans focus on cyber risk issues, including detection, response and recovery; cyber threats, including external communication and legal compliance; and breach simulations and penetration testing through internal and external exercises. Each year, we engage a third-party expert to oversee a cybersecurity incident response exercise to test pre-planned response actions from our incident response plan and to facilitate group discussions regarding the effectiveness of our cybersecurity incident response strategies and tactics. • Third-Party Suppliers and Service Providers: We conduct periodic vendor security reviews and risk assessments for prospective and significant current third-party technical suppliers and service providers. Vendor security reviews evaluate numerous key security controls and the outputs of these reviews are used as part of business decisions regarding procurement and to assess a vendor's overall security posture relative to a defined set of security criteria. • Certifications: Our security program is audited on an annual basis by several independent groups including an accredited certification body, leading accounting firms and institutional clients. • Experts: We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. Our collaboration with these third-parties includes periodic audits, threat assessments and consultation on security enhancements.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations or financial condition, but we cannot provide assurance that such risks or future material incidents will not materially affect us in the future. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. Risk Factors.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and technology platform ("Information Systems and Data").

companyName: DBV Technologies S.A.

ticker: DBVT


text: Under Federated Hermes' cybersecurity program, Federated Hermes conducts regular threat identification and assessment exercises. Some of these exercises involve the use of third-party cybersecurity experts, who assist with, among other things, system penetration testing and system design. Information gained from such exercises is used to develop and refine protective and detective strategies and tactics. Federated Hermes' information systems and assets are also monitored to identify cybersecurity incidents and verify the effectiveness of existing protective measures. New protective measures are deployed from time to time as threats evolve. Some of the measures employed by Federated Hermes to mitigate cybersecurity risk include, among others, use of firewalls, system segmentation, system monitoring, virus scanning, and periodic penetration and phishing testing. Federated Hermes' cybersecurity program also includes a detailed incident response plan for responding to cybersecurity threats. Federated Hermes' cybersecurity program also requires periodic training of employees on cybersecurity threats, including phishing and cybersecurity awareness campaigns.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: These processes are regularly reviewed and updated to adapt to evolving cybersecurity threats and any changes in our systems or business operations.

companyName: NEOGEN CORP

ticker: NEOG


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, Blue Owl's Audit Committee or Blue Owl's Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.

companyName: Blue Owl Capital Corp

ticker: OBDC


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, and remediation. Our IT team also regularly collects data on cybersecurity threats and risk areas and conducts a periodic risk assessment. Further, we conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. In collaboration with our Internal Audit team, the internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report.

companyName: Workhorse Group Inc.

ticker: WKHS


text: NEE operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats, including those related to XPLR, which is led by a cybersecurity incident response team. NEE uses these resources, and leverages third party resources, to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems, and monitors for impacts to their vendors or suppliers, including those related to XPLR. Assessment of incidents includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and individuals serving as officers and directors of XPLR.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: As a result, in addition to our information technology policies and procedures, we have implemented cybersecurity processes that aim to address, among other things, information security, password security, third party vetting, security incident response and vulnerability management. Our cybersecurity procedures include requiring multiple authentication factors prior to granting access to our assets, launching endpoint security software to guard against malware, viruses, and other cyber-attacks, use of third-party software to automate IT system monitoring for unusual or suspicious activity, conducting annual cybersecurity training for all employees, and providing cybersecurity information to employees through newsletters and fliers. We utilize third-party consultants to assist us with endpoint detection and response and routinely conduct penetration testing of our network infrastructure. Our consultants also provide digital forensics analysis of our systems, as needed. Additionally, we have sought to align our cybersecurity risk management in accordance with the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program.

companyName: HWH International Inc.

ticker: HWH


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Also, the Registrants' workforce undertakes mandatory role-based annual training on identifying, reporting, and escalating cyber and physical security concerns to further assist in the identification of risks as well as the acceptable use of corporate electronic resources. Additionally, all employees and contractors are required to participate in the Registrants' ethical cyber phishing campaign program. In addition to these enterprise-wide initiatives, PPL's Kentucky, Pennsylvania and Rhode Island operations are subject to extensive and rigorous mandatory cybersecurity requirements that are developed and enforced by NERC and approved by the FERC to protect grid security and reliability. LG&E is also subject to certain security directives related to cybersecurity issued by the Department of Homeland Security's Transportation Security Administration in 2021. See Note 12 to the Financial Statements for additional information on these directives.

companyName: PPL ELECTRIC UTILITIES CORP


text: Role of the Chief Information Security Officer and Cybersecurity Manager Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security Program. The Company's Cybersecurity Manager oversees the day-to-day cybersecurity operations.

