text: The Board, in coordination with the Audit Committee, oversees our risk management and information technology programs, including the management of cybersecurity threats. The Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Audit Committee also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses our approach to overseeing cybersecurity threats with our head of Information Technology (IT) and other members of senior management.

companyName: Xencor Inc

ticker: XNCR


text: Risk Management and Strategy We, through our third party service provider that manages our information have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP

secItem: Item 1C


text: Insider Threats - We implement insider threat controls designed to identify, assess, and address potential risks from within our Company. We implement controls and tools to alert on suspicious or unusual insider activity, and we have rigorous controls in place to prevent data loss and external sharing of company information. We consider and evaluate potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including executive management. When appropriate given the nature of any potential cybersecurity incident, our executive management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, and to make any legally required notifications to individuals or regulatory agencies, including making any required disclosures under the Securities Exchange Act of 1934, as amended.

companyName: GERON CORP

ticker: GERN


text: While we face regular cybersecurity threats, including ransomware and data breaches, we have not encountered significant incidents during the year ended April 30, 2024. We believe our security measures are adequate, but we acknowledge the rising sophistication of threats. Despite vigilance, system disruptions or unauthorized disclosures remain possible.

companyName: J M SMUCKER Co

ticker: SJM


text: While we can provide no assurance against unauthorized access and breaches, our information technology infrastructure is designed with security at its core, with all data, whether at rest or in transit, being protected against unauthorized access and breaches.

companyName: Paysign, Inc.

ticker: PAYS


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a vulnerability management policy; a disaster recovery plan; conducting risk assessments; encrypting certain of our data; maintaining network security controls, segmenting certain data; maintaining access and physical security controls; asset management, tracking, and disposal protocols; systems monitoring; a assessing vendor risk; employee training; penetration testing conducted by third parties; and maintaining cybersecurity insurance.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: Management plays a key role in assessing and managing material risks related to cybersecurity threats, including evaluating potential vulnerabilities, monitoring the effectiveness of controls, and ensuring timely remediation of any identified gaps. This ongoing effort includes the coordination of internal and external resources to respond to emerging cybersecurity threats and ensure our systems are resilient against attacks.

companyName: SRx Health Solutions, Inc.

ticker: SRXH


text: The Custodian is required by contract to ensure it has implemented, and requires its critical vendors to implement, cybersecurity and data protection measures that are reasonable and appropriate for the operation of, and enterprise risks facing, the Custodian, which measures also include processes to assess, identify and manage risks from cybersecurity threats that may materially affect the Trust. Such contract requires the Custodian to inform MetLife, Inc., of any actual or reasonably suspected data security incident, including any loss, compromise, unauthorized use, access, or disclosure of information provided to it as contemplated thereunder.

companyName: METLIFE POLICYHOLDER TRUST


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: The CISO has a degree in Business Administration, Finance, and Risk Management from Washington State University. The CISO has over 24 years of experience in cybersecurity and information security. The CISO has maintained a Certified Information Systems Security Professional (CISSP) certification for over 19 years.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: At a management level, our information security risk management program is led by our CIO, along with our Sr. Director, Information Security and Privacy Compliance. As of the date of this Annual Report, our Technology Department, led by our CIO, along with our Sr. Director, Information Security and Privacy Compliance, is comprised of nearly 100 technology professionals, with currently 11 of such technology professionals exclusively dedicated to cybersecurity. These security professionals have an average information security/cybersecurity tenure of 6 years and over 30 active certifications from ISC2, ISACA, CompTIA and other industry certification leaders including certifications such as CISSP, CISM, Security+, and CEH, among other advanced Cybersecurity and Technology degrees, tool and process specific certifications, and cybersecurity related work experience. Our Technology Department stays current on cybersecurity issues and trends through continuing education activities such as conferences and participating in webinars, maintaining continuous education requirements for certification bodies, as well as through the monitoring of security and vendor feeds on cybersecurity trends and threats.

companyName: CoreCivic, Inc.

ticker: CXW


text: The Information Security Program is periodically reviewed to ensure that internal controls are designed appropriately and operating as expected. The Information Security Program is reviewed and approved by the Board of Directors annually. Periodic audits are performed by internal and external auditors to confirm adherence to the security program and regulatory guidelines and requirements. The Information Security team performs an annual assessment of cybersecurity risk and maturity using the FFIEC Cybersecurity Assessment Tool and reports the results to the Board of Directors as part of the annual report.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: To date, we do not believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future. See Item 1A. Risk Factors, "Risks Related to our Information Systems and Technology" for additional discussion of cybersecurity risks to our business.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: Company faces various cybersecurity risks and threats that could potentially affect its operations, reputation, financial condition, and competitive position. These risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our data, systems, or networks; denial of service attacks; malware infections; phishing or social engineering attacks;

companyName: Mitesco, Inc.

ticker: MITI


text: The Company carries cyber risk insurance, but there can be no assurance that losses from a cybersecurity incident would not exceed the insurance coverage.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: Governance—Board Oversight and Management's Role in Assessing and Managing Cybersecurity Risks Our board of directors and Chief Executive Officer have ultimate accountability for risk. This includes oversight of our risk management program, which includes risks from cybersecurity threats. Our board of directors and Chief Executive Officer, including through the risk management committee of our board of directors, provide oversight to ensure the appropriate measures are in place so that management can identify, assess, prioritize, and respond to risk, including cybersecurity risks. We believe our board of directors, the risk management committee of our board of directors, and our Chief Executive Officer collectively have the requisite experience, knowledge, inquisitiveness, and visibility into the design and operation of our information security practices to fulfill this responsibility effectively.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Education and Awareness We provide regular (at least annual) training for personnel regarding cybersecurity threats to equip our personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security procedures.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program overseen by our Chief Risk Officer, and shares certain methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other areas affecting our business risks, including financial, compliance, EHS, compensation and governance matters, among other topics.

companyName: HESS CORP


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Audit Committee reviews cybersecurity on a quarterly basis. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to our peers. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board of Directors and the Audit Committee discuss our approach to cybersecurity risk management with the CISO and other cyber team members, as well as senior leadership.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: As part of our cybersecurity risk management program, we are working with our subsidiaries to develop a cyber training curriculum for their employees. While some have already implemented their programs, others are in the developmental phase. This training may encompass topics such as phishing, cybersecurity awareness, and email security best practices.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: Our board of directors has an advanced understanding of its role and that of management in cyber-risk oversight and is well-positioned to guide management in the development and implementation of an effective cybersecurity risk program. Two members of our audit committee hold cybersecurity certifications: Ms. Sears holds a Cyber Risk and Strategy Certification from Diligent Institute; and Ms. Barbe holds a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.

