text: Our Chief Information Security Officer and our Cybersecurity Risk Committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer and our Cybersecurity Risk Committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: • Continuous monitoring to detect and respond to potential cybersecurity incidents promptly, including the use of advanced security technologies and threat intelligence; • Engagement with external cybersecurity experts to conduct independent assessments of our cybersecurity posture, ensuring that our defenses remain robust against an evolving the threat landscape; • Development and testing of incident response processes, plans and procedures to ensure preparedness in the event of a cybersecurity incident, including clearly defined roles and responsibilities enabling a swift and coordinated response; • Communication and update channels that allow for the timely dissemination of information regarding cybersecurity incidents and the effectiveness of implemented controls. This includes regular reporting to senior management, Cybersecurity Risk Committee and, as appropriate, to the Board of Directors; and • Regular review and updating of our cybersecurity policies and processes to reflect the changing threat landscape ensuring that our risk management practices remain effective and aligned with industry best practices.

companyName: Yext, Inc.

ticker: YEXT


text: The Information Security Program is supported by our three lines of defense model of risk management. The Information Security Team is the first line of defense under the Chief Information Security Officer and provides day-to-day cybersecurity operations including identification and reporting of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, performance of vulnerability and third party information security assessments, and employee awareness and training programs. In addition, the Information Security Team works in coordination with the individual business lines that have direct and primary responsibility and accountability for identifying, controlling and monitoring cybersecurity risk embedded in their business activities. The Information Security Team uses reputable industry service providers for security operations, monitoring, investigation and incident response. The Information Risk Management team conducts periodic assessments in collaboration with consulting services with expertise in the cybersecurity domains. As the second line of defense, the ERM Team under the Chief Risk Officer independently monitors the cybersecurity risk framework across the Company, as well as the effectiveness of the Information Security Program, and third party vendors' vulnerability and penetration tests against the Company's network. Furthermore, the Third-Party Risk Management Team, in conjunction with the ERM Team and the Information Security Team, oversees, identifies, monitors, investigates and addresses material risks from cybersecurity threats associated with the Company's use of third-party service providers. The Third-Party Risk Management Team is also part of the independent risk management function of the Bank and included in the second line of defense. The ERM Team reports the status of the annual assessment of the effectiveness of the Information Security Program to the Chief Risk Officer, who reports to the Board's ROC. When applicable, the Company obtains Statement on Standards for Attestation Engagement 18 reports or equivalent reports for vendor products and services hosted by third parties. Internal Audit serves as the third line of defense and provides additional independent assurance and evaluates the effectiveness of cybersecurity risk management. In addition, the Company regularly engages independent external assessors to perform assessments of its cybersecurity control environment and operating effectiveness.

companyName: EAST WEST BANCORP INC

ticker: EWBC

secItem: Item 1C


text: Cybersecurity Governance AGM's Board of Directors' oversight of cybersecurity risk management is supported by the audit committee of AGM's Board of Directors ("AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. AGM's Board of Directors, AGM's audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on AGM's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from AGM's risk management professionals, AGM's Chief Security Officer ("CSO"), the CISO, the AHL CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from AGM's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's Board of Directors and/or AGM's audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or AGM's audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition as of December 31, 2024. For more information, please see the risk factor disclosures included in Item 1A of this Annual Report on Form 10-K.

companyName: Scilex Holding Co

ticker: SCLX


text: We recognize the importance of maintaining the integrity of our information technology systems and safeguarding the confidential business and personal information we receive and store about our employees, customers and suppliers. We have a cybersecurity risk management program in place to identify, assess, and manage risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cyber attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Among the key features of our program are:

companyName: TopBuild Corp

ticker: BLD


text: Our cybersecurity incident response plan was developed to respond to the threat of security breaches, the threat of cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate material cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: JUNIPER NETWORKS INC


text: Cybersecurity Program Overview FLIAC prioritizes the security of its electronic information systems and the data residing therein. In order to respond to the risks posed by a variety of cybersecurity threats, including security breaches, cyber-attacks, and other cybersecurity incidents, FLIAC has implemented a Cybersecurity Program (the "Program") managed by our Chief Information Security Officer ("CISO") and the CISO's Information Security Team. The Program is designed to protect and preserve the confidentiality, integrity, and continued availability of the electronic information systems that we own or use, and all electronic information owned by or in the care of the Company. The Program is based on industry leading frameworks including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and NIST 800-53. The NIST CSF provides standards, guidelines, and best practices on managing cybersecurity risk and for the organization, improvement, and assessment of the Program.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, customers, suppliers, independent sales agents and distributors. We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, and we monitor the Company's overall security score to assess performance and identify areas for improvement. In recent years, we have installed a new firewall to better protect from network intrusions, hired a Network and Security Administrator, and engaged a third-party service provider to perform an internal penetration test in order to identify and address vulnerabilities. Additionally, we introduced always-on VPN in an effort to better restrict off-campus network access in light of the increase in the number of our employees working remotely in recent years, enhanced our monitoring and control capabilities, and hardened our cloud computing cyber security footprint.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the "Risks Related to Information Technology." The Company has not experienced a cybersecurity incident that has materially affected the company.

companyName: CHIMERIX INC


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity governance, strategy and risk management.

companyName: MASONITE INTERNATIONAL CORP


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 105 of Regulation S-K and shall oversee the Company's response to such matter.

