text: The Chief Information Security Officer's organization includes managers who have led cybersecurity programs in other industries such as robotics and artificial intelligence, consulting, telecommunications, healthcare, and manufacturing, which brings together a multi-faceted approach to managing cybersecurity threats and risks. The Information Security department leadership and personnel hold degrees in Information Security, Management Information Systems, Computer Science, Engineering Management and other professional majors. They also hold multiple professional certifications inclusive of vendor-issued security credentials from CISCO, Microsoft and F5, and industry certifications including but not limited to: Certified Information Systems Security Professional issued by the International Information System Security Certification Consortium; the Cybersecurity and Infrastructure Security Agency and Certified Information Security Manager issued by the Information Systems Audit and Control Association; and the Certificate of Cloud Security Knowledge issued by the Cloud Security Association.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: The STEP Board and Audit Committee regularly review the measures implemented by STEP to identify and mitigate risks from cybersecurity threats. As part of such reviews, the STEP Board and Audit Committee receive reports and presentations from those responsible for overseeing STEP's cybersecurity risk management, including the Partner, Head of Information Technology & CISO ("Head of IT") and STEP's Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to STEP's peers, industry participants, service providers and other third parties. The Head of IT also periodically presents to the STEP Board and its Audit Committee, including to describe STEP's information security infrastructure and improvements made, and to report on any significant developments in respect to STEP. From time to time, external legal advisers provide education to the STEP Board and/or Audit Committee in respect of information security related developments and to provide training in respect of directors' responsibilities.

companyName: Stepstone Private Credit Fund LLC

secItem: Item 1C


text: In the event of an incident, we intend to follow our cyber incident response plan. Any assessment that is deemed an actionable incident would trigger an alert to the CIRT. The CIRT will further assesses the incident according to a predefined scale (e.g., low, medium, high and critical) and initiate the Company's incident response plan and communication protocols. The CIRT, in conjunction with the Risk and Sustainability Committee, will assess the materiality of the incident with respect to the rules, regulations and disclosure requirements of the SEC and NYSE. See "Risk Factors" in Item 1A of this Annual Report. As of December 31, 2023, we have not identified any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.

companyName: Blue Owl Capital Corp II


text: Under the direction of the CIO, management's responsibilities with respect to the Company's cybersecurity program include (i) identifying and managing cybersecurity risks, (ii) coordinating cybersecurity incident response, (iii) assessing the health and maturity of the Company's cybersecurity policies, procedures, and plans, including the program, and (iv) reporting overall progress to the Cybersecurity Committee and to the full Board of Directors.

companyName: APA Corp

ticker: APA


text: Our information security program is designed to generally align with recommended practices in security standards issued by the International Organization for Standardization (ISO), American Institute of Certified Public Accountants (AICPA, SSAE18), National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (ISO 27001 Brazil and U.K.), SOC 1 and 2 Type 2 reports and PCI DSS reports on compliance to adhere to industry standard practices.

companyName: CORPAY, INC.

ticker: CPAY


text: To our knowledge, previous cybersecurity incidents have not materially affected the Company, its business strategy, financial condition or results of operation. With regard to the possible impact of future cybersecurity threats or incidents, see "Item 1A. Risk Factors."

companyName: FIRST CAPITAL INC

ticker: FCAP


text: Our prior Global CISO departed HPE at the end of October 2024. We have identified a successor, who will join HPE in January 2025, previously served in relevant leadership positions at other public and private companies, and will bring over two decades of technology experience spanning information security and IT, including serving as CISO at other large companies. In the interim, our CDRM organization has been and will be led by our CISO of Cyber Defense and CISO of Cyber Governance, both reporting directly to our COLO.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: For information on the risks we face from cybersecurity threats, please see the risk factors included under Part I, Item 1A titled " A cyber-attack on our IT or OT systems could affect our business and assets, and have a material adverse effect on our financial position, results of operations and cash flows. " and " Failure of our critical IT or OT systems could have an adverse impact on our business, financial condition, results of operations and cash flows, as well as our ability to pay cash distributions. "

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: The Senior Information Technology and Enterprise Applications Manager is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Senior Information Technology and Enterprise Applications Manager oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the information security team is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: ExchangeRight Income Fund


text: We maintain a cybersecurity team responsible for the development and implementation of a program intended to protect the confidentiality, integrity and availability of our critical systems and information. A component of our program is a cybersecurity Incident Response Plan ("IRP") which has been built by the team utilizing current and historical industry knowledge and experience.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: The Company's Information Technology Manager has an over 25-year career in Information Technology, during which the prior 13-years have been in Information Technology, Security and Cybersecurity, working primarily in regulated industries.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third party risk management process for certain service providers, suppliers, and vendors.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: A primary function of the Audit Committee is to assist the Board in the oversight of the identification, assessment and management of risk. Cybersecurity risks are included in PPL's enterprise risk management process and are reported to the Audit Committee of the Board on a quarterly basis or more frequently, as needed.

companyName: PPL ELECTRIC UTILITIES CORP


text: Access to Estrella's data and email, hosted on Office 365, is protected by two-factor authentication, providing an additional layer of security against unauthorized access.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise. The plan ensures stakeholders across the organization are identified who have the appropriate experience, training and expertise in incident management and that the organization is well positioned to address incidents. For example, we carry out cybersecurity incident response exercises to develop widespread familiarity and experience in responding to cybersecurity incidents.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: Although we believe that we maintain reasonable cybersecurity measures, we recognize that cyber threats continue to evolve, and no system is immune to risk.

companyName: MCKESSON CORP

ticker: MCK


text: Material Impact of Cybersecurity Risks The Adviser recognizes that cybersecurity risks have the potential to impact business operations, financial performance, regulatory compliance, and reputation. To mitigate these risks, the cybersecurity program is built on scalable, future-ready solutions designed to address current and evolving threats.