companyName: Invitation Homes Inc.

ticker: INVH


text: We have implemented processes to assess, identify, and manage risks from cybersecurity threats, including the following: • Multi-factor Authentication: We secure access to our network and systems through multi-factor authentication. • Layered Email Protection: We have adopted a layered approach to email protection. • Zero-Trust Security Model: We are working towards a zero-trust security model, utilizing group-based access controls to manage network resources. • Continuous Monitoring: We continuously monitor our systems for security anomalies, to help enable early detection of issues and facilitating a rapid response. • Regular Scans: We conduct weekly and monthly scans to identify and prioritize the mitigation of the most critical vulnerabilities. • Quarterly Penetration Testing: We engage third-party consultants to perform quarterly penetration testing, examining our environment from various perspectives, including end-user and employee use cases, to thoroughly assess system vulnerabilities. • Collaborative Evaluation and Remediation: In collaboration with our third-party consultants, we evaluate the outcomes of our testing, address and remediate any identified issues, and subsequently re-test the environment to confirm that the mitigations have effectively resolved the vulnerabilities. • Regular Assessments and Gap Analyses: Our cybersecurity team regularly meets with the third-party consultants to assess overall risk and conduct gap analyses, ensuring the effectiveness of our current cybersecurity measures. • Comprehensive Risk Assessment: Our comprehensive risk assessment includes evaluating potential security risks associated with the use of external service providers. • Incident Response Readiness: We maintain a documented incident response readiness process that details the procedures to follow in the event of a security incident. • Data Backup: We maintain comprehensive backups of all system files to facilitate data recovery during a security incident. In addition to the above-described technology controls, we have implemented mandatory training and awareness programs designed to educate our employees on cybersecurity risks. These include periodic exercises to help employees identify phishing schemes and other social engineering tactics, and we provide various methods for them to report suspicious activity that may give rise to a cybersecurity incident.

companyName: Forestar Group Inc.

ticker: FOR


text: Cyber-attacks: We are vulnerable to cyber-attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Although, to our knowledge, we have not experienced any material cybersecurity breach to date, we may experience cybersecurity incidents and face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information regarding how cybersecurity risks may affect us, see "Item 1A Risk Factors."

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: We employ a variety of security tools and components to monitor, identify and block cybersecurity threats. In the event of a cybersecurity incident, the Company has an incident response team (IRT) whose role is to respond quickly and effectively. The IRT utilizes an incident response plan for the implementation of the [its] incident response capabilities that provides (i) a definition of "reportable incidents/events", and (ii) "metrics" for evaluating the IRT's response capabilities and effectiveness. The checklist is periodically reviewed by the IT Department for lessons learned from both mock and actual incidents, and to assure compliance with most current industry best practices and latest regulatory developments. The incident response plan includes processes through which cybersecurity incidents are escalated to the Company's executive officers. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises at least annually. These exercises are conducted by internal personnel.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has oversight responsibilities to ensure effective governance in managing these risks because it recognizes the significance of these threats to our operational integrity, shareholder and customer confidence and reputation.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes advanced employee training, innovative technologies, and policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third Party Risk Management, and Incident Response.

companyName: BV Financial, Inc.

ticker: BVFL


text: Although Coastal has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected Coastal's business strategy, results of operations, or financial condition, there can be no guarantee that Coastal will not experience such an incident in the future. For a discussion regarding risks from cybersecurity threats, see "Item 1A. Risk Factors," including the risk factors titled "—We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation and otherwise adversely affect our business, financial condition and earnings" and "—We are dependent on our information technology and telecommunications systems and third-party service providers; systems failures, interruptions, security breaches and cybersecurity threats could have an adverse effect on our business, financial condition and results of operations." As noted above, we are a regulated financial institution and are subject to financial privacy laws and to oversight by federal banking agencies. For additional information on these laws and oversight, see "Item 1. Business—Regulation and Supervision."

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: To respond to the threat of security breaches and cyberattacks, we rely on a cybersecurity program developed by our Sponsor and Advisor, the implementation of which is led by our Sponsor's and Advisor's Global Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). The cybersecurity program is designed to protect and preserve the confidentiality, integrity and continued availability of all information and systems owned by them, or in their care. Our board of directors has oversight of cybersecurity risk, as indicated in the Company's proxy statement disclosure. Cybersecurity is reviewed as part of our and our Sponsor's and Advisor's overall enterprise risk management program. These are led by our management, our Sponsor's Director of Enterprise Risk Management and our Advisor's Global General Counsel, respectively and assess our significant enterprise risks, provide a summary of those risks and primary mitigations, and identify control improvement projects for our significant risks. The progress of control improvement projects for our Sponsor and Advisor risks are regularly reported to our management and on our risks to our board of directors. Our Sponsor's Director of Enterprise Risk Management regularly meets with their CISO and CIO to assess cybersecurity risks, cybersecurity program mitigants, and status of control improvement projects and our management and other employees of our Advisor regularly meet and communicate with our Sponsor's Director of Enterprise Risk Management, CISO and CIO.

companyName: JLL Income Property Trust, Inc.


text: We recognize the critical importance of securing our information systems and protecting the confidentiality, integrity, and availability of our data. To achieve this, we have developed and implemented a comprehensive cybersecurity risk management program designed to identify, assess, and mitigate risks to our critical systems and data, including risks resulting from cybersecurity threats associated with our use of third-party service providers.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: We view cybersecurity as a shared responsibility. All employees are required to complete cybersecurity training as part of onboarding, on an annual basis and have access to more frequent cybersecurity training online. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training. The designated persons or committees actively monitor cybersecurity incidents through processes that monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, including continuous assessment and adaptation to emerging threats.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; cybersecurity awareness and spear-phishing resistance training of our employees, and senior management;

companyName: HeartCore Enterprises, Inc.

ticker: HTCR


text: Regular Audits and Monitoring: The Company conducts periodic audits and continuous monitoring of systems intended to detect any anomalies or potential security breaches. This involves using advanced tools to monitory network traffic and behavior for suspicious activities.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Our policies for Cybersecurity and the Safeguarding of Data, Computing Systems and Confidential Client Information policies establish the administrative, technical, physical safeguards and risk mitigations that are implemented to protect the security and confidentiality of all customer information as set forth by the federal regulatory authorities' interagency guidelines mandated by Section 501 of the Gramm-Leach-Bliley Act of 1999 and Part 364, Appendix B of the FDIC Rules and Regulations. Our objective is to emphasize compliance with all information and cybersecurity requirements, including those detailed in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, FFIEC guidance and regulatory agency guidelines, which provide established standards for cybersecurity and the safeguarding customer information and Bank assets.

companyName: River Financial Corp

ticker: RVRF


text: Risk Assessment. Our internal cybersecurity team conducts regular assessments designed to assess, identify, and manage material risks from cybersecurity threats and vulnerabilities within our systems and processes. These assessments are part of our ongoing risk management strategy and inform strategic decisions regarding security investments and policy developments. The internal risk assessment process includes periodic reviews of our charging infrastructure, software applications and operational procedures against best practices and address current and potential threats.

companyName: EVgo Inc.

ticker: EVGO


text: In the event of a cybersecurity incident, the IT team implements the Company's incident response plan to mitigate immediate impacts, implement remediation strategies, and prevent future incidents. The team also ensures that senior management is regularly informed about material cybersecurity risks and incidents to maintain alignment with organizational priorities.

companyName: Energy Services of America CORP

ticker: ESOA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Vice President, Technology and our General Counsel. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our Executive Vice President, Technology and our General Counsel and other senior executives work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our cybersecurity incident response team has over 32 years combined information technology and cybersecurity experience, and includes individuals with Certified Information Systems Security Professional (CISSP), Cyber Threat Intelligence Certification, Global Information Assurance Certifications, and other key information technology and cybersecurity certifications. In addition, the Company's incident response processes include reporting to the Audit & Risk Committee for certain cybersecurity incidents.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: Our Board considers cybersecurity risk as critical to the enterprise and is responsible for reviewing our cybersecurity risk profile, including management's design, implementation and enforcement of our cybersecurity risk management program. The Board of Directors receives periodic updates from our Chief Information Officer ("CIO") on cybersecurity risks and threats. Board members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Our Chief Technical Systems Officer has been with Pega for six years and has twenty-five years of technology management experience, with thirteen years of leadership roles in cloud services and related information security issues, and served in the U.S. Navy and holds a degree in Business Administration from the College of Technology at the State University of New York – Farmingdale.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The Nominating, Governance and Sustainability Committee of our Board (the "NG&S Committee") is responsible for assisting the Board with respect to designated risk oversight matters, including privacy and cybersecurity. The NG&S Committee receives reports from, and meets at least twice a year and as needed with, the CISO and the Chief Privacy Officer. The CISO and the Chief Privacy Officer inform the NG&S Committee, which in turn informs our Board, of risks from cybersecurity threats during such meetings. The NG&S Committee reports to our full Board following each of its regularly scheduled meetings at a minimum and reviews with our Board significant issues or concerns that arise at NG&S Committee meetings.

companyName: Kenvue Inc.

ticker: KVUE


text: Risks from Cybersecurity Threats Our top cybersecurity threats include phishing, smishing, business email compromise, ransomware, system & human errors, and malware. These types of attacks could have a material impact on the Company. To date, we have not encountered cybersecurity challenges that have materially impacted our operations or results of operations.

companyName: V2X, Inc.

ticker: VVX


text: Management is responsible for the day-to-day management of our risk exposures in a manner consistent with the strategic direction and objectives established by the Board. As a critical component of our risk management process, management has adopted an integrated risk management framework to continuously identify, assess, measure, prioritize, manage, monitor and report current and emerging information security related risks, including risks associated with our use of third-party service providers. As part of this framework, we have an Enterprise Risk Management ("ERM") program which is implemented across the Company to promote a strong Company-wide culture of risk management, compliance, and control.

companyName: Clever Leaves Holdings Inc.

ticker: CLVR


text: Our CISO is supported by and is a member of our Cybersecurity Strategy and Risk Committee ("CSRC"), which is a management-level governance body for oversight of all of our cybersecurity risk. Our VP of Product Security is also a member of the CSRC. On a quarterly basis, our CSRC receives information from our CISO regarding our enterprise IT, manufacturing and distribution OT and product security programs, including the Company's strategy and progress on key initiatives. We also have an executive-level Enterprise Risk Committee (ERC) that oversees our ERM program and aims to create an enterprise-wide culture that promotes open discussion regarding risk and opportunities and integrates effective risk management into our goals and objectives. As part of integrating cybersecurity risk management into our ERM program, our ERC receives updates from our CIO and CISO on BD's cybersecurity risk management strategy and program on a regular basis. In addition to our CSRC and our ERC, we have established processes providing for the escalation of certain cybersecurity incidents and breaches. We maintain a global response plan that sets forth a detailed incident management and reporting protocol designed to respond to cybersecurity incidents and breaches appropriately and efficiently. Our operational team is responsible for communicating the impact and status of certain cybersecurity incidents and breaches to senior management, including the CISO, based on its assessment of the significance of the cybersecurity incident or breach. We also have a committee consisting of senior members of our management, including our CIO and Chief Risk Officer, to evaluate cybersecurity incidents and breaches reported to the committee by our CISO on an ad-hoc basis for potential material impacts on our Company, including its financial condition, results of operations and cash flows, and to have a sub-committee of our disclosure committee assess our public disclosure obligations. The CIO, CISO and other members of the committees are informed about the status, effectiveness and risks associated with our cybersecurity risk management program through their management of and participation in the cybersecurity risk management processes, policies and operations described above.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: We also implement third-party risk assessments to identify, assess and monitor material risks from cybersecurity threats associated with the use of any third-party vendor who interacts with our technology infrastructure or our confidential, proprietary, or personal information, or is otherwise part of our supply chain. These assessments include identifying and evaluating cybersecurity risks as part of the due diligence conducted prior to the selection of third-party service providers, recurring risk assessments to ensure such third-party vendors have acceptable levels of cybersecurity controls in place and ongoing monitoring to address material cybersecurity risks that may arise from such third-party relationships.

companyName: Liquidia Corp

ticker: LQDA


text: Our Cybersecurity Policy requires that all of our employees, contractors and vendors report any suspected cybersecurity threat to our Information Security team using reporting functions within our digital work environment. Once reported, our Information Security team begins investigating the incident and assigns an alert classification to the incident, based on the perceived level of threat to our company and our technology network. The team updates the alert classification, as appropriate, throughout the incident response process.

companyName: EQT Corp

ticker: EQT


text: The cybersecurity team collaborates with partners from both industry and government, and routinely participates in industry-wide programs that exchange knowledge of threats with utility peers, industry and federal agencies. AEP is an active member of a number of industry-specific threat and information sharing communities including the Department of Homeland Security's Joint Cyber Defense Collaborative, the Electricity Information Sharing and Analysis Center and the National Defense Information Sharing and Analysis Center. AEP participates in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities. AEP continues to work with nonaffiliated entities to do penetration testing and to design and implement appropriate remediation strategies. There can be no assurance, however, that these efforts will be effective to prevent material interruption of services or other damages to AEP's business or operations in connection with any cyber-related incident. See "Risk Factors - Risks Related to Market, Economic or Financial Volatility and Other Risks - Physical attacks or hostile cyber intrusions could severely impair operations, lead to the disclosure of confidential information and damage AEP's reputation".

companyName: AEP Transmission Company, LLC


text: As part of the above process, we engage third-party services to provide 24-hour, 365-day monitoring, escalation, and response to cyber events. In addition to consulting on best practices, we leverage a third-party expert security firm for independent evaluations of our security controls through penetration testing. These evaluations test both the design and the operational effectives of security controls.

companyName: I-ON Digital Corp.

ticker: IONI


text: The Fortrea Audit Committee has been authorized by the Board of Directors to oversee risks from cybersecurity threats. We have established a Risk Committee chaired by the CISO and chartered to determine and execute the processes for the identification and management of material cybersecurity risks. The Risk Committee is comprised of cross-functional executive leaders who can assess materiality impact and are accountable for materiality disclosure. The CISO is responsible for reporting on the state of cybersecurity to the Audit Committee on a quarterly basis, including those risks deemed material by the Risk Committee.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to key members of management depending on the circumstances. Our CFO works with the Company's IT manager and our third-party information technology service provider to help us mitigate and remediate cybersecurity incidents of which our CFO is notified. In addition, our incident response plan includes reporting to the Audit Committee of our board of directors for certain cybersecurity incidents.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: To help us preserve the availability of critical data and systems, maintain regulatory compliance, and achieve our goal of managing our material risks from cybersecurity threats, and with an aim to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities: • Closely monitor emerging data protection laws and implement changes to our processes designed to comply with such data protection laws; • Undertake regular reviews of our policies and standards related to cybersecurity; • Proactively inform our customers of substantive changes related to customer data handling; • Conduct annual customer data handling and use requirements training for associates; • Conduct annual cybersecurity management and incident training for associates involved in our systems and processes that handle sensitive data; • Conduct regular cybersecurity training and awareness for all associates and all contractors with access to corporate systems; • Through policy, practice, and contract (as applicable) require associates, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • Run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • Maintain what we believe to be customary and appropriate third-party information security coverage for incident loss mitigation.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial condition. We believe with the cybersecurity and governance program we have in place that we have implemented effective processes and controls to prevent cybersecurity incidents from being reasonably likely to materially affect the Company. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Failure to maintain the integrity of our information technology systems, protect our internal information, or comply with applicable privacy and data security regulations could adversely affect us", for additional discussion about cybersecurity-related risks.

companyName: BOYD GAMING CORP

ticker: BYD


text: Board and Audit Committee Oversight We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially impact the company or its business strategy, operations, or financial condition. The Audit Committee provides direct oversight of cybersecurity risk and updates the Board of Directors on such matters.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Mr. Tao brings more than 20 years of professional experience in business consultation, operations, and management, with a focus on the marketing industry.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Our CISO reports to our Chief Information Officer and leads our overall cybersecurity function. Our CISO has over 20 years of experience in various security roles, which include managing information security, development cybersecurity strategy, and implementing cybersecurity programs. Our CISO collaborates with senior leaders and other members of our organization to identify and analyze cybersecurity risks and implement controls as appropriate and feasible to mitigate these risks. The CISO also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including by collaborating with internal and external stakeholders. Our CISO is supported by a management-led Security Council, which consists of our Chief Executive Officer, Chief Financial Officer and other senior leaders throughout our organization, and which reviews and discusses our cybersecurity program as well as emerging cyber risks, threats, and industry trends, among other topics.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Our Board of Trustee's considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: VORNADO REALTY LP


text: Following these risk assessments, we will evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; evaluate how to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Our Manager of Information Technology, who has over 20 years of information technology experience, and our Chief Operating Officer, who has over 10 years of information technology management experience, manage the risk assessment and mitigation process.

companyName: Peraso Inc.

ticker: PRSO


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across Ford and Ford Credit. Further, we engage third-party advisors, from time to time, as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to Ford and Ford Credit are brought to the attention of Ford's Chief Enterprise Technology Officer and General Counsel by Ford's Chief Information Security Officer as part of the Company's cybersecurity incident response processes.

companyName: FORD MOTOR CREDIT CO LLC


text: Management Oversight Our controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Information Technology ("IT") Security and Risk Committee, which consists of our Chief Information Officer ("CIO") and internal and third-party cybersecurity professionals. Our CIO has more than 25 years of experience as an IT professional overseeing and supporting IT operations in the biopharmaceutical industry, including several years of experience in cybersecurity. The members of the IT Security and Risk Committee also have expertise in cybersecurity. The IT Security and Risk Committee is responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure that the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our CIO provides regular briefings to our senior management team on cybersecurity matters, including threats, events and program enhancements.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as where it deems appropriate, regarding any material cybersecurity incidents, as well as certain incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Funko, Inc.

ticker: FNKO


text: The Director of IT Security is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents. With the support of legal, the Director of IT Security is responsible for global regulatory compliance related to cybersecurity regulations and industry standards. The Director of IT Security also advises on the implementation of cybersecurity risk management in the Company's products and services as they are being developed.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Retirement Services AHL's information security program is managed by its CISO with collaboration across lines of businesses and corporate functions. AHL's CISO is a senior-level executive responsible for establishing and executing AHL's information security strategy, including cybersecurity oversight. AHL's information security program implements a detailed cyber incident response plan that provides controls and procedures for handling cyber incidents and incorporates a cross-functional approach to addressing cyber risk, with engagement among internal working groups. AHL's CIO and CISO are members of AHL's management operational risk committee, which reports to AHL's management risk committee, which reports to AHL's board risk committee.

companyName: Apollo Global Management, Inc.

ticker: APO


text: Third-party vendors are vetted through our service delivery program to ensure they have an established cybersecurity program. We have also engaged our managed security provider to manage a supply chain defense subscription that will help obtain visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the IT Department thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.

companyName: W. P. Carey Inc.

ticker: WPC


text: Please see the risk factor captioned "Information technology failures and cyberattacks could affect us significantly" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: New Fortress Energy Inc.

ticker: NFE


text: As part of the above processes, we engage with a third-party to review our information security program and related cybersecurity safeguards to help identify areas for continued focus, improvement, and/or compliance. Along with these third parties we ensure that the appropriate personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their impact and potential mitigations. We have implemented the following activities (among others) to mitigate risk: • Periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • Background checks prior to hire; • Encryption of data at rest and in transit; • Logging and event monitoring; • Threat detection to monitor for malicious activity and anomalous behavior; • Malware protection and restricting connections to malicious websites; • Data loss protection mechanisms; • Third party penetration testing and internal vulnerability assessments; • Cybersecurity risk assessments of our third-party vendors; • Reviews by internal and external audit of the effectiveness of information security-related internal controls; • Closely monitor emerging data protection laws and implement changes to our processes designed to comply as needed; and • Carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Talkspace, Inc.

ticker: TALK


text: Keeping abreast of new technology and evaluating tools to help respond to threats to cybersecurity in an efficient and effective manner;

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: The Company has a dedicated internal Security Operations Center ("SOC") and a Managed Detection and Response ("MDR") third party service that provides 24/7/365 monitoring of its environment to investigate and respond to security alerts. Log sources are mapped to the MITRE ATT&CK framework to ensure appropriate security monitoring and gap analysis to detect and respond to attacks. Threat intelligence is used with contextual risk approaches to identify threats and prioritize response. Threat hunts operate both proactively and reactively to look for relevant behaviors and indicators of compromise from cybersecurity events or zero-day vulnerabilities. An Incident Response Plan is in place to ensure the timely and effective handing of security incidents. This includes providing the Company with a detailed outline of how to respond to a security incident, team responsibilities, contact information for key resources, definitions for determining the severity and escalation of security incidents, and pre-built playbooks to respond to the most common types of security incidents including ransomware. Incident response and escalation plans are tested and reviewed for improvements at least annually. An incident response retainer with an approved third party is contracted to assist in responding to security incidents and to conduct forensic investigations involving the potential compromise of sensitive data or information assets. All employees are required to complete privacy and information security awareness training upon joining the Company and on an annual basis. This includes incident response training on how to communicate potential or actual incidents.

companyName: Beacon Financial Corp

ticker: BBT


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating and Corporate Governance Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee receives reports from management on potential cybersecurity risks and threats. Our management plays a key role in assessing and managing our material risks from cybersecurity threats, with designated positions and committees equipped with the necessary expertise. The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel and threat intelligence and other information obtained from governmental, public, or private sources.

companyName: CHEETAH NET SUPPLY CHAIN SERVICE INC.

ticker: CTNT


text: Risk Management and Strategy Identifying, assessing, and managing material cybersecurity risks is an important component of our overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the parent company and our subsidiaries.

companyName: LOEWS CORP

ticker: L


text: The Cybersecurity Steering Committee, in collaboration with delegates from our business and functions, is responsible for implementing the Company's enterprise-wide cyber security and information security strategy, employee training and compliance, and managing policies and processes for the Company's information technology standards, product security, and privacy. As a member of the Cybersecurity Steering Committee, our Vice President of Software Development provides experience devising effective cybersecurity management practices in the areas of both software and product development, including risk evaluation, impact assessment, security threat modelling, cybersecurity mitigation strategies, residual risk acceptability and methodologies for security risk verification. He has led the integration of our medical device software into some of the largest hospital and research institutions in the world in compliance with the extensive cybersecurity requirements of these institutions. In addition to utilizing internal Company resources, the Cybersecurity Steering Committee also regularly consults with external advisors and specialists regarding opportunities and enhancements to strengthen its practices and policies. We also engage with third-party consultants to manage the infrastructure and security of our information technology landscape.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT


text: The board of trustees considers cybersecurity as part of its broader consideration of business strategy and enterprise risk management. Our board of trustees has delegated to the Audit Committee the responsibility of overseeing the Company's risk management program, including the cybersecurity program. The Audit Committee, which consists solely of independent trustees and whose chair has information security experience, receives quarterly updates with respect to the cybersecurity program. As part of its oversight, the Audit Committee may, for example, receive updates regarding assessments of our alignment with certain industry cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, cybersecurity training provided to company personnel, results of penetration testing, and revisions to the incident response plan and business continuity plan. The Audit Committee provides regular briefings to the full board of trustees with respect to the Company's cybersecurity program. Additionally, we provide an annual update on the cybersecurity program to the full board of trustees, which has included our CTO and third-party cybersecurity experts in recent years.

companyName: American Homes 4 Rent

ticker: AMH


text: The Company utilizes third-party service providers, such as cloud services, in connection with its operations, and its information security department implements a third-party risk assessment and review process in connection with those services to evaluate security posture and risk. The Company also engages third parties to assist in its cybersecurity management efforts, such as the leading incident response provider mentioned above and another provider to perform continuous monitoring and regular penetration testing of its information security systems and environment. The Company and its personnel also actively engage with a number of other key vendors, industry participants and intelligence and law enforcement communities as part of its information security and cybersecurity efforts.

companyName: OMNICELL, INC.

ticker: OMCL


text: Our internal cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and report to our CEO. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company.

companyName: Ainos, Inc.

ticker: AIMD


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also executing controls and procedures that provide for the prompt escalation of certain material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such material incidents can be made by management in a timely manner.

companyName: Velo3D, Inc.

ticker: VELO


text: Information security risks for large institutions like us have continued to significantly increase and we and the third parties with which we do business have been, and we expect will continue to be, the target of cyber attacks and other information security threats. These risks are an unavoidable result of conducting our business, and managing these risks is an inherent part of our business activities. We describe the cybersecurity risks we face in " Risk Factors — Operational and Model Risk."

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have established processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, including cloud service providers and AI system. We conduct due diligence assessments and evaluate contractual obligations to mitigate potential risks arising from third-party relationships.

companyName: EXPONENT INC

ticker: EXPO


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.

companyName: EchoStar CORP

ticker: SATS


text: For the fiscal year ended June 30, 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: S&W Seed Co

ticker: SANW


text: Our cybersecurity policies, standards, processes and practices are regularly assessed by external consultants and auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, for the last three years, we conducted an independent cyber security risk assessment to assess our cybersecurity maturity against the NIST cybersecurity framework. The results of significant assessments are reported to management and our Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments. For more information on our cybersecurity risks that may materially affect us, please refer to the section titled "Risk Factors – Security breaches of borrowers' confidential information that we store may harm our reputation, adversely affect our results of operations and expose us to liability – and – If our risk management framework does not effectively identify and control our risks, we could suffer unexpected losses or be adversely affected, which could have a material adverse effect on our business." While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner, which could result in substantial expenses and reputational damage.

companyName: OppFi Inc.

ticker: OPFI


text: To date we have not identified any cybersecurity threat or incident that has materially affected the Company or our financial position, results of operations and/or cash flows, but we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. We continue to invest in the cybersecurity and resiliency of our networks and enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors" included in this Annual Report.

companyName: Zevia PBC

ticker: ZVIA


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Advisor and other third-party service providers. The Investment Advisor manages our day-to-day operations and has implemented a cybersecurity program that applies to us and our business.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: The Company currently does not have operations in which the internet is utilized. Once operations commence we will contract with a data center that is current on their cyber security policies and practices.

companyName: Real Brands, Inc.


text: Our CISO has experience managing a risk-based, effective, practical and appropriately-sized cybersecurity program that aligns with our strategic business objectives and leads our cybersecurity team, which is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has 29 years of experience in the technology domain and 25 years of experience in information security. Our CISO is also a CISSP (Certified Information Systems Security Professional) and a CIPP/E (Certified Information Privacy Professional/Europe).

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: As a regulated financial institution, we have designed our cybersecurity program based on the requirements of the Gramm-Leach Bliley Act of 1999 and Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool. Our processes for identifying, assessing and managing material risks from cybersecurity threats rely on the FFIEC Cybersecurity Assessment Tool as well as recurring audits and assessments of our cybersecurity program and controls. As part of our cybersecurity program, we have developed an incident response plan based on industry-standard cybersecurity frameworks, with procedures for responding to and remediating a cyber-incident. We also review and test our incident response plan through simulations and assessments. Further, we employ recurring security awareness training for employees and produce recurring security awareness material for our customers.

companyName: First Foundation Inc.

ticker: FFWM


text: Information Systems Security The Sponsor's CISO oversees the maintenance of an inventory of information systems ("Information Systems") employed by the Sponsor of the Trust either directly or through a vendor. Information Systems include electronic and physical systems used to store, process or transmit information either directly or through a service provider. This includes all methods of data processing, transmission, and retention, both electronic and physical. Electronic Information Systems used by on behalf of the Trust must, at a minimum, adequately address security elements consistent with applicable state and local regulatory requirements and best practices pertaining to: Data Storage, User Access, and Data Transmission.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Once the CSIRT has been activated, incidents are reported to a subcommittee of the Company's disclosure committee, which consists of certain senior executives and leaders throughout the company and is charged with making disclosure determinations.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Legal Sign-off 2.24.25 Security Professional (CISSP) and Certified Information Security Manager (CISM). He has extensive experience in multiple security domains, including security operations, incident detection and response, security architecture, identity and access management, cloud security, vulnerability and threat management, application/product security, policy, and compliance.

companyName: XEROX CORP


text: Cyberattacks represent a threat to water, wastewater and electric utility systems. There have also been increasing threats to the information that companies maintain that have resulted in unauthorized disclosure of private customer, employee, director and corporate financial information.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: In accordance with our program and processes, we regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program and also utilize audits by our internal audit team and third-party consultants, table-top exercises, penetration and vulnerability testing, data recovery testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We are continuously working to evolve our oversight processes to mature how we identify and manage cybersecurity risks, and we perform periodic maturity assessments to measure our progress.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Cybersecurity risk management is overseen by the Company's Vice President of Information Technology and Security who is supported by full-time information security staff. These individuals have experience across industries that, among other things, develops and distributes information security policies, standards and procedures; engages in employee cybersecurity training; implements security controls; assesses security risk and compliance posture; monitors and responds to security events; and executes security testing and assessments The Vice President of Information Technology and Security advises the executive team on the development and implementation of the information security program.

companyName: Vireo Growth Inc.

ticker: VREOF


text: All of our Custodians have SOC type 2 reports that the Company has reviewed and we get regular bridge reports from our Custodians to help ensure the controls are being maintained. Our Custodians maintain their own insurance policies to cover our loss, which is in addition to the policies that we maintain ourselves. We currently have two qualified Custodians that we have approved for our treasury use and we are in the process of onboarding a third as part of our risk management process.

companyName: UPEXI, INC.

ticker: UPXI


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on applicable banking regulations, including the Interagency Guidelines Establishing Information Security Standards ("Interagency Guidelines"), and the Cybersecurity Assessment Tool (CAT2). Our cybersecurity program in particular focuses on the following key areas: Process

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: Our CIO supports the management team in staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Douglas Emmett Inc

ticker: DEI


text: Management, including the CFO, regularly updates the Audit Committee on our cybersecurity processes, material cybersecurity risks and mitigation strategies. The Audit Committee reports all material cybersecurity risks to the Board.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: Material Risks from Cybersecurity Threats The company has not identified any risks from cybersecurity threats that have materially affected us. We do not believe that risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the long term. Like many companies, we have experienced cybersecurity incidents, including data breaches and temporary service interruptions. However, as of the end of 2023, known cybersecurity incidents, individually or in aggregate, have not had a material impact. Nevertheless, there can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our IT infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems. Such cybersecurity incidents can cause the loss of critical or sensitive information, including personal information, and could give rise to legal liability and regulatory action under data protection and privacy laws. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Information system service interruptions or breaches, including significant cybersecurity incidents, could give rise to legal liability and regulatory action under data protection and privacy laws and adversely affect our business and operations."

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially impacted or are reasonably likely to materially impact us, including our business strategy, results of operations, or financial condition, to date. However, we face ongoing and increasing cybersecurity risks, including from threat actors that are becoming more sophisticated and effective over time, and we can provide no assurance that there will not be incidents in the future or that past or future threats or incidents will not materially affect us, including our business strategy, results of operations, or financial conditions. For additional information regarding these risks, please refer to Part I, Item 1A, "Risk Factors," in this Form 10-K, including, but not limited to, the risk factor entitled "A network or data security incident may allow unauthorized access to our network or data, harm our reputation, create additional liability, and adversely impact our financial results."

companyName: Palo Alto Networks Inc

ticker: PANW


text: To assess the effectiveness of the General Partner's cybersecurity programs and to mitigate exposure, the General Partner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the General Partner's cyber insurance provider. The General Partner also undertook a table top exercise designed to identify and mitigate issues and train personnel.

companyName: NESTOR PARTNERS


text: We have not had any cybersecurity incidents that we believe have materially affected or are likely to materially affect the Company. GOVERNANCE.

companyName: READING INTERNATIONAL INC

ticker: RDI


text: Additionally, we regularly engage consultants and other third parties to evaluate specific priority areas of our information and cybersecurity program based on our assessment of the current cybersecurity threat landscape. Examples of our engagement with consultants include external penetration testing, application security assessment and cybersecurity incident response tabletop exercises.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: We have updated our comprehensive cybersecurity and data protection policies and procedures to address any cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: We depend on digital technologies to perform many of our services and process and record financial and operating data. At the same time, cyber incidents, including deliberate attacks or unintentional events, have increased. To assess and manage cybersecurity risks impacting our industry and our business, we have implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect our systems, identify and remediate vulnerabilities in our systems and related infrastructure on a regular basis and monitor and mitigate the risk of data loss and other cybersecurity threats. As part of our cybersecurity risk management program, we have a designated in-house team principally responsible for managing cybersecurity risk assessment processes, security controls and response to cybersecurity incidents or intrusions. We have also engaged third-party consultants to conduct penetration testing and risk assessments.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: Our cybersecurity risk management and strategy activities are overseen by executive management, made up of the IT Steering Committee and Chief Information Officer. Our Chief Information Officer has over 25 years of experience in information technology and security as well as extensive experience working in and leading our information systems and technology function. The IT Steering Committee and Chief Information Officer receive regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation through the management of, and participation in, the cybersecurity risk management and strategy activities described above, and report to the Audit Committee quarterly on any appropriate items.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: During the first quarter of 2024, information security matters reporting, including managing and assessing risks from cybersecurity threats, have been established under the oversight of the Audit Committee of the Board or the "Audit Committee." The Audit Committee also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. Our security efforts are managed by a team of IT professionals who oversee the daily responsibilities of managing cybersecurity identification and threats. Going forward, the Audit Committee receives regular information security updates from management, including our Chief Technology Officer, who the board designated as the Chief Information Security Officer. The management team has established a quarterly rhythm to keep the Board and Audit Committee apprised of identified risks, ongoing risk management and changes in procedure to ensure transparency in the Company's governance over cybersecurity.

companyName: DUOS TECHNOLOGIES GROUP, INC.

ticker: DUOT


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, distributors, and supply chain management resources. We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers, such as reviewing security questionnaires, reviewing the vendor's written security program, conducting risk assessments for certain vendors, arranging security assessment calls with the vendor's security personnel, reviewing security assessments, or imposing contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify and mitigate cybersecurity risks associated with a provider.

companyName: MACROGENICS INC

ticker: MGNX


text: The Incident Response Plan includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company's Chief Operating Officer, Chief Financial Officer, Chief Risk Officer, and our Board Risk Committee.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: Incident Assessment and Response Procedures Upon identification of a potential cybersecurity incident, management initiates a structured initial assessment, guided by predefined criteria to gauge the incident's severity and potential impact. This evaluation is critical for determining the scope of the incident and crafting an appropriate response.

companyName: QHSLab, Inc.

ticker: USAQ


text: We rely on technology, including the internet and mobile services, to conduct much of our business activity and allow our customers to conduct financial transactions on our platform. As a result, our systems and operations as well as those of the third parties on which we rely to conduct certain key functions are vulnerable to cybersecurity incidents, which we have experienced in the past. Although no organization can eliminate cybersecurity and information technology risk completely, w e have a cybersecurity program that includes physical, technological, and administrative controls designed to detect, contain, respond to and remediate cybersecurity threats and incidents and defined processes to assess, identify and manage material risks from cybersecurity threats. These controls and processes include, among others: • maintaining a vulnerability management program that performs regular vulnerability scans and relies on our risk-based information security program to promote coverage of critical areas; • establishing an offensive security team that actively tests our security controls, imitating methods persons trying to achieve unauthorized access might use to identify any weaknesses; • our global privacy program supported by our privacy engineering and privacy legal teams; • maintaining an incident response plan which outlines the roles and responsibilities of key personnel in the event of a cybersecurity incident; • conducting mandatory annual security and privacy training for employees and contractors and, where appropriate, giving employees and contractors role-based training focused on content specific to their role at the Company; • undertaking an annual review of our consumer facing policies and statements related to cybersecurity; • requiring our employees to treat customer information and data with care through policy, practice and contract (as applicable); and • carrying cybersecurity insurance that provides some protection against potential losses arising from a cybersecurity incident.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business, financial condition, or results of operations. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business, financial condition, or results of operations, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: SPS COMMERCE INC

ticker: SPSC


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect Registrant, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts Registrant's critical operations, service or financial systems. See "Information Technology Risk Factors" under Item 1A. In addition, any unauthorized access to sensitive information or data breaches could be detrimental to Registrant's operations, critical corporate information and reputation and relationships with its customers, vendors, employees, directors and could negatively affect the future of contract awards at ASUS and could result in a termination of one or more of its existing contracts or the assessment of penalties. The cost of responding to a cyber-attack could be significant depending on the severity of the cyber-attack and could go beyond financial costs as operations and services provided by Registrant could be delayed and coordinated resources in response could be significant. Registrant could also be assessed penalties if it is determined that applicable data privacy laws have been violated.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our board of directors, our audit and compliance committee ("Audit Committee"), and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: Fold Holdings, Inc.

ticker: FLD


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition.

companyName: Marpai, Inc.

ticker: MRAI


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through assessments, tabletop exercises and other exercises focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. The Company also engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Company's Chief Information Officer and Audit Committee, and the Company considers adjustments to its cybersecurity processes and practices as appropriate based on the information provided by the third-party assessments and reviews.

companyName: Burlington Stores, Inc.

ticker: BURL


text: Remington Hospitality's IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, Remington Hospitality's IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging consultants to complete a benchmarking evaluation to compare its cybersecurity posture against peers; and (ii) engaging a cybersecurity risk readiness and response company to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: ASHFORD HOSPITALITY TRUST INC

ticker: AHT


text: Our management, represented by senior management, leads the cybersecurity risk assessment and mitigation processes, along with information technology management staff and our third-party business technology partner. Our third-party business technology partner has over 21 years of experience in cybersecurity and information technology. Continuous monitoring and routine meetings are conducted in order for the Company's information technology team and third-party business technology firm to update senior management regarding prevention, detection, mitigation and remediation of any cybersecurity threats or incidents.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Our Audit Committee receives and provides feedback regarding periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding significant cybersecurity threats or incidents.

companyName: Mersana Therapeutics, Inc.


text: We understand the importance of preventing, identifying, assessing and managing material risks associated with cybersecurity threats. Cybersecurity processes to identify, assess and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and are designed to help protect our information assets and operations from internal and external cyber threats and protect employee and customer information from unauthorized access or attack, as well as secure our network and systems. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and are included in the Company's overall risk management system and processes. We have implemented into our operations these cybersecurity processes, technologies and controls to identify, assess and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic internal and external penetration testing by an independent cybersecurity firm to inform our risk identification and assessment of critical, high, medium and minor material cybersecurity threats.

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: Cantor maintains an incident reporting and escalation process in the event of any observed, detected, or suspected events that it believes may qualify as a cybersecurity incident. Risks are identified based on a four-tier system, and tiers are assigned based on the service impact, user impact, financial impact, and security impact that a threat may pose. Cantor's processes include steps to recover our systems and information through established and tested system recovery plans and business continuity plans, each based on the appropriate response associated with the corresponding tier of the identified threat. Cantor's incident response process includes steps to notify key incident management team members who are responsible for communicating with regulatory and other governmental authorities about cybersecurity events as applicable and as required by law. Cantor determines the materiality of such incidents based upon a number of factors including if the incident had or may have a material impact on the respective business strategy, results of operations, or financial condition. This process involves a review of the nature of the incident by Cantor's cybersecurity team as well as other members of management and employees with specialized technological or financial knowledge, as applicable. In the event of a material breach, Cantor has a process for escalation to appropriate members of its senior management, who would, if appropriate, communicate with our management and board of directors or audit committee. These groups would also collaborate in determining the appropriate response to such events and disclosure of any material breach.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: Our Response Team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: American Assets Trust, Inc.

ticker: AAT


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, results of operation, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operation, and financial condition.

companyName: BCP Investment Corp

ticker: BCIC


text: Management of Cybersecurity Matters The Company's management is responsible for assessing, identifying and managing cybersecurity risks, threats and incidents. The Company has no internal IT function and engages third party providers that possess the requisite skills, systems and processes to effectively manage day-to-day IT operations, including cybersecurity. This includes, but is not limited to:

companyName: CAMBER ENERGY, INC.

ticker: CEIN


text: In the last three fiscal years, TVA has not experienced any material cybersecurity incidents. TVA is not currently aware of any potential cybersecurity threats, including as a result of any previous cybersecurity incidents, that may have materially affected or are reasonably likely to materially affect TVA, including its business strategy, results of operations, or financial condition; however, TVA cannot provide assurance that it will not be materially affected in the future by cybersecurity risks or any future material risks. For more information on TVA's cybersecurity related risks, see Item 1A, Risk Factors – Cybersecurity and Information Technology Risks in this Annual Report.

companyName: Tennessee Valley Authority

ticker: TVE


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards, and practices. This training includes certain periodic and mandatory training for Company personnel regarding cybersecurity threats as well as the handling and processing of payment cards. All periodic and mandatory training is scaled to reflect the roles, responsibilities and information systems access of applicable personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, accounting, risk management, internal audit, and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's ERM function, the Company's Chief Information Officer, other members of management, and relevant management committees and councils, including the Company's Cyber Security Committee.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our head of Information Technology. Such individuals have collectively over 6 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: Molecular Templates, Inc.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The Company performs quarterly penetration tests against both externally facing assets and internal assets. The Company also performs monthly and ad-hoc vulnerability scanning. Lastly, we collaborate with the NSA CCC to scan our public facing assets for vulnerabilities against the latest advanced persistent threats. The results of such assessments, audits, and reviews are evaluated by management and reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to include cybersecurity considerations in our decision-making processes at every level. Our IT Security Program ("ITSP") Group and third-party service providers seek to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and coordinate with our overall risk management framework.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: We not only focus on cybersecurity threats directly facing CommScope but also those that might affect us through one of the many third parties we do business with, including suppliers and customers. Our procurement and security teams have a shared process to review the cybersecurity risk of our suppliers, performing an assessment during onboarding, requiring them to sign up for contractual security requirements, emplacing security controls and investigating third-party incidents as appropriate.

companyName: Vistance Networks, Inc.

ticker: VISN


text: Upon a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of the Chief Legal Officer, Chief People Officer & SVP of IT, Associate General Counsel, Head of Information Technology, and a member of the Financial Reporting team, meets to make an initial assessment. If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our President/Chief Executive Officer, Chief Financial Officer, Chief Legal Officer & Corporate Secretary, and Chief People Officer/SVP of IT.

companyName: EyePoint, Inc.

ticker: EYPT


text: 1. Data Breaches: A breach of our information systems could lead to unauthorized access to customer or employee data, resulting in reputational harm and legal liabilities.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Our board of directors oversees our cybersecurity risk and receives a quarterly cybersecurity report and an update from management which includes additional discussions of any relevant issues related to the understanding of technology and cybersecurity risk that may be relevant at any given time. This report includes, among other things, information regarding our current security posture and on-going cybersecurity events. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to our Board.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to effectively mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.

companyName: Inogen Inc

ticker: INGN