text: We work to mitigate risks from cybersecurity threats stemming from third-party vendors by providing them with access only to systems that they need to provide services to us. In addition, we have developed, and continue to develop, processes regarding vendor management.

companyName: BRAINSTORM CELL THERAPEUTICS INC.

ticker: BCLI


text: Risk Assessment. On a periodic basis, but not less than annually, the CIO and ISO, in conjunction with the IT/IS Committee, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The IT/IS Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK

secItem: Item 1C


text: our board of directors is responsible for the oversight of risk management. In that role, our board of directors, with support from our cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receives quarterly reports from our management team regarding cybersecurity risks, and our efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board and management. While management is responsible for day-to-day risk management, the Board, is responsible for the Company's overall risk oversight function, including cybersecurity risks, and includes oversight by several committees. The Audit Committee supports the Board in overseeing the overall framework for the risk assessment and enterprise risk management ("ERM") process for the Company. The Nominating & Governance Committee ("NGC") supports the Board by overseeing cybersecurity risks, policies and objectives. As part of its duties, the NGC regularly provides reports to the full Board of Directors (which includes Audit Committee members) related to matters within its responsibility. As a result of this process, the Audit Committee receives updates on, among other things, cybersecurity, which can be used to assist the Board and Audit Committee in its oversight of the Company's ERM processes.

companyName: PERRIGO Co plc

ticker: PRGO


text: Violation of these laws, rules, regulations and standards may expose us to regulatory action and private litigation, including claims for damages and penalties. For more information regarding the risks associated with data privacy and cybersecurity laws and regulations, see "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability" and "We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), all of which could adversely affect our business or reputation, and create significant legal and financial exposure" under Risk Factors in Item 1A.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Engagement of Third-parties on Risk Management We engage cybersecurity assessors, and other service providers, as needed, in evaluating and testing our risk management systems. These engagements help us to leverage specialized knowledge and insights to better align our cybersecurity strategies and processes with applicable industry standards. Our collaboration with these third parties includes regular control assessments, threat and vulnerability assessments, and consultation on security enhancements.

companyName: HashiCorp, Inc.


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). She has over 30 years of experience in leading information systems management, strategy, and operational execution, including incident management, prevention, and response. Our Senior Director of Global Information Security (ISD) reports to our CIO and is responsible for the protection and defense of our networks and systems and managing cybersecurity risk. He has over 20 years of experience in managing cybersecurity and related risks, including threat identification, incident response, and defense strategies. Our CIO and ISD are supported by a direct and a cross-functional team of professionals with broad experience and expertise in threat assessment and detection, mitigation technologies, training, incident response, and regulatory compliance.

companyName: SMITH A O CORP

ticker: AOS


text: Management, along with our Chief Information Security Officer, Larry Chen is responsible for developing the cybersecurity strategy and supervising our cybersecurity risk management program, leading the cybersecurity team and coordinating responses to incidents and breaches, and managing relationships with regulators, auditors, and third-party vendors regarding cybersecurity matters. Our IT and security teams support these efforts by managing day-to-day operations, including threat detection, incident response, patch management, and system monitoring, ensuring that cybersecurity risks are actively managed and mitigated across our Company.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: The Company maintains an enterprise risk management process designed to identify potential events that may affect the achievement of the Company's objectives or have a material adverse effect on the Company. Cybersecurity is among the risks considered as a part of this process. The Company's management, including the CISO, also participates on the Company's Information Security & Privacy Governance Council ("ISPGC"). The ISPGC meets periodically to consider information security and privacy matters.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: Material Impact of Cyber Risk As discussed more thoroughly below, the Company devotes significant resources to implement, maintain, monitor and regularly upgrade our systems and networks with measures such as intrusion detection and prevention and firewalls to safeguard critical business applications. The additional cost to the Company of our cyber security monitoring and protection systems and controls includes the cost of hardware and software, third party technology providers, consulting, and legal fees, in addition to the incremental cost of our personnel who focus a substantial portion of their responsibilities on cyber security. With the assistance of third-party service providers, we continue to implement security technology and establish procedures to maintain network security. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, but such insurance coverage may not always be sufficient to cover all losses.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: Management Oversight We have a dedicated enterprise security team responsible for assessing and managing our material risks from cybersecurity threats. Our enterprise security team is led by our CISO, Drew Robertson, who has extensive experience in cybersecurity. In addition to acting as our CISO, Mr. Robertson currently advises several companies in the Cyber Security Industry and is active in a number of information security communities and groups. Prior to his appointment as CISO in October 2021, he served as our Deputy CISO. Before joining the Company, Mr. Robertson worked for the National Security Agency and the United States Army, where he held various leadership positions in computer network defense, computer network exploitation and intelligence oversight. Mr. Robertson holds a BA in Organizational Management, an MS in Cybersecurity Policy and an MBA.

companyName: Finance of America Companies Inc.

ticker: FOA


text: Our Global Information Security Team is responsible for the information security strategy, policy, security engineering, operations, and cyber threat detection and response. Our Global Information Security Team, which includes a security operations center, seeks to protect the company against reasonably foreseeable cyber threats and risks. The cybersecurity team members have the qualifications and certifications for their roles. They also have relevant industry experience in selecting, deploying, and operating cybersecurity technologies, initiatives, and processes globally. We also rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants that we engage.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: The Audit Committee informs the full Board of Directors about its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors are kept abreast of cybersecurity developments through presentations by our Chief Financial Officer or external experts as part of their ongoing education on issues impacting public companies.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Potential security breaches (including cybersecurity breaches) and terrorism risks could materially and adversely affect our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.

companyName: IPALCO ENTERPRISES, INC.


text: We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats. We have also taken steps to address cybersecurity threats at third parties, including service providers, that handle, possess, process, and store our material information. Our Third-Party Risk Management program requires that these third parties maintain certain security controls and we assess their compliance with these requirements.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: We use these frameworks, together with information collected from internal assessments, to develop policies for the use of our information assets (for example, business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including the employment of multiple layers of cybersecurity defenses, restricted access based on business needs, and integrity of our business information. We also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks.

companyName: IDT CORP

ticker: IDT


text: Our cybersecurity policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. We have also obtained industry certifications and attestations.

companyName: Jamf Holding Corp.