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, and software and cloud-based service providers. We proactively evaluate the cybersecurity risk of our third-party service providers by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform ourselves during contracting and vendor selection processes. Third-party service providers security issues are documented, tracked, and monitored in order to mitigate risk.

companyName: MCCORMICK & CO INC

ticker: MKC


text: A terminated employee's physical and electronic access to personal information must be immediately blocked. Such terminated employee shall be required to surrender all keys, IDs or access codes or badges, business cards, and the like, that permit access to the firm's premises or information. Moreover, such terminated employee's remote electronic access to personal information must be disabled; his/her voicemail access, e-mail access, internet access, and passwords must be invalidated. employees' user ID's and passwords must be managed in accordance to the Sponsor's password policy. are encouraged to report any suspicious or unauthorized use of customer information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Our cybersecurity measures are designed to help protect our information security systems from cybersecurity threats. Our Global Information Security Team is led by our Corporate Vice President and Chief Information Officer ("CIO") and is composed of key functional leaders. Our Global Information Security Team assesses, identifies and manages cybersecurity risks to the Company, including by: • Assessing, identifying and managing cybersecurity risks to our information systems: We assess, identify and manage cybersecurity risks to our information systems, including by: (i) establishing and maintaining a governance structure that includes policies, procedures and processes designed to manage cybersecurity threats and cybersecurity incidents; (ii) conducting ongoing risk assessments, including to identify and assess cybersecurity risks; (iii) developing and implementing an overall risk management strategy, which includes cybersecurity risks; (iv) overseeing, identifying and managing risks from cybersecurity threats associated with our use of third-party service providers and our supply chain; and (v) engaging external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity measures and risk management processes; and • Establishing a program to assess and help mitigate cybersecurity threats: We are committed to establishing a program to assess and help mitigate cybersecurity threats through: (i) conducting employee training on cybersecurity risks and best practices; (ii) implementing measures to classify and protect data; and (iii) taking steps to be aware of and address new cybersecurity threats, including through the receipt of threat information from third-parties that helps us proactively prevent and detect cybersecurity threats.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: Our cybersecurity risks are identified and addressed through a cross-functional approach that includes coordination through our Corporate Information Security Committee, which includes senior managers in our information security, information technology, operations, risk, compliance and privacy departments or functions. Key security, operations, risk, compliance and privacy stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board in a timely manner.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: At the executive and management level, the CISO has primary responsibility for the development, operation, and maintenance of FirstEnergy's cyber security program. The CISO has 6 years of experience in technology risk management, all of which have been with FirstEnergy, and an additional 23 years of experience in information technology. The CISO has passed examinations and received the International Information System Security Certification Consortium Certified Information Systems Security Professional certification. The CISO reports directly to FirstEnergy's Senior Vice President, Shared Services, who is responsible for all of FirstEnergy's digital and technology services and is FirstEnergy's most senior information technology executive. Under the CISO's oversight, FirstEnergy's cyber security team implements and provides governance and functional oversight for cyber security controls and services. Cyber security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the Senior Vice President, Shared Services, legal, and the executive leaders as appropriate based on the severity of any such risk or incident. In addition, regular updates from the cyber security teams, in conjunction with real-time escalation on an as-needed basis, are also used to update the risk landscape.

companyName: FIRSTENERGY CORP

ticker: FE


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors — Our business and operations may suffer in the event of information technology system failures, cyberattacks, or deficiencies, which could materially affect our results."

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: Our Information Systems Representative, in coordination with senior management including our Chief Operating Officer works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout our company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the Information Systems Representative and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. The Information Systems Representative has served in various roles in information technology and information security for over 25 years, including serving as the Director of Information Technology of another public company. Our Chief Operating Officer has over 7 years of experience managing information technology, including cybersecurity and risk management.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and data breaches. On a quarterly basis, the Audit Committee receives an overview from our Head of IT regarding our cybersecurity threat risk management and strategy processes, which may include, for example, covering topics such as data security posture, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Chair of the Audit Committee periodically updates our Board of Directors on its oversight of cybersecurity and data breach risk management and strategies.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Our organizational cybersecurity program is under the direction of our Chief Information Security Officer ("CISO") who receives reports from our cybersecurity team and oversees the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. Our CISO reports to our Chief Operating Officer ("COO"), who may discuss cybersecurity risks and other operational risks with other senior management as appropriate. Our CISO and dedicated cybersecurity team personnel are certified and experienced information systems security professionals and cybersecurity managers with many years of experience. Our CISO has served in that position since 2019 and has over 25 years of managerial and professional cybersecurity expertise. He has held the role of CISO and other senior management positions with NDS Services, Cisco Systems, Inc. and Deloitte and has also served as cybersecurity consultant for companies in multiple global industries. Our COO has extensive experience in project management and cybersecurity, including from past roles with Verint Systems Inc. and Cisco Systems, Inc. as well as the establishment and management of the Company's cybersecurity team prior to our CISO joining the Company.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Depending on the particular environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, asset management, tracking and disposal, incident detection and response, systems monitoring, vulnerability management policy, vendor management program, disaster recovery/business continuity plans, employee training, risk assessments, penetration testing, cybersecurity insurance, encryption of data, dedicated cybersecurity staff/officer, network security controls, asset management, tracking and disposal, data segregation, and access controls.

companyName: CS Disco, Inc.

ticker: LAW


text: The Program includes the following key elements: • Network, Systems, and Data Security – Corebridge deploys technical and organizational safeguards that are designed to protect Corebridge's networks, systems, and data from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, software security assessments, and access and identity management controls; • Threat and Vulnerability Management –Corebridge maintains a threat and vulnerability management program that leverages threat intelligence to proactively identify, assess, and address cybersecurity risks. This program incorporates vulnerability scanning, risk-based remediation and mitigation, penetration testing, and threat response capabilities to safeguard our information assets and ensure business continuity; • Cybersecurity Incident Monitoring and Response – Corebridge has established and maintains incident response plans that address Corebridge's response to a cybersecurity incident, utilizing a cross-functional approach; • Third Party Assessment and Oversight – Corebridge maintains a third-party risk management program to identify and manage risks from third-party service providers, including initial due diligence, an assessment of the service provider's control environment and periodic re-assessments; and • Security Training and Awareness – Corebridge provides ongoing education and training to employees regarding information security threats, and their role and responsibility in detecting and responding to such threats.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: We have established an Information Security department within our Risk Management department that is independent of the Information Technology department. Furthermore, we have a documented Information Security Strategy that guides the Information Security teams and business departments across the Company. The Information Security Strategy incorporates the external landscape, risk assessments, Company's strategy, information technology strategy and other inputs.