companyName: FIRST BANCSHARES INC /MS/


text: In the event of a cybersecurity incident impacting us or our Advisor, our Sponsor has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of our Sponsor, including coordinating with the relevant members of our Advisor. The incident response plan includes notification to the applicable members of cybersecurity leadership, and, as appropriate, escalation to the full HMC Capital risk management team and/or an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee of our board of directors and to our full board of directors, if appropriate.

companyName: StratCap Digital Infrastructure REIT, Inc.


text: Information Security Risk Management and Strategy The Company is committed to developing robust governance and oversight of cybersecurity risks and to implementing processes, controls and technologies designed to help assess, identify, and manage material risks. As described further in "—Information and Security and Governance Oversight" below, the Vice President of IT is responsible for Li-Cycle's information security program and as part of its broader risk oversight, while the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. Our information technology ("IT"), infrastructure, applications, and networks are susceptible to potential impacts due to the escalating sophistication and frequency of cyber-attacks and security incidents. Breaches in our technology systems, whether from circumventing security measures, denial-of-service attacks, hacking, phishing, computer viruses, ransomware, malware, employee errors, malfeasance, social engineering, vendor software supply chain compromises, physical breaches, or other actions, have the potential to compromise the confidentiality, availability, and integrity of crucial information. Such incidents may cause interruptions or malfunctions in our manufacturing systems, applications, and data processing, thereby disrupting other business operations. Additionally, critical information associated with our business operations is managed by some of our third-party vendors.

companyName: Li-Cycle Holdings Corp.


text: The REIS Policy has been drafted in collaboration with one of the largest IT solutions providers in the field and was modeled after NIST standards relating to governance, documentation and processes. The Company is implementing the REIS Policy through its Cyber and Privacy Risk Steering Committee (the "CPRSC"), which is chaired by the Chief Administrative Officer (who is also AVD's Risk Manager) and includes cross functional business process owners from operations, sales, marketing, finance and Human Resources, as well as our Director of Information Technology, who alone has over 30 years' experience in IT-related security and whose staff collectively has over 50 years' experience in this area. In addition, the committee is advised by a virtual Corporate Information Security Officer who works with the third-party solutions provider.

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: The day-to-day management of the Company's cybersecurity program is led by a dedicated Director of IT. The Director of IT provides regular updates to the Company's senior management team through briefings on cybersecurity matters, including potential cybersecurity threats and incidents. This ensures that the highest levels of management are made aware of potential cybersecurity threats and any material cybersecurity matters are promptly escalated to the audit committee and Company's board of directors if necessary.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: We have obtained both ISO 13485 (quality management systems for medical devices) and ISO 27001 (information security management systems) certifications, which require independent annual auditing to obtain and maintain. In addition to our commitment to secure our employees', customers' and patients' data, as well as intellectual property, we take steps to ensure data integrity and protection standards are maintained throughout our supply chain. We understand that supply chains are vulnerable to increasing risks from cybersecurity threats. Cybersecurity threats to our supply chain are accounted for by performing risk assessments by our dedicated cybersecurity staff. These analyses take into account the type and amount of data being accessed and the supplier's ability to employ and maintain cybersecurity health and is also verified through third-party assessments and certifications. Supply chain vendors are monitored to ensure that risks remain mitigated and mechanisms are in place to allow for tracking and reporting of any material supplier cybersecurity events. Data security requirements are also included in all key vendor contracts. All vendors that handle personal information are required to provide appropriate protection in accordance with our policies and applicable regulations and laws.

companyName: NovoCure Ltd

ticker: NVCR


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Terrorist attacks and cyber-attacks or other security breaches may negatively affect our business, financial condition and results of operations and cash flows" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems. Cybersecurity incidents may lead to reputational harm, revenue and client loss, legal actions, and statutory penalties, among other consequences. Additional information on cybersecurity risks we face are discussed in Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: In the previous 12 months, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. For additional information about the cybersecurity risks we face, see the risk factors entitled, "A cybersecurity attack, 'data breach' or other security incident experienced by us or our third-party service providers may result in negative publicity, claims, investigations and litigation and adversely affect our business, results of operations and financial condition," and "If we fail to properly maintain the confidentiality and integrity of our data, including member and customer credit or debit card and bank account information and other PII, or if we fail to comply with applicable laws, rules, regulations, industry standards and contractual obligations relating to data privacy, protection and security, it may adversely affect our reputation, business and operations," in Item 1A Risk Factors.

companyName: Soho House & Co Inc.


text: Cybersecurity Risk Governance Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board of Directors in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of cybersecurity risk to the Audit Committee and the Audit Committee reports on its activities and findings to the full Board of Directors. Key cybersecurity topics are presented regularly to the Audit Committee. In addition, if any cybersecurity incident is determined under our incident response policy to pose a risk in excess of an identified threshold (as set forth in the policy), our Chief Legal Officer will promptly notify the Audit Committee regarding the incident. The notification to the Audit Committee will include management's determination regarding whether or not the incident is material to us.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: Our product security efforts are informed in part by industry security standards such as ISA 62443, UL 2000-1, and certain standards from the National Institute of Standards & Technology ("NIST"). As part of our efforts, we conduct risk assessments and prioritize security validation for certain of our products. For example, we conduct security testing and remediation on a risk-based prioritized basis prior to releasing certain products into the market, as well as periodically post-release to discover potential issues in code, firmware, and protocols and to consider potential security patches or future version updates. We have received SOC 2 certifications for some of our products and software offerings and continue to strive to meet similar requirements for other digital offerings.

