text: Incident Response Procedures We have in place a cyber incident response plan outlining procedures to follow in the event of a cybersecurity incident. Under the plan, we established a cross-functional critical response team (CRT) with expertise in various subject matter areas responsible for initiating and leading our incident response procedures. The CRT is under the direction of our Chief Information Officer and is comprised of our Director of Information Technology, Chief Accounting Officer, Assistant General Counsel and Chief Compliance Officer, Senior Manager of Risk and Insurance, and certain other members of management. The plan provides that our CRT will conduct an impact assessment in the event of a cybersecurity incident meeting pre-established criteria, or which may otherwise impact the operations or finances of the Company. If any such cybersecurity incident is determined by the CRT to have the potential to materially impact the Company, such event would be elevated for further review and assessment by a senior leadership team consisting of our Chief Executive Officer, Chief Financial Officer, General Counsel and, under certain circumstances, the Board.

companyName: TopBuild Corp

ticker: BLD


text: The implementation of a comprehensive cybersecurity policy addressing acceptable use, data governance, social media, encryption, remote access, authentication, vulnerability management, and incident response; Cybersecurity awareness training for all employees; A multidisciplinary cybersecurity incident response team with defined protocols and escalation paths; Tabletop exercises to test and refine response readiness; Continuous integration of intelligence from industry and government sources into internal monitoring and defense processes; Ongoing internal reviews of enterprise applications and infrastructure, including access control evaluations and configuration audits.

companyName: Alternus Clean Energy, Inc.

ticker: ALCE

secItem: Item 1C


text: We, together with our third-party vendors, employ information technology including networks, systems, and applications to support our business processes and decision-making across the Company. Our information technology is connected to support the flow of information across our business processes. As such, our information technology infrastructure is susceptible to cybersecurity threats.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: Cybersecurity threat risks have not materially affected the Company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect the Company, see "Item 1A. Risk Factors—Operating Risks—We rely on technology and information systems, many of which are controlled by third-party vendors, to maintain the security of our information and technology networks and to conduct our businesses, and any failures or interruptions of these systems could adversely affect our businesses and results of operations."

companyName: Apollo Global Management, Inc.

ticker: APO


text: The Company maintains a cybersecurity program focused on preventing, identifying and mitigating cyber threats applicable to its business as an owner and operator of commercial office properties. Our Board oversees our cybersecurity program through its Audit Committee, which meets regularly with the Company's executive officers and senior personnel from the Company's IT department, which manages the program on a day-to-day basis. The Company's cybersecurity program is integrated into its overall risk management processes.

companyName: EQC Liquidating Trust


text: Additional information on cybersecurity risks we face is discussed in Part I, Item A – Risk Factors, which should be read in conjunction with the foregoing information.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Management, along with Vornado's Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Management and Vornado's Chief Information Officer have primary responsibility for our overall cybersecurity risk management program and supervise both the internal cybersecurity personnel and external cybersecurity consultants. Vornado's Chief Information Officer has many years of experience leading cybersecurity oversight and overall has broad, extensive experience with information technology, including security, auditing, compliance, systems and programming.

companyName: ALEXANDERS INC

ticker: ALX


text: During fiscal 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not successfully eliminate all risks from cybersecurity threats and can provide no assurance that undetected cybersecurity incidents have not occurred.

companyName: Alzamend Neuro, Inc.

ticker: ALZN


text: We continuously evaluate the practical effectiveness of our cyber-defenses both internally and externally using a combination of technology-based assessments and recurring third-party audits. Our Critical Incident Response Team periodically conducts cyber-focused tabletop exercises using scenarios drawn from observations of risk indicators and from threat intelligence reports of real-world incidents affecting our industry. Outcomes and insights from tabletop exercises are used to enhance RadNet's Incident Response Plan which is architected following NIST guidelines and reviewed annually and updated periodically as needed.

companyName: RadNet, Inc.

ticker: RDNT


text: Incident Response Procedures Our cybersecurity incident response procedures are designed to escalate certain cyber security incidents to our executive officers and the Board as appropriate. Upon initial discovery of a potential incident, a member of the corporate security team leads the initial potential incident response efforts. Potential incidents are scored based on impact (including potential impact), and if certain criteria are met, the technical response team is broadened to include a representative from the Company's legal team and other relevant stakeholders (such as executive management) as appropriate. Our incident response team or its designee, provides relevant updates to the Chief Executive Officer or other Company senior management and the Board, as appropriate.

companyName: Life360, Inc.

ticker: LIF


text: No cybersecurity incidents have occurred that materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition during the year ended December 31, 2024. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Garrett Motion Inc.

ticker: GTX


text: Federated Hermes' Global Technology Organization (GTO), which is headed by Federated Hermes' CIO, has a dedicated Information Security Group (ISG) responsible for day-to-day oversight of the cybersecurity program. The ISG, which is headed by Federated Hermes' Chief Information Security Officer (CISO), coordinates cybersecurity activities with Federated Hermes' business functions (including FHL) and third-party service providers. Federated Hermes' Information Security and Data Governance Committee (ISDG) provides executive management oversight of the ISG and Federated Hermes' cybersecurity program. Federated Hermes' Chief Compliance Officer (CCO), CRO and General Counsel, as well as Federated Hermes' CIO, CISO, Chief Financial Officer, and other senior members of Federated Hermes' management, and the Global Head of Investment Technology at FHL are members of, and Federated Hermes' Chief Audit Executive attends meetings of, the ISDG.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: Our enterprise risk management framework considers cybersecurity risk alongside other applicable risks as part of our overall risk assessment process. Within our comprehensive enterprise risk management framework, our cybersecurity program is led by the Company's Vice President and Chief Information Officer ("CIO") and is overseen by the Company's Executive Vice President and Chief Financial Officer ("CFO"). The program includes the following processes, activities and resources to identify, assess, manage, and mitigate our cybersecurity threats: • An IT security team responsible for managing our cybersecurity risk, assessment processes, security controls, and responses for security breaches and cyberattacks • A cyber incident response plan that provides controls and procedures for responding to cybersecurity incidents and for timely and accurate reporting of any material cybersecurity incident; • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Annual cybersecurity training for all employees to provide a better understanding of the issues and risks related to cybersecurity. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Periodic phishing testing and other exercises performed by our IT department to test our systems and reinforce the training provided to all colleagues to ensure our employees remain vigilant and compliant with expectations • Easy-to-use tools to report potential phishing emails; and • A third-party cybersecurity risk management process for service providers, suppliers, and vendors performed throughout the year.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: The Bank's Information Security Officer ("ISO"), who reports to our Chief Compliance & Risk Officer, is directly responsible for assessing and managing cybersecurity risks pursuant to the Company's Information Security Program, which is approved by our Board of Directors periodically. The current ISO has more than 5 years of cybersecurity experience and holds multiple industry certifications.