companyName: Antares Strategic Credit Fund


text: Yubo Beijing's management team is responsible for assessing and managing the material risks from cybersecurity threats. The team has primary responsibility for its overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants. Yubo Beijing's management team's experience includes decades of managing public pharmaceutical companies, including their related information technology and cybersecurity risk management programs.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: The cybersecurity risk management and mitigation measures we implement for certain of our IT Systems and Data including for example (1) cybersecurity risk is addressed as a component of our enterprise risk management assessment processes; (2) the information security function works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the Board, which evaluates our overall enterprise risk, (4) policies and procedures to manage how IT Systems and Data are collected, maintained and stored, (5) communicating with and training personnel on cybersecurity risks and trends.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: Third-party vendors are vetted through our Advisor's service delivery program to ensure they have an established cybersecurity program. Our Advisor has also engaged a managed security provider to manage a supply chain defense subscription that will help obtain visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our Advisor's managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the IT Department thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.

companyName: Net Lease Office Properties

ticker: NLOP


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including those associated with the use of third-party services and service providers. This framework includes steps for assessing a cybersecurity threat's severity and source, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and threat mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. To prevent and detect material cybersecurity incidents, our framework further includes, among other things, ongoing security awareness training for employees, regular cybersecurity risk and vulnerability assessments, and mechanisms to detect and monitor unusual network activity. We recognize the complex and evolving nature of cybersecurity threats and engage with various third-party service providers, including cybersecurity assessors and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size.

companyName: EVOLUTION PETROLEUM CORP

ticker: EPM


text: We appreciate the importance of cybersecurity in maintaining the trust and confidence of our guests, employees, and business partners, and we are committed to upholding the highest standards of network and data security throughout our operations to protect our various stakeholders. Our cybersecurity risk management program is integrated into our overall enterprise-level risk management system and shares common communications channels and response processes that apply to other legal, compliance and operational risk areas addressed by our enterprise-level risk management program. Our technology infrastructure and information systems are central to our sales of admissions products, such as single day tickets, season passes, and Six+ memberships, as well as in-park offerings of food, beverages and merchandise. We also use our technology platforms to interact with suppliers and make payments. Our technology infrastructure and information systems also forms the foundation for our accounting and finance systems and our disclosure and accounting control environment. Our internally developed technology systems, as well as those we license from third-parties, could each face breaches from cybersecurity threats. These threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, theft of intellectual property or other security breaches. Such attacks have become increasingly sophisticated, and we expect that will continue to evolve as threat actors increase their use of artificial intelligence and machine-learning technologies.

companyName: Six Flags Entertainment Corp/OLD


text: The governance of our risk management program is a partnership between our cross functional management team and our Board of Directors. This program includes both a cyber team led by our Chief Information Officer ("CIO"), as well as an Enterprise Risk Management ("ERM") program led by our head of compliance. Our CIO has 30 years of information technology experience, including over 3 years of direct oversight of information security. Risk oversight for both our cyber and ERM programs is primarily the responsibility of the Audit Committee of the Board of Directors who receive quarterly updates, at a minimum, with additional updates shared to the full Board of Directors on a recurring basis.

companyName: J.Jill, Inc.

ticker: JILL


text: Our Vice President of Product and Enterprise Security is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management. Our Vice President of Product and Enterprise Security has over 30 years of experience in cybersecurity and information technology roles, including executive leadership positions at public and private companies.

companyName: ROKU, INC

ticker: ROKU


text: Our cybersecurity program includes: • Vigilance: The Company maintains a cybersecurity threat operation that endeavors to detect, contain and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the business. • Partnerships: The Company has established partnerships with a number of third parties, including service providers, to identify and assess cybersecurity risks. • Systems Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments. • Third-Party Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, such as vendors and service providers. The Company performs due diligence on third parties that have access to our systems, data or facilities that house such systems or data. Additionally, the Company generally requires those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways. • Education: The Company provides periodic awareness training for personnel regarding cybersecurity best practices. Routine security bulletins are sent to personnel throughout the year to enhance awareness of responsibility regarding security risks and we conduct regular phishing exercises. "Security Awareness Month" activities also occur on an annual basis and include sessions with guest speakers, relevant communication, and additional educational opportunities related to security risks. • Incident Response Planning: The Company has established and maintains a written incident response plan that addresses the Company's response to a cybersecurity incident, and such plan is tested periodically with tabletop exercises. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving senior management personnel from the technology, operations, legal, risk management, internal audit and other key business functions (the "cybersecurity team"), as well as members of the Company's Board and the Audit Committee of the Board. • Insurance: The Company carries information security risk insurance that is designed to mitigate against certain potential losses arising from a cybersecurity incident.

companyName: Burlington Stores, Inc.

ticker: BURL


text: Cybersecurity risk is a critical aspect of our Board of Directors' risk oversight function. The Board has entrusted the Audit Committee with the oversight of cybersecurity and other IT-related risks. This committee monitors the execution of our cybersecurity risk management program.

companyName: KALTURA INC

ticker: KLTR


text: SLB faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. SLB has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on SLB's business, financial condition, results of operations, or cash flows. See "Risk Factors – Business and Operational Risks – Our operations are subject to cyber incidents that could have a material adverse effect on our reputation, business, financial condition, results of operations, and cash flows."

companyName: SLB LIMITED/NV

ticker: SLB


text: The Company has not experienced any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected, or that it believes are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Managing Third Party Risk There are risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information. We evaluate third-party service providers' cybersecurity posture and seek to mitigate risk through contractual safeguards, monitoring, and incident response plans.

companyName: Cactus, Inc.

