text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Company's enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity risk management program is designed to be aligned with the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"), which provides standards, guidelines and best practices on managing cybersecurity risk, as well as the organization, improvement and assessment of the Company's cybersecurity risk management program.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Monitoring Cybersecurity Incidents The Chief Information Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The Chief Information Officer implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Chief Information Officer will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Stran & Company, Inc.

ticker: SWAG

secItem: Item 1C


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, including cybersecurity risks, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Our CTO holds a Bachelor's degree from RV College of Engineering in Bengaluru, India and a Master of Public Administration from Columbia University. Our CTO has been recognized as one of the Top 50 Women in Tech by the National Diversity Council and has received the Digital Diversity Network's Innovation and Inclusion CodeBreakers Award, Innovators & Disrupters Award from New York on Tech and Future CIO Award at Women in IT Awards. Our CISO has nearly twenty years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, and secure architecture and design, as well as several relevant degrees and certifications, including a Bachelors of Science in Computer Engineering from the University of Denver, and IAPP Certified Information Privacy Technologist ("CIPT"). Our CISO held previous certifications include ISC2 Certified Information Systems Security Professional ("CISSP"), EC-Council Certified Chief Information Security Officer ("C|CISO"), and ISACA Certified Data Privacy Solutions Engineer ("CDPSE").

companyName: ETSY INC

ticker: ETSY


text: Our Vice President of IT has over thirty years of IT background in a variety of industries, with experience developing security frameworks, training on cyber security best practices, and emergency response and remediation.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: Governance of cybersecurity risk management Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Management is responsible for day-to-day assessment and management of cybersecurity risks. The IT Executive Steering Committee, comprised of a cross-functional group of our executive management, leads management's oversight of the IT function, including IT risk management. The IT Steering Committee, comprised of operational management, provides tactical oversight of the IT function, including IT risk management Our Director of IT has primary oversight of material risks from cybersecurity threats. Our Director of IT has 20 years of experience across various software engineering, IT security and compliance, business and management roles, including serving as the Director of Engineering Applications and Data Management, leading the development and implementation of information technology strategies and roadmaps for Digital and Engineering applications group. The Director of IT is supported by our Director of IT Security and Compliance, who has more than 10 years of experience in information technology and IT security.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: We manage cyber risk on a daily basis, as we face a multitude of threats ranging from ransomware, phishing attacks, business email compromise, and a wide array of other cyber-criminal tactics aimed at impacting our operations and compromising our sensitive information. Our customers, suppliers, subcontractors, and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. Accordingly, we have invested in resources (people, processes, and technology) aimed at identifying, assessing, and responding to cyber threats.

companyName: INSULET CORP

ticker: PODD


text: Impact of Risks from Cybersecurity Threats The energy industry's growing reliance on information technology and operational technology to support critical operations, such as energy distribution and management activities, has made it more susceptible to cybersecurity incidents. As a result, the global rise of cybersecurity incidents, whether from intentional attacks or accidental events, poses a significant challenge to our industry. As cybersecurity threats continue to evolve in complexity and scale, it remains an ongoing and increasingly difficult task for the industry to prevent, detect, mitigate, and remediate these incidents.

companyName: Antero Midstream Corp

ticker: AM


text: While we continue to invest in our information security defenses, including cybersecurity defenses, if our security systems or those of third parties are penetrated or circumvented such that the confidentiality, integrity or availability of information about us, our customers, transactions processed on our networks or on third-party networks on our behalf, or third parties with which we do business is compromised, we could be subject to significant liability that may not be covered by insurance, including significant legal and financial exposure, actions by our regulators, damage to our reputation or loss of confidence in the security of our systems, products and services that could materially adversely affect our business. For more information about the risks posed by cybersecurity threats, see "Risk Factors — Operational and Other Risk — If the security of our systems, or the systems of third parties we rely upon, is compromised, our business could be disrupted and we may be subject to significant financial exposure, liability and damage to our reputation."

companyName: Discover Financial Services


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors," in this Annual Report on Form 10-K under the heading " We, Stellus Capital Management and our portfolio companies are subject to risks associated with "phishing" and other cyber-attacks. "

companyName: Stellus Capital Investment Corp

ticker: SCM


text: We conduct regular security reviews, simulations and testing, including internal and external penetration testing, vulnerability assessments and regular scans on our hosts and network devices. We review available threat intelligence, including information from industry groups and our security vendor. We consult with third parties, including cybersecurity consultants, as part of our cybersecurity threat and risk management strategy.

companyName: ADOBE INC.

ticker: ADBE


text: Cybersecurity Incident Response Plan—In addition to protecting our assets proactively, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management and our board of directors. The cybersecurity incident response team is composed of a smaller, core group of our cybersecurity team, as well as a larger, extended group that includes personnel from our operations, legal, compliance, privacy, risk management, communications, incident command center, security, human resources, finance, audit and government relations teams. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management as appropriate based on the nature of the incident.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: Our Manager engages in the periodic assessment and testing of our Manager's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of polices and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Manager adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Our IT security director reports to our CIO and has more than 25 years of experience working in information technology-related roles, holds a Masters in Information Systems, with a focus in cybersecurity and a Masters in Business Administration, with an emphasis in business intelligence and analytics management.

companyName: biote Corp.

ticker: BTMD


text: We have an established cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of Okta, Inc.'s critical systems, internal networks, and information. This program implements policies, processes and controls to respond to cybersecurity threats and mitigate business impacts. Our board of directors (the "board") has delegated to the cybersecurity risk committee of the board (the "cybersecurity risk committee") oversight responsibility of the cybersecurity risk management program, which includes a cybersecurity incident response plan.

companyName: Okta, Inc.

ticker: OKTA


text: PetIQ's Board of Directors is responsible for overseeing the Company's cybersecurity risks and threats. Specifically, the Audit Committee of the Board of Directors reviews the Company's cybersecurity status, risks, and threats periodically. Additionally, as needed, individual board members may reach out to Company management directly with cybersecurity questions or clarifications.

companyName: PetIQ, Inc.


text: Cybersecurity Incident Response The Company has an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents that is also tested on an annual basis. The incident response plan is updated based on results of the test or as new cyber related developments occur. The CIO, executive leadership which includes the chief executive officer, chief financial officer, chief accounting officer, chief legal officer, and SEC financial reporting department employees, and the board of directors are notified of any material cybersecurity incidents through a defined escalation process. The defined escalation process is a risk-based process that specifies who is to be contacted and when at each risk level.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: The Company's DIT oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. The Company's DIT also coordinates with the Company's legal counsel and third parties, such as consultants, to assess and manage material risks from cybersecurity threats. The Company's DIT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.