companyName: Sterling Bancorp, Inc.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example data encryption for certain data, network security controls, data segregation for certain data, access controls, physical security controls, monitoring for certain systems, asset management and tracking, and employee training. We also maintain cybersecurity insurance.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: Despite the efforts outlined above, we cannot ensure that we will not be subject to any cybersecurity incidents or threats. See "Risk Factors Risks Related to Information Technology" for additional information. To date, management has not determined that any cybersecurity incidents the Company has experienced would have resulted in, or are reasonably likely to result in, a material impact to its financial condition, results of operations, or business strategy.

companyName: MediXall Group, Inc.

ticker: MDXL


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee biannually reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports its findings to the full Board of Directors. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the Chief Information Security Officer ("CISO") and Sr. Director of Internal Audit on a biannual basis. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer, Chief Information Officer, and Chief Legal Officer may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.

companyName: SYNAPTICS Inc

ticker: SYNA


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal), senior leadership and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Our management team stays informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents that impact our corporate systems and information through various means, which may include briefings from internal and external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the corporate IT environment.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.

companyName: QVC INC

ticker: QVCD


text: The Information Technology Steering Committee is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Information and Operations Officer provide regular reports to the Information Technology Steering Committee and our board of directors regarding the Information Security Program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee and our board of directors review and approve our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full board of directors at each board meeting.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Our cybersecurity risk management and strategy program consists of cybersecurity-related policies and procedures, industry standard technology solutions including antivirus, firewalls and monitoring tools, awareness training for all employees, periodic testing, and insurance coverage. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Uber's Chief Information Security Officer ("CISO") is responsible for the cybersecurity program, which is coordinated and primarily executed by the global organization of engineers focused on risk management using the NIST Framework (Govern, Identify, Protect, Detect, Respond, and Recover) and activities such as automation, secure development, and advanced analytics and monitoring. The CISO has served in such role since February 2021 and has more than 20+ years of engineering and/or cybersecurity experience, including previously as CISO and Deputy Chief Technology Officer at a Fortune 500 company.

companyName: Uber Technologies, Inc

ticker: UBER


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats that we face are assessed on an ongoing basis, and the way such risks could materially affect our business strategy, operational results, and financial condition is regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.

companyName: Muzinich BDC, Inc.


text: Our CISO and representatives from our steering committee on information security provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Because many members of our board of directors regularly attend our audit committee meetings, the full board of directors regularly receives updates on cybersecurity.

companyName: Cricut, Inc.

ticker: CRCT


text: Management's Role Managing Risk The role of the Chief Information Security Officer (CISO) has been assigned to our VP, Information Technology, who has more than 20 years of IT experience and reports to the CFO. The CISO and the CFO inform the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on no less than an annual basis or on an ad hoc basis when needed. These briefings encompass: Evaluation of existing cybersecurity risks; Status of ongoing cybersecurity initiatives and strategies from the cybersecurity roadmap; and Incident reports and learnings from cybersecurity events.

companyName: electroCore, Inc.

ticker: ECOR


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 13 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its President, Chief Compliance Officer, Chief Operating Officer, who acts as chairperson of the ORC, Chief Credit Officer, Chief Financial Officer - Investment Funds and Chief Financial Officer - Management Company. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.

companyName: Monroe Capital Income Plus Corp


text: Our cybersecurity efforts are managed through third-party service providers and third-party software providers who will notify Mr. Winn of a significant cybersecurity incident report that details the nature of the incident, the measures taken to mitigate its impact, and the steps implemented to remediate the situation. We receive periodic summary reports from our providers that outline emerging threats, trends, and the overall effectiveness of our current cybersecurity controls. These processes ensure that Mr. Winn remains actively informed and engaged in overseeing the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: Description of Processes for Assessing, Identifying and Managing Cybersecurity Risks Our operations are dependent on our ability to process financial transactions in a secure manner. Failure in or breach of our operational or security systems or infrastructure, or those of our third-party vendors and other service providers, could disrupt our business or the businesses of our customers, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: Risk Management and Strategy Peapack-Gladstone Bank's risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Peapack-Gladstone Bank's Information Security Officer is primarily responsible for cybersecurity and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Information Technology Steering Committee and Peapack-Gladstone Bank's board of directors.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: We or our third-party manager currently maintain a cybersecurity insurance policy that provides coverage for security incidents and periodically meet with our insurer to discuss emerging trends in cybersecurity. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, notwithstanding the programs, policies and procedures described above, there can be no assurance that we or businesses with which we interact will not experience a cybersecurity incident that materially affects us in the future. For more information about the cybersecurity risks we face, see the risk factor entitled "Cybersecurity incidents, including the failure to protect the integrity or availability of IT systems or the security of confidential information, or the introduction of malware or ransomware, could harm our business." in Item 1A. Risk Factors of Part I of this Annual Report on Form 10-K.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: We recognize the importance of protecting our critical information technology ("IT") systems and data from material risks from cybersecurity threats. Risk management for cybersecurity threats is integrated into our overall enterprise risk management system. We consider cybersecurity risks alongside other business risks. Our risk management framework includes risk assessments, internal controls, and systems monitoring mechanisms. We have established processes designed to assess, identify, and manage material risks from cybersecurity threats to our IT systems and critical data, including intellectual property, confidential information, and personal data ("Information Systems and Data"). Third parties also play a role in our cybersecurity efforts. We engage third-party services to assist us from time to time to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. We conduct audits and evaluations of our IT infrastructure, network architecture, and software applications to help us identify vulnerabilities, potential entry points, and areas for improvement. We perform assessments considering principles from the National Institute of Standards and Technology Cybersecurity Framework and by using an external third-party security assessor from time to time.

companyName: SI-BONE, Inc.

ticker: SIBN


text: Our Cybersecurity Incident Response Team manages and executes technical response activities in coordination with our Security Operations Center, subject matter experts and others to respond to a cybersecurity incident. The objectives of the CSIRP include to: • Establish the Company's cybersecurity incident response process and provide actionable guidelines to provide a timely, consistent, and repeatable response process; • Describe the requirements and expectations for cybersecurity incident response; • Set forth the roles and responsibilities for cybersecurity incident response personnel; • Establish cybersecurity incident classification, escalation, and prioritization parameters; • Confirm the documentation process for cybersecurity incidents affecting the Company and the Company's responses are appropriately documented; • Establish protocols for materiality determinations for cybersecurity incidents under the SEC's cybersecurity rules; • Establish the process for assessing when public disclosure and external communications may be required; and • Mitigate or minimize the effects of a cybersecurity incident on the Company, its personnel, customers, consumers, or others and limit financial, operational, legal, and reputational impact.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: We have developed and implemented an information security program predicated on industry practices, frameworks and applicable regulations that are reinforced by policies, processes, procedures, standards, technologies and training designed to protect our IT systems, operations and sensitive business information with administrative, physical and technical safeguards. Through our information security program, we seek to assess, identify, monitor, mitigate and manage cybersecurity incidents and threats, and to prevent the occurrence of a cybersecurity incident through protective and detective technologies that measure and monitor our critical IT systems, which include among others, intrusion detection and protection, email security, endpoint security, third-party security monitoring and proactive security testing. Our information security program is integrated as part of our enterprise risk management framework.

companyName: PRA GROUP INC

ticker: PRAA


text: The company's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally and report cybersecurity incidents to appropriate levels of management based on potential impact. The company conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, IT management exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate, and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The company takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: As noted above, the Company relies on CTO's information systems and the MSP in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by CTO. All of the Company's executive officers are executive officers and employees of CTO, and one of the Company's officers (John P. Albright) is also a member of CTO's board of directors.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: In the ordinary course of our business, we have experienced and expect to continue to experience, cyber-based attacks and other attempts to compromise our information systems. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any risks from any cybersecurity threats or from any previous cybersecurity incident have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, whether directly or through our supply chain or other channels, we face a risk of such threats, the consequences of which could be material. Further, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" under the heading "We face, and may continue to face, risks related to information systems interruptions, intrusions and or new software implementations, which may adversely affect our business operations" for a discussion of cybersecurity risks.

companyName: MOOG INC.

ticker: MOG-A


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and refine our practices. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: Annual internal and external vulnerability scans are completed to ensure we mitigate any risks proactively. The Company's internal operations are PC based and the PCs have up to date security software. Regular phishing exercises are conducted, and employee awareness training is conducted annually by our outsourced provider.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: We employ a robust information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to imitate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.

companyName: Public Storage

ticker: PSA


text: Corporate Controller reviews the efficacy of our cybersecurity procedures from time to time as circumstances make it appropriate and annually in connection with the annual audit of the Company's financial statements. Our Corporate Controller reports to our CEO and CFO on matters of cybersecurity, and together they carry responsibility for our overall cybersecurity risk management procedures.

companyName: INVO Fertility, Inc.

ticker: IVF


text: Cybersecurity Leadership Our Board of Directors is actively involved in overseeing our cybersecurity risk management. Our Board of Directors receives quarterly updates on our cybersecurity posture, threats, and incidents from our Senior Vice President of Technology. Our Board of Directors also delegates certain oversight functions to our Audit Committee, which reviews our cybersecurity policies, procedures, controls, and audit results. Our Board of Directors and our Audit Committee regularly assess the adequacy of our cybersecurity risk management framework and the effectiveness of our mitigation strategies.

companyName: urban-gro, Inc.

ticker: UGRO


text: Our board of directors address the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including the Company's oversight and mitigation of risks from cybersecurity threats.

companyName: Pulmonx Corp

ticker: LUNG


text: We also incorporate security practices into employee training. We have a process for employees to formally acknowledge their review and understanding of security obligations, and the information security and legal teams conduct periodic security and data protection training aimed to emphasize the importance of security and data protection. In addition, we have implemented a review process to assess the security profile and data protection practices of certain third-party service providers that have exposure to Akamai's systems, including, as appropriate, review of vendor security policies and procedures and contractually required security commitments.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Aside from our general efforts to protect ourselves from global cybersecurity threats, for the period covered by this annual report, management has not identified any risks from cybersecurity threats or cybersecurity incidents that we believe have had a material effect, or that are reasonably likely to have a material effect, on our business strategy, results of operations or financial condition. However, we cannot provide any assurance that they will not be materially affected by such threats or incidents in the future.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: Additionally, the Company's management reports to the Audit Committee on the Company's and its subsidiaries' strategies, risks, metrics and operations relating to cybersecurity and information security matters, including significant cybersecurity and information security-related projects and initiatives and related progress, the integration and alignment of such strategy with the Company's overall business and strategy, and trends that may affect such strategy or operations.

companyName: Cosmos Health Inc.

ticker: COSM


text: The Companies' corporate intelligence and security program includes both cybersecurity and threat intelligence components as part of its evaluation and mitigation of risks. The evaluation of risks includes consideration of cybersecurity and privacy risk, including potential impact on the Companies' employees, customers, supply chain and other stakeholders, intelligence briefings on notable cyber events impacting the industry and evaluation of insider threats. The Companies utilize a robust set of internal and third-party assessment tools to test its cyber risk management policies, practices and procedures as well as challenge assumptions upon which its defenses are built. These assessments provide opportunities for self-critical analysis and constructive feedback needed to build cyber resilience. Trainings are routinely provided to employees to help identify, avoid and mitigate cybersecurity threats and to ensure an understanding of the Companies' cyber risk management policies. In addition, risk assessments are conducted as a component of the evaluation of vendors and suppliers.

companyName: VIRGINIA ELECTRIC & POWER CO


text: The Chief Financial Officer of Varagon is responsible for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing non-public information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, including those pertaining to the Company. Additionally, Varagon uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, Varagon also maintains an incident response plan that is utilized when cybersecurity incidents impacting the Company or the Adviser are detected. Varagon also requires that all employees, including employees of the Adviser, complete periodic information security training, including new hire training, regular compliance training, and periodic informal training pertaining on specific areas of concern.

companyName: Varagon Capital Corp


text: We also engage third-party consultants to assist in designing and enhancing our cybersecurity risk management framework, including penetration testing and continuous threat monitoring. date, we have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: Ondas Inc.

ticker: ONDS


text: Management has not identified any specific risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See " Item 1A. Risk Factors, Our business could be negatively impacted by security threats, including cybersecurity threats, and other disruptions. " above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers.

companyName: McEwen Inc.

ticker: MUX


text: AFG has designed its ERM program to reinforce the way the Company operates its business and reflects its culture, organizational structure and risks. The AFG Enterprise Risk Committee ("ERC"), consisting of AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's General Counsel and Great American's President, oversees the ERM process including risk identification, risk impact and mitigation strategies. Each member of the ERC directly reports to AFG's Co-CEOs. On a day-to-day basis, the Company's ERM process is overseen by an AFG Enterprise Risk Officer, who regularly meets with senior leaders, including the CISO, representing key areas throughout the organization. Cybersecurity risk has been identified as a significant risk monitored under the ERM program. In addition, Ms. Murray, one of AFG's independent Directors, completed the National Association of Corporate Directors' Cyber-Risk Oversight Program and received the CERT Certificate in Cybersecurity Oversight issued by the Software Engineering Institute at Carnegie Mellon University.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: • Enterprise Risk Management Committee ("ERMC") – The ERMC is a management committee of the Bank and has primary oversight responsibility of the Company's cybersecurity programs. • Chief Risk Officer ("CRO") – Tawnya Schoolitz is serving as our interim CRO, after serving in several leadership roles in the Company, including Chief Compliance Officer. In her current role, Ms. Schoolitz is responsible for reporting serious incidents to external authorities pursuant to advice from internal or external legal counsel, unless otherwise delegated. • Chief Information Officer ("CIO") – Lori Meyer has served as our CIO since June 30, 2023, after serving in several leadership roles in the Company, including Director of Enterprise Program Management, Director of IT Business Management, Director of IT Business Relations, and Business Process Improvement Lead. As CIO, Ms. Meyer is responsible for oversight of the Company's cybersecurity policies and informing the ERMC on current computer security readiness, information security standards, procedures, regulatory compliance, data security and privacy concerns, and the remediation plans annually, or as needed. • Chief Information Security Officer ("CISO") – Dale Daugherty has served as our CISO since 2021. As CISO, Mr. Daugherty is responsible for establishing and monitoring the effectiveness of the Company's cybersecurity policies and reporting the status and a summary of cybersecurity incidents to the CRO, CIO, ERMC, and Risk Committee. In this role, Mr. Daugherty serves as an intermediary between the CRO and the CIRT. Since 2002, Mr. Daugherty has served in the roles of Information Security Officer, AVP – IT Audit Manager, and Director of IT Compliance, Risk, and Security for the Bank and holds the CISSP, CISA, GCIH, GCIA, and GSEC certifications. • Chief Human Resources Officer ("CHRO") – Rachel B. Turitto has served as our CHRO since 2019. As CHRO, Ms. Turitto is responsible for appropriate administration of the Company's cybersecurity policies with respect to employee-related cybersecurity incidents. Ms. Turitto joined us with over 15 years of diverse experience across multiple human resource disciplines, including human resource information systems. • Risk Committee – The Risk Committee reviews periodic updates on cybersecurity matters from the CISO, CIO and the CRO. These updates include the information security risk and vulnerability assessment, the overall status of the information security program, and compliance with regulatory guidelines. In addition, reporting includes periodic assessments of business resiliency including oversight and management of incidents.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: The Information Technology Steering and Audit Committees are responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer and our Chief Technology Officer provide quarterly reports to the Information Technology Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Information Technology Steering Committee reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Management Committee and Audit Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Information Technology Steering Committee and Risk Management Committee each provide a report of their activities to the full board of directors at least quarterly.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: The Utilities have a cybersecurity program in place, which is integrated into the overall risk management program and includes a risk management strategy and risk assessment policy, which are disseminated and maintained by the Chief Information Security Officer (CISO), revisited annually and govern the enterprise cybersecurity risk and maturity assessment process. The program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), and leverages a risk-based approach to optimize security investment and advance the security program's maturity and security posture over time.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Company's management is responsible for assessing and managing material risks from cybersecurity threats, in consultations with cybersecurity consultants. The compliance team of the Company will maintain effective disclosure controls and procedures to ensure timely identification, consideration, and disclosure of material cybersecurity incidents, including through timely reporting to management and the Board. The Chief Compliance Officer, in consultation with the IT Consultant, will periodically determine whether the Company requires additional information technology or cybersecurity support.

companyName: SARATOGA INVESTMENT CORP.

ticker: SAR


text: Management has implemented robust risk management structures, policies, and procedures, with day-to-day cybersecurity risk management being a core responsibility. Our Chief Financial Officer ("CFO") spearheads the assessment and management of cybersecurity risks on a daily basis, ensuring that our strategies and actions are both proactive and responsive to the evolving cybersecurity landscape. Supporting this effort, we have a cross-departmental approach to cyber security management. This ensures that our executive leadership team receives comprehensive quarterly updates on cybersecurity from various teams within the organization. Such updates are instrumental in promoting stakeholder engagement across all levels and enhancing management's oversight of cybersecurity. The content of these updates includes progress on ongoing cybersecurity initiatives, insights from recent threat assessments or incidents, findings and action plans derived from external vulnerability and penetration tests, and key performance metrics aligned with industry standards.

companyName: TRANSCAT INC

ticker: TRNS


text: We also conduct tabletop exercises that simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.

companyName: TEJON RANCH CO

ticker: TRC


text: We are a global company built on the trust of our customers, employees and business partners, and one of the primary ways we maintain that trust is by respecting privacy rights and safeguarding their information. We believe security is at the center of any strong data privacy program and maintaining cyber-readiness and managing cybersecurity risk continue to be areas of critical focus for us. We have in place a group-wide risk management process designed to identify and assess the greatest existing and emerging risks that could impact our business, including cybersecurity and data privacy risks. As a part of our risk assessment process, we have developed a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. We follow widely-accepted security standards to help guide our decisions and minimize cybersecurity risks. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined policies and procedures for responding to such security incidents, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement.

companyName: Capri Holdings Ltd

ticker: CPRI


text: The Company has implemented controls based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") and the Sarbanes-Oxley Act of 2002. Our Information Technology organization is led by the Chief Information Officer ("CIO") who is responsible for cybersecurity risk management. The Audit Committee is tasked with oversight of our overall enterprise risk management program, including cybersecurity, and receives recurring cybersecurity updates throughout the year with one full cybersecurity report to the Board of Directors. Directors with experience in cybersecurity and technology play crucial oversight roles for our digital and cybersecurity strategies.

companyName: Ingersoll Rand Inc.

ticker: IR


text: Internal Cybersecurity Team Our interim Chief Information Security Officer ("CISO") oversees a team with extensive cybersecurity knowledge and experience. The team is responsible for: • leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes; • incident response and operational activities, including identifying and initiating updates to systems which require patching, vulnerability management strategy, red teaming, network security configurations and security architecture; • oversight of third parties engaged to assist in our cybersecurity risk management, along with third parties' vendors; and • legal and regulatory compliance.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: We, Kronos and CompX continually enhance our security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We, Kronos and CompX engage third-party services to conduct evaluations of our security controls through penetration testing, red team testing, consulting on best practices, and to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: NL INDUSTRIES INC

ticker: NL


text: Ondas Networks, risk management is further managed through the use of expert third party companies to assist in managing relevant risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Senior Director of Information Technology, who has worked in various roles responsible for securing networks and application systems, the Chief Executive Officer, the General Counsel, and the Chief Financial Officer. These members of management are responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They are also responsible for approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. When incidents are identified, these members of management are responsible for determining whether such incidents are material and may escalate material incidents to the Audit Committee and/or investors, based on the particular circumstances.

companyName: Pulmonx Corp

ticker: LUNG


text: Risk Management and Strategy Envestnet's Information Security Program uses a risk-based approach to assess, identify and manage material risks from cybersecurity threats and is an integral part of our enterprise risk management program and processes. The Information Security Program is complemented by our business continuity and disaster recovery planning controls. Envestnet's Group Head, Cybersecurity/Information Security Officer is a member of the firm's Risk Management Committee.

companyName: ENVESTNET, INC.


text: Our Vice President, Information Security and Technology, who reports to our Chief Technology Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Vice President, Information Security and Technology has extensive experience assessing and managing cybersecurity and risk programs having served in the current position for us since December 2020 and prior Senior Director level positions in Security and Privacy at several private and public Software as a Service, or SaaS, companies. Specialized knowledge also results from our Vice President, Information Security and Technology holding a Master of Information Security and Assurance from Norwich University.

companyName: CarGurus, Inc.

ticker: CARG


text: Under the oversight of the Audit Committee, and as directed by our Chief Financial Officer, our Head of Information Technology has established policies for and is primarily responsible for overseeing our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. As part of this cybersecurity program, we utilize a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. The MSP has the requisite experience to oversee our cybersecurity program. Our Chief Financial Officer and our Head of Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan. In addition, our Chief Financial Officer and our Head of Information Technology coordinate with our legal counsel to assess and manage material risks from cybersecurity threats. Our Chief Financial Officer and our Head of Information Technology provide updates as frequently as appropriate to the Audit Committee.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, operations, privacy and compliance issues are identified and addressed through a multi-faceted approach. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: Journey Medical Corp

ticker: DERM


text: The Company has implemented and continues to enhance a comprehensive set of cybersecurity measures based on industry best practices that are meant to protect confidential information, minimize vulnerabilities and intrusions, and maximize detection and response and restoration capabilities. Key components of our strategy include employee training, identity management, multi-factor authentication, endpoint security, detection and response SOCs, privileged access and endpoint management, network traffic inspection, email security, local and cloud-based backups, and third party vulnerability testing and remediation.

companyName: Townsquare Media, Inc.

ticker: TSQ


text: Notwithstanding the effort we place on cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats or incidents which have materially affected or are likely to materially affect our Company, results of operations, or financial condition.

companyName: MAYS J W INC

ticker: MAYS


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We utilize standard commercial software for business operations, which includes basic security features such as password protection and data encryption. Our management is generally responsible for assessing and managing any cybersecurity threats.

companyName: BIOETHICS LTD

ticker: BOTH


text: We recognize the importance of cybersecurity in maintaining the integrity of our systems and data. Our IT Director oversees cybersecurity risk management, conducting assessments as needed based on identified risks or evolving security practices. We implement security measures such as firewalls, encryption, and access controls to help protect against unauthorized access.

companyName: BIOREGENX, INC.

ticker: BRGX


text: We also have an Enterprise Risk Management Steering Committee (the "ERM Steering Committee"), which is responsible for formally identifying and evaluating risks that may affect our ability to execute our corporate strategy and fulfill our business objectives, including cybersecurity risks. The ERM Steering Committee is chaired by the Company's chief financial officer and includes the Company's SVP-ITS, general counsel, internal audit director, and other members of management. The ERM Steering Committee conducts an annual comprehensive risk review of our overall risk profile and analyzes any significant identified risks, including consideration of risks relating to cybersecurity matters, which the ERM Steering Committee then presents and discusses with the FRMA Committee and the entire Board. In addition to the formal annual review, members of the ERM Steering Committee review and provide periodic updates as appropriate regarding our overall risk profile and any significant identified risks to both the FRMA Committee and the entire Board.

companyName: INSPERITY, INC.

ticker: NSP


text: We annually engage third parties (as well as our own internal audit department) to audit our cyber and information security programs, processes and controls, and the findings of these parties are reported to the Audit Committee and the full Board. These audits also include annual penetration testing and web application assessments by third parties to test control effectiveness against threat actor attack techniques.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: The Company has multiple other enterprise risk programs and assessments which include information security as an integrated component that allow the Company to identify, assess, and manage risk. Processes and controls documented as part of these programs are tested as part of the enterprise-wide risk control self-assessment program. Additionally, metrics have been identified across the organization to cover key information security risk, including risk thresholds in line with our risk appetite. A management information systems program is in place with supporting governance routines to review any breaches of these metrics. Further risk management practices related to cybersecurity include scenario risk analysis, operational risk event escalation and monitoring, as well as processes to assure policy compliance.

companyName: Santander Holdings USA, Inc.


text: Atkore's commitment to cybersecurity emphasizes maintaining secure technology and data environments and the cultivation of a security-minded culture and capability. We do this through education and training, and a layered approach to identifying, preventing, detecting, responding to and recovering from cybersecurity threats and incidents. Key elements of our program for assessing, identifying, and managing material risks from cybersecurity threats are anchored in widely used and industry recognized security frameworks and are described below.

companyName: Atkore Inc.

ticker: ATKR


text: Cybersecurity Risks The Company believes that its current preventative actions and response activities provide reasonable measures of protection against security breaches and serve generally to reduce the Company's overall cybersecurity risk. However, cybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In addition, the Company has obtained insurance to provide coverage for a portion of the losses and damages that may result from a cyber attack or a security breach, but such insurance is subject to exclusions, limitations and exceptions, and may not cover the total loss or damage caused by an attack or breach. To date, management has determined that no cybersecurity incident experienced by the Company has resulted in a material impact on its financial condition, results of operations or business strategy. For additional information concerning cybersecurity-related risks, see Item 1A—Risk Factors—We may be subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Through this ongoing engagement with these internal teams and certain third-party service providers, our CIO and our Managing Director of Information Security monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report on cybersecurity incidents. The Company has a notification process in our incident response plan that contains requirements for timely notification to senior management by the CIO and to the Board of Directors by the CEO for incidents that reach established thresholds as well as procedures for external reporting.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: Peabody's cybersecurity strategy emphasizes reduction of cybersecurity risk exposure and continuous improvement of its controls and policies based on industry recognized best practices for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). This strategy includes: (i) proactive management of cybersecurity risk to ensure compliance with contractual, legal and regulatory requirements; (ii) performing due diligence on third parties to ensure they have sound cybersecurity practices in place; (iii) ensuring essential business services remain available during a business disruption; (iv) annual cybersecurity assessments to include NIST CSF maturity assessments, penetration testing and red team assessments, as well as table top exercises with subsequent remediation of key findings; (v) participation in Information Sharing and Collaboration industry groups; (vi) maintaining an updated cybersecurity policy and incident response plan; (vii) exercising cyber incident response plans and risk mitigation strategies to address potential incidents should they occur; and (viii) annual cybersecurity awareness training for all employees and directors, including formal training and simulated phishing events.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: Cybersecurity risk is an integral part of our enterprise risk management and is managed as part of our overall information technology risk under the direction of our Chief Information Security Officer (CISO). Our CISO is an executive vice president at State Street and is responsible for our overall information security program.

companyName: STATE STREET CORP

ticker: STT


text: 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: VIVOS INC

ticker: RDGL


text: We have established an enterprise cybersecurity program to assess, identify, and manage cybersecurity risks with the aim that our information systems, including those of our vendors and other third parties, will be resilient, effective, and capable of safeguarding against emerging risks and cybersecurity threats.

companyName: Catalent, Inc.


text: A dedicated management team at our corporate headquarters, which is led by our Director of Data Security ("DDS") and composed of the Chief Technology Officer ("CTO") and representatives from risk management, legal, internal audit, and finance departments, is responsible for assessing and managing our cybersecurity risks and data protection practices. The Audit Committee oversees the measures taken by this management team to monitor material risks associated with cybersecurity threats, a role crucial to maintaining a robust and effective cybersecurity risk management approach. The DDS and CTO provide formal briefings to the Audit Committee on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, and other areas of importance at least once a year, with the Board of Directors receiving updates periodically. Regular discussions on enterprise risks are held between the Audit Committee, Board of Directors, and senior management.

companyName: WATSCO INC

ticker: WSO


text: As part of its cybersecurity risk management, the Company delivers specific education to the organization on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees globally on a regular basis and may be supplemented by various testing initiatives including periodic phishing tests.

companyName: Garrett Motion Inc.

ticker: GTX


text: To achieve these objectives, we emphasize fundamental security measures, such as access controls, cyber hygiene (e.g., patching and malware protection) and employee awareness training.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: Our management team, specifically our President and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: HONG YUAN HOLDING GROUP

ticker: HGYN


text: We have established a tiered risk management strategy that helps us to evaluate our ability to protect assets (data and systems) by identifying, assessing, and prioritizing associated risk through, among other tools, the use of a non-affiliated third party assessor, audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, and simulations. We report the results of these assessments to the Audit Committee of the Board of Directors.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: As a global leader in CRM technology, our services involve the storage and transmission of our customers' and our customers' customers' data. As such, we have in the past been, and likely will in the future be, the target of cybersecurity threats and other efforts to breach or compromise our services and underlying infrastructure. With trust as our foremost value and the foundation of everything we do, we recognize the importance of maintaining the safety and security of our systems and data, as our customers trust our technology to deliver the highest levels of security, privacy, performance, compliance and availability at scale.

companyName: Salesforce, Inc.

ticker: CRM


text: Signet partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Signet engages with these partners to provide or operate technical controls and technology systems, monitor, and maintain the performance and effectiveness of products and services deployed in Signet's environment, and conduct vulnerability scans and penetration testing.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: The audit committee receives periodic written and verbal reports from our Chief Financial Officer and directly from the information technology department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The audit committee also receives from the Director of IT Operations and Security or the Senior Director of IT, various written reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: KKR also has a cybersecurity incident response plan that is specific to our insurance business. The plan sets forth the roles and responsibilities of the Global Atlantic incident response team, which is comprised of Global Atlantic employees representing key business functions at our insurance business. Global Atlantic utilizes several mechanisms to monitor and manage the cybersecurity risks of our insurance business, including to prevent, and prepare to respond to, an incident. This includes maintaining relationships with external incident response organizations, performing periodic cybersecurity risk assessments, overseeing and monitoring risks from cybersecurity threats associated with third-party service providers, and ensuring that Global Atlantic employees complete security awareness training relating to cybersecurity best practices. Global Atlantic also has a cybersecurity notification framework in place to determine when appropriate notifications and escalations are required to be provided to the senior members of Global Atlantic's management, members of Global Atlantic's board of directors and members of KKR's risk and operations committee, certain member of which would, as appropriate, report such information to our Board of Directors or its Audit Committee or Risk Committee.

companyName: KKR & Co. Inc.

ticker: KKR


text: The Audit Committee regularly reviews and discusses with management and, as appropriate, the Company's auditors, the Company's guidelines and policies with respect to risk assessment and risk management, including the Company's data privacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.

companyName: Criteo S.A.

ticker: CRTO


text: Cyber Liability Insurance. Through consultant driven data, analytics and peer benchmarking, we secured and maintain specific coverage to mitigate losses associated with cyber-attacks and other information security incidents, addressing both first-party and third-party losses from incident response, cyber extortion, data loss, business interruption, contingent business interruption, regulatory penalties, media liability, social engineering coverage, system failures and bricking/hardware replacement.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Board receives periodic reports from the Audit Committee on these and other activities. The Audit Committee receives periodic reports from management on our cybersecurity risks, including presentations from our Chief Information Officer, internal security staff, and external experts. This includes updates to the Audit Committee, as appropriate, regarding any significant cybersecurity incidents, or multiple incidents that could be significant in the aggregate. These updates may occur in between regularly scheduled Audit Committee meetings.

companyName: Bloom Energy Corp

ticker: BE


text: We did not identify any cybersecurity incidents during the year ended December 31, 2024 that have materially affected or are reasonably likely to materially affect Solitario's business strategy, results of operations, or financial condition.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: We use threat intelligence, vulnerability scanning and security assessments to identify and classify risks and impact. We engage multiple third-party cybersecurity services and experts who collaborate with our internal team to provide a multilayered approach for real-time threat detection across cloud services, networks and endpoints. Our security measures are under continuous scrutiny, with regular enhancements and updates to our policies and operational protocols integrated with a feedback loop from tabletop exercises. Our business continuity and response plan outlines our plans, procedures and policies governing our general information security program. As part of our business continuity plan and security awareness, we conduct tabletop exercises and regular mandatory training for all employees. We have also implemented a cybersecurity enhancement program, focusing on special initiatives which include automating security incident response, including systems that can provide quicker business recovery from multi-geographical locations, strengthening the governance framework, upgrading the hybrid server environment on our vessels and improving wireless communication system resilience. In addition, we have a process in place to manage cybersecurity risks associated with third-party service providers. We are in the process of imposing the new regulatory security requirements upon our suppliers, which will include: maintaining an effective security management program, abiding by information handling and asset management requirements and notifying us in the event of any known or suspected cyber incident.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: Our CISO has served in various roles in information technology and information security for more than 30 years, including serving as the Chief Information Security Officer at two other large public companies and has been with ACI since 2015. Our CCO has over 30 years of experience in compliance program leadership and process design, risk management and financial services operations, including serving as Head of Compliance for several banking and financial services technology organizations including two other publicly traded companies.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the Board). The Board, Audit Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is incorporated into our enterprise risk management program and leverages industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0), which organizes cybersecurity into six functions: govern, identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. We have a set of Company-wide policies and procedures concerning cybersecurity matters, which include numerous written information technology (IT) security policies, standards, procedures and guidelines as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: CINTAS CORP

ticker: CTAS


text: As part of our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: DarioHealth Corp.

ticker: DRIO


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities. Our CIO is part of the executive management team, and updates our CEO and executive management on a monthly, or even more frequent basis, on cybersecurity enhancement and the development and implementation of our roadmap.

companyName: SPAR Group, Inc.

ticker: SGRP


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the rick factor entitled "If our information technology systems or sensitive information, or those of our collaborators or other contractors or consultants, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to, a significant disruption of our product development programs and our ability to operate our business effectively, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."

companyName: IN8BIO, INC.

ticker: INAB


text: Third-party assessments: We have engaged third-party vendors to periodically assess our cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats. We also regularly engage with consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and compliance.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Our Business and Industry" and "Risk Factors – Risks Related to Government Regulation" in this annual report on Form 10-K.

companyName: American Well Corp

ticker: AMWL


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled " Failure of a key information technology system, process or site could have an adverse effect on our business " in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.

companyName: Envoy Medical, Inc.

ticker: COCH


text: The CIO, in coordination with the Chief Executive Officer, Chief Financial Officer, Chief Compliance Officer, Chief Legal Officer, and Chief People Officer works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams, comprised of our cybersecurity experts, are deployed throughout the Company to identify and address cybersecurity threats and to respond to cybersecurity incidents. The CIO has served in various leadership roles in information technology and information security for over 24 years, including serving as the vice president of information technology, with direct responsibility over the cyber security program, for a large publicly-traded company and as the chief information security officer of several large healthcare organizations. The CIO holds a Certified Information Systems Security Professional certification, an undergraduate degree in engineering, an MBA and a PhD in engineering.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: The CISO role is responsible for hiring appropriate personnel, managing the security budget, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, providing security and security-related risk guidance to leadership relating to product management, development, and operations, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Sprinklr, Inc.

ticker: CXM


text: Our commitment to cybersecurity resilience includes an ongoing monitoring program and a well-defined incident response plan that provides guidelines for mitigating the impact of cyber threats. These processes are periodically reviewed and updated to address emerging threat intelligence and other matters.

companyName: Urgent.ly Inc.

ticker: ULY