ticker: WHD


text: The Company's business is highly dependent on the communications and information systems of the Adviser, its affiliates and third-party service providers. The Adviser is an affiliate of TPG Inc. ("TPG"), a leading global alternative asset management firm. We, in conjunction with the Adviser and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations, at least annually or whenever there are material changes to our systems or operations. As part of the risk management process, TPG engages outside providers to conduct periodic internal and external penetration testing. TPG has informed us that it uses the National Institute of Standards and Technology (or "NIST") Cybersecurity Framework and the Center for Internet Security (or "CIS") Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. This does not imply that TPG, its affiliates or we meet any particular technical standards, specifications, or requirements. TPG stores data, including the Company's data, in cloud environments with security that we believe is appropriate for the data involved and has adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG Twin Brook Capital Income Fund


text: Our Board of Directors recognizes the importance of maintaining the privacy and security of customer information, as well as the availability of our systems, and consequently dedicates meaningful time and attention to oversight of cybersecurity risk. In light of these risks, our Board of Directors is actively engaged in the oversight of the Company's information technology, which includes periodic briefings on cybersecurity threats and participation in cybersecurity preparedness exercises. Furthermore, under its charter, the Board's risk committee has primary responsibility for cybersecurity oversight. In this capacity, the risk committee oversees the Company's processes for identifying, assessing and managing technology and cybersecurity risk. In connection with the MOVEit Cybersecurity Incident, the risk committee was immediately notified by management and regularly briefed on the matter, and worked with management, including Genworth's CISO and Chief Risk Officer ("CRO"), to assess and manage the risk and implement the Company's response to the incident.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: Governance; Board Oversight Our Audit Committee is responsible for reviewing our information security programs, including cybersecurity. IT provides regular updates to the Audit Committee on our IT security strategy, secure score assessments, penetration testing results, and status of risk mitigation activities, where applicable. IT also notifies the Audit Committee and Executive Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities, as appropriate.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX


text: The Company has adopted an Enterprise Risk and Resilience Framework (the "ERRF") to identify, assess, monitor, and manage the Company's risks, including cybersecurity risks. Our Chief Risk Officer (the "CRO") is responsible for implementing and executing the ERRF. The Company's information security and cybersecurity team is staffed with skilled professionals who manage the safeguarding of our information and is led by our Chief Information Security Officer (the "CISO"). This team is responsible for aligning our practices with the requirements of local regulations and the voluntary standards to which we strive to adhere, such as ISO/IEC 27001 and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The CISO reports directly to our Chief Information Officer (the "CIO") and CRO. The CIO is responsible for designing and executing the Company's technology strategy, which includes overseeing the Company's cybersecurity strategy.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: For any of our critical hosted applications we require the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, or the report is qualified, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: Cottonwood Communities, Inc.


text: Members of our executive leadership team, including our CFO & COO and our Senior Vice President and General Counsel, as well as the other members as needed, supervise efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, alerts and reports produced by security tools deployed in the IT environment.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: Related to Cybersecurity Risks Management is responsible for the day-to-day management of cybersecurity risks we face, while our Board of Directors has responsibility for the oversight of risk management. The Audit Committee of our Board of Directors oversees the management of our risks from cybersecurity threats. In addition, the Board of Directors discusses with management our major risk exposures, their potential impact on us, and the steps we take to manage them.

companyName: CareMax, Inc.


text: We have endeavored to implement a cybersecurity program that is structured on the National Institute of Standards and Technology ("NIST") framework, ensuring a comprehensive approach to managing and mitigating material risk from cybersecurity threats. We seek to assess, identify, and manage the risk from cybersecurity threats through a strategy that includes risk assessment, policies, vulnerability management, event management and continuous monitoring of threat detection. Through these measures we aim to safeguard our company's networks and digital assets and maintain the integrity of our operations.

companyName: Vital Energy, Inc.

ticker: VTLE


text: Our cybersecurity approach is designed to minimize risks from cybersecurity threats identified by internal stakeholders, threat intelligence providers, vulnerability management programs, and security management programs. Our internal team manages and maintains remediation strategies for identified risks, and reports on them periodically to senior leadership.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. Lifted does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that Lifted will not be seriously damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: LFTD PARTNERS INC.

ticker: LIFD


text: At the management level, our Corporate Crisis Management Team (CCMT) is comprised of senior representatives from all key business functions, including finance, operations, and legal, and has broad oversight of our risk management processes, including management of cybersecurity risks. The CCMT has global responsibility for corporate crisis management, policy guidance, and training for employees involved in crisis management at all levels. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A—Risk Factors, which should be read in conjunction with this Item 1C—Cybersecurity.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Outside Consultants: We engage various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties, to, among other things, externally audit our systems against top information security standards, including controls for Payment Card Industry Data Security Standard (PCI DSS) and conduct regular testing of our networks and systems to evaluate and strengthen our cybersecurity posture.

companyName: POTBELLY CORP

ticker: PBPB


text: Our cybersecurity defenses include multiple layers of processes and technologies that can help prevent, detect and respond to cybersecurity threats. We administer multiple cybersecurity-related training and awareness events annually. These include baseline cybersecurity training for all new employees and an annual, mandatory, interactive cybersecurity training for all who are assigned our user accounts, and frequent cybersecurity topic awareness broadcast emails and targeted training to specific user groups. Additionally, we use a variety of detective and preventive technologies, including: • email threat detection; • endpoint detection and response; • a 24 hours a day, 7 days a week security operations center that monitors system log telemetry and threat intelligence via a security incident and event management platform; • vulnerability scanning on both internal and externally-facing infrastructure; • next-generation firewalls with geographic access restriction for sensitive externally-facing systems; • multi factor authentication for remote access and certain internal systems; • domain name service threat detection; and, • internal incident response procedures based on NIST Special Publication 800-61.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: As a wholly owned subsidiary of APA, the Company relies on APA for its information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes undertaken by APA for assessing, identifying, and managing material risks from cybersecurity threats. The Company's executive officers are executive officers of APA, and one of such officers (John J. Christmann IV) is also a member of APA's board of directors (the APA Board of Directors).

companyName: APACHE CORP


text: Our cybersecurity risk management program is informed by the National Institute of Standards and Technology ('NIST') Cybersecurity Framework ('CSF') and incorporates its principles in assessing, identifying, and managing cybersecurity risks relevant to our business. While we leverage the NIST CSF as a foundational guide, our program is tailored to our specific operational and risk environment.

companyName: Shake Shack Inc.