ticker: JAMF


text: We undertake proactive activities to prevent, detect, and minimize the impact of cybersecurity incidents. We maintain an incident response plan to respond to breaches and minimize disruption to our operations swiftly. The incident response process is consistently tested and reviewed through simulated incidents. To bolster the incident response process, we have business continuity, contingency, and recovery plans to ensure operational resilience during a cybersecurity incident. Previous cybersecurity incidents guide continuous improvements in our governance, policies, procedures, and technology. We use these lessons to strengthen our cybersecurity defenses.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Our Management's Role in Assessing and Managing Cybersecurity Matters The Company's CISO directs the Company's information security program and our information technology risk management. The CISO and Cybersecurity Manager along with a team of dedicated security personnel examines risks to the Company's information systems and assets, designs and implements security solutions, monitors the environment, and provides immediate responses to threats.

companyName: FIRST BANCSHARES INC /MS/


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Vendor risk assessments are performed before each vendor is engaged, and annual reviews are conducted to ensure vendors continue to meet security requirements.

companyName: OptimizeRx Corp

ticker: OPRX


text: In addition, under the Plan, we have established a cross-functional management group comprised of our Chief Legal Officer, Chief Financial Officer, Chief Digital and Technology Officer, Vice President Internal Audit, Chief Compliance Officer, Senior Vice President Finance & Corporate Controller and CISO. The Plan provides that any cybersecurity incident that is elevated for the review of the Response Team will also be reviewed by this group to determine whether any such incident is material for securities laws purposes and whether public disclosure is required or advisable in connection therewith, following any necessary consultation with the Company's senior management, Disclosure Committee, Audit Committee and/or Board of Directors.

companyName: YUM BRANDS INC

ticker: YUM


text: The Secretary of the Company relies on the Investment Manager's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Investment Manager's Chief Compliance Officer has 13 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's Secretary has been responsible for the general oversight function as Secretary to the Company since its inception and has worked in the financial services industry for 11 years.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: In addition, a management-level Safety and Security Council ("Council") chaired by our CEO and comprised of our CSO and other senior officers, provides cross-functional coordination for the management of the Company's security functions. The Council receives information, typically monthly, on the status of the cybersecurity program, initiatives, incidents, cybersecurity risks, assessments, and threats, among other items. The Chair of the Board's Cybersecurity Committee is the Board's liaison to the Council and attends the regular meetings of the Council.

companyName: VERISIGN INC/CA

ticker: VRSN


text: The Audit Committee of our board of directors (Audit Committee) has oversight responsibility for our cybersecurity program and reviews with management the Company's policies and procedures for identifying, assessing, managing, and monitoring information security and cybersecurity risks.

companyName: GoPro, Inc.

ticker: GPRO


text: Our Information Security Director has served in various roles in information technology and information security for over 20 years, including as a security consultant and as the Chief Information Security Officer for private companies, and has attained professional certifications in information technology and information security, healthcare privacy, and compliance. We also have security consultants who regularly work with us. One such consultant, who previously served as our Vice President Information Security until his retirement in January 2024, has over 40 years of experience serving in various roles in information technology and information security, holds undergraduate and graduate degrees in business administration, and has attained the professional certifications of Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, and Project Management Professional. Our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer each hold undergraduate and graduate degrees in their respective fields, and collectively they have over 70 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: UpHealth, Inc.


text: In the normal course of business, we may collect and store personal information, customer information, and certain sensitive company information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding trial participants in connection with clinical trials, sensitive third-party information, and employee information. To protect this information, our existing cybersecurity policies require monitoring and detection programs, network security measures, and encryption of critical data. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We have established our disaster recovery plan, and we protect against business interruption by backing up our major systems. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: Zomedica Corp.

ticker: ZOMDF


text: As of December 31, 2024, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; and • a third-party risk management process for service providers.

companyName: Aimco OP L.P.


text: In the event of an incident, we intend to take appropriate steps from incident detection to mitigation, recovery and notification of appropriate parties. Management is responsible for day-to-day monitoring of cybersecurity, including detection and response and to report risks and incidents to the Board of Directors. We rely on computer software provided by third parties to protect our computer systems against cybersecurity threats.

companyName: NP Life Sciences Health Industry Group Inc.

ticker: ACATD


text: The Board of Directors of the Company oversees the management of risks from cybersecurity threats through its review of quarterly reports from the CISO on the status of the Company's cybersecurity preparedness; updates on information systems; and any cybersecurity threats of which management has become aware. In addition the Board receives periodic cybersecurity awareness training.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, and supply chain resources. We manage cybersecurity risks associated with our use of these providers by reviewing their security assessments, reviewing their written security program, and applicable reports.

companyName: Turnstone Biologics Corp.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data"). Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the cybersecurity program works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: OS Therapies Inc

ticker: OSTX


text: The Kellanova Board of Directors has risk oversight responsibility for Kellanova, which it administers directly and with assistance from its committees. Oversight of the information security program sits with the Audit Committee. The Audit Committee has oversight responsibilities with respect to ERM, including cybersecurity, information security and data protection risk exposures, and the steps management has taken to monitor and control these exposures. In addition to periodically providing the Executive Management Team with information and cybersecurity briefings, the Chief Digital and Information Officer ("CDIO") and Chief Information Security Officer ("CISO") provide at least biannual updates to the Audit Committee regarding cybersecurity, including on strategy and the Company's cybersecurity program. For cybersecurity incidents, the Company's cybersecurity incident response plan includes a process for incidents to be evaluated for material impact. The escalation protocol includes reporting of security incidents to members of the Kellanova Executive Management Team and reporting of any cyber incidents that could have a material impact on the Company to the Audit Committee.

companyName: KELLANOVA


text: To date, cybersecurity threats, including any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K titled "If we or our third-party partners experience a security breach, other hacking or phishing attack, ransomware or other malware attack, or other privacy or security incident, our work marketplace may be perceived as not being secure, our reputation may be harmed, demand for our work marketplace may be reduced, our operations may be disrupted, we may incur significant legal costs, fines, or liabilities, and our business could be adversely affected."