companyName: Inuvo, Inc.

ticker: INUV


text: We perform periodic risk assessments of the Company's information systems based on regulatory guidance issued by the Federal Financial Institutions Examination Council ("FFIEC") and state and federal regulators, including the FDIC and the UDFI. We use multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents. We also engage multiple independent third parties or cyber experts to detect and defend against cybersecurity threats and to assess information security programs and practices including penetration testing. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analyses regarding current threats.

companyName: Finwise Bancorp

ticker: FINW


text: Material Risk Identification The Company identifies risks from cybersecurity threats through a variety of methods including, but not limited to, internal and external assessments, security incidents, evaluations of changes to the business environment, systems, or technology, and reporting by associates, vendors, customers, and security researchers. These processes occur during the procurement, development, integration, modification, operation, and maintenance of the Company's information systems and the integration with or introduction, purchase, acquisition, or renewal of any third-party information systems and services. Notable changes to the Company's operating environment are scrutinized to ensure the confidentiality, integrity, and availability of the Company's information systems.

companyName: GARMIN LTD

ticker: GRMN


text: Direct oversight of cybersecurity risks is delegated to the Board's Risk and Technology Committee. The Committee meets at least quarterly and receives reports detailing current risks, the maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats. Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board. All Committee reports are available to the full Board for review. In the event of critical matters arising between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to our response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief financial officer, chief operating officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Our IT team is responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our third-party vendors, through various means, such as hacking, social engineering, phishing, and fraud. However, the Company does not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors – Risks Related to Our Bitcoin Strategy and Holdings – If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected" and "Item 1A. Risk Factors – Risks Related to Our Operations – If we or our third-party service providers experience a disruption due to a cybersecurity attack or security breach and unauthorized parties obtain access to our customers', prospects', vendors', or channel partners' data, our data, our networks or other systems, or the cloud environments we manage, our offerings may be perceived as not being secure, our reputation may be harmed, demand for our offerings may be reduced, our operations may be disrupted, we may incur significant legal and financial liabilities, and our business could be materially adversely affected."

companyName: Strategy Inc

ticker: MSTR


text: Our cyber risk management program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. Our cybersecurity risks are identified and addressed through a comprehensive, cross- functional approach. The Company's Vice President of Engineering is primarily responsible for the implementation of defense capabilities and risk mitigation strategies in connection with the Company's information security and cybersecurity risks. The Company's Vice President of Engineering, in coordination with the Company's senior management, works collaboratively across the Company to implement the cyber risk management program. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the Company's Vice President of Engineering and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee of the Board of Directors when appropriate.

companyName: IEH Corp

ticker: IEHC


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the CISO works with management, including the Chief Information Officer ("CIO"), to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit & Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: We have established an Enterprise Risk Committee ("ERC") to manage overall risk across the Company including cybersecurity risks identified by the Cybersecurity team; the ERC includes representatives from relevant functions and is led by our CEO. We have also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our risk management, control and governance processes is assigned to our Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. The Cybersecurity team also regularly coordinates with other key stakeholders within the Firm, including Compliance, Human Resources, Internal Audit and Legal.

companyName: TPG Inc.

ticker: TPG


text: Managing cybersecurity risks and securing our sensitive data and systems are a critical part of our business operations and of paramount importance to our organization. Consequently, our cybersecurity risk management program is integrated into our overall enterprise risk management (ERM) program.

companyName: CARROLS RESTAURANT GROUP, INC.


text: Sandisk's Information Security organization addresses cybersecurity risks with a broad spectrum of technologies, controls, and processes that focus on mitigating these risks. Our cybersecurity strategy is designed to be dynamic and adaptive to combat the rapidly-evolving cybersecurity threat landscape and is influenced by commonly leveraged frameworks such as the NIST-CSF (National Institute of Standard and Technologies – Cyber Security Framework). Our program includes, but is not limited to, endpoint protection and response systems, network security protocols, electronic communications protections, vulnerability management programs, least-privilege access controls, third-party risk management procedures, workforce education and training exercises, and compliance programs.

companyName: Sandisk Corp

ticker: SNDK


text: The Company conducts due diligence prior to engaging third-party service providers which have access to the Company's networks, systems, and/or customer or employee data. Risk assessments are performed using Service Organization Controls (SOC) reports, self-attestation questionnaires, and other tools. Third-party service providers are required to comply with the Company's policies regarding non-public personal information and information security. Third parties processing non-public personal information are contractually required to meet all legal and regulatory obligations to protect customer data against security threats or unauthorized access. After contract execution, Seacoast requires critical and high-risk providers to have an ongoing monitoring plan.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: If a cybersecurity incident occurs, incident response procedures are in place to ensure that the occurrence is appropriately reported to the CISO and senior management. Where necessary, business continuity plans are mobilized to minimize disruption to business operations. The Company has established the Cyber Materiality Committee ("CMC"), whose purpose is to review cybersecurity incidents escalated to it by our Threat & Incident Management Team and determine whether they are material and thus require a disclosure on Form 8-K. CMC's membership includes the Chief Executive Officer ("CEO"), the Chief Financial Officer, the Executive Vice President of Technology, the CISO, and other senior leaders.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Our board oversees Okta, Inc.'s enterprise risk management program, of which cybersecurity is an important component. To facilitate the board's supervision of cybersecurity matters, the board formed the cybersecurity risk committee. Among other responsibilities, the cybersecurity risk committee provides oversight over the effectiveness of Okta, Inc.'s cybersecurity program.


text: The risk management program is primarily focused on safeguarding the organization's digital assets, ensuring continuous business operations, and minimizing the potential impact of cyber threats. The structured risk management process is designed to comprehensively identify and assess risks, implement effective mitigation and remediation strategies, enhance overall cybersecurity resilience, and provide transparent reporting. Continuous risk assessments are conducted through internal evaluations and routine engagements with independent third-party security services organizations to systematically identify, prioritize and manage information security risks. Subsequently, risk mitigation strategies are developed and executed to address and remediate identified risks effectively through new cybersecurity initiatives and ongoing enhancements to the cybersecurity program. Regular audits and assessments, including penetration tests and attack simulations, are performed both internally and through independent third-party consultants, and internal auditors evaluate the operational effectiveness of cybersecurity controls and risk management measures. These inputs form the basis of a risk register that is integrated into the overall enterprise risk management program to further inform the Company's strategy assessing the likelihood, impact, and velocity of these risks on a forward-looking, multi-year mitigated basis. A formal process exists, grounded in the enterprise risk management program where material risks, interdependencies, and the associated remediation plans that are tracked to completion at a minimum on a monthly basis are presented and discussed cross-functionally. In addition to the normal discourse on emerging risks, a focused drill down into cybersecurity risk is presented annually at the enterprise risk steering committee meeting. The outcomes of these discussions are submitted quarterly to the Audit Committee of the Board of Directors.

companyName: XEROX CORP


text: We [regularly] engage certified and reputable consultants and auditing firms to evaluate the maturity and effectiveness of our security, including testing the design and operational effectiveness of controls, penetration testing, engaging in independent reviews of policies and standards, and consulting on best practices.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: Company's internal auditor and CISO are informed in the event of any significant cyber security incident and operate to comply with applicable laws regulations.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: While we are not aware of any cybersecurity incidents that have occurred to date, we are exposed to, and may in future be adversely impacted by cyberattacks and interruptions to our information technology systems and infrastructure. Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, and/or result in the loss of trade secrets, proprietary information, or competitively sensitive data.

companyName: Third Harmonic Bio, Inc.


text: Our board of directors, including through delegation to our audit committee, exercises oversight over cybersecurity risks and controls. Our audit committee and board of directors regularly receive updates (including, in the case of our audit committee, quarterly updates) from our Chief Financial Officer and other members of management regarding the status of cybersecurity initiatives and the effectiveness of our internal control system related to information security. In connection with such updates, our board of directors and audit committee discuss our approach to cybersecurity risk management with management. Additionally, the audit committee periodically receives presentations from third-party cybersecurity experts to remain informed of developments in cyber risk and mitigation. Our board of directors and audit committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Vice President of Information Technology has over 15 years of experience managing information technology and cybersecurity matters. The Vice President of Information Technology, together with our senior leadership team, are responsible for assessing and managing cybersecurity risks and they work collaboratively across our company to implement policies and procedures designed to protect our information and systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response plans. A cross-functional team is responsible for responding to cybersecurity incidents.

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company.

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: The five management personnel above also serve in the Company's Enterprise Risk Management Committee and are informed about and discuss updates to the cybersecurity risk management programs and cybersecurity incidents, including any prevention and detection measures as well as mitigation and remediation measures for any reported cybersecurity incidents. The Enterprise Risk Management Committee oversees the Company's overall risk management processes that include oversight of material risks from cybersecurity threats. The CEO and CFO are also members of the Company's Disclosure Committee. The CTO and Head of Information Security participate in Disclosure Committee meetings, as needed, to facilitate discussion and provide information on cybersecurity incidents reported. The CEO, CTO and Head of Information Security provide the Board with information and updates on cybersecurity risks and incidents as in-house technology and cybersecurity experts during Board meetings or as needed.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: We routinely assess material risks from cybersecurity threats, which include unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing therein. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Talkspace, Inc.

ticker: TALK


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program. Board and Audit Committee members receive presentations on cybersecurity topics from our Chief Technology Officer and others within the Chief Technology Officer's team, as well as other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Commerce.com, Inc.

ticker: CMRC


text: have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.] We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations.

companyName: Hour Loop, Inc

ticker: HOUR


text: Our cybersecurity functions are led by our Chief Technology Officer ("CTO"), who reports to our Chief Executive Officer. Our Senior Director - Global Security ("SDGS"), under the direction of the CTO, is responsible for overseeing our cybersecurity management program and the protection and defense of our networks and systems. The SDGS manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: EOG relies on information technology systems across its business. As its reliance on data and information technology systems has increased, EOG has continued to evolve and modify its cybersecurity processes and strategy and related governance and oversight practices as well as enhance the expertise of its cybersecurity team.

companyName: EOG RESOURCES INC

ticker: EOG


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including collecting vendor questionnaires and conducting due diligence in connection with onboarding new vendors. We also collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from management and, from time to time, third parties that assist management in managing cybersecurity threats. The Audit Committee also receives regular reports on how management identifies, assesses and manages cybersecurity and broader technology risks. The Audit Committee reviews these reports and discusses them with management.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: We have not identified or experienced any cybersecurity threats or incidents likely to materially affect our business strategy, results of operations, or financial conditions.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: The IT team is led by Shoals' Vice President of IT, Gerald Jowers, who joined in 2024 with 30 years of technology experience.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: As part of our corporate governance process, the Board, along with the Audit Committee, oversees our risk management process, which includes cybersecurity and related risks. Our CISO periodically meets with the Board and Audit Committee to inform and update them on our cybersecurity program.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The Company relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's Cybersecurity Program.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. All personnel are made aware of our cybersecurity policies through training.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: The CSO may provide more frequent updates to the Board or the Audit Committee if necessitated by a security incident or other developments. The Audit Committee reports regularly to the Board regarding the committee's oversight of cybersecurity risk matters.

companyName: Aspen Technology, Inc.


text: The North American Regional Risk Management Officer and Risk Management Officers of local companies in North America receive technical support from the Cyber Security, Risk & Architecture (CSRA) division of AHM when applying the procedures under the Honda Global Risk Management Policy at the regional and local company levels. The CSRA division includes the Office of the Chief Information Security Officer. The North American Cybersecurity Steering Committee (NACSC) has been established by the North American Regional Operating Board and is responsible for the oversight and monitoring of all North American cybersecurity activities including providing immediate direction and decision-making when threats or incidences of high severity occur. Roles supporting the NACSC include the North American Risk Management Officer who is the chair of the committee, the Chief Information Security Officer, and senior leaders representing various key business functions. The NACSC is also supported by the business through an Advisory Group.

companyName: AMERICAN HONDA FINANCE CORP


text: We routinely evaluate the risks posed by third-party providers and engage with those whom fail to comply with our relevant contract requirements, or when we feel further action is needed to keep our risk levels within approved tolerance levels.

companyName: QUALYS, INC.

ticker: QLYS


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect our company, including our business strategy, results of operations or financial condition.

companyName: CalEthos, Inc.

ticker: GEDC


text: Commvault's Management, including the CEO, CFO, Chief Trust Officer, CSO, CIO, and Senior Vice President of Engineering, is responsible for our cybersecurity risk management strategy, operational decision- making, and incident preparedness and response. The current CSO holds a Bachelor of Science and Master of Business Administration from the University of Maryland, industry certifications such as CISSP, PMP, CIPP/E, CIPP/US and CISA, is affiliated with various industry working groups focused on threat intelligence and privacy, and has over twenty years of experience in cybersecurity leading technical, operational, and strategic programs to protect critical data and infrastructure. Management ensures cybersecurity risks are communicated through the establishment of the ERMC and regular, or as needed, reporting to the Audit Committee and the Board. The ERMC is responsible for the implementation, maintenance, and execution of our enterprise risk management program. The ERMC meets quarterly, or as needed, to assess, consider, and manage material risks, including cybersecurity threats across the business. An Executive Security Council is responsible for the significant operational decisions in the event of an active cybersecurity incident. The Executive Security Council meets monthly, or as needed, with the Audit Committee Chair as an optional attendee, to provide counsel and foster productive communication between Management and the Board.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: Incident Response Planning: We have established and continue to maintain an incident response plan that addresses our response to a cybersecurity incident.

companyName: CEVA INC

ticker: CEVA


text: We engage a third-party Managed Service Provider (MSP) to implement technology infrastructure and oversee its tactical operations. Our MSP employs multiple people with experience in technical leadership, system architecture, network infrastructure and cybersecurity. We believe using an MSP provides economies of scale for a smaller-sized company such as ours, by allowing us access to a broad range of experience and tool sets that would otherwise be difficult to acquire in-house. Our MSP uses specialized third-party services and tool sets for identifying, protecting against, and detecting cyber incidents. Through these services and tools, our detection capabilities include, but are not limited to, near real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide near real-time alerts, log aggregation, and threat intelligence feeds.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protecting the confidentiality, integrity, and availability of our data and other information located on our information systems. Below is a discussion of how we assess, identify and manage material risks from cybersecurity threats.

companyName: Integer Holdings Corp

ticker: ITGR


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "— Item 1A. Risk Factors — Cyber Security and Operational Risk" in this Annual Report on Form 10-K.

companyName: Blackstone Private Equity Strategies Fund L.P.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Also see "Information Security, Cybersecurity, Data Privacy, Regulatory and Legal Risks" included as part of Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: Role of Management At the management level, the Information Technology Steering Committee has overall responsibility for identifying, assessing, and managing information security risks, including cybersecurity risk. The Information Technology Steering Committee provides cybersecurity reports periodically to the ROC and is comprised of the Company's senior information technology, information security and third party risk management leaders, including the Chief Risk Officer and Chief Information Security Officer. The Chief Risk Officer is responsible for managing cybersecurity risk and coordinating with the Chief Information Security Officer to ensure the Company's cybersecurity risk profile is managed in a manner consistent with its risk appetite. The Chief Risk Officer also provides periodic reports to the Board's ROC, outlining the overall status of the Company's Information Security Program and its compliance with regulatory guidelines, and coordinating and reporting on incident response. The Chief Information Security Officer is responsible for the day-to-day management of the Information Security Program and Security Incident Response Policy and Plan. The Chief Risk Officer has held various leadership roles at the bank, including over 13 years previously serving as the Company's Chief Financial Officer. The Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions. The majority of Information Security Team members have over 10 years of cybersecurity experience and cumulatively hold over 50 active professional certifications in related fields.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: Although our third-party service providers have experienced cybersecurity incidents, which have resulted in minor adverse impacts to our business, we have not experienced material losses or other material consequences related to cybersecurity incidents experienced by us or our third-party service providers. We expect to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the continuously evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party service providers, will not have a material adverse effect on our business, results of operations and financial condition. Further discussion of how TMCC's business, results of operations and financial condition may be materially adversely affected by risk from cybersecurity threats is contained in Item 1A. Risk Factors, Regulatory, Legal and Other Risks, "A security breach or a cyber-attack could adversely affect our business, results of operations and financial condition."

companyName: TOYOTA MOTOR CREDIT CORP


text: Our cybersecurity program is contracted through and led by Harley-Davidson's Chief Information Security and Privacy Officer (CISO) who is responsible for assessing and managing the Company's data privacy function and information security and technology risks (including cybersecurity). The CISO has over 20 years of cyber industry and compliance experience, serving in a CISO capacity for over ten of those years. The CISO reports to Harley Davidson's Chief Digital and Operations Officer, who has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: Uber's Chief Information Security Officer ("CISO") is responsible for the Cybersecurity Program, which is coordinated and primarily executed by the global organization of engineers focused on risk management using the NIST Framework (Identify, Protect, Detect, Respond, and Recover) and activities such as automation, secure development, and advanced analytics and monitoring. The CISO has served in such role since February 2021 and has more than 20+ years of engineering and/or cybersecurity experience, including previously as CISO and Deputy Chief Technology Officer at a Fortune 500 company.

companyName: Uber Technologies, Inc

ticker: UBER


text: While we have experienced cybersecurity incidents in the past, in the last three years we have not experienced any cybersecurity incidents that have materially affected or are currently viewed as reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, the scope and impact of any future incidents cannot be predicted and there can be no assurance that our enterprise security program will be effective in preventing material cybersecurity incidents in the future.

companyName: ANALOG DEVICES INC

ticker: ADI


text: Conagra's Cybersecurity Team is led by our Chief Information Security Officer (CISO). Our CISO, a certified information security professional, has over 25 years of cybersecurity leadership experience across multiple industries and holds a Doctor of Science (DSc) degree in Cybersecurity. The CISO reports to our Chief Information Officer (CIO), who has been with Conagra for more than 20 years serving in various leadership roles in information technology, finance, and business services. We believe our CIO possesses a firm understanding of the Company's cybersecurity landscape, risks, and knowledge of the capabilities of our cybersecurity and information systems personnel.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: The Audit Committee is primarily responsible for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on cybersecurity risks, addressing matters such as evolving standards; vulnerability assessments, including results of third-party penetration testing; audits of our cybersecurity IT controls; and independent reviews of our cybersecurity processes. Management and the Board also receive prompt and timely information regarding any significant or potentially material cybersecurity incident and our remediation efforts.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO. With over twenty years of experience in the field of cybersecurity, our CIO brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: The Company is not aware of any cybersecurity incidents that have materially affected the Company, including its business strategy, results of operations or financial condition. For a discussion of cybersecurity threats that could materially affect the Company's business strategy, results of operations or financial condition, please see Item 1A. Risk Factors.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: The Company's Chief Information Officer ("CIO") leads our Information Security Committee (a taskforce comprised of senior representatives from primary corporate functions, mortgage and title operations, IT infrastructure, IT security, and external security consultants), which is responsible for developing, updating, implementing and maintaining our cybersecurity strategy, policy (which leverages the NIST CSF framework), standards, architecture, and processes. The Company has integrated cyber security into its annual risk assessment process. This process identifies critical assets and assesses those assets for potential threats and vulnerabilities. Risks are prioritized based on their impact and likelihood. Controls are assessed to ensure the Company's controls are appropriate to mitigate risks. It also allows us to identify any gaps that we need to focus on. These gaps are typically part of the Information Security Committees risk register. The Information Security Committee meets quarterly and continuously monitors and re-evaluates risks through this risk register, which was initially developed using the NIST CSF framework. The CIO provides annual reports to our Board of Directors, and periodic reports to our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO"), and other members of senior management, regarding existing and emerging cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, and assessments of our information security program.

companyName: M/I HOMES, INC.

ticker: MHO


text: While everyone at the Company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by the Board, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, with substantial involvement of the Company's IT subsidiary.

companyName: SUNLINK HEALTH SYSTEMS INC


text: We engage third parties in connection with assessing, identifying and managing our cybersecurity risks, including, but not limited to, the following: • We engage an independent third-party with incident response expertise to provide intelligence-based cybersecurity solutions and services to assist us with preparing for, investigating, and responding to cybersecurity incidents, including attacks that target on premise, cloud, and critical infrastructure environments. • We engage an independent third-party service provider to conduct an annual security program assessment of the controls, maturity and performance of our information security program and the information security risks associated with our technology and business systems. • We engage an independent third-party service provider to annually perform external and internal penetration and intrusion testing using industry standard tools and techniques. • We engage an independent third-party auditor to help ensure compliance with certain information security standards required under some of our federal contracts. • We have an established cadence of reviews, reporting and coordination with government agencies to review cybersecurity metrics, findings and any applicable remediation efforts. These agencies conduct assessments of our controls on a periodic basis using the National Institute of Standards and Technology Cybersecurity Framework. • We engage a third-party auditor to review processes and procedures designed to control access to information systems as part of its Sarbanes-Oxley testing. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our cybersecurity risk management program. Further, our internal audit team conducts annual assessments of our cybersecurity risk management program and controls.

companyName: CoreCivic, Inc.

ticker: CXW


text: Role of the Board On an annual basis, the Board reviews and approves the overall enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk. The Board has delegated its responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with experience in risk management including cybersecurity.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. We design and assess our program using components of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: HOST HOTELS & RESORTS L.P.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including third party service providers engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Mereo BioPharma Group plc

ticker: MREO


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. Our Information Systems and Technology Department (the "IT Department") monitors security alerts or indicators and initiates triage, verification and remediation actions when needed. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: A robust cybersecurity program to protect our assets from cyber and information security threats is critical to managing risk effectively. Our cybersecurity program is designed with consideration of internationally recognized information security standards and best practices. Our multi-layered data protection and information security programs and practices are designed for the safety, security and responsible use of the information and data our stakeholders entrust to us. The approach blends defense-in-depth and zero-trust principles. Our cybersecurity program is informed and assessed by third-party assessments and advice regarding best practices from consultants, business partners and advisors, and it incorporates benchmarking and other data from peer companies. We have processes for evaluating (among other things) the data protection and information security infrastructure of our third-party providers (including examining any relevant records such as service organization controls reports), and we seek to manage third-party risk with procedures to onboard our third-party providers, monitor their activity during our engagement (where possible) and off-board such third-party service providers at the end of our engagement.

companyName: Greenbacker Renewable Energy Co LLC


text: Beginning in the first quarter of 2024, the full Board, at least annually, and the Audit Committee of the Board, at least quarterly, will receive quarterly reports on our cybersecurity program and developments from our Vice President of Global Security. These reports will include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity. It is anticipated that Audit Committee oversight will include review of periodic tabletop exercises to test cybersecurity infrastructure and incident response measures.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Our Operations" in Item 1A. Risk Factors.

companyName: Bogota Financial Corp.

ticker: BSBK


text: Our Senior Director of IT is currently responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO has the overall IT and cybersecurity responsibility and is currently responsible for approving IT and cybersecurity related policies, processes, and procedures, approving related activities and budgets, helping prepare for cybersecurity incidents, and reviewing security assessments and other security-related reports.

companyName: Y-mAbs Therapeutics, Inc.


text: Our Adviser and our Administrator have implemented ongoing processes that are designed to continually identify, assess, manage, monitor and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's resource management and compliance departments, which then are considered by other officers and employees of our Adviser and Administrator before implementation.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN


text: Meetings of our board of directors include discussions and presentations from management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from management on our enterprise risk profile on an annual basis. The board of directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.

companyName: Lipocine Inc.

ticker: LPCN


text: The audit committee receives regular reports from the Chief Information Security Officer concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risks, and mitigation measures.

companyName: Confluent, Inc.

ticker: CFLT


text: Tredegar entrusts the third-party service providers with the responsibility to institute security measure protocols that are appropriately and proportionally tailored to the corresponding risks. Additionally, Tredegar also periodically conducts assessments of the third-party service providers' security frameworks to verify the implementation of adequate security measures, to safeguard Tredegar against potential vulnerabilities.

companyName: TREDEGAR CORP

ticker: TG


text: Our commitment to establishing a secure digital realm is underpinned by the structured governance and management of our data security and privacy policies and strategies. Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee, a member of which has extensive technology experience, including in the area of cybersecurity. The Audit Committee engages in regular, at least quarterly, discussions on these topics, informed by reports from our IT Security Team led by the CTO. Specific topics may include updates to the Company's approach to cybersecurity risk management; recent developments; key initiatives; the threat landscape; trends; and the results of certain assessments and testing. Periodically, the Audit Committee also receives presentations on cybersecurity matters from third-party cybersecurity experts. The Board of Directors receives reports from the Audit Committee chair on these and other risk-related matters as deemed necessary.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: We maintain policies, procedures and controls designed to safeguard against cybersecurity incidents by protecting the confidentiality, integrity, availability and reliability of our systems, networks and information. These policies, procedures and controls are subject to monitoring, auditing, and evaluation practices, pursuant to our Enterprise Risk Management program, which is supported by a three-line defense strategy that includes, the business lines, the Enterprise Risk Management Committee, the Risk Management and Information Security Department, the Compliance Department and the Internal Audit Department. Further, we have developed and conduct at least annually cybersecurity and data privacy training programs for our employees and our third-party consultants who have access to our systems. At least annually, we also conduct simulations, tabletop exercises, independent third-party cybersecurity penetration assessments, and response readiness tests. In addition, the information technology systems of our self-regulatory organizations are subject to periodic reviews, audits, and inspections by regulatory authorities. We also conduct diligence on cybersecurity practices in connection with our overall risk assessment when evaluating expansion into new regions, strategic opportunities, and new products.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: The full board of directors receives an annual information security update by our Chief Information Security Officer ("CISO") and an annual privacy update, which covers, among other matters, our privacy and cybersecurity programs and risks. Our audit and risk committee receives updates, at least quarterly, on significant data privacy and security risks, including any significant incidents, relevant industry developments, threat vectors and significant risks identified in periodic penetration tests or vulnerability scans. The updates also include significant legal and legislative developments concerning data privacy and security, our approach to complying with applicable law, and significant engagement with regulators concerning data privacy and cybersecurity. Our audit and risk committee provides regular updates to the board of directors on such reports.

companyName: Block, Inc.

ticker: XYZ


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, from time to time we and our third-party vendors have experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors - Risks Related to Our Intellectual Property and Information Technology" in this Annual Report on Form 10-K.

companyName: Lifeward Ltd.

ticker: LFWD


text: We have developed a cybersecurity program designed to protect and preserve the confidentiality, integrity and continued availability of all information we own or process against risks from cybersecurity threats. Using a risk-based prioritization approach, the cybersecurity team focuses on securing our high value assets, updating our cybersecurity detection and prevention capabilities to identify new threats, and maturing the compliance processes to protect the Company's operations and data.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: Management is responsible for the day-to-day management of risks we face, while the Board as a whole and through its committees, provides guidance on the oversight of risk management.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: We maintain cyber insurance coverage and have tendered claims for certain expenses incurred in connection with this event. During the year ended December 31, 2024, we recovered $ 2.1 million from our insurer. Insurance recoveries are recorded as a reduction of general and administrative expense. Refer to Note 13 of the Notes to Consolidated Financial Statements included elsewhere in this Annual Report on Form 10-K for additional information concerning the incident.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Our Board reviews and discusses significant risks with executive management, including cybersecurity risk, that affect us. Although our executive management team and our Board work together on risk matters, our Board has the ultimate oversight authority over all enterprise risks, including cybersecurity risk. Our Board reserves the right to, and periodically does consult with third-party advisors and experts to assist our Board in understanding and anticipating future cybersecurity threats and trends. The risk and safety committee of our Board (the "RSC") is specifically tasked with reviewing and monitoring cybersecurity and information security risk, as well as the risk management strategies, systems and policies and processes implemented, established and reported on by our executive management team. The RSC is also primarily responsible for assisting our Board with oversight of our enterprise risk management program. As part of the risk management team, our Chief Information Security Officer reports key performance indicators of our information security program to the RSC at least three times a year to facilitate the committee's oversight of the effectiveness of the program through objective measurements, including metrics regarding software patching, IT asset management, cyber incident management and cybersecurity training. Reports by our Chief Information Security Officer also include detailed information on the activities of our cyber incident response team to allow for analysis of trends and the identification of any control gaps that require remediation.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: We have processes for assessing, identifying and managing cybersecurity risks, which are an integral part of decision-making at every level. Such processes include physical, procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and refine our practices.

companyName: Greenland Technologies Holding Corp.

ticker: GTEC


text: Our cybersecurity program incorporates ongoing risk management practices such as risk identification and the maintenance of a cyber risk register, threat intelligence tracking, identification and monitoring of key controls using key performance indicators, the performance of independent control effectiveness testing by internal audit, annual third-party risk assessments, external penetration testing, and cyber incident response exercises. Our cybersecurity program also incorporates processes intended to help anticipate emerging technology innovation, utilizing a security capability map as a resource in combination with our cyber risk and enterprise risk assessment processes, to inform and prioritize investment decision-making in connection with the cybersecurity program. Additionally, we collaborate with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices, including for industry best practices for cybersecurity programs and capabilities, incident response processes, legal and regulatory developments, and experiential guidance. Our cybersecurity risk management activities are integrated in our overall enterprise risk management processes, so that cyber risks are assessed in the context of other risks relevant to our overall enterprise risk profile, to inform the organization's decision-making and planning processes.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: The Company leverages continuous monitoring and regular risks assessments to identify the Company's current and potential cybersecurity risks. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed on a regular basis to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board Risk Oversight Committee.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the heading "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences"


text: We have processes to evaluate third party service providers and vendors that have access to sensitive systems and Company and customer data, which may include the use of cybersecurity questionnaires and due diligence procedures such as assessments of that service provider's cybersecurity posture.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See " Item 1A. Risk Factors – Our business is subject to cybersecurity risks " included elsewhere in this Annual Report on Form 10-K.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: At this time, no cybersecurity threats or incidents have been identified that have materially affected or are reasonably likely to materially affect our operations, business strategy, results, or financial condition.

companyName: AIRGAIN INC

ticker: AIRG


text: We intend to continue to leverage the support of third-party information technology and security providers, including to perform risk assessments designed to identify, assess, and manage cybersecurity risks. We assess on an ad hoc basis the data protection practices of certain of our third-party vendors who handle our data, which assessments include the assessment of vendor data protection policies, disclosure of changes to data protection policies or practices, maintenance of cyber liability insurance, and provision of certifications, assessments, or other documentation as deemed relevant.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: The Company's Board of Directors (the " Board ") recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is responsible for overseeing the Company's risk management process, and cybersecurity represents a component of the Company's overall approach to enterprise risk management (" ERM "). In general, the Company seeks to address cybersecurity risks through an approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: With respect to third-party service providers, our cybersecurity program includes conducting due diligence of relevant and material service providers' information security programs prior to onboarding. In general we also contractually require material third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain reasonably appropriate security controls and to use our personal information only to provide services to us, except as required by law.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us and we believe are not reasonably likely to have a material adverse effect on us, including its business strategy, results of operations, or financial condition. For additional information on cybersecurity risks and potential related impacts on AIR Operating Partnership, refer to "Our business and operations would suffer in the event of significant disruptions or cyberattacks of our information technology systems or our failure to comply with laws, rules and regulations related to privacy and data protection." in Part I, Item 1A, Risk Factors.

companyName: Apartment Income REIT, L.P.


text: As a part of our overall risk management processes, we have implemented a comprehensive cybersecurity program designed to identify and manage cybersecurity risks. This program includes a robust risk assessment process designed to identify security vulnerabilities, incorporates regulatory requirements and also provides the foundation for the Information Security department's annually updated multi-year project roadmap, which is used to continually enhance 1st Franklin's cybersecurity program to respond to new threats and challenges.

companyName: 1st FRANKLIN FINANCIAL CORP


text: training and awareness programs for employees to drive adoption and awareness of cybersecurity processes cybersecurity incident response plan that includes procedures for responding to cybersecurity the last two fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business, results of operations or financial condition, refer to Item 1A. Risk Factors - "Our business and operations would suffer in the event of system failures or, cyber-attacks or a deficiency in our cyber-security," which is incorporated by reference into this Item 1C. (Role of Management/Role of the Board)

companyName: Biofrontera Inc.

ticker: BFRI


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident response policy, vulnerability management policy, risk assessments, encryption of certain data, network security controls and data segregation for certain environments and systems, access controls for certain environments and systems (such as identity controls and quarterly user access reviews), physical security, systems monitoring for certain systems, vendor risk management program, system configuration standards, employee security awareness training, asset management, managed detection and response tools, penetration testing, cybersecurity insurance and dedicated cybersecurity staff.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: The Company's CIO and CISO have over 40 years of combined experience in technology leadership roles for large, multinational corporations, including extensive experience in enterprise cybersecurity strategy, policy, incident response and controls.

companyName: Walgreens Boots Alliance, Inc.


text: The Board receives a periodic update from the Chair of the F&RM Committee regarding the matters addressed by the F&RM Committee, as well as an annual report from the CISO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Cybersecurity incident identification and response. We use several processes and procedures to protect our data, systems and employees from cyber incidents, to reduce our overall cybersecurity risk profile, and to identify and respond to cybersecurity incidents in a timely manner. These processes and procedures leverage a variety of tools, including a security incident and event manager interface that uses behavioral analytics and provides live metrics and reports of attempted breaches and logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications. We also conduct periodic tests to assess our processes and procedures and the threat landscape, which include, among other things, the engagement of third-party experts for external and internal penetration testing and system security assessments.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: Our cybersecurity risk management program forms a part of our overall enterprise risk management program, and shares reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Highlands REIT, Inc.


text: We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board of Directors has overall responsibility for risk oversight, the Board of Directors has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee reports to the Board of Directors at least annually, and notifies the Board of Directors as necessary regarding significant new cybersecurity threats or incidents. The Audit Committee of our Board of Directors meets annually to discuss our approach to overseeing cybersecurity threats with management, including with members of our internal cybersecurity team.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: As part of the administration of our Cybersecurity Risk Mitigation Practices, the Committee is tasked with managing and mitigating our exposure to cybersecurity threats, creating our cybersecurity policies, and establishing short and long- term cybersecurity goals and objectives that are designed to protect our information systems. The Committee is also responsible for planning ordinary course security projects and initiatives aimed at ensuring that our organizational leaders are informing our employees about our cybersecurity policies and about cybersecurity basic practices. On a periodic basis, the Committee meets to review the performance and effectiveness of our Cybersecurity Risk Mitigation Practices.

companyName: PC CONNECTION INC

ticker: CNXN


text: Safeguarding the security and integrity of our systems, networks and data is an important element of our business activities. We invest in resources that help us develop and implement various cybersecurity programs and processes that are designed to assess, identify and manage material risks from cybersecurity threats and to address the ever-evolving cybersecurity landscape.

companyName: PAMT CORP

ticker: PAMT


text: The CISO and the Cybersecurity Management Board monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the Risk and Cybersecurity Committee, as appropriate, and simulated exercises.

companyName: General Motors Co

ticker: GM


text: Company's Board of Directors maintains ultimate oversight of cybersecurity risks. The Audit Committee, which is composed entirely of independent directors, has primary responsibility for overseeing cybersecurity risk as part of its broader oversight of information technology and risk management. The Audit Committee receives regular briefings—at least quarterly—from management on cybersecurity matters. full Board is also periodically briefed on material cybersecurity risks, incident response preparedness, and significant security incidents, if any.

companyName: Perfect Moment Ltd.

ticker: PMNT


text: Our cybersecurity manager is designated as the senior executive responsible for cybersecurity and reports directly to the head of IT. Our cybersecurity manager has a comprehensive information technology background and over ten years of service in managing or assisting in managing cybersecurity risks.

companyName: NEOGEN CORP

ticker: NEOG


text: For instance, we utilize our existing information security measures to oversee operational landscapes, address suspicious events, and generate necessary reports shared during our monthly meetings. Additionally, as deemed necessary, we request third-party service providers to furnish System and Organization Controls ("SOC") reports. Simultaneously, we are in the process of revising and formulating new IT policies, standards, and procedures in harmony with the National Institute of Standards and Technology Cybersecurity framework.

companyName: Li-Cycle Holdings Corp.


text: Incidents & Risks We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company. For more information on our cybersecurity risks, see "Technology Risks" identified in the "Risk Factors" section of Part 1 of Item 1A herein.

companyName: Baker Hughes Co

ticker: BKR


text: Our processes for identifying, assessing and managing the risks from cybersecurity threats are a key component of our overall cybersecurity strategy, which is designed to safeguard technology critical to providing services for our customers, and protecting business-sensitive and personal information that is entrusted to us. To help execute our cybersecurity strategy, we have adopted a risk-based, layered, defense-in-depth approach, which, among other measures, includes: (i) the segregation of our critical industrial control systems (Operational Technology or OT systems) from our corporate network; (ii) multiple layers of preventative and detective measures; (iii) a cybersecurity incident response plan to promote preparedness; and (iv) a cross-functional cybersecurity steering committee (the "Cybersecurity Committee") to provide guidance around cybersecurity risk management. Our overall cybersecurity program is based on various industry-recognized frameworks and standards developed and issued by leading international, domestic and energy-industry standard-setting organizations.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: Our internal cybersecurity program is led by USAC's IT department. USAC's internal cybersecurity program is designed to align with the National Institute of Standards and Technology's Cybersecurity Framework. USAC's IT department stays informed of current developments in cybersecurity threats, including incidents or issues that may arise involving our third-party service providers, and preventative measures and continuously updates our cybersecurity program based on this knowledge. It utilizes industry-leading security tools and regularly performs security risk assessments and tool reviews with independent third parties to evaluate program effectiveness, and regularly updates our security roadmap. USAC's IT department monitors industry news and updates to stay aware of the cybersecurity landscape, including incidents or issues that may arise involving USAC's third-party service providers.

companyName: USA Compression Partners, LP

ticker: USAC


text: Information Security Program The information security team provides regular reports to the Chief Technology Officer and other relevant teams on various cybersecurity threats, assessments and findings. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors or other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. Our management team identifies and assesses information security risks using industry practices informed by the National Institute of Standards and Technology ("NIST"), including the NIST Cybersecurity Framework.

companyName: WELLTOWER INC.

ticker: WELL


text: Management, and specifically our Chief Financial Officer, reports quarterly to our Audit Committee on cybersecurity, including initiatives and strategies, and incident reporting and any lessons learned. From time to time, management will also engage in informal discussions with members of the Audit Committee about our cybersecurity practices and risks, including informing our Audit Committee Chair in a timely manner about any cybersecurity incidents that management determines may have a significant impact on our operations or that may trigger any reporting obligations. Audit Committee will conduct an annual review of our cybersecurity measures and the effectiveness of our risk management strategies.

companyName: MICROVISION, INC.

ticker: MVIS


text: In the last three fiscal years, we are not aware of and have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We have not been faced with any penalties or settlements related to cybersecurity.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: If we were to experience a cybersecurity incident, our Security Leader would inform the Cybersecurity Steering Committee, which would then evaluate and assess the materiality of the incident to the Company and the impact of the incident on the Company's information technology infrastructure and data integrity, and determine whether the incident should be reported to the Audit Committee of the Board in advance of the next regular cybersecurity update. The Cybersecurity Steering Committee, with the assistance and input of the Audit Committee of the Board, has established a set of predefined criteria that it uses to make such determinations. Once a cybersecurity incident has been reported to the Audit Committee of the Board, the Audit Committee of the Board, with the input of the Cybersecurity Steering Committee, will determine how to address it.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: Securing the Company's business information, intellectual property, customer, patient and employee data and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements and maintaining the trust of its stakeholders. Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks.

companyName: CVS HEALTH Corp

ticker: CVS


text: In July 2023, the SEC implemented cybersecurity amendments effective for annual reports with fiscal years ending on or after December 15, 2023, which was effective for Navitas beginning in 2023. The board of directors oversees our cybersecurity program, which is managed by our director of IT in collaboration with management of our businesses and functions. During the year ended December 31, 2024, we experienced no material cybersecurity incidents. Our approach to identifying and managing cybersecurity risks involves maintaining an updated firewall, monitored by our director of IT, coupled with annual cybersecurity awareness training for all our employees. We also have email filters to prevent spam and phishing attacks, while anti-virus software on employee computers alerts our IT department to potential threats. We have performed an annual penetration test, conducted by consultants, to ensure the robustness of our cybersecurity. If a breach is discovered, the director of IT informs our chief financial officer and chief executive officer, who would then communicate the information to our board of directors.

companyName: Navitas Semiconductor Corp

ticker: NVTS


text: We have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. All proposed third parties are subject to a preliminary assessment to identify those that may handle or have access to company information and scope appropriate due diligence activities relating to the engagement. Third-parties that may handle or have access to company information are subject to enhanced due diligence procedures prior to onboarding and security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by third-parties and information obtained through other channels. In addition, we require our providers to adhere to appropriate security requirements and controls, and we investigate security incidents that have impacted our third-party service providers, as appropriate.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "System security risks, data protection breaches, cyber-attacks (including artificial intelligence (AI)-enabled threats), AI-related operational errors, and systems integration issues could disrupt our internal operations or services provided to customers, and any such disruption could reduce our expected revenue, increase our expenses, damage our reputation and adversely affect our stock price."

companyName: Mission Produce, Inc.

ticker: AVO


text: Cantor's global cybersecurity processes form the comprehensive framework for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. Cantor aims to conduct its cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by Cantor's cybersecurity team and supported by its business continuity teams.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Vice President of IT, Randall Anderson, reports to the Audit Committee as part of every regularly scheduled quarterly meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad ERM program.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Engaging third-party IT security vendors to conduct ongoing assessments and monitoring of our networks and devices. Additionally, we routinely collaborate with assessors, consultants, and other third-party entities to review our cybersecurity program. These efforts aim to identify areas requiring sustained attention, enhancement, and alignment with regulatory requirements. Certifications held by our cybersecurity consultants include but are not limited to: CISSP, CISM, CCNP, and CMMC-RP.

companyName: WEYCO GROUP INC

ticker: WEYS


text: Additionally, the Board recognizes the critical importance of maintaining the trust and confidence of the Company's customers, vendors, business partners and employees. The Board oversees the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's Cybersecurity Incident Response Plan (the "Cybersecurity Plan"), which includes the Company's standards, processes and practices are a component of the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company's Cybersecurity Plan states that it seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on (i) preserving restrictions on information access and disclosing, including means for protecting the confidentiality of personal private and proprietary information, (ii) guarding against improper information modification or destruction, and (iii) ensuring timely and reliable access to the Company's information systems.

companyName: Verano Holdings Corp.

ticker: VRNO


text: Materiality Assessment, Mitigation and Reporting. Under our Security Incident Response Policy, the SIRT, under the leadership of the Information Security Coordinator, is responsible for promptly assessing the materiality of security events, developing our response to such events and, if a security event is determined to be a material incident, to oversee our disclosures regarding the incident as required by the rule adopted by the SEC related to cybersecurity disclosures. In determining whether a security event could constitute a security incident, the SIRT considers all facts and known information, including (without limitation) the potential harm to customers, employees and other parties; possible effects on our operations, financial statements, brand perception, reputation, customer or vendor relationships and competitiveness; the risk of fraud, extortion or intellectual property theft; litigation, regulatory and other legal risk; and other potential impacts. The Chair of the Audit Committee is informed of the SIRT's review of cybersecurity events and its determinations as to the materiality of such events. The Security Incident Response Policy also includes procedures for the SIRT to coordinate the containment, eradication, mitigation, recovery and remediation related to security events and security incidents and the implementation of procedures and actions designed to prevent additional security events in the future.

companyName: EVgo Inc.

ticker: EVGO


text: In designing, operating, evaluating and maintaining our program we use internal and external resources and frameworks, including cybersecurity expert consultants, industry working groups, the U.S. NIST Cybersecurity Framework and the U.S. Cybersecurity Agency's National Cyber Incident Scoring System model to benchmark, inform and evaluate the design of our program, our operational capabilities and our program maturity.

companyName: BIOGEN INC.

ticker: BIIB