ticker: SHAK


text: Education and Awareness Each of our employees is required to comply with our cybersecurity policies. We regularly remind employees of the importance of handling and protecting our data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Our Global Cybersecurity Operations function is a global team led by our Executive Director of Cybersecurity and Infrastructure, who reports to our CIO. In turn, our CIO reports to our Chief Executive Officer. The Information Security Council provides additional oversight for assessing and managing cybersecurity risk.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: The Audit Committee and the Cybersecurity Committee receive periodic reports, summaries, and presentations from management regarding our significant cybersecurity risks and threats, incidents, and response initiatives. Through our cybersecurity governance practices, we strive to achieve a strong cybersecurity posture and to refine our security measures to respond to emerging threats.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the VPIT. Our VPIT oversees our governance programs, tests our compliance with standards, remediates known risks and leads our employee training program. Reporting to our VPIT are a number of experienced information security officers responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals.

companyName: Orion Group Holdings Inc

ticker: ORN


text: We maintain and process a range of sensitive information, including Personally Identifiable Information (PII), Protected Health Information (PHI), financial data, intellectual property, and other regulated or proprietary information. Our cybersecurity management program is designed to protect confidentiality, integrity, and availability of information systems and sensitive data. The program is aligned with cybersecurity frameworks and governance standards such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and NIST SP 800-53, and the International Organization of Standardization (ISO) 27001 information security management system framework as a structured approach to identifying, assessing, and mitigating cyber risk. Our cybersecurity management program includes the following elements: Policies and Procedures: Processes are documented to formalize the implementation of the cybersecurity program.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: Oversight of Third-Party Service Providers The company also uses third-party service providers to support its operations and many of its technology initiatives, and evaluates its third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following such evaluation, the company determines and prioritizes service provider risk based on the potential threat impact and likelihood, and such risk determination drives the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and disaster recovery plan, disaster recovery testing, data encryption for certain data, asset management, system monitoring and multi-factor authentication for certain systems, employee training and cybersecurity insurance.

companyName: CalciMedica, Inc.

ticker: CALC


text: Our Manager's information security program is led by its Chief Information Security Officer ("CISO") who reports directly to the GCSO and has extensive experience in information security and risk management. Our Manager's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: We leverage the support of third-party information technology and security providers for the maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. These third-party providers directly report to, and meet periodically with, our Senior Vice President of Finance and Administration to discuss and review our cybersecurity risk management processes.

companyName: ImageneBio, Inc.

ticker: IMA


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage third-party cybersecurity firms to assist with network and endpoint monitoring, cloud system monitoring, and assessment of our incident response procedures, risk identification and assessment of material cybersecurity threats.

companyName: McEwen Inc.

ticker: MUX


text: We are committed to protecting our Information Technology (IT) assets and the data stored within these assets. This commitment includes the protection of IT assets relevant to our operations, stakeholder data (including employee, customer and supplier data), intellectual property and our products.

companyName: CUMMINS INC

ticker: CMI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain roles within our management, including the roles of CISO, CCO and General Counsel ("GC"). The CISO role reports to our GC and is the role with the primary responsibility for our cybersecurity risk assessment and management processes. Our VP, Product Security, who reports to our GC and also supports the management team's cybersecurity risk assessment and management processes, has twenty years of cyber experience, as well as in product security, program development and software development. Additionally, as part of our governance of cybersecurity, if a role on the management team relevant to our cybersecurity risk assessment and management processes is or becomes vacant, another senior member of the applicable functional team is designated to support our cybersecurity risk assessment and management processes on an interim basis, as needed.

companyName: Sprinklr, Inc.

ticker: CXM


text: Our Vice President of Information Technologies ("IT") and our Chief Financial Officer ("CFO") play a pivotal role in informing the Audit Committee about cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per quarter. These briefings encompass a broad range of topics, including: • the current cybersecurity landscape and emerging threats • the status of ongoing cybersecurity initiatives and strategies • incident reports and learnings from any cybersecurity events and • compliance with regulatory requirements and industry standards. In addition to its scheduled meetings, the Audit Committee, Vice President of IT and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the board of directors' oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and input for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. Additionally, on an annual basis, the board of directors discusses the Company's approach to cybersecurity risk management with the Vice President of IT and CFO.

companyName: CHUY'S HOLDINGS, INC.


text: As a regulated financial institution, we have designed our cybersecurity program based on the requirements of the GLBA and the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool. Our processes for identifying, assessing, and managing material risks from cybersecurity threats includes reliance on the FFIEC Cybersecurity Assessment Tool as well as recurring audits and assessments of our cybersecurity program and controls. In addition to the above, we periodically (and at least annually) conduct an overall inherent cybersecurity risk assessment based on threats, the likelihood of the threats, and the potential impact of these threats to the Company. We conduct this assessment by reviewing industry-recognized breach reports, identifying the top threats, calculating the likelihood and impact of these threats, and thereby determining our overall inherent risk. We then use the Cybersecurity Assessment Tool to establish a risk profile. Based on the risk profile, the FFIEC Cybersecurity Assessment Tool recommends a program maturity level, which we use to determine whether we have the requisite minimum security controls in place that are effective. This control evaluation then helps us to determine our cybersecurity residual risk and whether we need to implement any additional controls. In addition to using FFIEC Cybersecurity Assessment Tool, we evaluate the robustness and effectiveness of our cybersecurity program both internally and externally with periodic internal risk assessments, and internal and third-party audits. W e also use third party assessments to simulate threat actors to test and evaluate our cybersecurity controls and the effectiveness of our overall program. As part of our cybersecurity program, we have developed an incident response plan based on industry-standard cybersecurity frameworks, with procedures for responding to and remediating a cyber-incident, which also includes a process to activate our business continuity plan, if necessary. We also review and test our incident response plan through simulations and assessments. Furthermore, we employ recurring security awareness training for employees and produce recurring security awareness material for our customers.

companyName: HOPE BANCORP INC

ticker: HOPE


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems, and those that we offer to our tenants are necessary for the operation of our business. We use these systems, among others, to manage our tenant and vendor relationships, for internal communications, for accounting to operate record- keeping function, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, IT and security personnel and senior management;