companyName: Finwise Bancorp

ticker: FINW


text: Material Risks from Cybersecurity Threats Like many companies, we face cybersecurity threats and have experienced cybersecurity incidents, including data breaches and temporary service interruptions. However, since the beginning of fiscal year 2024, the company has not identified risks from known cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us. Nevertheless, there can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our IT infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems. Such cybersecurity incidents can cause the loss of critical or sensitive information, including personal information, and could give rise to legal liability and regulatory action under data protection and privacy laws. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Information system service interruptions or breaches, including significant cybersecurity incidents, could give rise to legal liability and regulatory action under data protection and privacy laws and adversely affect our business and operations."

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: The SIMT, together with other internal and external advisors, has developed a Security Incident Management Policy ("Security Policy") and Cybersecurity Incident Management Process ("CIM Process") to help guide our response to any potential cybersecurity incidents or threats. These documents are reviewed on a periodic basis by the SIMT, and the Audit Committee is apprised of the SIMT's actions and potential improvements to the Security Policy and CIM process.

companyName: PubMatic, Inc.

ticker: PUBM


text: Given the constantly evolving cyber-threat landscape, as well as the previously disclosed ransomware attacks we experienced in 2019 and 2020, we continuously test and evolve our cybersecurity program. We engage internal security team experts who perform 'ethical hacks' against our information assets to uncover risks. As part of its risk based annual audit plan, our internal audit team reviews a number of components of our information technology operations, which taken together, comprise our cybersecurity defenses. A report of its findings is distributed to certain members of management and completion of the auditor's comments is tracked and reported up to the Audit Committee of the Board. We also engage third-party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: As one of the critical elements of our overall risk management program, our cybersecurity program is focused on the following key areas: • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, Security information and event management, Managed detection and response and access controls, which are regularly evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response & Recovery Planning: We have established and maintain incident response and recovery plans that address our response procedures in the event of a multitude of various cybersecurity incidents. We leverage a Managed Detection and Response service which further helps support our internal security team to identify real time threats across our landscape. • Risk Management: We maintain a preemptive and comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks across our entire technology stack. Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology. This approach also includes third-party risk management issues presented by third parties, including our vendors, service providers and other external users of our systems. We conduct cybersecurity assessments of third-party vendors that we engage with in our operations to identify and evaluate potential vulnerabilities. We also evaluate certain core operational capabilities of our third-party vendors. In addition, our agreements with material vendors include indemnification provisions with respect to cybersecurity matters. • Outside Consultants: In addition to the broad capabilities of our internal information security team, we also engage various outside consultants, including contractors, auditors, and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advise on potential improvements to our incident prevention, response, and documentation procedures. • Team Member Education & Awareness: We provide training to new team members, as well as frequent, mandatory training for all team members regarding cybersecurity threats to equip our team members with effective tools to identify and prevent cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: INSEEGO CORP.

ticker: INSG


text: Our team leverages over 25 years of experience in various IT leadership roles, including oversight of cyber security functions. Our SVP of IT, and her team, is responsible for the day-to-day management of the cybersecurity program.

companyName: EyePoint, Inc.

ticker: EYPT


text: The CISO plays an important role in the prevention, detection, mitigation, and remediation of cybersecurity incidents and in informing management, the Technology Committee and the Board of Directors on cybersecurity risks and issues. The CISO provides quarterly briefings to the Technology Committee on any significant information security issues, relevant cybersecurity metrics and the status of the Company's security-related strategic initiatives. The CISO also provides mid-year and annual reports to the full Board of Directors of the Company regarding the state of the Company's information security program. The annual reports encompass a broad range of topics, including: Confidentiality of nonpublic information and the integrity and security of the Company's information systems; Cybersecurity policies and procedures; Material cybersecurity risks;

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: The Corporation's risk management program includes focused efforts to identify, assess and manage cybersecurity risks including, but not limited to, the following: • Developing and maintaining a standardized Written Information Security Policy ("WISP"), which provides specific provisions pertaining to employee training, network security, data security, and confidential information for use and adherence by all pertinent operating entities of the Corporation; • Developing and maintaining an Incident Response Plan ("IRP"), which provides specific directives in the event of a cyber-attack including identifying the attack, containing and eradicating the cyber-threat, avoiding and minimizing damages, reducing recovering time, and mitigating future cybersecurity risks; • Aligning the Corporation's risk management program, as outlined in the WISP and the IRP, with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyber-attacks; • Requiring all employees with access to the Corporation's networks to participate in regular and mandatory training on how to be aware of, and help defend against, cybersecurity risks, combined with periodic testing to measure the efficacy of the training efforts; • Testing vulnerability of the Corporation's key systems to cybersecurity risks, including targeted penetration testing, tabletop incident response exercises, periodic audits by outside industry experts, and regular vulnerability scanning; • Maintaining adequate business continuity plans and critical recovery backup systems; • Engaging external cybersecurity experts in incident response development and management; and • Maintaining adequate cyber insurance for damages caused by a cyber-attack.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: Monitoring and detection processes and procedures have been implemented to help identify cybersecurity incidents. In the event of an incident, we intend to follow protocols associated with incident detection, mitigation, recovery and notification, including notifying senior leadership and the Board of Directors, as appropriate. awareness training has been implemented for all employees whereby training is conducted on a monthly basis.

companyName: Prairie Operating Co.

ticker: PROP


text: Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with information technology controls; user and employee awareness of cybersecurity policies and practices; information systems configuration management; and infrastructure security systems. Management makes concerted efforts to select third-party software providers with a demonstrated track-record of effectively addressing cybersecurity concerns. In event of a cybersecurity incident, we would rely upon these providers. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including Microsoft Azure CSPM and SOC 2. We use this framework, together with information collected from periodic manual assessments and automated testing, to tailor aspects of our cybersecurity practices given the nature of our assets, operations and business.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity threats or incidents. For additional information on our cybersecurity risks, see "Item 1A. Risk Factors – We rely on certain critical information systems for the operation of our business and a disruption in our information systems, including those related to cybersecurity, could adversely affect our business operations."

companyName: SEMTECH CORP

ticker: SMTC


text: We believe that information and technology security is a shared responsibility and, therefore, incorporate data and privacy protection education into the customer experience through ongoing resources such as best practices content, one-on-one consultations with customer success managers and bbcon sessions. We also participate in global communities and conference platforms to share information and present on best practices to improve the industry's security awareness posture. In addition, Blackbaud employees are all engaged in on-going security and privacy awareness training campaigns to ensure they are empowered to protect both Blackbaud's and our customers' data.

companyName: BLACKBAUD INC

ticker: BLKB


text: Our Senior Vice President, Corporate Operations and Legal is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Senior Vice President, Corporate Operations and Legal is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Kronos Bio, Inc.


text: Cyber Threats and Incident Response In the ordinary course of our business, we collect and store confidential data, including intellectual property, proprietary business information and personally identifiable information (including of our employees, customers, suppliers and business partners). We rely extensively on information technology systems, including some systems that are managed by third-party service providers, to securely process, store and transmit such confidential data in order to conduct our business. These systems include programs and processes relating to internal and external communications, ordering and managing materials from suppliers, collecting, processing and storing data produced by our clinical trials and other research and development initiatives, converting materials to finished products, shipping products to customers, processing transactions, processing payments to employees and vendors, calculating sales receivables, generating our financial results for each reporting period, summarizing and reporting results of operations, and complying with information technology security compliance and other regulatory, legal or tax requirements. In addition, as cybersecurity attacks may become increasingly complex as they are enhanced or facilitated by the emergence of new technologies such as AI used to identify and target new vulnerabilities in our information technology systems or those of our customers, third-party vendors and other business partners, we are taking measures to manage these risks by utilizing new tools and capabilities, including AI.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: The Board of Directors receives regular reports from the Chief Information Officer and the Information Security Officer on Plumas Bancorp's cyber risks and threats, the status of projects to strengthen Plumas Bancorp's information security systems, assessments of Plumas Bancorp's security program, and the emerging threat landscape. Additionally, the Chief Information Officer chairs the Technology Steering Committee, which drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. In addition to conducting internal audits, Plumas Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Executive Committees of the Board. The Company also engages with key vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Technology Steering Committee and Board of Directors.

companyName: PLUMAS BANCORP

ticker: PLBC


text: The CIO and CISO collaborate with our internal audit department and external consultants to review information technology-related risks (based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework) as part of the overall Vistra cyber risk management process. Through these processes, the CIO and CISO are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats.

companyName: Vistra Corp.

ticker: VST


text: We continue to promote a company-wide culture of cybersecurity risk management awareness, and cybersecurity considerations are integrated in our decision-making processes. We have an experienced IT team led by our Senior Vice President of IT and Cybersecurity, who has more than 20 years of industry experience. Our Senior Vice President of IT and Cybersecurity reports directly to the executive team and works closely with our management team, and where necessary, engages external experts to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Senior Vice President of IT and Cybersecurity provides regular updates on cybersecurity to the audit committee of our board of directors.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Investment Adviser, Administrator and our executive officers under the oversight of our Board of Directors. As such, we rely on the cybersecurity policies and procedures implemented by Prospect Capital Management, for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details that Prospect Capital Management has provided to us regarding its cybersecurity program that are relevant to us.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: The Company engages third parties in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including penetration testing, vulnerability assessments, tabletop exercises, and other activities focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments influence the Company's tuning of cybersecurity policies, standards, processes and practices, the results of which are shared with the Board and the Audit Committee.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Liberty Broadband has also established a Compliance Committee responsible for overseeing and monitoring all corporate compliance initiatives at GCI, including cybersecurity. The Compliance Committee is composed of members of Liberty Broadband's ISSC as well as GCI's executive leadership team, including the President & Chief Operating Officer, General Counsel, and Chief Financial Officer. The CISO reports periodically to the Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Third-party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor, for a variety of factors, including its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.

companyName: ENTERPRISE BANCORP INC /MA/


text: We have not been materially affected by cybersecurity threats. We may, from time to time, experience threats to and security incidents related to our data systems but we do not believe they are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information, please see the risk factors entitled "Our internal computer systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer cybersecurity incidents, data breaches or other unauthorized or improper access, which could result in a material disruption of the development programs of our product candidates" and "Cybersecurity incidents, loss of data or modification of information, and other disruptions could compromise information related to our business or prevent us from accessing critical information, result in a significant disruption of our activities and expose us to liability, which could adversely affect our business and our reputation" in Item 1A- Risk Factors in this Annual Report on Form 10-K.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: Our cybersecurity policies and processes are fully integrated into our Risk Management procedures and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. We plan to brief the Board of Directors on our strategy and roadmap in alignment with the NIST Cybersecurity Framework and we plan to provide our Board with regular updates regarding cybersecurity risks, threat landscape and overall program progress.

companyName: EACO CORP

ticker: EACO


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DO. Our DO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant employees and personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Structured management of change process to ensure material changes to our systems or operations have an updated assessment of their potential impact associated with internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations;

companyName: FutureFuel Corp.

ticker: FF


text: The Company's Cybersecurity Team ("Team"), comprised of individuals with a broad range of cybersecurity skills, experiences and certifications, is led by the CISO. The Team is responsible for the implementation, monitoring and maintenance of the Company's cybersecurity practices in coordination with its businesses, operations and functions, and oversees the Company's cybersecurity program, including infrastructure, governance and incident response as detailed below. On a regular basis, the CISO receives reports from the Team on these cybersecurity program matters. In addition, the CISO also receives reports and updates on incident response and cybersecurity threats.

companyName: Xylem Inc.

ticker: XYL


text: Senior leadership, including our CEO, who also has relevant experience in cybersecurity matters, and our CISO, regularly brief the Board of Directors on our cybersecurity and information security initiatives, and the Board of Directors is apprised of cybersecurity incidents deemed to have a material business impact.

companyName: TUCOWS INC /PA/

ticker: TCX


text: In addition, all CIM Group employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: These reports cover a broad range of topics, including: • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards The SVP Technology regularly informs our executive management group of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity environment and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: HARMONIC INC.

ticker: HLIT


text: The strength and resilience of our cybersecurity and data privacy programs are critical in maintaining the trust of our patients, customers, employees, shareholders, and other stakeholders. Securing our business information, customer, patient and employee data and IT systems is an important part of our overall risk management framework. We rely on IT systems, some of which are dependent on services provided by third parties, to provide data and other services, including diagnostic information services for patients, clinicians and healthcare organizations, clinical testing, test ordering and reporting, billing, customer service, logistics, commercial and operational data, human resources management, legal, finance and tax compliance, and other information and processes necessary to operate and manage our business.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: As a matter of process, the Nominating and Corporate Governance Committee annually reviews, and recommends to the Board of Directors its approval of, our information security policy and cybersecurity program and our incident response plans. Furthermore, on an annual basis, the Board of Directors and its Committees review and discuss our technology strategy with our Executive Vice President – Business Intelligence and approve our technology strategic plan.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO, our Vice President – Cyber Risk Governance and our Senior Vice President – Enterprise Information Security. The management team is highly experienced in cybersecurity matters. The CISO has over 20 years of experience in cybersecurity including working at a global bank and leading cybersecurity vendors, and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Privacy Professional certifications for security and privacy, respectively. The CISO has a bachelor's, master's, and law degrees. The Vice President – Cyber Risk Governance has advanced degrees and certifications related to cybersecurity and over 15 years of experience with the federal government in a similar role. The Senior Vice President – Enterprise Information Security has more than 20 years of information security risk management experience, including serving as a bank CISO, and has bachelor's and master's degrees and holds the CISSP certification.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our client or employee data or our systems. Cybersecurity considerations affect the selection and oversight of our third-party service providers. Although we perform diligence on third parties that have access to our systems, networks, data or facilities that house such systems, networks or data, and we monitor cybersecurity threat risks identified through such diligence, there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks and other assets owned or controlled by third parties. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: MSCI Inc.

ticker: MSCI


text: The audit committee receives periodic reports from our Chief Operating Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: Our senior management team, including the Senior Director of Information Services, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Senior Director of Information Services has over 20 years of industry experiences leading and overseeing cybersecurity programs at public and private companies.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: Board of Directors The Audit Committee operates under a written charter adopted by the Company's Board of Directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats. For further information about the Audit Committee's role in assessing and managing the registrant's material risks from cybersecurity threats, see "Risk Management and Strategy," under this Item 1C.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: As discussed in this Annual Report on Form 10-K, the changes in our business and operations that will occur in connection with our review of strategic alternatives may impact our cybersecurity program in the future. As such, the following section describes the Company's cyber risk management and strategy, and governance related to cybersecurity risks, for the fiscal year that ended December 31, 2023. For more information regarding the changes to our business and operations and associated risks, please see (i) Item 1 – Business, (ii) Item 1A – Risk Factors, and (iii) Item 7 – Management's Discussion and Analysis of Financial Condition and Results of Operations in this Annual Report on Form 10-K.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: The Company's Board of Directors is responsible for providing oversight and strategic guidance to management to support the long-term interests of the Company's shareholders. The Audit Committee is the lead committee of the Board of Directors responsible for oversight of the Company's risk-based cybersecurity program and bears the primary responsibility for oversight of this aspect of the business. As part of this responsibility, the Audit Committee of the Board of Directors annually reviews the Company's Information Security Incident Response Plan.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: As part of our broader risk management system and processes, we maintain procedures for identifying, assessing, and managing material risks from cybersecurity threats that is designed to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Lakeside Holding Ltd

ticker: LSH


text: Our Audit Committee receives regular reports from management on our cybersecurity risks, and our full Board receives a periodic update. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as significant incidents.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Our cyber risk treatment plan is reviewed in a bimonthly cadence with a cross-functional Cyber Steering Committee, the managerial governing body that regularly reviews our top cyber risks and receives reports on progress on key cyber initiatives. Our CISO leads the Cyber Steering Committee, which also includes individuals with experience identifying and managing enterprise risks, including our President and Chief Executive Officer, Executive Vice President, Chief Financial Officer, Executive Vice President, General Counsel and Corporate Secretary and Senior Vice President, Internal Audit, as well as individuals with technical expertise in information technology, data and cyber matters and/or experience in managing cyber incident responses, including our Executive Vice President, Chief Technology Officer, Senior Vice President, Information Technology Operations and Senior Vice President, Deputy General Counsel and Chief Compliance Officer. Our CISO has over 15 years of Chief Information Security Officer experience leading security strategy and execution for large companies. He holds a Certificate in Secure Software and Information Engineering from Pace University and is a Certified Information Systems Security Professional.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: Our Chief Information Security Officer and Chief Risk Officer report information on cybersecurity risks to the Board of Directors on a regular basis.

companyName: Axos Financial, Inc.

ticker: AX


text: We continue to evaluate and improve the capabilities of our people, processes, and technologies to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance, and are reviewed by our Board of Directors annually.

companyName: International Stem Cell CORP

ticker: ISCO


text: As referenced above, our IT security team, in consultation with our privacy team, is primarily responsible for frontline assessments and management of day-to-day risks from cybersecurity threats, including the monitoring and detection of cybersecurity incidents and the execution of DaVita's cybersecurity and privacy incident response plans, as needed. Pursuant to the plan, the teams are responsible for assessing and classifying cybersecurity incidents and coordinating the response to such incidents, including managing both internal and external reporting obligations and remediation efforts. Our key personnel responsible for privacy and cybersecurity expertise include our CIO, CISO and CPO. Their qualifications include expertise in international privacy laws, compliance, global IT strategy, and security responsibilities, helping to ensure a comprehensive approach to risk management. Our CISO has more than two decades of experience in information technology risk and compliance and holds a Certified Chief Information Security Officer certification from EC-Council, a Certified Information Security Manager certification from ISACA and a certification from the Massachusetts Institute of Technology on AI management in healthcare. Our CPO is a Certified Information Privacy Professional and a Certified Compliance and Ethics Professional, and has more than two decades of experience in creating and implementing privacy and data protection programs that enable multinational organizations to respect and protect personal data and execute mission critical business strategies.

companyName: DAVITA INC.

ticker: DVA


text: The Board of Directors and the Audit Committee are responsible for understanding the primary risks to our business. The Audit Committee is responsible for reviewing BXPE's and the Sponsor's IT security controls with management and evaluating the adequacy of BXPE's and the Sponsor's IT security program, compliance and controls with management.

companyName: Blackstone Private Equity Strategies Fund L.P.


text: Given the importance to our business and the heightened risk, the Board of Directors provides oversight of management's response to cybersecurity risks. Management, including our CIO, provides the Board of Directors periodic updates on cybersecurity, including updates on cyber goals, cybersecurity risks, and related risk mitigation strategies. As part of our enterprise risk management process, an annual risk assessment is completed by a cross-functional group of management led by our finance department, and includes members of our information technology department for the cybersecurity assessment section. The results of the risk assessment, as well as mitigation strategies, are discussed with the Board of Directors.

companyName: ITC Holdings Corp.


text: Our incident response plan identifies the key employees responsible for responding to a cybersecurity incident and coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: TrueBlue, Inc.

ticker: TBI


text: The Audit Committee of the Company's Board of Directors is responsible for the oversight of risks from cybersecurity threats. The Audit Committee periodically receives updates from management and our third party IT support specialists of our cybersecurity threat risk management and mitigation strategies covering topics such as data security posture and potentially material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the company's plans to mitigate those risks, and discusses such matters with our third party IT support specialists and other members of senior management. Potentially material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management.

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: We have two cybersecurity teams, each dedicated to a specific area. Our Information Technology Cybersecurity team focuses on corporate programs, and our Products Cybersecurity team focuses on customer-facing programs. These teams work collaboratively to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, these teams are charged with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President of Information Technology, the Senior Director of Information Security and the General Counsel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. Similarly, the Audit Committee reports cybersecurity threats and incidents to the full Board of Directors as appropriate.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: We employ multiple security and monitoring devices and applications throughout the Company to identify, alert, report and log all authorized and unauthorized access to the Leidos enterprise networks. We use an application that collects, correlates, and notifies CSIRT analysts regarding any item meeting an electronic intrusion event. We categorize anomalous cyber events into discrete levels in which cybersecurity matters are escalated to certain levels of management, as well as our Board, based on the severity of the incident, as appropriate. Sharing cyber threat information at these levels supports the Company's ability to integrate cybersecurity considerations into its overarching risk management system and processes.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: Our cybersecurity risk management program is closely aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including third-party relationships, legal, compliance, strategic, operational, and financial. Key elements of our enterprise cybersecurity risk management program include: • implementation of policies and procedures in the areas of Information Security, Business Continuity, Disaster Recovery, Privacy, Third-Party Relationship Risk Management, Risk Management, and Incident Response; • risk assessments designed to help identify material cybersecurity risks to our critical systems, data, products, services, and our broader enterprise information technology environment; • an independent second line function, the Information Security Department, which is principally responsible for managing our cybersecurity risk assessment processes, executing our incident response plan, and monitoring of our security controls; • the use of external service providers, where appropriate, to assess, test and enhance our security controls, including penetration testing, training, and table top exercises; • a comprehensive employee training and awareness program which includes periodic security assessments to test knowledge and reinforce adoption of security processes and controls that include simulated phishing attacks; • membership with the Financial Services Information Sharing and Analysis Center (FS-ISAC) and annual participation in the Cyber Attacks against Payment Systems (CAPS) exercises; • regular reporting of cybersecurity metrics and other risk/threat information matters to both the Management Risk and CIT Committees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party relationships risk management process for service providers, suppliers and vendors which analyses, monitors, reports, and mitigates cyber risks associated with third-party relationships.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: We have developed and implemented a cybersecurity risk management program intended to protect our properties, confidential and proprietary data, and information technology and systems, from cybersecurity threats, including unauthorized access or attack. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to the business. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Part I. Item 1A. Risk Factors" in this Form 10-K, including "If we or the third parties upon which we rely experience a cybersecurity breach or other security incident or unauthorized parties otherwise obtain access to our customers' data, our data or our Unified-CXM platform, our Unified-CXM platform may be perceived as not being secure, our reputation may be harmed, demand for our Unified-CXM platform may be reduced and we may incur significant liabilities."

companyName: Sprinklr, Inc.

ticker: CXM


text: The Company contracts with external firms to assess the Company's cybersecurity controls relative to its peers using the NIST CSF. The Company also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.

companyName: Cohen & Co Inc.

ticker: COHN


text: There were no cybersecurity incidents during the financial year ended April 30, 2025, that resulted in an interruption to our operations or known losses of any critical data or that otherwise had a material impact on our business strategy, financial condition, or results of operations. However, the scope and impact of any future incident cannot be predicted. See Item 1A, "Risk Factors," for more information on how material cybersecurity attacks might impact our business.

companyName: AIRWA INC.

ticker: YYAI


text: Our Board of Directors oversees cybersecurity risk management and is supported by the Audit and Finance Committee of the Board (the "Audit Committee"). The Audit Committee interacts with the Executive Leadership Team ("ELT"), including our Chief Technology Officer ("CTO"), and other members of management with respect to cybersecurity matters. The Board of Directors and the Audit Committee receive periodic reports from management on the effectiveness of the cybersecurity program and any material cybersecurity incidents that have occurred. The Board of Directors and the Audit Committee work with management to help ensure that our cybersecurity program is effective in addressing the risks associated with cybersecurity threats and are committed to continuously improving our cybersecurity program to stay ahead of emerging threats. The CTO oversees our cybersecurity program, including assessing and managing material risks from cybersecurity threats. The Chief Information Security Officer ("CISO") reports to the CTO and leads the cybersecurity program and team.

companyName: nVent Electric plc

ticker: NVT


text: above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: As codified in its charter, the Audit Committee is responsible for reviewing the processes by which cybersecurity risks are managed and reporting any issues that arise out of such reviews to the Board. The CISO provides key security metrics to the Audit Committee on a quarterly basis, and directly to the chair of the Audit Committee on a case-by-case basis, as needed, at any time during the quarter. The Audit Committee reviews these reports, which include, among other things, external events impacting the Company, security incidents, user training statistics, and evaluations of user readiness to address cyber incidents. Notwithstanding the Company's approach to cybersecurity, the Company may not be successful in preventing or mitigating future cybersecurity incidents that could have a material adverse effect on the Company. While LivaNova maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on risks related to cybersecurity and data security, see Item 1A. "Risk Factors – Risks Relating to the Company's Business and Operations."

companyName: LivaNova PLC

ticker: LIVN


text: As of December 31, 2024, we are unaware of any risks from cybersecurity threats (including previous cybersecurity incidents) that may have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. We have experienced and may continue to experience cybersecurity incidents; however, we do not believe any cybersecurity incidents incurred to date have materially affected our Company, including our business strategy, results of operations, or financial condition. While we continue to employ resources to monitor our systems and protect our infrastructure, these measures may prove insufficient, and that could subject us to significant risks. For further discussion of how these and other potential cybersecurity risks may impact our business, refer to the risk factor under heading "A cybersecurity breach, disruption or misuse of our information systems, or our external business partners' information systems could have a material adverse effect on our business" in Item 1A. Risk Factors – Operational Risks.