companyName: DOVER Corp

ticker: DOV


text: Independent Assessments We regularly engage third parties to perform assessments of our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate and remediate cybersecurity incidents. While we are not aware of any material cybersecurity threats or incidents that have had or are reasonably likely to materially affect us, including having a long-term impact on our business strategy, results of operations or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. For additional information the cybersecurity risks faced by our Company, refer to Item 1A. "Risk Factors—Risks Related to Our Business—Our electronic information systems have been and could in the future be, subject to service interruptions, data corruption, cyber-based attacks and network security breaches. Significant disruptions in, or breaches in security of, our electronic information systems or data can adversely affect our business and financial statements."

companyName: ESAB Corp

ticker: ESAB


text: Our Company's Executive Management Team ("EMT") receives periodic briefings, and the Board of Directors and its Audit Committee receives annual and quarterly briefings, respectively, on cybersecurity matters. These briefings may include updates on critical information security and cybersecurity risks and the threat landscape; cybersecurity improvement initiatives and the internal control environment; and, if relevant, the status of actions taken with respect to any cybersecurity incidents.

companyName: Hillenbrand, Inc.

ticker: HI


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. The Company engages a third-party to perform 24/7 monitoring for threats and unauthorized access to our information security network.

companyName: N-able, Inc.

ticker: NABL


text: The Chief Information Officer ("CIO") leads our global information security organization responsible for overseeing the Company's information security program. Our CIO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: Independent Third-Party Assessments We engage an independent third party to conduct comprehensive assessments of our cybersecurity program approximately every 18 months. This independent third-party assessment includes an evaluation of our cybersecurity controls based on the CSF.

companyName: Zoetis Inc.

ticker: ZTS


text: The CIO is a member of our Governance Committee and regularly reports on cybersecurity risk management to other members of the Governance Committee comprised of the Company's senior executive officers. The Governance Committee oversees the prioritization and escalation of risks from cybersecurity threats and is responsible for strategy, operations, financial management, information technology, compliance, legal, administration and corporate governance. The members of the Governance Committee collectively possess experience in these areas, including cybersecurity and risk management.

companyName: WisdomTree, Inc.

ticker: WT


text: Risks from Cybersecurity Threats Cybersecurity threats and attacks are becoming more sophisticated and pose a risk to our systems and information. While, to date, we have not been subject to cybersecurity incidents that, individually or in the aggregate, have been material to our operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For more information regarding the cybersecurity-related risks we face, see "Risk Factors - Risks Related to Data Privacy and Cybersecurity."

companyName: Stagwell Inc

ticker: STGW


text: Board Oversight of Risks from Cybersecurity Threats: The Board is ultimately responsible for the oversight of risks from cybersecurity threats and collaborates with the Audit Committee of the Board and the ERC in these oversight responsibilities. The responsibilities of the ERC include participating and collaboration with the CROC to oversee policies and management systems for cybersecurity matters, overseeing the identification, assessment and response to cybersecurity risks, maintaining and implementing our IRP, and communicating on a regular interval, or more frequently (if necessary) with the Board, the Audit Committee and executive management in regard to such risks. The Company's processes call for prompt and timely notifications and updates to the Board and the Audit Committee, as applicable and as necessary depending on the nature and severity of the incident, in connection with any cybersecurity incidents that may occur. In addition, the Board, the Audit Committee, and the ERC receive regular presentations and reports on cybersecurity matters that address the full range of cybersecurity topics discussed herein. Further, on a periodic basis, the Board and/or Audit Committee and the ERC also discuss our cybersecurity programs and processes with our Chief Information Officer (CIO) and Chief Information Security Officer (CISO).

companyName: Vertiv Holdings Co

ticker: VRT


text: The Audit Committee receives regular reports from our Chief Financial Officer and the VP of IT concerning significant cybersecurity threats and risk and the processes our company has implemented to address them. The Audit Committee's training includes participation in tabletop training exercises designed to test and evaluate our company's response to a cybersecurity incident. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Vital Farms, Inc.