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: Recurring audit and oversight of all critical third parties within the Company's digital ecosystem to identify risks and adverse trends and monitor their compliance with our cybersecurity requirements. Use of external subject matter experts to provide threat intelligence and updates on trends and emerging schemes.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Cybersecurity is at the foundation of the Company's values and the way it approaches its users, professionals, and customers. We face a number of external threats common to companies in the industries we serve, such as ransomware, denial-of-service, phishing, and social engineering. Our customers, suppliers, and professionals face similar threats, and a cybersecurity incident impacting the Company or any of these entities could materially adversely affect the performance of our businesses, our results of operations, and our cash flows.

companyName: DHI GROUP, INC.

ticker: DHX


text: The Company’s cybersecurity program is part of its overall risk management framework. The cybersecurity risk program includes a risk-based approach to identifying, assessing, and addressing cybersecurity threats that could impact our data, our networks, or the information provided to us by consumers and counterparties.

companyName: QUINSTREET, INC

ticker: QNST


text: The Board of Directors is responsible for oversight of the Company's risk management process. The Board administers this oversight function directly through the Board of Directors as a whole, as well as through the Audit Committee of the board. Areas of focus include economic risk, operational risk, financial risk (accounting, investment or liquidity, and tax), competitive risk, legal and regulatory risk, cybersecurity risk and compliance and reputational risks. The Board of Directors is supported by regular reporting by leaders from the Company's finance, cyber security, privacy, legal and compliance teams, who have an average of approximately 15 years of experience, which is designed to give the Board of Directors visibility over the Company's operations and activities to adequately identify key risks and understand management's risk mitigation strategies.

companyName: CUTERA INC


text: Cybersecurity Risks We rely on internal and third-party information technology systems and networks to process, transmit and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers and employees. We use various internal and third-party information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information and personal information of our customers, suppliers and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: a management team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: The Enterprise Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of FHLBank physical and intangible information technology assets in accordance with the GLB Act and the interagency guidelines issued thereunder, and applicable laws.

companyName: Federal Home Loan Bank of Topeka


text: Our board of directors holds oversight responsibility over our strategy and risk management, including risks related to cybersecurity. The board's oversight of cybersecurity risk management is supported by the Audit Committee, which has responsibility for discussing with management significant cybersecurity risks and the measures we have implemented to monitor and control such cyber risk exposures. The Audit Committee receives quarterly updates from our Vice President, Information Technology & Compliance ("IT Officer") relating to IT and cybersecurity matters, including cybersecurity risks and threats. The Audit Committee provides periodic updates to our board of directors on cybersecurity matters discussed at such meetings. Our IT Officer also provides these and similar reports to the full board of directors on a biannual basis.

companyName: TELA Bio, Inc.

ticker: TELA


text: Our Senior Vice President ("SVP") of Production Innovations & Technology, Vice President ("VP") of Information Technology, Director of Information Security & Infrastructure, and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of management's Security Steering Committee (the "Security Committee"), which is a governing body that drives alignment on security decisions across the Company. The Security Committee meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.

companyName: PGT Innovations, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of NetScout's management, including our CISO, who reports to the CIO and has over 25 years of experience, the CCO, who reports to the General Counsel, and the Senior Director of Engineering, who reports to the SVP of Research and Development, for security.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Management plays a critical role in assessing and managing material risks from cybersecurity threats. Our Vice President of Information Security & Risk Management and Chief Information Security Officer (CISO), in coordination with our Chief Information Officer, leads a team of information security professionals and manages our cybersecurity risk management program and activities. This involves monitoring our information systems for cybersecurity threats, reviewing cybersecurity incidents, analyzing emerging threats, and the development and implementation of risk mitigation strategies. Our CISO has over 25 years of experience working in the information technology and services industry who is a subject matter expert in a variety of areas including information security, and IT risk.

companyName: Avantor, Inc.

ticker: AVTR


text: The Audit Committee of the Board oversees our annual enterprise risk assessment, where we assess key material risks within our Company, including technology risks and cybersecurity threats. The Audit Committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include the Company's risk assessment and risk management policies.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: The Board Risk Committee provides a verbal risk report and meeting minutes to the Board at least quarterly. This includes a discussion of key risks and effectiveness of internal controls. In addition, cybersecurity incidents are escalated to the Board in a timely manner using the processes defined within the Bank's Incident Response Plan.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Our Director of Information Technology, assisted by our managed information technology service provider and other third party service providers, leads the Company's cybersecurity risk management processes. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing threat intelligence reports and feeds, conducting scans of certain environments, and other tests.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: Cybersecurity is an important part of Vista's enterprise risk management processes and an area of focus for the Board of Directors and management for both Vista and us. These cybersecurity risk management and strategy processes are overseen by the Data Privacy and Information Risk Committee (the "DPIRC"). The DPIRC is co-chaired by the Vista CCO and Vista's Chief Information Officer, with members including the Vista CISO and senior representatives from Vista's Information Security, Legal, and Human Resources departments. The Vista CISO has extensive experience in cybersecurity and technology. The Vista CISO was appointed in 2024 and has over 20 years of cybersecurity, information security, and technology services and innovation experience.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: We recognize sophisticated global cybersecurity threats and targeted computer crimes pose a continuously evolving risk to the confidentiality, availability, and integrity of our data, operations and infrastructure. We have implemented comprehensive practices to minimize these risks. Our cybersecurity program is certified to the International Organization for Standardization ISO 27001, a standard for information security management, which covers key areas of management, technical and physical controls, legal, compliance and business continuity management.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: Conducting regular cybersecurity awareness training, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees.

companyName: WEYCO GROUP INC

ticker: WEYS


text: Company prioritizes the security of its information systems and data integrity. We have developed a cybersecurity strategy to manage and mitigate potential cybersecurity risks. Our strategy is designed to safeguard our systems and data.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling or processing our Information Systems and Data. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: Further, we work closely with third-party software as a service providers and other service partners to manage and mitigate security risks by implementing robust policies and procedures. Our process includes conducting thorough risk assessments during onboarding and requiring providers to maintain and implement strong security measures within their respective organizations. We mandate contractual obligations for timely notification of any material data breaches, enabling us to respond quickly to protect our data and operations.

companyName: Karat Packaging Inc.