companyName: PERRIGO Co plc

ticker: PRGO


text: The underlying controls of the cyber risk management program are designed to meet Oaktree's business requirements, security risks and organization profile, and leverages many elements of the National Institute of Standards and Technology Cybersecurity Framework and the International Organization Standardization 27001 Information Security Management System Requirements. The Internal Audit team conducts an annual internal audit of the Company's cyber risk management program utilizing the services of a third-party provider. Additionally, Oaktree hires a third party provider to conduct an annual penetration test of Oaktree's systems. Oaktree has developed and implemented controls and processes to oversee and manage its engagements with third-party vendors. These procedures encompass pre-engagement due diligence efforts and the ongoing monitoring of the third-party vendors that are considered to be high-risk. Although these controls and processes are designed to mitigate risks associated with third-party engagements, they do not guarantee the elimination of all potential risks. The effectiveness of these controls and processes is dependent on a variety of factors, some of which are outside Oaktree's and our control.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, quality audits and communication and reporting structures, among other processes.

companyName: SKINVISIBLE, INC.

ticker: SKVI


text: We leverage third party applications and software, as well as vulnerability and cybersecurity testing by third party cybersecurity experts, to help identify vulnerabilities within our system's boundaries. These vulnerability lists are used to create remediation plans and are prioritized based on severity and attack feasibility.

companyName: USBC, Inc.

ticker: USBC


text: The Southern Company system has adopted a CIRP that applies in the event of certain cybersecurity threats or incidents to provide a standardized guide for responding to security incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the incident response process follows the National Institute of Standards and Technology guidance and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. The CIRP is reviewed periodically to help ensure its applicability to any changing needs or circumstances and to provide users a tactical tool to effectively respond to incidents. The CIRP applies to all Southern Company system personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Southern Company system information and to all devices and network services that are owned or managed by the Southern Company system. A full tabletop exercise is performed at least annually, including stakeholders from business units beyond technology security, such as power delivery, legal, compliance, risk management, and corporate communications. In addition, the Southern Company system participates in sector-level and cross-sector exercises led by industry or the U.S. government. In the event of an incident, the technology security organization, the legal organization, and other stakeholders frequently review lessons learned after an incident has been remediated.

companyName: SOUTHERN CO GAS


text: The board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cyber security threats. The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board for consideration. Our executive leadership team regularly discusses cyber risks and trends and, should they arise, any material incidents with the audit committee.

companyName: Proto Labs Inc

ticker: PRLB


text: As part of the ongoing refinement of our information security program, we engage (as appropriate) various third-party risk management services to assist with the identification of potential cybersecurity issues, such as those involving software vulnerabilities, configuration errors, data exposure and credential theft (among others), as well as consult with external legal counsel, third-party experts and other advisors to assist with incident response and recovery efforts, forensic investigations, extortion negotiations and crisis management or readiness for the same. We also maintain a cyber insurance policy to help manage, in part, costs associated with significant cybersecurity incidents that may occur.

companyName: Angi Inc.

ticker: ANGI


text: Our management, including our Chief Operating Officer and Executive Director of IT, is responsible for hiring appropriate information security personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and helping prepare for cybersecurity incidents.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Board of Directors' Roles and Responsibilities The Board oversees the Company's risk management processes, including those relevant to cybersecurity risks, and the Audit Committee provides focused governance of cybersecurity, ensuring that cybersecurity threats, vulnerabilities, and incident response measures are continuously assessed and managed. The Audit Committee receives regular briefings from the CISO on risks related to internal systems, third-party relationships, and emerging cybersecurity threats. The Audit Committee provides updates to the Board on significant cybersecurity risks and the Company's mitigation strategies.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: As of the date of this report, we have not experienced any cybersecurity threats or incidents that have materially affected, or reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. Refer to "Our operations could be disrupted if our information systems fail or are not upgraded or are subject to cyber-attacks" in Part I, Item 1A of this report for additional information on risks from cybersecurity threats.

companyName: Endo LP


text: In our risk factors, we describe how potential risks from cybersecurity threats may affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: In February 2024, the Company formed a dedicated Cybersecurity Risk Committee (the "Cybersecurity Committee"), consisting of designated members of the Company's Information Technology team, the Company's General Counsel and Chief Compliance Officer, the Company's Deputy General Counsel, the Company's Controller, the Company's Chief Operating Officer, and designated members of the Company's Communications team. The Company's CEO and CFO have the authority to appoint and remove members of the Cybersecurity Committee.

companyName: Cano Health, Inc.


text: Our processes to identify and manage cybersecurity risks form part of our overall risk management framework which includes an organization wide, multi-layered approach to risk assessment and management. Our cybersecurity risk management program is designed to proactively identify, assess and mitigate potential cybersecurity threats. It leverages industry-leading cybersecurity frameworks and standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the ISO/IEC 27001 standard. We conduct regular risk assessments to evaluate the security posture of our systems and processes, including vulnerability assessments, penetration testing, external attack surface mitigations and monitor our network for suspicious activity and potential breaches. We engage third-party advisory firms to conduct assessments of the maturity of our cybersecurity program, including measures to improve our Payment Card Industry Data Security Standard ("PCI DSS") compliance, as well as to conduct penetration testing of our shoreside and shipboard assets on a periodic basis. We continue to invest in our information technology, operational technology and cybersecurity programs to layer in the right mix of risk-based controls to protect against evolving threats.

companyName: CARNIVAL PLC

ticker: CUK


text: The Company's Chief Operating Officer is the member of the Company's executive management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Operating Officer has served in various roles in research and development, operations, portfolio management and compliance for over 30 years, including serving as a member of the executive leadership team and Sr. Vice President, Operations and Project and Portfolio Management at other companies. The Chief Operating Officer earned a Master's of Public Health (MPH) in biostatistics and epidemiology and a B.A. in psychology from the University of Oklahoma Health Sciences Center. He also earned a B.S. in nursing from the University of Kansas Medical Center.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: The Company faces risks from cybersecurity threats, including as a result of any cybersecurity incidents, that could have materially affected or are reasonably likely to materially affect its business strategy, results of operations, and financial condition, cash flows or reputation. Although to our knowledge such risks have not materially affected us in the last three fiscal years, from time to time the Company has experienced and will continue to experience cybersecurity incidents, whether directly or through our supply chain or other channels, in the normal course of its business. For more information about the cybersecurity-related risks that the Company faces, see the risks detailed under the headings "The Company relies heavily on technology and automated systems to operate its business and any significant failure or disruption of, or failure to effectively integrate and implement, these technologies or systems could materially harm its business" and "Increasing privacy and data security obligations or a significant data breach may adversely affect the Company's business" included as part of our risk factor disclosures in Part I, Item 1A. of this Form 10-K.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Our cybersecurity risk management program includes: • Periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. • A security team principally responsible for managing our cybersecurity risk assessment processes, security controls, and response to cybersecurity incidents, supported by a virtual Chief Information Security Officer ("vCISO") that we have engaged through a third-party IT security firm. • The use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls. • Our Internal Audit department, which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment. • Periodic cybersecurity awareness training for our employees and contractors with access to our information technology systems.

companyName: Bloom Energy Corp

ticker: BE


text: We have plans in place in order to Respond to detected cybersecurity incidents: • Maintain written playbooks, which provide sequential instructions on the appropriate steps to take in the wake of various cyberattacks, including a playbook for each of the following: ransomware attack, a data breach, loss of third-party data and partial and full disaster recovery plans; and • Retain a leading provider of incident response to assist us with a security incident as well as an attorney that serves as our data breach coach who specializes in data privacy and cyber security, and has relationships with third-party forensics investigators, crisis communications professionals and other services and organization we may need if a data breach is encountered.

companyName: FIRST INDUSTRIAL LP


text: Our cybersecurity risk management program is grounded in a zero-trust framework and employs a multi-layered approach to ensure comprehensive protection. This approach includes:

companyName: CALAVO GROWERS INC

ticker: CVGW


text: We maintain a formal cybersecurity program with guidance drawn from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and other industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: We recognize the critical importance of protecting our information technology ("IT") systems and the data of our employees, customers, and partners. We have an enterprise-wide cybersecurity program designed to identify, detect, investigate, protect, and respond to cybersecurity risks.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: CFO and management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CFO and representatives from our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: monitoring of Company computer and information systems for potential malware, ransomware and other malicious activity, and remediation of identified issues, including mitigation of identified risks and containment and elimination of any malicious software; cybersecurity training as part of new employee onboarding along with required annual and periodic employee cybersecurity re-training; of systems and network infrastructure by security information and event management application;

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We manage cybersecurity risks associated with our use of these providers by reviewing their security assessments and applicable reports.

companyName: OS Therapies Inc

ticker: OSTX


text: We have designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Vertex, Inc.

ticker: VERX


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • internal resources who are responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • periodic cybersecurity training for our workforce.

companyName: HBT Financial, Inc.

ticker: HBT


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We utilize well-known cloud-based technologies and service providers such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.

companyName: Premier Air Charter Holdings Inc.

ticker: PREM


text: Index to Financial Statements There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements. We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: The Company educates its workforce as part of our security awareness program to understand the risks and potential impacts cybersecurity threats pose to our business, and ways employees can remain vigilant to prevent cybersecurity incidents from occurring. The program includes annual employee acknowledgement of security related policies, ongoing communication about prevalent vulnerabilities, security awareness training, and simulated phishing campaigns.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: Board of Director Oversight The Audit Committee receives a detailed cybersecurity update annually from the Chief Information Officer and receives a cybersecurity update quarterly through the ERM program as a key risk.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: The Company's VP of Information Technology, Security and Business Intelligence, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policy as it relates to the incident, management response and recovery plan. Through the ongoing communications from these teams, the VP of Information Technology, Security and Business Intelligence and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: Axogen, Inc.

ticker: AXGN


text: We maintain an information security and cybersecurity program as part of our overall risk management program. Our information security and cybersecurity program is managed by a dedicated Chief Information Security Officer ("CISO"), who reports to our Chief Financial Officer ("CFO"). Our CISO has extensive expertise and eighteen years of experience in information security. In addition, the CISO's team is responsible for leading the enterprise-wide information security and cybersecurity strategy, policy, standards, architecture and processes. Our information security and cybersecurity program identifies and prioritizes risks to appropriately analyze and manage our potential cyber-related threats. The CISO provides periodic, or as needed, reports regarding risks from cybersecurity threats to the Audit Committee (the "AC") of the Board, as well as the Security Executive Committee, which includes our Chairman and Chief Executive Officer ("CEO"), CFO and other executive leadership. These reports include updates on our cybersecurity risks, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. The CISO is responsible for leading the day-to-day assessment, identification and management of cybersecurity risks, while the Board, as a whole and through the AC, has responsibility for the oversight of risk management, including cybersecurity risk. The Board, in its risk oversight role, is responsible for determining that the risk management framework and supporting processes as implemented by management are adequate and functioning as designed. The Board is actively involved in the oversight of key risks inherent in our business and routinely reviews our strategic plan and the related key risks, including the output of our enterprise risk management process, which includes risks related to cybersecurity. In addition to the CISO's and Security Executive Committee's review, cybersecurity risks are regularly assessed by two other internal information security sub-committees, as well as a third-party security consultant. The results of those reviews are reported to our Security Executive Committee, the AC and the Board. The third-party security consultant discussed above has extensive industry expertise in security and risk management. In addition, as part of our cybersecurity program, we evaluate all of our third-party vendors for any material cybersecurity risks and only contract with third-party vendors that have the controls that we believe are appropriate to have in place to protect against cybersecurity risks and threats. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See Part I, Item 1A. Risk Factors of this Form 10-K under the heading "Risk Factors" for further discussion.

companyName: SP Plus Corp


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), our outsourced security team has a written incident response plan outlining how to address cybersecurity events that occur. We have assigned a team comprised of finance and technology personnel to review the plan annually to serve as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties.

companyName: NEPHROS INC

ticker: NEPH


text: We have identified and, in some cases, engaged, third-party experts to allow for quicker engagement if a cybersecurity incident occurs in the future.

companyName: HERBALIFE LTD.

ticker: HLF


text: The Board of Directors is responsible for exercising oversight of management's identification of, and planning for, the material risks facing the Company, and we believe our risk management policies and procedures are adequate to ensure that relevant information about cybersecurity risks and incidents is appropriately reported and disclosed. In October 2017, the Board authorized the formation of a Cybersecurity Committee, which is now known as the Governance, Risk & Compliance ("GRC") Committee. Our cybersecurity risk management process, which are discussed in greater detail below, are led by the GRC Committee. The GRC Committee is currently comprised of the Chief Technology and Innovation Officer, Chief Financial Officer, General Managers of the business units, Corporate Security Officer, Corporate Privacy Officer, and General Counsel and Corporate Compliance Officer. The GRC Committee generally meets weekly, and has a formal meeting quarterly, to discuss the primary security and compliance-related risks currently facing the Company, including cybersecurity risks. The General Counsel and Corporate Compliance Officer then provides updates to the Board at each regular quarterly meeting. Annually, the full Board participates in cybersecurity training and discusses the internal incident management process with the GRC Committee.

companyName: TruBridge, Inc.

ticker: TBRG


text: We make every effort to comply with the GDPR and implement best practices including annual review of our Data Protection Policy. We also train employees to maintain secure systems, and access control measures, and regularly monitor and test our networks to protect data, payment information, and personally identifiable information.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: The cybersecurity program within our company helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity program identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data.


text: With respect to third parties that assist in our cybersecurity oversight, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all third-party providers to ensure compliance with our cybersecurity standards.

companyName: TFF Pharmaceuticals, Inc.


text: Our management team—including our Chief Information Officer and our Vice President, Information Security, Risk and Compliance—is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Officer and our Vice President, Information Security, Risk and Compliance have more than 40 years of combined experience in the field of IT.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: We periodically test our security controls through internal and external penetration testing that covers both corporate and plant IT networks by external specialized vendors, as well as in connection with auditing of our financial systems. We also conduct regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, we conduct an annual independent review of our cybersecurity posture.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our VP of IT, software and telematics who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: IDEANOMICS, INC.

ticker: IDEXQ


text: Cybersecurity Risk Management of Third-Party Vendors and Service Providers We have also implemented risk management practices designed to minimize the material cybersecurity risks that arise from utilizing third-party vendors and service providers that receive or have access to Lucid confidential information or personal data. In order to oversee and identify such risks, we have implemented the following processes: (i) a third-party security risk management program designed to assess security risk of new third-party vendors or service providers and develop countermeasures to manage unacceptable risks; (ii) provisions in our third-party vendors and service provider contracts with added security requirements; (iii) training procurement teams on management of third-party vendor and service providers; (iv) role-based access controls for third-party personnel; and (v) data transfer mechanisms for the sharing of data with third parties. While we are in the process of increasing the resiliency of these capabilities across the board, our control over and ability to monitor the security posture of third-party vendors and service providers remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

companyName: Lucid Group, Inc.

ticker: LCID


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this report, including the risk factor entitled "We may experience a significant disruption in our information technology systems or breaches of data security" and "Unauthorized third parties may seek to access our devices or other products and services, or related devices, products, and services, and modify or use them in a way inconsistent with our FDA clearances and approvals, which may create risks to users." As of the date of this report, we do not believe that we have experienced a material cybersecurity incident.

companyName: RxSight, Inc.

ticker: RXST


text: Once an event materially impacts systems or data, these cross-functional professionals and stakeholders evaluate the incident using key factors (e.g., type and scope of information impacted, systems impacted, reputational impact) and promptly inform senior leadership, the Audit Committee and the Board of Directors. Further, we may consult outside counsel or external advisors given the circumstances and situation (e.g., client, controls, location, or regulatory landscape).

companyName: CRAWFORD & CO

ticker: CRD-A


text: The Company also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate the Company's security posture. The Company also engages external firms to measure the Company's NIST CSF maturity level.

companyName: Cohen & Co Inc.

ticker: COHN


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Executive Director of IT and Information Security (ED, IT & IS), who reports to our Chief Financial Officer. Our ED, IT & IS has over 30 years of IT experience and an Advanced Graduate Certification in Cybersecurity. He is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. He provides regular briefings (quarterly at a minimum) to our Computer Security Incident Response Team consisting of the Chief Financial Officer and General Counsel/Chief Compliance Officer on cybersecurity matters, including threats, events, and program enhancements.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: See Item 1A. Risk Factors - "We rely on our systems and employees, and those of certain third-party vendors and service providers in conducting our operations, and certain failures, including internal or external fraud, operational errors, systems malfunctions, or cyber-security incidents, could materially adversely affect our operations" for additional discussion.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: Cybersecurity is a top priority for us and we are dedicated to continuously improving our cybersecurity posture to protect our systems and data from evolving threats. By implementing robust governance, policies, technologies, and compliance measures, we strive to maintain the trust and confidence of our stakeholders in our ability to safeguard their information.

companyName: HG Holdings, Inc.

ticker: STLY


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures and evaluating guidelines and policies with respect to our risk assessment and risk management. Our Chief Legal Officer working with the SVP-IT and other senior management is responsible for determining and coordinating reports and updates to the Audit Committee or the Board of Directors, or as requested by the Audit Committee or the Board of Directors. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. The Board of Directors receives an update on the Company's risk management processes and the risk trends related to cybersecurity at least annually.

companyName: HELEN OF TROY LTD

ticker: HELE


text: KKR also has a Chief Information Security Officer dedicated to our insurance business (the "Global Atlantic CISO"), who has more than 20 years of experience in various information security and technology roles. The Global Atlantic CISO leads an information security team that is focused on overseeing the cybersecurity strategy and program for Global Atlantic, which includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about Global Atlantic's security policies. The Global Atlantic CISO reports at least annually to the operations & technology committee of Global Atlantic's board of directors (whose members include non-executive directors unaffiliated with KKR) and members of KKR's Risk and Operations Committee. The Global Atlantic CISO also provides ad hoc reporting to Global Atlantic's management-level committees and Global Atlantic's board of directors and its risk committee. Material information regarding information security affecting our insurance business is also reported to KKR's Risk and Operations Committee and to the Audit Committee or Risk Committee of KKR's Board of Directors.

companyName: KKR & Co. Inc.

ticker: KKR


text: We have established procedures for monitoring network activities, detecting anomalies and responding to cybersecurity incidents promptly. We engage a specialized managed services firm to provide continuous monitoring and an initial level of incident response. We work with a leading cyber forensics firm to provide incident response services as needed. Our incident response and escalation procedures are documented to classify incidents according to defined thresholds. Our core incident response and extended incident response teams are cross-functional and include leaders across technology, legal, finance, asset protection, customer care, human resources, stores operations and communications. Protocols to notify our executive leadership team and Board of Directors are in place based on the severity of the incident.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, result of operations or financial condition. If we or our partners were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "We, our partners, our customers, and others who use our services obtain and process a large amount of sensitive data. Any real or perceived improper or unauthorized use of, disclosure of, or access to such data could harm our reputation as a trusted brand and adversely affect our business, operating results, and financial condition."

companyName: BILL Holdings, Inc.

ticker: BILL