ticker: VITL


text: Our strict protection and security measures have resulted in zero security incident-related disruptions or downtime to our business continuity. However, there is no guarantee that a future security incident would not materially affect our business strategy, results of operations or financial condition. See "Risk Factors" beginning on page 13 of this Form 10-K.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. The architecture reviews entail utilizing best practices and the involvement of third party experts, as well as internal Information Security personnel and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Landstar maintains an Incident Response Plan that guides the actions the Company is to take in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable us to comply with applicable legal and regulatory obligations and mitigate financial and reputational damage. We also maintain a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents that may significantly impact our operations. Our cybersecurity risk management processes incorporate appropriate industry standards and are designed using the frameworks developed by National Institute of Standards and Technology ("NIST") as a guide.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: Through the Company's enterprise risk management program, the Board of Directors is responsible for overseeing cybersecurity, information security, and IT risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. The Audit Committee assists the Board in exercising oversight of the Company's cybersecurity, information security, and IT risks. As appropriate, the Board or Audit Committee reviews and discusses with management the Company's procedures and practices as well as any potential identified incidents with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Executive Vice President, Operations is responsible for keeping the Board of Directors apprised of cybersecurity incidents and the Board is charged with determining the materiality of such incident.

companyName: Sitio Royalties Corp.


text: The Chief Information Officer has over 27 years of experience in cybersecurity and is responsible for designing and implementing the organization's cybersecurity strategy. The cybersecurity program and the Information Security Team are led by the Senior IT Director, who reports to the Chief Information Officer. The Senior IT Director has over 20 years of experience in cybersecurity. The Information Security Team is responsible for security operations, cybersecurity monitoring, application security audits, and responding to incidents through a structured Incident Response Plan.

companyName: HEICO CORP

ticker: HEI


text: This dependence exposes us, along with others who use these service providers, of a cyber breach on their service providers. It's possible that a cyber-attack at a third-party service provider may have a material financial, operational or reputational impact to the Company. The Company and its business units will continuously monitor these risks associated with its service providers.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Potential Impact of Cybersecurity Incidents We recognize that a significant cybersecurity incident could have material adverse effects on our business, including operational disruptions, financial losses, legal liabilities, and damage to our reputation.

companyName: AppTech Payments Corp.

ticker: APCX


text: Although our computer and communications hardware are protected through physical and software safeguards, they are still vulnerable to system malfunction, computer viruses, malware and ransomware, and other cybersecurity threats such as phishing and social engineering attacks.

companyName: Beyond Air, Inc.

ticker: XAIR


text: The Company engages with a range of third-party experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing its risk management systems. These relationships enable Management to leverage specialized knowledge and insights with respect to the Company's cybersecurity strategies and processes.

companyName: WEIS MARKETS INC

ticker: WMK


text: Board Governance and Management The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our corporate information security function, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has an extensive information technology and cybersecurity background gained through years of industry experience and leadership. The corporate information security function is responsible for managing and continually enhancing our information security posture and information security infrastructure with the ultimate goal of preventing cybersecurity incidents and reducing their severity to the extent feasible, while simultaneously increasing our resilience in an effort to minimize the business impact should an incident occur.

companyName: TUCOWS INC /PA/

ticker: TCX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: documented incident response process, vulnerability management, disaster recovery and business continuity processes, risk assessments, network security controls, access controls, physical security, asset management, tracking and disposal for certain assets, systems monitoring, employee cyber security training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff, and a security operations center.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Information regarding cyber incidents is reported at the monthly meeting of the management security committee or sooner if warranted. Members of this committee work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. Our incident response and vulnerability management processes include reporting by management to the board of directors for certain cybersecurity incidents.

companyName: Iridium Communications Inc.

ticker: IRDM


text: Our strict protection and security measures have resulted in zero security incident-related disruptions or downtime to our business continuity. However, there is no guarantee that a future security incident would not materially affect our business strategy, results of operations or financial condition. See "Risk Factors" beginning on page 27 of this Form 10-K.


text: Increased global cybersecurity threats and sophisticated, targeted computer crime could pose a risk to our operations. Aptar has strategically integrated cybersecurity risk management into a broader enterprise-wide risk management framework, and consists of administrative, operational, organizational, physical, and technical processes that we believe are appropriate to the scope and nature of our business. We believe this integrated approach allows cybersecurity considerations to be an integral part of our decision-making processes. Our risk management team works closely with our Information Security Department to continuously evaluate and address cybersecurity risks in alignment with our business and operational needs.

companyName: APTARGROUP, INC.

ticker: ATR


text: As part of our cybersecurity program management activities and our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures, we actively engage internal and prominent external experts, as well as industry participants. Our cybersecurity program is managed by the Chief Information Officer who has biannual meetings with the Audit Committee and provides periodic reports and updates concerning our cybersecurity program to our Chief Executive Officer and other members of our senior management, as appropriate. These reports include updates on our cyber risk and threats, the status of projects to strengthen our information network and data security, assessments of our information security program, and the emerging threat landscape. We have established governance committees to provide us with cybersecurity oversight with supportive roles to advance the effectiveness of our cybersecurity program. The Chief Information Officer has over 20 years of IT leadership and cybersecurity experience, and the Information Technology Leadership Team overall has a combined fifteen years of cybersecurity experience. The Chief Information Officer and members of the Information Technology Leadership Team maintain industry recognized credentials relevant to their roles and stay informed on the latest trends and technologies.

companyName: Mistras Group, Inc.

ticker: MG


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity, including the responsibility to review and discuss with management and the Company's auditors, as appropriate, management risks relating to data privacy, technology and information security, including cyber security and back-up of information systems, and the steps the Company has taken to monitor and control such exposures and the responsibility to confer with management and the Company's auditors the adequacy and effectiveness of the Company's information and cyber security policies and the internal controls regarding information security. The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may adversely affect the Company and on cybersecurity risks in general at least once each year.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: To date, we have not experienced any cybersecurity attacks. However, any such attack could adversely affect our business. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: Allegro Merger Corp.


text: We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Allegion plc

ticker: ALLE


text: We engage third parties in connection with assessing, identifying and managing our cybersecurity risks, including, but not limited to, the following: • Incident response expertise to provide intelligence-based cybersecurity solutions and services to assist us with preparing for, investigating, and responding to cybersecurity incidents, including attacks that target on premise, cloud, and critical infrastructure environments; • Annual security program assessment of the controls, maturity and performance of our information security risk management program and the information security risks associated with our technology and business systems; • External and internal penetration and intrusion testing using industry standard tools and techniques; • Compliance assessments with certain information security standards required under some of our federal contracts; • Established cadence of reviews, reporting and coordination with government agencies to review cybersecurity metrics, findings and any applicable remediation efforts in accordance with the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF; and • Review processes and procedures designed to control access to information systems as part of our Sarbanes-Oxley Act, or SOX, testing. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our information security risk management program. Further, our internal audit team conducts annual assessments of our information security risk management program and controls.

companyName: CoreCivic, Inc.

ticker: CXW


text: Risks from cybersecurity threats, incidents or intrusions have not thus far materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1A. "Risk Factors--We are subject to cyber security risks. Cyber incidents or intrusions may result in information theft, data corruption, operational disruption and/or financial loss" for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for the board of directors and management. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare the Company to address cybersecurity risks.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: Cybersecurity Risk Management and Strategy Bio-Techne's cybersecurity strategy is to maintain and fortify a secure, actively-monitored environment for our and our customers' data that complies with legal requirements [and industry best practice] while supporting our and our customers' business needs. Our cybersecurity program follows industry standards and best practice for preventing, detecting, remediating, and mitigating potential cybersecurity threats, including regular processes to identify, evaluate and manage potential risks.

companyName: BIO-TECHNE Corp

ticker: TECH


text: The Company has experienced, and expects to continue to experience, cyber incidents in the normal course of business. Cybersecurity threats, including as a result of previous incidents, to date, have not had, and as of the date hereof we do not believe are reasonably likely to have, a material adverse effect on the Company's business, strategy, financial condition, results of operations, or cash flows. However, for the reasons described above, management cannot guarantee that the Company will not be materially affected in the future. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for further discussion of cybersecurity risks.

companyName: Andersons, Inc.

ticker: ANDE


text: Audit Committee of the Board of Directors, or the Audit Committee, is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Inmune Bio, Inc.

ticker: INMB


text: Key to our cybersecurity resilience, we strategically leverage third-party expertise and tools to augment our defenses, ensuring a proactive stance against evolving threats. Rigorous assessments by third-party auditors validate the alignment of specific components of our technology environment with industry standards such as the Payment Card Industry Data Security Standards, ensuring robust compliance and resilience.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: perform assessments on the Company's cybersecurity measures, including audits and independent reviews of the Company's information security control environment and operating effectiveness; obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure;

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: We identify, assess, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include tabletop exercises, control gap analyses, threat modeling, impact analyses, internal audits, external audits, vulnerability scans, penetration tests, and engagement of third parties to conduct analyses of our information security program. We obtain cybersecurity threat intelligence from recognized forums, third parties, and other sources as part of our risk assessment process. We also maintain a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with third party service providers and other companies with whom we do business. As part of our cybersecurity program, team members receive cybersecurity training and participate in awareness programs including phishing simulation exercises and reminders, and programming and events during Cybersecurity Awareness Month. We also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.

companyName: VAIL RESORTS INC

ticker: MTN


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our systems, networks and technology.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our information technology ("IT") department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Orion Group Holdings Inc

ticker: ORN


text: As of the date of this report, we are not aware of any risks from cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, individually or in the aggregate.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers who have access to customer, supplier and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we endeavor to require those third parties that could introduce significant cybersecurity risk to us to agree to manage their cybersecurity risks in specified ways.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: We also engage internal and external assessors, consultants, auditors, and other third parties, to assess our RM Program. We manage cybersecurity risks associated with third parties, including vendors, service providers, and external users of our systems. This includes conducting due diligence on the third parties we use, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, and by using contracts to reinforce their cybersecurity obligations.

companyName: MCKESSON CORP

ticker: MCK


text: Risks from Cybersecurity Incidents As of December 31, 2023, and for the past four years, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. Cybersecurity Governance We involve multiple levels of oversight as a part of our approach to cybersecurity risk management.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: The Company's cybersecurity risk management approach is reviewed for alignment with the Company's overall risk tolerance. The Company has a dedicated cybersecurity team led by the CISO who is responsible for executing the risk strategy and policies developed in coordination with the Company's Chief Executive Officer, Chief Financial Officer, General Counsel, Presidents, and the Vice Presidents of Finance and Capital Markets.

companyName: Abacus Global Management, Inc.

ticker: ABX


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is maintained by a third-party technology firm. The third-party firm has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools.

companyName: RARE ELEMENT RESOURCES LTD

ticker: REEMF


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.

companyName: Greenwich LifeSciences, Inc.

ticker: GLSI


text: The CISO is in regular communication with senior management regarding cybersecurity matters and provides frequent routine (generally weekly) updates to the Company's Executive Chair and Chief Executive Officer, Chief Operating Officer ("COO"), Chief Financial Officer ("CFO"), CTO and Chief Legal and Policy Officer. As part of the Company's incident response plan process, cybersecurity risk events of a certain criteria are communicated in a timely manner to the Company's incident response governing body, which is comprised of members of senior management, including the COO, CTO, and CFO. The Company tests the effectiveness of the incidence response plan and assesses its response capabilities by conducting executive tabletop exercises involving detailed topical cybersecurity scenarios with these executives, as well as technical tabletop exercises including technical and operational personnel. The Company also has processes in place that are designed to ensure that decisions regarding public disclosure and reporting of cybersecurity incidents can be made in a timely manner.

companyName: Fox Corp

ticker: FOXA


text: Our cybersecurity program includes: • Penetration testing of internal information technology systems and review of program maturity based on the National Institute of Standards and Technology ("NIST") cybersecurity framework; • Phishing, social engineering, and cyber hygiene training; • Continuous security event monitoring, management, and incident response plans; • Continuous enhancements to security capabilities based on evolving threats; • Information security policies and procedures; • Privacy controls and compliance with applicable legislative and regulatory requirements; • Assessment of applicable third-party vendors' cybersecurity and information security practices; and • A cross-functional approach to addressing cybersecurity risk with participation from representatives across the business and functions.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT


text: Our management team, including our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Information Officer ("CIO") and CISO, has overall responsibility for assessing and managing our material risks from cybersecurity threats. Our management team has primary responsibility for implementing our cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: The Company's Chief Information Security Officer (CISO) is designated as the program coordinator responsible for coordinating and overseeing the program.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • Ongoing Assessment—The Cybersecurity department, led by the VP, Chief Information Security Officer (CISO), and reporting to the SVP, Chief Information and Digital Officer (CIDO) is staffed with cyber professionals tasked with the day-to-day responsibility of assessing material risks from cybersecurity threats. In addition, the Cybersecurity Council, comprised of senior management, is kept apprised of the state of PSEG's cybersecurity program, including any emerging risks, and provides guidance on the strategic directions of the program. • Engagement of Nth Parties—We engage Nth parties (third parties and other business relationships, including fourth parties, etc.), such as cybersecurity service providers, risk management firms, and external legal counsel, to assess material risks from cybersecurity threats and assess our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including but not limited to the NRC and Transportation Security Administration (TSA), as well as NERC, inspect applicable components of our cybersecurity program. • Nth-Party Service Provider Management— We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers. This includes a risk-based vendor management program, which incorporates robust cybersecurity contractual provisions, vendor security assessments and, if appropriate, periodic audits. • Technical Safeguards—We manage controls to protect our network perimeter, internal IT and Operational Technology (OT) environments, such as internal and external firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments, threat intelligence, endpoint security and access controls. • Training and Awareness—We provide mandatory annual cybersecurity training for all personnel with network access, and additional education for personnel with access to industrial control systems and/or customer information systems; and conduct phishing exercises with progressive consequences for failures. Employees also receive periodic cybersecurity awareness messages and each year, in recognition of Cybersecurity Awareness Month, are invited to presentations throughout October from internal and external cyber experts covering diverse cyber topics. These efforts better enable all employees to identify potential cybersecurity risks and escalate them appropriately. • Incident Response Plans—We maintain and periodically update a cyber incident response plan that addresses the life cycle of a cybersecurity incident from a technical perspective (i.e., detection, response, and recovery), and a data breach response plan (with a focus on external communication/disclosure and legal compliance); and conduct regular tabletop exercises to test plan effectiveness (both internally and through external exercises). • Mobile Security—We maintain controls to prevent loss of data through mobile device channels.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Our goal is to maintain an information technology infrastructure that implements physical, administrative, and technical controls. These controls are adjusted based on risk and designed to protect the confidentiality, integrity, and availability of our information systems, including the customer information, personal information, and proprietary information stored on our networks.

companyName: Option Care Health, Inc.

ticker: OPCH


text: We conduct annual assessments by certified external third-party assessors as part of our industry-recognized information security certifications, ISO 27001, 27017, 27701, and ISMS-P. We periodically have external third-party consultants conduct maturity assessments of our Information Security program. The results of these audits and assessments inform us about possible risks which are managed through our enterprise risk management process. We employ external third-party vendors to provide cyber threat intelligence when relevant information is available or as requested. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider, customer or otherwise implicating the third-party technology and systems we use. We also have a program of Cyber Tabletop exercises, run periodically, with key people in our business, to further enhance our capabilities to respond and recover to a cyber incident.

companyName: Coupang, Inc.

ticker: CPNG


text: Changes must be approved by authorized personnel prior to (i) performance of any work related to a Change, (ii) migration of any Change-related work from the quality environment to the production environment, to ensure the Change was adequately tested and performs properly, and (iii) closing of the Change, to ensure the Change was implemented in the production environment and correctly solves the issue that prompted the Change request.

companyName: Clene Inc.

ticker: CLNN


text: While we have experienced threats to our data and systems, to date, we are not aware of a cybersecurity incident being experienced by the Company that had, or is reasonably likely to have, a material impact on our business or operations; however, because of frequently changing attack techniques and the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational, or other business harm as well as financial costs and regulatory action. See "Item 1A. Risk Factors–Technology Risks" of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: Cybersecurity Risk Management of Third-Party Vendors and Service Providers We have also implemented risk management practices designed to minimize cybersecurity risks that arise from utilizing third-party vendors and service providers that receive or have access to Lucid confidential information or personal data. In order to oversee and identify such risks, we have implemented the following processes: (i) a third-party security risk management program designed to assess security risk of new third-party vendors or service providers and develop countermeasures to manage unacceptable risks; (ii) provisions in our third-party vendors and service provider contracts with added security requirements; (iii) training procurement teams on management of third-party vendor and service providers; (iv) role-based access controls for third-party personnel; and (v) data transfer mechanisms for the sharing of data with third parties. While we are in the process of increasing the resiliency of these capabilities across the board, our control over and ability to monitor the security posture of third-party vendors and service providers remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. In addition, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

companyName: Lucid Group, Inc.

ticker: LCID


text: All operations, products, services, information assets and information systems that are owned and operated by CXApp are assessed for risks that result from threats to the integrity, availability, and confidentiality of CXApp's data.

companyName: CXApp Inc.

ticker: CXAI


text: Third-Party Monitoring and External Reviews Axon utilizes the assistance of third-party technology and providers to support our objective of protecting our information, information systems and network. Services provided by third parties to assess the performance of our cybersecurity risk management systems and procedures and to identify cybersecurity risks to the Company include assessing products and internal systems for vulnerabilities, incident response services such as computer forensics, internal and external audits for security certifications globally and overall security program maturity evaluations. Axon and our service providers have also developed systems and processes that are designed to protect our and our customers' data, to prevent data loss, and to prevent or detect cybersecurity threats and incidents.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: We maintain a cyber liability insurance plan underwritten by multiple insurance companies, which provides protection against certain potential losses arising from cybersecurity incidents.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, disaster recovery/business continuity plans and cybersecurity insurance; incident detection and response, risk assessments, systems monitoring and penetration testing; encryption of data, network security controls, access controls, physical security and asset management, tracking and disposal; and employee training.

companyName: CERUS CORP

ticker: CERS


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Cybersecurity risk is identified in our risk register, and our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Sprinklr, Inc.

ticker: CXM


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists.

companyName: First Financial Northwest, Inc.


text: We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program in accordance with our risk profile and business that is informed by and incorporates elements of industry standards.

companyName: Lifeward Ltd.

ticker: LFWD


text: Our business requires that we develop and maintain large and complex technology systems, and that we rely on third-party systems and applications, to run our operations and to store the significant volume of data that we acquire, including the personal information of our customers and employees and our intellectual property, trade secrets, and other sensitive business and financial information.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: Oversight of Third-party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact the Company in certain circumstances. In response, we have implemented processes for overseeing and managing these risks. The processes include limiting the exposure of our information systems to external systems to the least practical amount, assessing the third parties' information security practices before allowing them to access our information systems or data, requiring third parties to implement appropriate cybersecurity controls in our agreements with them, conducting ongoing monitoring of their compliance with those requirements, and requiring third parties to agree to contractual requirements designed to ensure cybersecurity concepts are appropriately addressed.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: As of the date of this Annual Report, cybersecurity incidents and risks, separately or in aggregate, have not materially affected our business strategy, results of operations, and financial condition. However, we face ongoing risks from cybersecurity threats and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent or minimize cybersecurity risks. See "Risk Factors—If we are unable to protect our sensitive data and information systems against data corruption, cybersecurity incidents or network security breaches, or if we are unable to provide adequate security in the electronic transmission of sensitive data, it could materially adversely affect our business, financial condition and results of operations" and "—A failure of a key information technology system or process could materially adversely affect the operations of our business" in Item 1A of this Annual Report for more information on our cybersecurity-related risks.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: The Company engages with third-party experts, including cybersecurity focused Security Operations Center (SOC) and leading-edge (EDR) providers, to assist in evaluating and detecting security risk and initiate corrective actions. These partnerships enable the Company to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain aligned with industry best practices. The collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: Our Vice President of Information Technology has over 20 years of experience at public companies, including within the energy sector, enterprise technology vendors, and consulting firms. His expertise includes enterprise technology strategy, transformation, governance, vendor management, and operations and initiatives to strengthen cybersecurity, enhance information security posture, and mitigate technology risk. We continue to focus on cybersecurity measures as the company grows.

companyName: Tamboran Resources Corp

ticker: TBN


text: During the period of this Annual Report, the business strategy, results of operations and financial condition of the Company have not been materially affected by risks from any known cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Risks Related to Information Technology and Cybersecurity at Item 1A. Risk Factors.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to customers and/or corporate partners or customers; violation of privacy laws and other litigation and legal risk; and reputational risk.

companyName: Hoth Therapeutics, Inc.

ticker: HOTH


text: The Company's cybersecurity operations team manages all facets of the security monitoring and global incident program, coordinating with a sourced managed services security provider and internal analysts across our operating companies. Applicable company employees are provided cybersecurity awareness training, which includes topics on the Company's policies and procedures for reporting potential incidents. The Company's cybersecurity team is continuously evaluating emerging risks, regulations, and compliance matters and updating the policies and procedures accordingly.

companyName: Veralto Corp

ticker: VLTO


text: We have experienced cybersecurity attacks and incidents in the past and could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.

companyName: IES Holdings, Inc.

ticker: IESC


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework, and we are engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.

companyName: T2 Biosystems, Inc.

ticker: TTOO


text: Board of Directors is responsible for the oversight of risks from cybersecurity threats. As the Company does not have a separately constituted audit committee, the entire Board of Directors fulfills this function. The Board receives reports from management on an as-needed basis regarding information technology and security matters, allowing it to monitor the Company's risk management processes.

companyName: CITRINE GLOBAL, CORP.

ticker: CTGL


text: Risks from Material Cybersecurity Threats As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective, and responsive measures. COMPASS MINERALS INTERNATIONAL, INC.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Invesco’s Board of Directors oversees cybersecurity risk and receives updates at a minimum, of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco’s risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco Ltd.’s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco’s Enterprise Risk Management Committee which provides updates to the Invesco Board to facilitate their oversight.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Our Board has delegated the primary responsibility for oversight of cybersecurity risk to the Audit Committee. The Audit Committee regularly reviews our cybersecurity and data security risks and mitigation strategies. At least twice each year, the Audit Committee receives reports and presentations from members of our team responsible for overseeing our cybersecurity risk management, including our Senior Vice President, Global Information Security ("SVP-GIS") and our Executive Vice President and Chief Information Officer ("EVP-CIO"), and periodically receives reports and presentations from third parties. These reports may address a wide range of topics, including recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Audit Committee reports to the Board on data protection and cybersecurity matters. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee in a timely manner.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: The cybersecurity program of the Company interfaces with other functional areas within the Company, including but not limited to the Company's brands and information technology, accounting, finance, legal and human resources, as well as external third-party partners, where appropriate, to assess, identify and manage potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in training, including phishing exercises, monthly safety meetings, and an annual cybersecurity awareness update. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.

companyName: IPALCO ENTERPRISES, INC.


text: Our management team, including our Senior Vice President of Information Systems and Vice President of Information Security and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team overseeing cybersecurity has over 25+ years of technology and cybersecurity experience and certain of our team hold various cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.

companyName: Extra Space Storage Inc.

ticker: EXR


text: We utilize third party security firms and consultants to test our cybersecurity control environment and to provide certain security measures that we use to protect our information technology environment, including to detect and filter external phishing and malware threats, to provide enhanced endpoint protection and to protect our data through data classification. We have developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by our chief information officer (CIO) who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. Our CIO, who also serves as the Kronos CIO, reports to our and Kronos' chief executive officers, respectively. CompX's cybersecurity program is led by the director of information technology (IT). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating reporting units. Both our CIO and the CompX director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review enterprise risk management level cybersecurity risks annually.

companyName: VALHI INC /DE/

ticker: VHI