ticker: KRT


text: The CIO, in coordination with the Company's executive team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO oversees the monitoring, prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the Board of Directors when appropriate. The CIO is supported by, among others, a Cybersecurity Architect who is a Certified Information Systems Security Professional (CISSP) and an Application Director who is Certified in Risk and Information Systems Control.

companyName: Callon Petroleum Co


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from government, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Cybersecurity is an important part of our overall risk management processes and an area of focus for our Board and management. Our Audit Committee of the Board oversees our cybersecurity risk and receives reports from our SVP, Information Technology on a quarterly basis. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), status on key information security initiatives, industry trends, and other areas of importance.

companyName: PROKIDNEY CORP.

ticker: PROK


text: The CTO, in coordination with the SLT, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams are prepared to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the Company's information technology partner, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Company's SLT and Audit Committee, when appropriate.

companyName: Longeveron Inc.

ticker: LGVN


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate personnel, including our Head of Information Security, who reports to our Vice President, Information Technology, to manage the risk assessment and mitigation process.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: In the ordinary course of our business, we are subject to cybersecurity threats and risk which it manages as an important component of its overall enterprise risk management strategy. We store and process data for our customers, employees, partners and suppliers. We have not yet implemented a formal cybersecurity risk management program designed to identify, assess and mitigate risks from cybersecurity threats to this data, our systems and business operations. We intend to implement a cybersecurity risk management program before the end of 2025.

companyName: T-REX Acquisition Corp.

ticker: TRXA


text: Board members receive presentations on cybersecurity topics. For example, February 2024, the full Board held a cybersecurity tabletop exercise to help prepare to respond to a cyberattack or other security incident.

companyName: EVERTEC, Inc.

ticker: EVTC


text: We recognize the importance of maintaining the trust and confidence of the patients we serve, our business partners, employees and our shareholders and are committed to protecting the confidentiality, integrity and reliance of our business operations and systems. Effective data protection practices, including responsible stewardship of our intellectual property and the secure processing, storage, maintenance and transmission of critical information by us and other third parties with whom we do business is vital to our operations.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: We periodically engage external advisors to perform an analysis of our information security procedures, which include a review of program documentation and an overall maturity assessment of Nasdaq's information security programs. These advisors provide recommendations to further enhance our procedures. The findings are then presented to the Audit & Risk Committee of the Board of Directors, or the Audit & Risk Committee. In 2023, our management team and the Board of Directors conducted tabletop exercises and simulations in cybersecurity matters with assistance from internal and outside experts.

companyName: NASDAQ, INC.

ticker: NDAQ


text: We have documented and well-rehearsed incident response procedures to effectively respond to, contain, and remediate security incidents. These procedures ensure timely detection, investigation, and recovery, minimizing potential damage and ensuring user privacy.

companyName: Mega Matrix Corp.


text: The audit committee receives periodic reports from the CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives regular reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Landos Biopharma, Inc.


text: The IRP is executed by an Incident Response Team (IRT), led by our Chief Information Security Officer (CISO). The exact composition of the IRT varies depending on the severity and potential impact of an incident, and will typically include stakeholders across corporate and business functions. The team collaborates with internal experts and may engage external resources to assess and contain a threat if deemed necessary. Such external resources may potentially include forensic investigation and response firms, law firms, external auditors, forensic accountants, and consultants who are on retainer contracts for expedited availability.

companyName: Eaton Corp plc

ticker: ETN


text: Cybersecurity Risk Management and Strategy We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (e.g., legal counsel), threat intelligence service providers, cybersecurity consultants, software providers, managed service providers, penetration testing, and dark web monitoring services.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: A security team led by a Chief Technology Officer ("CTO") principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;

companyName: BurgerFi International, Inc.


text: Our global cybersecurity team ensures the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program. Programs to address key cybersecurity risks have been put into place including layered coverage with focus areas and practices designed to address network and endpoint security, application security, and security operations. We also employ automated detection and event correlation techniques and alerting as well as integrate cyber threat intelligence into our processes. Our security operations center serves as the front line of these alerts and investigates and remediates threats as necessary. Although it is difficult to determine the potential impacts from a cybersecurity incident, we may experience negative impacts such as reputational harm, inability to retain existing customers or attract new customers, exposure to legal claims and government action, among others. Previous attacks on our operating systems have not had a material financial impact on our operations, but we cannot guarantee future attacks will have little to no impact on our business. Furthermore, given the interconnected nature of the supply chain and our significant presence in the industry, we believe we may be an attractive target for such attacks. The impact of a cybersecurity incident may have a material adverse impact on our financial condition, results of operations, availability of our systems, and growth prospects, which makes cybersecurity risk management of critical importance to our organization.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: Our comprehensive risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats involves a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cybersecurity Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: We design and assess our program guided by a number of well-known industry standards, such as the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001, and Center for Internet Security (CIS) Controls V8. This does not imply that we meet all of these standards, specifications, and requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Vroom, Inc.

ticker: VRM


text: The ITBC meets quarterly, while the ITSC meets monthly. Meeting minutes from the ITSC are regularly submitted to the Board for review. These two committees jointly oversee the organization's information technology and cyber risk posture, focusing on the assessment of information and cybersecurity risks. Evaluated risks are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. In instances where a risk is identified as inadequately controlled, remediation measures are implemented to reduce the risk to an acceptable level. This commitment to ongoing assessment and responsiveness enhances our ability to adapt to emerging threats and maintain a proactive stance in managing risks effectively.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: Our cybersecurity risk management program encompasses periodic risk assessments, designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment. More specifically, an independent third-party performs a regular penetration test of Marvell's IT infrastructure. In addition to our penetration testing, an independent third-party security firm is engaged to perform additional security controls testing and provide an independent report to our executive team. This external assessment provides us and our Audit Committee with a comprehensive evaluation of our security posture.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: In general, cybersecurity incidents can result from deliberate attacks or unintentional events such as a cyber-attack against USCF, a natural catastrophe, an industrial accident, failure of the Trust's disaster recovery systems, or consequential employee error. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of a fund's clearing broker or third party service provider (including, but not limited to, index providers, the administrator and transfer agent, the custodian), have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of fund shareholders to transact business, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: Risks from Cybersecurity Incidents To date, we have not encountered a cybersecurity incident that has materially impaired our operations or financial condition.