companyName: UPWORK, INC

ticker: UPWK


text: Our Board considers cybersecurity risk as part of its enterprise risk management oversight function. The Board delegates oversight of the cybersecurity risk management program to the Audit Committee. This oversight includes periodic reports from management concerning cybersecurity related risks. The management of the program is the responsibility of our Risk Management Committee, comprised of our Chief Financial Officer, Chief Digital & Information Officer, Chief Accounting Officer and General Counsel. Our Chief Digital & Information Officer, who has over 30 years of extensive work experience in the field of technology and cybersecurity, leads our team of cybersecurity professionals and provides the Risk Management Committee with periodic reports on our cybersecurity risks and any material cybersecurity incidents. Our team of cybersecurity professionals monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through the cybersecurity risk management and processes described above, including the operation of our incident response plan. The Risk Management Committee provides updates to the Audit Committee on our cybersecurity risk management program as appropriate, including updates on (1) any critical cybersecurity risks; (2) ongoing cybersecurity initiatives and strategies; (3) applicable regulatory requirements; and (4) industry standards. The Risk Management Committee also notifies the Board of any significant and/or material cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Azenta, Inc.

ticker: AZTA


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems. Tests are conducted by both internal security teams and third-party consultants. In developing the testing procedures, the Company considers its individual risks and industry standards. Testing procedures are supplemented by executive cyber threat exercises and employee training. Executive exercises such as "tabletops" are used to develop and refine the Company's incident response plans. Employees undergo security awareness training annually and upon hire.

companyName: KEMPER Corp

ticker: KMPR


text: On an annual basis, the Board's Audit Committee also receives reports from outside consultants who perform various IT related audits, and the Company's independent registered public accounting firm regarding the effectiveness of the Company's cybersecurity program in connection with its review of the Company's financial statements.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: The Audit Committee regularly receives information and reports from the Senior Director - Information Security and other executives responsible for identifying and assessing the scope, nature and impact of cybersecurity risks, incidents and mitigation efforts. In addition to the Audit Committee, the full Board of Directors receives regular annual reports on the status of our cybersecurity risk, incidents and mitigation efforts. We utilize a technology-based reporting system to identify and log data-related events.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: CBIZ's IT Security Director reports to CBIZ's Chief Information Officer and is the head of the Company's cybersecurity team. The IT Security Director is responsible for assessing and managing CBIZ's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying and operating cybersecurity technologies, initiatives and processes. Additionally, members of the cyber security team have extensive information technology and program management expertise and have earned various cybersecurity certifications. Finally, the cybersecurity team relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by CBIZ.

companyName: CBIZ, Inc.

ticker: CBZ


text: In the event of a cybersecurity incident, the VP of IT collaborates with the information technology department and relevant teams to assess and respond to the incident, determining the need for internal and external reporting.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To our knowledge, such risks have not materially affected our operations nor have we experienced any cybersecurity incidences which have impacted our operations. In the past three years, we have not experienced a material information security breach. We will continue to face cybersecurity threats whether directly or through our supply chain or other channels in the normal course of business. See Risk Factors in Part I, Item 1A in this Form 10-K for additional information.

companyName: W&T OFFSHORE INC

ticker: WTI


text: Cybersecurity Program Governance Our cybersecurity program is led by our Vice President of Information Services, North America, who reports directly to our CFO and oversees the dedicated team responsible for executing our cybersecurity strategy, including the primary assessment and management of cybersecurity risks. Our cybersecurity leadership team also includes our Director, Technology Risk and Cybersecurity, our Senior Director, Strategic Planning, our Senior Director, North American Solution Delivery and our Senior Director, Enterprise Technology. The Board receives quarterly updates on material security incidents (if applicable), detection, monitoring, security culture scores, and other key initiatives and notable events from our cybersecurity leadership team.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors," of this Annual Report on Form 10-K.

companyName: SUNation Energy, Inc.

ticker: SUNE


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to our risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, or harm to our vendor relationships.

companyName: Corvex, Inc.

ticker: MOVE


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, ("NIST"), and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Molecular Templates, Inc.


text: We contract with several outside cybersecurity experts to audit and test security controls on a regular basis. Any risks or control gaps identified as a result of such assessments, audits, and reviews are reported to the most senior leadership of all functional areas of the Company, the Audit Committee of the Board (the "Audit Committee"), and the Board as appropriate, and we adjust our cybersecurity policies, standards, and practices as necessary.

companyName: Dayforce, Inc.

ticker: DAY


text: A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: We use a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We also obtain assurances from outsourced service providers regarding the sufficiency of their security procedures and, where appropriate, assess the protections employed by these third parties.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: The Cybersecurity Leadership Team maintains an ongoing dialogue with senior management regarding emerging or potential cybersecurity risks. Together, they discuss updates on any significant developments in the cybersecurity domain, ensuring that management's oversight is proactive. In addition, a cross-organizational cyber task force, which includes the Cybersecurity Leadership Team and several members of senior management, meets regularly to consider and address cybersecurity risks, including risks related to our use of third-party service providers. This task force reports regularly to senior management, who actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. The involvement of senior management in our cybersecurity strategy ensures that cybersecurity considerations are collaborative and integrated into our broader strategic objectives.

companyName: CubeSmart

ticker: CUBE


text: Related to Cybersecurity Risk Our Senior Director of Information Technology ("IT"), who reports to the Chief Financial Officer, is responsible for the strategic leadership and direction of the Company's cybersecurity program. The Senior Director of IT has over 30 years of professional experience in IT, including the development of data protection strategies, identification of cybersecurity matters, management of IT environments, (including corresponding data relied on in the environment), and timely deployment of responses to cybersecurity incidents. Further, the Senior Director of IT has education related qualifications specific to cybersecurity, including a Master of Science in Cybersecurity Management.

companyName: AVADEL PHARMACEUTICALS PLC

ticker: AVDL


text: We are dedicated to safeguarding our invaluable assets and ensuring the well-being of personnel, as demonstrated through the preparation of our cybersecurity program.

companyName: EnerSys

ticker: ENS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our CROs or other contractors or consultants we may utilize, may fail, suffer disruptions or suffer security breaches, which could result in a material disruption of our product development programs."

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Information Security Team works with other members of management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity and Data Privacy Oversight Subcommittee (the "Privacy and Security Subcommittee") of the Nominating and Corporate Governance Committee, as well as our Board of Directors, the latter of which evaluates our overall enterprise risk.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Cybersecurity is a shared responsibility across the Company, and all our employees are subject to periodic email phishing simulation campaigns and mandatory quarterly cybersecurity training to enhance awareness and readiness against potential common cyber threats. Certain roles require additional role-based, specialized cybersecurity training, such as tabletop exercises to ensure proactive preparation and effective coordination in the event of a security incident. We conduct tabletop exercises annually or as needed to review our incident response plan, as well as to identify and prioritize opportunities for improvement within our cybersecurity program and associated security controls. To help protect our data and information systems, we maintain Company-wide cybersecurity policies and procedures regarding encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and internet, social media, email, and wireless device usage. Our IT and InfoSec teams review and update such policies and procedures to adapt to the evolving cybersecurity threat landscape, industry best practices, and regulatory updates. Our CISO conducts thorough reviews of these updates on an annual basis or as needed to help ensure their continued relevance and effectiveness in safeguarding the Company's assets and business interests.

companyName: Bowhead Specialty Holdings Inc.

ticker: BOW


text: Third party entities that provide hardware, software or related support services to the Company or hold the Company's customer data represent material cybersecurity risks to the Company. To help mitigate those risks, the Company has robust procurement processes and requirements for such third-parties (which include a formal assessment of the third-party's cyber posture, cyber liability insurance, and breach reporting protocols) that help the Company to oversee and identify cybersecurity risks associated with its use of such third party entities.

companyName: UNITIL CORP

ticker: UTL


text: Our chief privacy officer oversees an enterprise wide privacy program that includes annual training; a "privacy by design" ethos within development teams; privacy-specific contract reviews; and an enterprise wide privacy platform to manage rights, requests and consent management.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on Diameter and other service providers to protect the Company's information from cybersecurity threats. Diameter has processes in place to assess, identify, and manage material risks from cybersecurity threats, including pursuant to its Written Information Security Policy ("WISP") and Cyber Incident Response Plan ("CIR Plan", and together with the WISP, the "Plans"). Diameter utilizes a third-party managed service provider to support and manage its information technology framework.

companyName: Diameter Credit Co


text: Board of Directors The Board of Directors ("the Board") has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit Committee. The Board and Audit Committee periodically review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The Board and Audit Committee are updated on a quarterly basis by Vice President, Corporate Services on the Company's internal information technology ("IT") security testing, any unauthorized attempts to access the Company's network, any significant developments in cyber security risks and threats, and updates on the Company's policies and procedures for protecting the Company's data. We also have processes by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit Committee. All incidents are reported to the Executive Officers (including the President and Chief Executive Officer, Chief Financial Officer and the Chief Operating Officer) who assess the severity and what measures and procedures are necessary.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: We maintain a risk-based approach to identifying cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: We aim to foster and preserve the confidence of customers, employees, shareholders, and other stakeholders regarding our technology and data practices. Our commitments to digital trust, aligned with our core values of service, excellence, integrity, and individual respect, form the basis of our cybersecurity approach.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: Through a combination of governance, risk, and compliance (GRC) resources, we • proactively monitor IT controls to ensure compliance with legal and regulatory requirements, • perform third-party risk management assessments, • implement processes designed to ensure essential business functions remain available during business disruptions, • develop and update incident response plans to address potential weaknesses, and • maintain cyber incident management and reporting procedures.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care;

companyName: ALPHA PRO TECH LTD

ticker: APT


text: The Company's Board of Directors is responsible for identifying the principal risks of the Company's business and ensuring that those risks are effectively managed. The Company's Chief Information Officer is responsible for assessing and managing the Company's risks from cybersecurity threats and has approximately 15 years of prior work experience in roles involving information technology. The Chief Information Officer is informed about, and monitors the prevention, detection, mitigation and remediation of, cybersecurity incidents through his management of, and participation in, the monitoring systems and processes described above. The Chief Information Officer reports information about such risks to the Company's Chief Executive Officer, Chief Financial Officer and General Counsel, who then would report information to the Company's Board of Directors. When appropriate, the Chief Information Officer would be invited by management to present information to the Company's Board of Directors.

companyName: ELECTRAMECCANICA VEHICLES CORP.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management process. Our executive officers, along with input from our outsourced IT managed services provider, other external experts, and department managers, are responsible for our overall enterprise risk assessment and management process and regularly consider cybersecurity risks in the context of other material risks to the Partnership. We obtain input on the security industry and threat trends for our cybersecurity risk management processes from external experts, as appropriate. Our outsourced IT managed services provider has expertise in areas including, but not limited to, information technology and infrastructure, network and communications architecture, information systems and database management, back up management, and cybersecurity.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: Our Audit Committee is responsible for overseeing information security and cybersecurity risk. Senior leadership communicates with the Audit Committee at least quarterly regarding information security and cybersecurity risk and formally reports to the entire Board of Directors on information security and cybersecurity risk at least annually.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: We maintain an Information Security Leadership Committee, or ISLC, that is accountable for enterprise-level information security risk strategy, identification, prioritization, and mitigation, including establishing objectives and priorities. The ISLC comprises company executives that, collectively, represent experience and expertise in information technology, enterprise security and risk management, cybersecurity, engineering, technology, privacy, data security, and healthcare compliance. Members of this committee include our CTO, CCPO, Chief Information Officer, Chief Information Security Officer, and Chief Accounting Officer. The ISLC meets on at least a quarterly basis to review matters including updates on existing and emerging cybersecurity risks and threats including prioritization, mitigation, and remediation; the status of projects to strengthen our information security systems; assessments of our information security program and operations; and prioritized information security incidents, if any. The ISLC oversees the Information Security Execution Team.

companyName: Natera, Inc.

ticker: NTRA


text: h. Maintaining a program to identify cybersecurity risks associated with certain third-party vendors, which is one component of an overall vendor risk management program.

companyName: HUMANA INC

ticker: HUM


text: We staff a cybersecurity operations center to respond to threats and incidents. Our cybersecurity crisis management plan sets forth the items, procedures and actions we expect to address and follow in the event of a cybersecurity incident, including detection, response, mitigation and remediation. In addition to the cybersecurity operations center and our designated cybersecurity response team, we maintain a cross-functional cybersecurity crisis core team, which includes our CISO and senior representatives from our Legal, Finance, IT and Corporate Security teams.

companyName: BIOGEN INC.

ticker: BIIB


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes vendor due diligence prior to onboarding, a review of System and Organization Control (SOC) reports on an annual basis, regular review of vendor contracts, and compliance with service level agreements (SLAs).

companyName: Banzai International, Inc.

ticker: BNZI


text: Cybersecurity and data privacy risks related to our information technology resources are a key component of our Board's risk oversight. The Audit Committee assists the Board in evaluating our cybersecurity and data privacy risks and overseeing our efforts to mitigate these risks. Our Audit Committee is also responsible for reviewing and analyzing significant financial and operational risks and how management is managing and mitigating such risks through its internal controls and financial risk management processes and is regularly engaged in discussions with management regarding business risks, operational risks, transactional risks, cybersecurity, enterprise-level and financial risks. Our CIO provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks and our Vice President of Internal Audit/Compliance conducts an annual ERM survey, which includes cybersecurity risk, and provides the findings to the Board.

companyName: Meritage Homes CORP

ticker: MTH


text: Our cybersecurity risk management program is under the direction of our Senior Vice President and Chief Digital and Information Officer, who has 30 years of technology leadership, and staffed by a cybersecurity team that includes personnel with a range of information and product security experience, from early-career professionals with cybersecurity degrees to seasoned professionals with multiple cybersecurity-related certifications and more than twenty years of experience. The Senior Vice President and Chief Digital and Information Officer received reports from our cybersecurity team on the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Executive Cybersecurity Council meets as appropriate and receives updates from the Senior Vice President and Chief Digital and Information Officer and the cybersecurity team regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including learnings from external cybersecurity incidents.

companyName: Polaris Inc.

ticker: PII


text: Our VP of Technology & Senior Security Officer, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the VP of Technology & Senior Security Officer monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the audit committee and other colleagues in accordance with our cybersecurity policies and procedures, as appropriate.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Integration into Overall Risk Management System or Processes Consistent with our prioritization of information and technology protection, cybersecurity risk management has been and remains a key aspect of our overall business strategy, financial planning and capital allocation and a point of ongoing emphasis at all levels of our Company. Our enterprise risk management ("ERM") framework integrates our information technology and data management systems and related policies and practices into the larger framework to help guide and prioritize our cybersecurity and information technology-related investments, activities and risk management strategy. At least annually, we review cybersecurity risk as part of our ERM processes and integrate those findings into our overall strategy. Additionally, our cybersecurity program is further integrated with our overall risk management program through our Chief Information Security Officer's ("CISO") participation in such governance structures as our Risk Steering Committee and our Disclosure Committee, both of which are described in detail below.

companyName: BLACKBAUD INC

ticker: BLKB


text: Although the Board of Directors has determined that enterprise risk management should be the responsibility of the Board of Directors as a whole, it has delegated responsibility to oversee specific areas of risk management to its committees. Our Audit Committee oversees and reviews the Company's cybersecurity, data privacy, and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and respond to data breaches. At periodic meetings of the Board of Directors and its committees and in other meetings and discussions, management reports to the Board of Directors and its committees with respect to the most significant risks that could affect our business, including cybersecurity-related risks. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident to meet reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: We regularly release new versions of our products to address identified security vulnerabilities, enabling clients to stay updated with the latest product releases. However, even after we make these updates available, it is possible that clients do not implement these updates or use products on extended support that do not include security updates.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Cybersecurity risk is evaluated within the population of all enterprise risks in the framework and is included in assessments overseen by the RMC that identify the risks of highest priority to the Company. For these highest priority risks, including cybersecurity risks, the RMC designates risk owners, sets common reporting processes, and monitors risk mitigation and treatment strategies to support business continuity.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Forming a Security Council Committee (SCC), which consists primarily of members of our management team and IT department, to develop and oversee our cybersecurity policies and infrastructure and establishing a multi-tiered reporting and governance system pursuant to which our SCC reports to our Service Center Board, which reports to our Risk Committee, which reports to our Board;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Our management is responsible for implementing our security program, which is overseen by our Security Governance Council (the "SGC") that regularly reports to our CEO and Audit Committee. The SGC is chaired by our CISO and is comprised of senior leaders and key personnel throughout the Company to support cross-functional representation. The members of the SGC are comprised of our executives and managers who understand our business operations, including but not limited to individuals from the following departments: Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management. The SGC meets on a quarterly basis with the mission to develop, coordinate, and sustain the organization's enterprise security program; coordinate and respond to security risks and incidents; and develop, implement, and maintain the organization's enterprise security strategy in alignment with, or in support of, business goals and objectives. The recommendations of the SGC are considered when updating the information security policies, procedures, and standards at Paychex.

companyName: PAYCHEX INC

ticker: PAYX


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI"), and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Our Head of IT periodically reports to our CFO on matters relating to our overall cybersecurity risk management program and, in the event of a cybersecurity incident, reports directly to our entire Risk Management Committee. The CFO reports on the cybersecurity risk management program to the other members of our Risk Management Committee and, alongside our General Counsel, provides quarterly cybersecurity risk management briefings to the audit committee, including discussion of cybersecurity risks, that include any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and other matters relevant to our overall cybersecurity risk management. Our audit committee provides quarterly updates, as appropriate, on the cybersecurity risk management program, to our full board of directors.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: The Company has no established process for assessing, identifying, and managing any material risks from cybersecurity threats. Breaches are not required to be reported. In the event, therefore of a cyber security incident, there is no system in place to assess whether such incident has materially affected or is reasonably likely to materially affect the Company.

companyName: NEXT-ChemX Corporation.

ticker: CHMX


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats The Board oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our CIO regularly briefs the Board on cybersecurity matters. We have procedures led by our CIO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and appropriate or required external notifications. Based on its nature and severity, the Board would be informed of an incident by our executive team.

companyName: Twist Bioscience Corp

ticker: TWST


text: Quarterly Cybersecurity Memos. At the 2nd, 3rd and 4thquarter Audit Committee meetings, an update memo is provided to the Audit Committee that details the progress against the Annual Cybersecurity Plan, any updates on PCI compliance and SOX compliance activities and any emerging threats. The memo also contains a summary of significant cybersecurity threats over the past quarter both within our ecosystem and outside our ecosystem and any impact (if any) they may have had upon the company.

companyName: Zumiez Inc

ticker: ZUMZ


text: Northern Trust understands the importance of managing cybersecurity risk to ensure the safety and security of our data and systems. The Business Risk Committee of the Board of Directors (Business Risk Committee), which reports regularly to the Board, oversees management's actions to identify, assess, mitigate and remediate material issues related to cybersecurity and technology risk as part of our enterprise risk management program and processes. The Cybersecurity Risk Oversight Subcommittee, chaired by the former chief information officer and chief transformation officer of a Fortune 50 company, assists the Business Risk Committee in discharging its oversight duties with respect to cybersecurity risk and meets on a regular basis to provide for an even deeper focus on, and governance framework around, cybersecurity risks inherent in the Corporation's business. The Business Risk Committee, Cybersecurity Risk Oversight Subcommittee, and the Board are regularly briefed on the organization's cybersecurity posture by senior management, including the Chief Executive Officer, Chief Information Officer (CIO), Chief Risk Officer, Head of Non-Financial Risk and Chief Information Risk Officer (CIRO), and Chief Information Security Officer (CISO). The CISO, a Certified Information Systems Security Professional (CISSP) with nearly 30 years of relevant experience, reports to the CIO and is responsible for identifying, managing, and, if necessary, remediating cybersecurity risk to ensure the protection of our data, network, and systems. The primary management-level committees responsible for assessing and managing cybersecurity risk are the Information Technology Oversight Committee, chaired by the CIO, who has over 20 years of experience in technology leadership roles, and the Information Technology Risk Committee, chaired by the CIRO, who has over 20 years of cybersecurity and risk management experience.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: Our Board of Directors and its Audit Committee are responsible for overseeing the cybersecurity program and policies. The Company's management, led by the Chief Technology Officer, is responsible for designing and implementing the program. The Information Security Manager/Officer and Chief Technology Officer regularly report to the Audit Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threats, assessments of our cybersecurity systems and the planning and status project to strength our information security. Our cybersecurity incident response plan requires that management promptly advise the Audit Committee of any material cybersecurity incident. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Audit Committee meetings where cybersecurity issues are discussed and have access to the materials for management's Risk and Technology and Enterprise Risk Management Committee meetings.

companyName: California BanCorp


text: We have established processes and policies for assessing, identifying, and managing material risks posed by cybersecurity threats. Our processes and policies are designed to be based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework with our processes focused on: (i) developing organizational understanding to manage cybersecurity risks, (ii) applying safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes. For instance, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are also frequently working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection. We have engaged independent consultants and other third-parties to assist us in establishing and improving our policies. We conduct tabletop simulation exercises with outside consultants at least annually to test our processes and policies and use feedback from those exercises to improve our processes. Our senior management team members are active participants in each of those exercises, and members of the Audit Committee of our Board of Directors have participated in some of those exercises as well. Our processes and policies include the identification of those third-party relationships that have the greatest potential to expose us to cybersecurity threats and, upon identification, we conduct additional due diligence as a part of establishing those relationships. We also maintain insurance coverage for cybersecurity matters as part of our overall insurance portfolio. For additional information concerning cybersecurity risks we face to our business strategy, results of operations and financial condition, see Item 1A Risk Factors – Information technology failures or data security breaches could harm our business and result in substantial costs.

companyName: PULTEGROUP INC/MI/

ticker: PHM


text: Our Board of Directors recently assigned specific oversight responsibility for cybersecurity to our Audit Committee, which also oversees our general risk management. The Audit Committee reviews and discusses with management our policies, practices and risks related to information security and cybersecurity.

companyName: CVRx, Inc.

ticker: CVRX


text: We recognize the importance of developing, implementing and maintaining the integrity of our information technology systems and safeguarding the personal data and confidential information we receive and store. We have a cybersecurity risk management program in place designed to assess, identify and manage material risks from cybersecurity threats utilizing a defense-in-depth security strategy that integrates our staff, technology and operations to establish various securities barriers across multiple layers and missions of our operations. Our cybersecurity risk management program is designed to employ industry standard practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cybersecurity incidents, attacks and data breaches; cybersecurity preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Key aspects of our cybersecurity risk management program include, but are not limited to, the following: • Surveillance controls and technical protective capabilities, including a centralized security incident event management system, or SIEM, and a third-party continuous monitoring engagement, that monitors threat detection and response 24/7/365; • Utilization of third parties to assess our practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • Annual cybersecurity training for all employees, including social engineering (e.g., phishing, vishing, and smishing), privacy and other related topics; • Established policies and procedures that govern information security and cybersecurity which apply to all employees and information systems we control; • Business continuity, incident response and disaster recovery procedures, including quarterly tabletop incident response exercises, annual disaster recovery tests, annual unannounced penetration tests, annual phishing campaigns, and annual security control assessments; • Database activity monitoring, encryption, secure file transfer protocols and application firewalls; and • Maintaining cybersecurity insurance covering certain security and privacy damages and claim expenses resulting from cybersecurity incidents (we periodically meet with our insurer to discuss trends in cybersecurity).

companyName: CoreCivic, Inc.

ticker: CXW


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a security incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: To date, we have not experienced any attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. Any significant disruption to our service or access to our systems in the future could adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See " Risk Factors - Our business and operations would suffer in the event of computer system failures, cyber-attacks or deficiencies in our or third parties' cybersecurity."

companyName: Global Gas Corp

ticker: HGAS


text: We conduct thorough security assessments of all third-party service providers before engagement and perform regular monitoring of the third-party service providers' hosted applications designed to ensure compliance with our cybersecurity standards. This occurs through annual assessments by our internal audit function of the third party's System and Organization Controls ("SOC") 1 or SOC 2 report or through additional user access reviews by the internal business owner if a SOC 1 or SOC 2 report is unavailable.

companyName: M/I HOMES, INC.

ticker: MHO


text: Our CSO is responsible for implementing and maintaining our cybersecurity risk assessment and management processes. Our CSO has over 25 years of experience in cybersecurity, including serving as a chief security and strategy officer at another company as well as serving over 20 years conducting offensive and defensive cyber operations within the intelligence community and US Cyber Command. Our CSO oversees and maintains our information security management framework and is responsible for defining and implementing our information security strategy, hiring appropriate personnel, communicating key cybersecurity priorities to relevant personnel, and managing cybersecurity budgets and cybersecurity processes.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: We have an informal cyber incident response plan for mitigating and remediating cybersecurity threats and incidents. Any identified cybersecurity threats and incidents are promptly reported to executive management who, along with our IT professionals, will assess the severity of the event and formulate a response. Our determination of the severity of a cybersecurity incident would generally include an evaluation of the incident's effect on the Company, including (i) our business strategy, results of operations, or financial condition, (ii) the integrity, confidentiality, resiliency, and security of our networks and systems, and (iii) our operations. Based on the severity of the event, the Board will be notified and will provide strategic direction through the incident response and communication.

companyName: PARKERVISION INC

ticker: PRKR


text: Our Board actively oversees our enterprise risk management program. Our Board's role in risk oversight is consistent with our overall leadership structure: management is responsible for assessing and managing our short- and long-term risk exposures, and our Board and its committees provide effective oversight through independent monitoring of strategic risks and regularly scheduled meetings with management to discuss in-depth the strategic objectives of the Company and associated risks. In connection with Board oversight across the entire enterprise risk management program, the Board delegates to the individual committees certain elements of its oversight function. The Audit Committee of the Board has oversight of cybersecurity risk and receives regular updates on any developments from our Chief Information Security Officer ("CISO"), including biannual updates on strategies and action plans, with periodic reports provided to our full Board.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: We have established a formal set of policies and procedures to identify, assess, manage and report on material risks derived from cybersecurity threats and vulnerabilities, codified in the Bausch Health Cybersecurity Program (the "Program"). The purpose of the Program is to deploy a comprehensive framework designed to reasonably protect our information assets, systems, and networks from potential threats; and enable a prompt response to cybersecurity events and, if necessary, recovery from cyber-attacks using a combination of risk management and cybersecurity frameworks.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents experienced by the Company. There can be no assurance that our cyber insurance policies will be sufficient in scope or amount to cover the costs and expenses related to any future cybersecurity incidents and it does not remedy the reputational and future business impacts.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: Our Audit Committee provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if any.

companyName: Generation Bio Co.

ticker: GBIO


text: In addition, we use a threat intelligence platform to routinely monitor risks specific to both our organization and third parties. Risks we identify are assessed based on severity and are addressed as appropriate through both tactical and strategic plans. Our governance and compliance practice focuses on cybersecurity and data privacy policy taxonomy and policy compliance.

companyName: Research Solutions, Inc.

ticker: RSSS


text: The Audit Committee of the Board (the " Audit Committee ") is central to the Board 's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of independent board members with diverse expertise and experience which allows them to oversee cybersecurity risks effectively.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Our critical corporate information systems are maintained in a commercial grade data center with climate controls, fire suppression, redundant power, and several telecommunication options. The data center is designed to host mission-critical computer systems with fully redundant subsystems and compartmentalized security zones. Our primary data center also undergoes independent assessment on an annual basis. Our computing infrastructures are protected by multiple independent layers of security measures managed by the corporate information security department. Our approach to accessing protected networks is based on the principle of least privilege.

companyName: ICF International, Inc.

ticker: ICFI


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect the Company. While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.

companyName: Ellington Financial Inc.

ticker: EFC


text: We have established structured processes and mechanisms, including incident reporting and escalation, and a comprehensive incident response and communication plan, in the event of a cybersecurity incident. These plans consist of internal reporting and communication, including to the Chief Executive Officer, Chief Financial Officer, and General Counsel, and, as appropriate, management, as well as external reporting, including notifying the Board of Directors, and proper agencies as appropriate. The Chief Information Officer and the Chief Information Security Officer report significant risks from cybersecurity threats, the level of risk, and any material cybersecurity incidents to the Board of Directors, as well as annually review with the Board of Directors the budget, utilization of systems, processes, and controls in place to address cybersecurity risks and management. The Chief Information Officer and/or the Chief Information Security Officer update the Board of Directors no less than quarterly on significant developments in these areas. For more information on our information technology investments and their effects on our results of operations, refer to "Management's Discussion and Analysis of Financial Condition and Results of Operations – Overview," and for more information regarding risks related to our information technology, refer to "Risk Factors – Risks Related to Our Technology Infrastructure".

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: After investigation and discussions with certain third parties, we determined that our customer databases were not accessed, however, we confirmed that certain employee-related records as well as a limited number of other records containing certain personal information were among the data extracted. We took steps to protect the affected records, received confirmation that the extracted data was deleted and notified individuals whose data was extracted.

companyName: EchoStar CORP

ticker: SATS


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO, who has held that role since 2019 and has been employed by the company since 2004. With almost 20 years of experience in cybersecurity, our CIO has extensive cybersecurity expertise and in-depth knowledge and experience instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our cyber governance programs, evaluates our compliance with applicable standards and remediates known risks. Our CIO also oversees our internal phishing tests, leads our employee cyber training program and seeks to promote company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.

companyName: POOL CORP

ticker: POOL


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. In consideration of the size and complexity of our business, we devote appropriate internal and external resources to manage material risks from cybersecurity threats. We also designate senior-level personnel, including our Vice President, Information Technology who reports to our Chief Financial and Business Officer, to manage the risk assessment and mitigation process and to closely coordinate with our General Counsel on applicable regulatory obligations.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: Our Board of Directors provides oversight to our cybersecurity efforts to ensure effective governance in assessing and managing risks associated with cybersecurity threats. Our Head of Information Technology provides periodic updates to senior management and quarterly updates to the Board of Directors regarding our cybersecurity program, including information about cyber risk management governance, status updates on various projects intended to enhance the overall cybersecurity posture of the Company, and information about the prevention, detection, mitigation and remediation of any cybersecurity incidents, as appropriate.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: Our cybersecurity risk management program includes: • risk assessments of our risk capacity, conducting pressure and gap analyses, and formalizing our risk tolerance; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a third-party risk management process for service providers, suppliers, and vendors, in which we assess their processes, controls, and monitor cybersecurity enhancements to safeguard our interests and mitigate potential risks.

companyName: AIRGAIN INC

ticker: AIRG


text: The Cybersecurity Program is also supported by Uber's Chief Privacy Officer and Associate General Counsel, Privacy & Cybersecurity ("CPO"), who has served in that role since August 2018. The CPO has three decades of experience as a legal advisor to multinational corporations, including serving as Chief Privacy & Security Counsel for a Fortune 100 technology company prior to her role at Uber.

companyName: Uber Technologies, Inc

ticker: UBER


text: NEE, including FPL, conducts an annual internal cybersecurity drill with the participation from time to time of local, state and federal agencies to test its capability of dealing with a simulated cyber-attack. NEE, including FPL, also participates in industry forums and trade groups, as well as in NERC activities to learn and apply these learnings to its cybersecurity policies and procedures.

companyName: FLORIDA POWER & LIGHT CO


text: We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the financial year ended December 31, 2023.

companyName: Wetouch Technology Inc.

ticker: WETH


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework. Our measures to prevent, detect and mitigate cyber threats include training for employees, multi-factor authentication, backup servers, threat monitoring, periodic strategy review and penetration testing performed by a third-party advisory firm, and coverage under an information security risk insurance policy. Third-party suppliers are pre-screened as part of our vendor onboarding process to evaluate their cybersecurity programs and assess risk. As a part of our pre-screening process, we evaluate each vendor's overall cybersecurity risk profile relative to the services they provide for the Company, including questions relating to cybersecurity insurance, security operations and access and management of our data. Cybersecurity incidents involving third-party supplier systems are evaluated for their impact on the Company and managed through our cyber incident management process. In addition, our employees are required to complete an annual cybersecurity training managed through our internal compliance training system.

companyName: Biohaven Ltd.

ticker: BHVN


text: Strategy and Oversight We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or our information systems and the data contained therein.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: As one of the critical elements of the Company's overall ERM approach, the Company's Information Security Program is focused on the following key areas: • Protecting the confidentiality, integrity, and availability of information systems and the nonpublic information stored on them. • Identifying risks, defending against unauthorized access, and detecting, responding to, and recovering from cybersecurity incidents.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Incident reports and learnings from any cybersecurity events; and addition to our scheduled meetings, the Audit Committee, CISO and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated our broader strategic objectives. The Audit Committee conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Incident Response Plan: The Company has established an incident response plan in an effort to address and contain any breaches or cybersecurity incidents. This plan includes defining roles, responsibilities, and steps to recover from any potential attack.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, or otherwise material to our business, including customer and client Personally Identifiable Information ("Information Systems and Data").

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: We, like any company operating in the current environment, have experienced cybersecurity incidents in the past. However, we have not experienced a cybersecurity event that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors", of this Annual Report on Form 10-K, including the risk factor titled "Security breaches and incidents, loss of data and other disruptions could compromise sensitive information related to our business or protected health information or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."

companyName: Zymeworks Inc.

ticker: ZYME


text: Like other firms in the financial services sector, insurers like us are particularly vulnerable to cybercrime due to our large amounts of customer data. Insurance-related data is particularly interesting to cybercriminals because of its inherent confidentiality. Often linked to policyholders, sensitive data helps insurers customize their policies, products, and prices for each client. The scope of personally identifiable information and sensitive data processed by insurers puts the industry at increased risk of cybercrime. Cyber attacks can lead to the loss of confidential data, business, and reputation. Additionally, business disruption through cyber incidents is also a major problem for insurance companies, which need to react quickly to fulfill their contracts and maintain the trust of their clients. Because of the risks posed to our business and customers, we have developed robust processes for assessing, identifying and managing our cybersecurity threats.

companyName: CITIZENS, INC.

ticker: CIA


text: Our cybersecurity risk management program is part of our overall risk management program and shares similar governance processes and reporting channels that apply across the risk management program to financial, legal, compliance, and other operational risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition. For information regarding cybersecurity risks that may materially affect our Company, see the risk factor titled " We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. Privacy and security laws and regulations may also increase costs for our business. " under "Risk Factors" in Part I, Item 1A to this Annual Report on Form 10-K.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant program delays and reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—We are susceptible to a security breach, through cyber-attack, cyber-intrusion, insider threats or otherwise, and to other significant disruptions of our IT networks and related systems, or those of our customers, suppliers, vendors, subcontractors, partners, or other third parties" in this Annual Report.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our board receives regular presentations and reports from the management team on information regarding the policies, processes and practices that we implement to address risks from cybersecurity threats including, for example, discussion of recent developments, evolving standards, third-party and independent reviews, the threat environment and technological trends. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, the board will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.

companyName: CEVA INC

ticker: CEVA


text: Management's Role in Cybersecurity Risk Management The Fund's management, including the Fund's CCO and the Investment Adviser's Technology Risk and Information Security Committee (the "Committee"), manage the Fund's cybersecurity program. The CCO of the Fund oversees the Fund's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Adviser's Chief Financial Officer, General Counsel, and Director of Information Technology. The CCO has been responsible for this oversight function since the Fund's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Fund.

companyName: John Hancock Comvest Private Income Fund


text: We from time to time use our Incident Response Procedures to respond to potential cybersecurity incidents and threats, as our systems and users identify areas of potential incidents during the course of normal operations, none of which to date we believe have been material. We cannot provide assurance that there will not be future incidents that may materially impact us, our financials, our strategy, or our operations. For more cybersecurity risks, see "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or otherwise to protect our confidential information, could damage our reputation and brands and substantially harm our business, financial condition, and results of operations" under Item 1A "Risk Factors."

companyName: PETMED EXPRESS INC

ticker: PETS


text: The Company has developed an information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: LA-Z-BOY INC

ticker: LZB


text: Cybersecurity risks are monitored and evaluated by management through an internal compliance program with oversight by internal audit. We engage a variety of cybersecurity partners to perform penetration testing and quarterly audits on our cybersecurity profile. These partnerships enable us to leverage specialized knowledge and insights, and are meant to help our cybersecurity strategies and processes in remaining risk appropriate. In order to promote a company-wide culture of cybersecurity risk management, management has also implemented a variety of required programs to both test and train our employees on cybersecurity fundamentals, including both annual and ongoing information security awareness training.

companyName: Civeo Corp

ticker: CVEO