companyName: ExchangeRight Income Fund


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management and/or the Board of Directors depending on the circumstances. The Board receives periodic reports and updates from our senior management concerning cybersecurity threats and risks, and the processes that the Company has implemented to address them. are not aware of any instances of material cybersecurity incidents that impacted the Company.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.

companyName: Blue Owl Capital Corp II


text: The Company's information technology partner has worked in information technology and information security for over 30 years with over 300 employees with six locations in the United States. A virtual Chief Information Officer ("vCIO") from the partner works directly with the VPBO for align business and technical strategies, decisions, and implementations. The VPBO has over 35 years in the pharmaceutical and biotech industry managing programs and projects across a variety of implementation methodologies and risk factors and holds undergraduate degrees and certifications in his respective field. The Company's Chief Executive Officer, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at similar companies, including risks arising from cybersecurity threats.

companyName: Longeveron Inc.

ticker: LGVN


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk assessment procedures. Our cybersecurity-specific risk assessment and management procedures help identify cybersecurity threat risks. Our cybersecurity risk assessment program includes the following: • Annual cybersecurity vulnerability and maturity assessments based on the Center for Internet Security (CIS) Critical Security Controls framework. • Annual internal/external penetration testing conducted by a third-party offensive security vendor.

companyName: HF Foods Group Inc.

ticker: HFFG


text: We have implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: Our General Counsel leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The consultant that operates our SOC updates the General Counsel regarding the detection of cybersecurity risk exposure and provides advice on the prevention, mitigation and remediation of such risks. The General Counsel keeps the senior executive leadership team apprised, including our Chief Executive Officer and Chief Financial Officer, on assessments of risk exposure to ensure that the highest levels of management are kept abreast of potential risks we are facing. The General Counsel has significant prior business experience in compliance and risk management and coordinates directly with the third party who operates our SOC on issues involving particular cybersecurity expertise.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: For additional information regarding how cybersecurity threats could potentially materially affect our business strategy, results of operations or financial condition, see Part 1, Item 1A "Risk Factors – Risks Related to Information Technology". Interruption, interference with, or failure of information technology systems could hurt our ability to effectively provide our product and services, which could harm our reputation, financial condition, operating results and cash flows.

companyName: QXO BUILDING PRODUCTS, INC.


text: Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's CIO and the Company's CISO, who reports to the Company's CIO. The CIO and his direct reports, including the CISO, discuss action items related to risks at a standing monthly meeting. The CISO and many members of his team have multiple decades of cybersecurity related experience. Risk reporting is provided at monthly meetings of the firm's cross-business Cybersecurity Committee and periodic presentations to the firm's Risk Management Committee, at which many members of the Company's senior management are present.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Our board of directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: EverCommerce Inc.

ticker: EVCM


text: As a healthcare-focused company, we understand the importance of managing cybersecurity risks that we face and have established a cybersecurity risk management program as part of our enterprise risk management program.

companyName: Phreesia, Inc.

ticker: PHR


text: The Cybersecurity Program includes a cyber incident response plan that provides controls and procedures designed to enable swift response, remediation, and timely and accurate reporting of any material cybersecurity incident.

companyName: Oportun Financial Corp

ticker: OPRT


text: Our CISO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our IT environment.

companyName: SolarWinds Corp


text: Our Senior Director, Information Technology, along with the members of our Incident Response Team, which includes our Senior Vice President, Finance and our General Counsel, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Incident Response Team is supported by an experienced managed service provider and an incident response provider with extensive global cybersecurity expertise, who each monitor, assess and report threats to us. Additionally, our Senior Director, Information Technology has over twenty years of experience operating in the information technology, security and cybersecurity space. In particular, he has experience with cybersecurity assessment and prevention, incident responses, breach notifications and remediation.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: incident" means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through our information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Trans American Aquaculture, Inc

ticker: GRPS


text: Management Experience Our CDO and CISO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CDO joined PTC as Chief Digital Officer in January 2022 and is responsible for PTC's global information technology (IT) team, overseeing PTC's digital infrastructure and working with business leaders to guide PTC's digital process optimization strategy. He has more than two decades of IT and operations leadership. Before joining PTC, he served as Global Vice President and Chief Information Officer for Avaya, where he led a globally-dispersed team of 1,200 IT professionals to support the entire global Avaya enterprise. Prior to Avaya, he held technology leadership roles at Arise Virtual Solutions Inc., Oracle, and Colorado College.

companyName: PTC INC.

ticker: PTC


text: Our associates receive annual cybersecurity training, and we conduct mock phishing campaigns to better enable our associates to recognize phishing emails and other social engineering tactics. We have established reporting processes for our associates if they encounter suspicious activity that may give rise to a cybersecurity incident.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: Third-Party Engagement We employ multiple service providers from time to time to perform periodic reviews and evaluations of our cybersecurity framework, the results of which are provided to and reviewed with management, with appropriate reporting to the Finance and Risk Management Committee (F&RM Committee) of the Board. These reviews encompass a broad range of areas, including information technology system resilience, cybersecurity risk assessments, information security program assessments, external threat environment reviews, internal cybersecurity policy compliance, and near-term incident response to identify or disconfirm potential involvement of a threat actor.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: The Audit Committee of the Board of Directors oversees risks from cybersecurity threats as part of its broader risk oversight responsibilities. The board recognizes the importance of cybersecurity in safeguarding the company's assets and operations. GSE's Risk Management Plan includes an assessment of, and mitigation plans related to, the operational risk of business disruption due to factors including cybersecurity breaches and related events.

companyName: GSE SYSTEMS INC


text: We have an information security program designed to identify, protect, detect and respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we utilize various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a reasonably timely manner. These include, but are not limited to, internal reporting and tools for monitoring and detecting cybersecurity threats.

companyName: Reborn Coffee, Inc.

ticker: REBN


text: The Corporation engages with a multitude of third-party assessors, consultants, auditors and other third parties to support and maintain a robust information security practice. These partners are credentialed cybersecurity firms that assist to monitor and maintain the performance and effectiveness of our processes, procedures, and internal controls, as well as the various products and services that are deployed in our environment. The Corporation has a Third Party Risk Management program in place to monitor for any potential material risks from cybersecurity threats regarding any third-party service providers. Through our Third Party Risk Management Program we risk rate our vendors and conduct a thorough review prior to the execution of any agreement and then on an ongoing risk-based basis. The review consists of due diligence documents and information such as the Service Organizational Control ("SOC") Reports, Information and Data Security, Business Continuity Testing and Penetration Testing.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Related to Cybersecurity Risks Cybersecurity risk oversight is a top priority for management and our board of directors. Management is responsible for the day-to-day management of cybersecurity risks we face, while our board of directors, as a whole and through committees, is responsible for the oversight of risk management.

companyName: LendingTree, Inc.

ticker: TREE


text: Cybersecurity Risks Cybersecurity threats are constantly evolving and have and will continue to become more frequent and sophisticated. Although the Company has implemented measures that it believes are reasonable to safeguard its operational and information technology systems and has sought to establish a culture of continuous monitoring and improvement, the evolving and increasingly complex nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. By way of example, as previously disclosed, on October 3, 2024, the Company identified unauthorized activity within its information technology computer networks and systems, which was determined to be the result of a cybersecurity incident. To date, the Company has determined that it has not experienced a cybersecurity incident that has resulted in a material impact to the Company's financial condition, results of operations, cash flows, or business strategy. For additional information concerning the October 3, 2024, cybersecurity incident, and cybersecurity-related risks, see Item 1A—Risk Factors—Risks Related to Our Industry and Business Operations—We are, and may in the future be, subject to physical and cyber attacks, and —We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured; and Item 7—Management's Discussion and Analysis of Financial Condition and Results of Operations—Other Matters—Cybersecurity Incident.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Our Audit Committee oversees our cybersecurity program and its alignment with overall risk management. This includes monitoring cybersecurity, data privacy and IT risks.

companyName: MASIMO CORP

ticker: MASI


text: Yum China Compliance Oversight Committee (the "Compliance Committee"), primarily comprised of leaders and representatives from our information technology, supply chain, legal, finance, HR and public affairs functions, as well as internal audit group, is responsible for assisting the Board and Audit Committee in overseeing the Company's cybersecurity risks. The Compliance Committee meets regularly to discuss legal and regulatory developments on cybersecurity, assess the Company's emerging cybersecurity risks and mitigation plans, and determine strategy to promote cybersecurity compliance. Through ongoing communications, the Compliance Committee is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our CTO, as a member of the Compliance Committee, served various positions in the Company's information technology department for more than 20 years and began leading the department in 2017.

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management. Our Board Enterprise Risk Management Committee ("ERMC") is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the ERMC receives an overview from management and the management steering committee of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer and Chief Information Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions. The Board engages external cyber security experts, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cyber defense capabilities and transformation designed to mitigate associated threats, reduce risk, enhance our cybersecurity posture, and meet the Company's evolving needs.

companyName: Mechanics Bancorp

ticker: MCHB


text: For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business and Structure."

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We periodically assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Following these risk assessments, we evaluate how to reasonably address any identified gaps in existing safeguards and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Chief Legal Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process in a manner that is consistent and integrated with our overall risk management processes.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: We recognize that cybersecurity risks pose a significant threat to our business, customers, and stakeholders, and we have implemented a comprehensive security and privacy program to address these risks. We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our customers' information remains secure in the face of evolving cybersecurity challenges. With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, OWASP Top 10, and Security by Design, we prioritize the identification and assessment of risks to create a protective shield around our customers' data.

companyName: Certara, Inc.

ticker: CERT


text: • Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors, or Audit Committee, helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats. • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO. The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis. Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members. The Internal Audit team oversees internal controls implemented by us under our information security program. • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer). Our CISO has been at the company for over 7 years, and has served in various cybersecurity roles for over 20 years across multiple companies and industry verticals including banking, consulting, ecommerce, and pharmaceuticals. He is a Certified Information Systems Security Professional and has experience responding to major information security incidents at previous companies prior to joining the company. Our CIO has been at the company and had oversight of our cybersecurity for over 7 years. In addition, our CIO has served in various information technology roles in the U.S. and overseas for over 25 years across multiple companies and industry verticals including consulting, healthcare, and pharmaceuticals. • The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management. Management, including those serving on our Information Security Governance Committee, is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity considerations into our overall risk management strategy, providing appropriate resources for cybersecurity risk management, and communicating key priorities to relevant personnel. Our cybersecurity incident response plan includes processes designed to escalate certain cybersecurity incidents that caused a significant impact to us to members of the Information Security Governance Committee, and certain members of executive management depending on the circumstances. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents, including those that have potentially had a material impact to us.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: We maintain a robust cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and is designed to addresses the corporate information technology environment in which we operate. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: EnLink Midstream, LLC


text: Our cybersecurity practices, policies, and standards are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") (NIST SP 800-53), the Center for Internet Security ("CIS"), along with adopting best practices from Control Objectives for Information and Related Technologies ("COBIT") and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: Our Vice President of Information Technology and Security monitors our processes for preventing, detecting, mitigating, and remediating cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of our incident response plans, which include escalation to our Interim Chief Executive Officer and Chief Financial Officer, as appropriate.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: The cybersecurity program of the Company interfaces with other functional areas within the Company, including but not limited to the Company's brands and information technology, accounting, finance, legal and human resources, as well as external third-party partners, where appropriate, to assess, identify and manage potential cybersecurity threats. The Company aims to regularly assess and update its processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: Solo Brands, Inc.

ticker: SBDS


text: Our cybersecurity risk management program is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. This integrated approach helps ensure that cyber risks are not viewed in isolation, but are assessed, prioritized and managed in alignment with the Company's operational, financial and strategic risks, assisting the Company in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK