text: The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. The Company leverages a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience in response to cyber-related events and supporting the integrity of components and systems used in its products and services.

companyName: General Motors Co

ticker: GM


text: The Company's risk management framework includes its risk appetite statement, which is approved annually by the Board's Risk Management Committee, and defines acceptable levels of risk-taking and risk limits and establishes the governance and oversight activities over risk management and reporting. Management monitors and measures the Company's risk appetite using a quantitative risk scorecard consisting of risk appetite metrics and associated limits reported to the Board's Risk Management Committee on a quarterly basis. The Company's risk appetite statement includes specific information security metrics and associated limits. These limits also inform how matters, including cybersecurity incidents or threats, are escalated to specific members of management, appropriate senior operating committees (including the ISRC and/or ERC), and/or the Board of Directors or appropriate Board committee. The Board's Risk Management Committee oversees the Company's risk profile relative to its risk appetite and compliance with risk limits.

companyName: US BANCORP \DE\

ticker: USB

secItem: Item 1C


text: The Company's Chief Executive Officer ("CEO"), through the appropriate reporting channels, is responsible for the cybersecurity risk management program. The Company's information technology department is responsible for developing and implementing the Company's cybersecurity policies, procedures, and strategies; overseeing the Company's cybersecurity risk assessment process; and monitoring the Company's cybersecurity risk profile. Our VP, Information Technology, who leads the information technology department, has over 15 years of experience with information security and information technology matters.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: Reporting directly to our Chief Operating Officer, our Data Protection Officer has primary day-to-day responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. With close to 25 years of experience in the fields of cybersecurity and data protection, our Data Protection Officer joined the Company in 2019.

companyName: THOR INDUSTRIES INC

ticker: THO


text: Our Chief Information Officer ("CIO") is directly responsible for the implementation of our cybersecurity risk management program. Our CIO is additionally primarily responsible for our overall information security, strategy, policy, security engineering, architecture, operations and cybersecurity threat detection and the management of cybersecurity risk. Our CIO has over 30 years of experience in the fields of finance, technology and cybersecurity, including relevant prior senior leadership positions held with Marriott International, where he served as Global Chief Information Officer. The CIO meets with our Chief Executive Officer ("CEO") on a weekly basis and regularly reports to our senior management, as well as directly to our Board of Directors and the Audit Committee, regarding our cybersecurity risk and risk management.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: As we are fully externally advised, we are reliant on our external advisor's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our advisor's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.

companyName: New York REIT Liquidating LLC


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The Classified Business and Security Committee of the Board of Directors is briefed by senior leadership, as appropriate, on the cybersecurity of classified programs and the security of our classified business supply chain. Other than oversight of classified business cybersecurity, the full Board retains oversight of cybersecurity because of its importance to Lockheed Martin and the heightened risk in the aerospace and defense industry. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership, the Board, and regulators, as appropriate.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: Despite the Company's security measures and programs, our information technology and infrastructure are vulnerable to cybersecurity incidents, intrusions and attacks, any of which could have a materially adverse effect on our business, financial results, revenues and competitive position. See "Part I—Item 1A. Risk Factors" for further discussion of these risks.

companyName: AtriCure, Inc.

ticker: ATRC


text: We aim to incorporate industry best practices for companies of our size and financial strength throughout our cybersecurity program. Our Board has ultimate oversight of cybersecurity risk. The Interim Chief Executive Officer reports to our Board. Our Interim Chief Executive Officer provides periodic updates to the Board on (1) any critical cybersecurity risks; (2) ongoing cybersecurity initiatives and strategies;

companyName: Sonnet BioTherapeutics Holdings, Inc.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations, or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third party vendors' information systems. For more information, please see Part I, Item 1A "Risk Factors."

companyName: Butterfly Network, Inc.

ticker: BFLY


text: We also seek to oversee and identify potential cybersecurity and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party's cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We also collaborate with select third-party suppliers to develop and align incident response plans.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: EOG's cybersecurity team is led by EOG's group director, information systems and senior manager, information systems security, who each have over seven years of experience overseeing EOG's cybersecurity processes and strategy.

companyName: EOG RESOURCES INC

ticker: EOG


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LCI INDUSTRIES

ticker: LCII


text: We have established robust incident reporting policies and procedures. These include training employees and contractors to recognize and report incidents promptly upon discovery, as well as preparing and submitting follow-up written reports.

companyName: CSP INC /MA/

ticker: CSPI


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: We maintain cybersecurity insurance coverage in amounts that we believe are adequate to address any incidents such as data destruction, extortion, theft, hacking, denial of service attacks and other such incidents.

companyName: Karman Holdings Inc.

ticker: KRMN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical systems, information and other information technology assets (including those of third parties upon which we rely).

companyName: EVERBRIDGE, INC.


text: Our information technology consultants help identify, assess and manage the Company's cybersecurity threats and risks. Our information technology consultants identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans and; vulnerability testing.

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls;

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Wisconsin Electric Power Company WEC Energy Group's CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. WEC Energy Group's CAO has 25 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in WEC Energy Group's IT/OT cybersecurity, data security, and physical security environment and risk profile.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: Below is a discussion of our risk management and approach to governance as it relates to cyber risks. For additional information on the impact of cyber risks, refer to Part I, Item 1A. Risk Factors, of this Form 10-K, under the heading "Data Privacy and Security Risks".

companyName: TRINET GROUP, INC.

ticker: TNET


text: Senior leaders of global cybersecurity, governance, risk and compliance teams are responsible for assessing and managing our material risks from cybersecurity threats. They also have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-specific expertise in SaaS technology, regulatory compliance knowledge, previous leadership roles in cybersecurity or related fields, as well as a track record of successfully implementing effective cyber risk mitigation strategies.

companyName: BOX INC

ticker: BOX


text: The Company does not, and will not, have the resources to institute cybersecurity measures until such time as it may be able to enter into a successful merger transaction.

companyName: CONECTISYS CORP

ticker: CONC


text: Risk Management & Strategy: The Company is committed to maintaining strong and meaningful privacy and security protections for our customers' information by making available sufficient human and financial resources to protect against and monitor cybersecurity threats. These threats have increased as the use of technology has proliferated in our core business. Examples include internet banking, mobile banking, remote deposit capture, work from home accommodations, and advance function ATMs.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: The Company's cybersecurity and data privacy programs are implemented and overseen by the Company's Chief Information Security Officer ("CISO"), the Executive Vice President, Chief Digital and Technology Officer, and senior management. The CISO reports to the Chief Digital & Technology Officer, who in turn reports to the CEO. Collectively, our CISO and senior management team have extensive experience in information security and information technology risk management, including cybersecurity. Our CISO has led our enterprise-wide cybersecurity risk management, strategy, policy, standards and processes since 2018, and t he information security team responsible for managing and implementing the Company's cybersecurity and data privacy programs has many years of valuable business experience effectively addressing cybersecurity risks and developing related robust policies and procedures.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: ORIX USA maintains a Cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of Cyber Incidents. The plan and run books are tested annually through Cybersecurity tabletop simulations where incident response technical, and executive team members go through real - world scenarios focused on current Cyber threats. ORIX USA's Cybersecurity incident response plan provides for escalation of identified Cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of Cybersecurity threats and incidents, assessment of Cybersecurity risk profile or certain newly identified risks relevant to our company, and evaluation of the adequacy of our Cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when the notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including BFIM and the Principal Executive Officer and Principal Accounting and Financial Officer of the Assignor Limited Partner.

companyName: BCTC V ASSIGNOR CORP


text: We have a defined security policy that is reviewed on an annual basis. We have established response procedures for cyber-security incidents and tests the procedures on a periodic basis. We provide robust computer-based cybersecurity and wire fraud / phishing awareness training to all new employees as well as training to existing employees on an annual basis. We have not experienced material information security incidents in the last three years nor have we incurred any material expenses related to penalties and/or settlements related to a material breach nor have we been materially affected or reasonably likely to have had a material adverse effect on us, our business strategy, results of operations, or financial condition. Nevertheless, we do carry a cybersecurity insurance policy.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: Our CIO's experience includes over 25 years of experience in information technology leadership roles, including ProBuild Holdings, the nation's largest supplier of building materials; Gates Corporation, a manufacturer/distributor of automotive parts; and Nupremis Inc., a start-up that provided hosting and managed services. We also have a dedicated CISO, whose team is responsible for management of PFG's Information Security Program, policies, compliance with internal/external mandates, strategy, security incident planning and response. Our CISO reports to our CIO and has more than 20 years of cybersecurity, technology assurance and controls experience, including 18 years as a Certified Information Systems Security Professional (CISSP) and 13 years at PFG in information security and compliance. Our CISO joined PFG following several years of experience working in information security consulting, including Big 4 Accounting and Assurance, as well as working in industries including banking and finance.

companyName: Performance Food Group Co

ticker: PFGC


text: iii. Reporting to the Board There is a structured reporting mechanism in place through which our Chief Financial Officer regularly updates our audit committee on cybersecurity risk management efforts, thus facilitating informed oversight by the board. Further, our Chief Financial Officer and IT personnel monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to our audit committee and/or board of directors when appropriate.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: The cybersecurity risk management program is designed to provide ongoing detection and monitoring of cybersecurity threats and intrusions. The Company's Information Technology ("IT") department leads the identification of critical applications, systems and data, and possible points of failure and takes a proactive approach to the detection of unauthorized activity, intrusion attempts and compromised equipment. The IT department also carries out automated and ad hoc network-based vulnerability, compromise and business impact assessment and guideline compliance scans of our networks, systems and devices to detect vulnerabilities, compromised hosts and compliance failures. We rely on information technology systems provided by third parties, and our IT department implements procedures that seek to identify cybersecurity risks of these third-party providers to whom we outsource certain of our services or functions, or with whom we interface, store or process company, employee or other confidential information. The Company also provides regular information security training to its employees. The Company engages external consultants and other third parties to provide cybersecurity controls assessment relying on the National Institute of Standards and Technology's Cybersecurity Framework and for other advisory support. The Company will continue to take additional steps designed to further protect its networks, information and operations as needed.

companyName: SSR MINING INC.

ticker: SSRM


text: Following these risk assessments, we evaluate whether, and if so, how, to design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. For example, to advance and demonstrate our commitment to data security and privacy, we have achieved four cybersecurity-related certifications under standards promulgated by the International Organization for Standardization (ISO). We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (our "CISO"), who reports to our Chief Information Officer, to manage the cybersecurity-related risk assessment and mitigation process.

companyName: Samsara Inc.

ticker: IOT


text: In addition, the group, under the leadership of the CCO, undertakes the appropriate internal notifications of any such occurrence, and responsive activities, to the General Counsel, Chief Executive Officer, Chief Financial Officer and Board of Directors.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: We partner with third parties to support and evaluate our cybersecurity program. The Services provided by third-parties span areas including cybersecurity maturity assessments, incident response, penetration testing and consulting on best practices. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to our data or our systems. Third-party risks are included within our risk assessment of vendors, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of third-party service providers. We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: We have implemented an information security program, which is overseen by our CIO and our Sr. Director, Security & Infrastructure, that consists of controls designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats. Both our CIO and our Sr. Director, Security & Infrastructure each have extensive experience assessing and managing cybersecurity programs and cybersecurity risk across a mix of public and large, private enterprises in the retail space. Our Sr. Director, Security & Infrastructure has over 25-years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Leaders and team members who support our information security program have relevant education and industry experience, including various cybersecurity industry certifications.

companyName: Murphy USA Inc.

ticker: MUSA


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats. Our Cybersecurity Leadership Team inventories and prioritizes information security risks and evaluates material risks from cybersecurity threats, and reports those periodically to the Audit Committee of our Board of Directors, which evaluates our overall enterprise risk.

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: We integrated our cybersecurity program into our overall risk management processes by instituting corporate measures and protocols to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel. Our employee guidelines also addressed employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.

companyName: EQC Liquidating Trust


text: our cybersecurity program maturity is benchmarked annually against global industry standards and norms. The result serves as a guide to identifying evolving risks, prioritizing improvements, and enhancing the program;

companyName: TE Connectivity plc

ticker: TEL


text: PECO maintains, internally publishes, and annually reviews its cybersecurity policies and procedures, which includes an incident response plan. Additionally, PECO engages with external cybersecurity experts to conduct annual penetration testing, provide monitoring of the environment, conduct tabletop exercises, and for dedicated incident response and advanced forensics capabilities. In addition to internal audits and external reviews, assessments have included the NIST CSF, cybersecurity maturity assessment, and Center for Internet Security Benchmarks to identify opportunities for enhancement.

companyName: Phillips Edison & Company, Inc.

ticker: PECO


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board of Trustees, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.

companyName: Ellington Credit Co

ticker: EARN


text: Our board of directors holds oversight responsibility over Cryoport's risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its audit committee. Our audit committee oversees the management of Cryoport's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds quarterly meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.

companyName: Cryoport, Inc.

ticker: CYRX


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business.

companyName: Q32 Bio Inc.

ticker: QTTB


text: Koppers Holdings Inc. 2023 Annual Report Information security policies at Koppers lay out the guardrails that ensure compliance with the program. Examples of guardrails set within the information security policies at Koppers include application of the principle of least privilege when granting access (the principle that a user or entity should only have access to the specific data, resources and applications needed to complete a required task), logging and monitoring activity of privileged accounts, authorized physical and logical access to information technology (IT) systems, and requiring maintenance of confidentiality of non-public information. Standard operating procedures (SOPs) ensure accuracy and completeness of various IT tasks being performed throughout the organization. SOPs include incorporating data processing agreements in contracts, commissioning and decommissioning of IT systems, granting role-based user access, patch management, and change management. Training is conducted regularly for all employees who interact with Koppers IT systems. Specialized training is also conducted for employees who deal with sensitive data. Security systems have been deployed to manage vulnerabilities within the IT environment, and periodic penetration tests validate the Koppers security posture.

companyName: Koppers Holdings Inc.

ticker: KOP


text: Our risk management program is led by senior management who meet regularly to assess, analyze, evaluate, propose, and approve treatment and or remediation projects for identified information technology risks (including cybersecurity risks and vulnerabilities). Our Executive Vice President of Global IT and eDiscovery Operations, who is a member of the Risk Subcommittee, reports to our Board of Directors via our Chief Executive Officer. Our Vice President and Chief Information Security Officer (VP, CISO) is responsible for the identification of cybersecurity risks and the performance of vulnerabilities assessments. Risks and vulnerabilities are assigned to key stakeholders and senior management staff who possess the technical know-how to own these identified risks and vulnerabilities. In accordance with this process, the VP, CISO collaborates and works closely with risk owners to ensure the timely remediation and treatment of risks and vulnerabilities.

companyName: KLDiscovery Inc.


text: We rely on our Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We rely on our Advisor's risk management program and processes, which include cyber risk assessments.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: We recognize the importance of maintaining the trust and confidence of the customers we serve, our business partners, employees and our shareholders and are committed to protecting the confidentiality, integrity and reliance of our business operations and systems. Effective data protection and cyber security practices, including responsible stewardship of our intellectual property and the secure processing, storage, maintenance and transmission of critical information by us and other third parties with whom we do business is vital to our operations. We have adopted policies and procedures with an intended design to identify, assess and manage risks associated with cybersecurity threats.

companyName: Priority Technology Holdings, Inc.

ticker: PRTH


text: Our executive management, the Audit Committee, and the Board of Directors are notified of any significant cybersecurity incidents through an escalation process that is established in our incident response plan. Pursuant to that plan, upon detection incidents are first reported to and assessed by the Information Security Team. Depending on the nature and severity of an incident, and considering the actual or potential impact, significance, and scope, the plan calls for the Information Security team to notify the executive team, who may in turn notify the Audit Committee and Board of Directors, regarding the detection, mitigation, and remediation of cybersecurity incidents.

companyName: ITERIS, INC.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: Our data access procedures require completion and authorization of access request forms to request, change, or delete access privileges to Information Systems containing Medium or High Risk Information Assets. We perform checks for segregation of duties conflicts and only grant the minimum necessary and least privilege access to users based upon their role. When users are reassigned, promoted, or separated, their access privileges are reviewed and, if necessary, updated in a timely manner. We also perform periodic reviews of user privileges and require training for users with access to Medium or High Risk Information Assets.

companyName: Clene Inc.

ticker: CLNN


text: For a description of the risks from cybersecurity threats that may materially affect us, see the risks described in the section titled "Risk Factors" contained in Part I, Item IA of this report, including under the headings "Security incidents, improper access to or disclosure of our customers' data or other cybersecurity incidents may harm our reputation and materially and adversely affect our business."

companyName: ADOBE INC.

ticker: ADBE


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. The Board oversees the implementation of the cybersecurity risk management program.

companyName: VPR Brands, LP.

ticker: VPRB


text: Risks from Cybersecurity Threats Our systems and our third-party vendors' systems periodically experience directed attacks intended to lead to (i) interruptions or delays in our operations or (ii) the loss, misuse or theft of personal information and other data, including confidential information or intellectual property. Based on the information available as of the filing date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, directly or indirectly, that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. For more information regarding our risks from cybersecurity threats, see "Risk Factors — Operational Risks — Any failure in our cybersecurity risk management program, as well as the occurrence of events unanticipated in Brighthouse Financial's or our third-party service providers' disaster recovery systems and business continuity planning, could result in a loss or disclosure of confidential information, damage to our reputation and impairment of our ability to conduct business effectively" and "Risk Factors —Operational Risks — Any failure to protect the confidentiality of customer, employee, or other third-party information could adversely affect our reputation and have a material adverse effect on our business, financial condition and results of operations."

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: The SVP, E&O provides updates to the Audit Committee at its quarterly meetings regarding management of the Partnership's cybersecurity matters, including any new cybersecurity threats, incidents, risks, risk management solutions, trainings or education, infrastructure upgrades, or governance changes.

companyName: Summit Midstream Partners, LP


text: Further information regarding cybersecurity risks can be found in Item 1A. Risk Factors - risks relating to "cyber-attacks or other breaches of information technology security could adversely impact our business and operation".

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Our company has training and awareness programs designed to educate its employees about cybersecurity risks and how to protect our company, our customers and themselves from cyber-attacks and to keep its employees informed about cybersecurity threats and how to stay safe online, including secure access practice, phishing schemes, remote work and response to suspicious activities.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Our Board considers cybersecurity and other information technology risk as part of its risk oversight function. The members of our Board receive reports on our cybersecurity risks and risk management on at least an annual basis from our CIO and CSRO. These reports include reviewing current trends, processes and systems used to mitigate the risk of cybersecurity threats. Our internal audit department also conducts cybersecurity reviews as part of its audit procedures and presents any findings to the Board. We have protocols by which certain cybersecurity incidents would be escalated within the Company and, where appropriate, reported to the Board in a timely manner.

companyName: HORTON D R INC /DE/

ticker: DHI


text: The Bank considers Cybersecurity Risks as part of our strategic planning process. Management and the Board of Directors acknowledge that technology systems, managed both by the Bank and third-party service providers, are critical to business operations and therefore require appropriate risk management.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: The Compliance Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Compliance Committee is composed of board members with diverse expertise, including risk management, technology, health care operations, and finance, equipping them to oversee cybersecurity risks effectively. In addition, each of the directors on the Compliance Committee has completed the Diligent Cyber Risk and Strategy Certification Program, developed by Diligent Corporation, a leading corporate governance technology company, which teaches cyber literacy for corporate directors to effectively govern significant enterprise-wide cyber risks and have meaningful conversations with management.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Our Security Incident Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to executive leadership and the Board of Directors based on an assessment of the risk and other specified criteria. We have established a cyber incident response team to prepare for, mitigate and remediate cybersecurity incidents, which is integrated within our enterprise crisis management framework.

companyName: Waste Connections, Inc.

ticker: WCN


text: We rely on third parties, including cloud vendors, for various business functions. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including security evaluation. Governance.

companyName: iTeos Therapeutics, Inc.


text: Notwithstanding the foregoing efforts, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. No security program can entirely eliminate the risk of human error, such as an employee or contractor's failure to follow one or more security protocols. Like many other businesses, we have experienced, and are continually subject to, cyber-attacks. While these past cyber-attacks have not materially affected or, in our belief, are reasonably likely to materially affect us, future cybersecurity incidents and threats may materially affect us, including by affecting our business strategy, results of operations, or financial condition. See Item 1A., "Risk Factors" for additional details regarding cybersecurity risks.

companyName: APPFOLIO INC

ticker: APPF


text: We also understand the importance of collecting, storing, using, sharing and disposing of personal information in a manner that complies with all applicable laws. Our policies provide explanations of the types of information we collect, how we use and share information, and generally describe the measures we take to protect the security of that information. Our policies also describe how customers may initiate inquiries and raise concerns regarding the collection, storage, sharing and use of their personal data.

companyName: Hanesbrands Inc.


text: Risks from Cybersecurity Threats—Likely Material Impact See the risk factor entitled Cyber-attacks and security vulnerabilities could result in serious harm to our reputation, business and financial condition. in Item 1A, Risk Factors. We do not believe any risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect E2open.

companyName: E2open Parent Holdings, Inc.


text: Our Cybersecurity Program ("Program") is designed from a risk- and compliance-based approach to achieve systemwide resilience and protection across our operations and to ensure the appropriate acquisition, access, use, and/or disclosure of PHI, PII, and payment card information ("PCI"). Our Program employs the National Institute of Standards Technology (NIST) cybersecurity framework and strategy to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. In concert with our Program, the Company's Enterprise Risk Management program builds resiliency in our operations to support continuous delivery of services and considers cybersecurity risks alongside other company risks.

companyName: R1 RCM Inc. /DE


text: Additionally, we conduct periodic risk assessments to identify and monitor against potential cybersecurity threats and incidents, as well as assess for any changes in our business practices that may affect our cybersecurity position. This risk oversight includes identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and certain testing firms.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Our CISO is an experienced cybersecurity senior executive with more than 25 years' experience building and leading cybersecurity, risk management, and IT teams. In performing his role, he regularly reviews enterprise cybersecurity risks, controls, program policy, and processes, including training, oversees policy and program development, implementation and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Our CISO is regularly apprised of enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs, and lifecycle status.

companyName: RTX Corp

ticker: RTX


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program through our overall enterprise risk management program, which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks that may affect us, including cybersecurity risks.

companyName: Cerevel Therapeutics Holdings, Inc.


text: We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data.

companyName: SRx Health Solutions, Inc.

ticker: SRXH


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Chief Information Officer ("CIO"). Our CIO has more than 25 years of digital experience in the biopharmaceutical industry and was previously Senior Vice President Digital at Moderna, Inc., where he was responsible for technology leadership and digital transformation across core operations. Our CIO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our CIO provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Cybersecurity Risk Management and Oversight We have processes for assessing, identifying, and managing cybersecurity risks, integrated into our overall risk management program and information technology function. These processes are designed to:

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: We also use third-party service providers to assist us from time to time to identify, assess, audit and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and certain testing firms.


text: We have developed a robust organizational structure to manage and oversee our information technology and cybersecurity programs, including full-time information security associates dedicated to cybersecurity. These individuals possess relevant experience and expertise in cybersecurity and risk management. Our Director, IT Infrastructure & Security leads our information security, data privacy and protection, and information technology compliance programs. The Director stays current with security related topics by either webinars, training classes or cybersecurity conferences. Guided by management, our information technology teams maintain a detailed Cyber Incident Response Plan ("CIRP") and hold frequent meetings to ensure the proper communication and execution of our security controls and procedures. The Cybersecurity team has various expertise ranging in Associate of ISC2-CISSP certification and extensive training on current security products. The Director, IT Infrastructure & Security regularly reports to the Vice President of Information Technology and maintains ongoing dialog with the reporting structure to our CEO, CFO and COO, and Board of Directors regarding our information security programs. This reporting includes updates on matters evaluated under our CIRP, the current threat landscape, cybersecurity initiatives, and the effectiveness of our cybersecurity programs.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: We experience cybersecurity threats and incidents from time to time. We are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, our financial condition, results of operations or cash flows, and we have not experienced a cybersecurity threat or incident that has materially affected Kroger in at least the last three years. There can be no assurance that cybersecurity threats will not have a material effect on us, including our business strategy, our financial condition, results of operations or cash flows. Please see "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.

companyName: KROGER CO

ticker: KR


text: Our board has final oversight responsibility over cybersecurity-related matters. The full board participates in interactive sessions with management, typically twice a year, dedicated to cybersecurity risks. These sessions, led by our Chief Information Security Officer (CISO), address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, technological trends and information security considerations arising with respect to our peers and third parties.

companyName: HUBSPOT INC

ticker: HUBS


text: Cybersecurity is a significant and integrated component of the Corporation's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Through December 31, 2024, the Corporation has not, to its knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Corporation.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: At the management level, our SVP-GIS is responsible for the assessment and management of risks from cybersecurity threats. Our SVP-GIS has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere and maintains several certifications, including Certified Information Systems Security Professional ("CISSP") from ISC Squared and Certified Information Security Manager ("CISM") from the Informations Systems Audit and Control Association ("ISACA"). Our SVP-GIS leads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection policies and practices across our business and reports directly to our EVP-CIO. Our SVP-GIS's direct reports include a number of experienced information security leaders responsible for various aspects of our security program, each of whom is supported by a team of experienced cybersecurity professionals.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, including our Cyber and Privacy Risk Committee described above, led by our CISO. Our CISO has more than 25 years of technology experience across various disciplines, including 15 years of experience as a CISO in the financial, manufacturing, and CPG industries. He has led our global information security organization for more than five years. In addition to his employment experience in the cybersecurity field, our CISO has a Master of Business Administration in management and operations and a Bachelor's Degree in technology management, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CISO reports to our CIO, who meets regularly with other members of our executive team and provides relevant updates on our cybersecurity program.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: On regular basis, our board of directors receives a presentation on cybersecurity risks from our senior management team, which may, depending on relevance at the time of the report, address topics such as prevailing cybersecurity threats, vulnerability assessments and/or network integrity testing, infrastructure and practice updates, and other considerations applicable to our IT network and related systems and other third-party systems.

companyName: STAG Industrial, Inc.

ticker: STAG


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our Global Information Security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes created by artificial intelligence). This training is mandatory for all employees globally and is supplemented with periodic phishing tests. Additionally, we perform an annual external evaluation of our cybersecurity program using the NIST Cybersecurity Framework.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any.

companyName: Currenc Group Inc.

ticker: CURR


text: Policies and Procedures The Company does not have its own cybersecurity policy, but it contracts with CROs that handle all of its data and software. Our CRO's data systems are 21 CFR 11 (Part 11) compliant, which means that they have implemented controls to ensure the reliability and integrity of electronic records and signatures. Our CRO also runs industry standard antivirus and antimalware software on their networks and have written procedures for cybersecurity management, incident response, backup and recovery, and employee training. We have reviewed the cybersecurity policies and procedures of our CRO and require them to report any cybersecurity breaches or incidents that may affect our data or systems.

companyName: Mitesco, Inc.

ticker: MITI


text: The board of directors oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. They also oversee the response to any significant cybersecurity incidents.

companyName: Balance Labs, Inc.

ticker: BLNC


text: We face significant and persistent cybersecurity risks due primarily to: the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: MIMEDX GROUP, INC.

ticker: MDXG


text: While we have not been subject to cyberattacks and other cyber incidents, we take cybersecurity preparedness seriously. Our risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. We have plans to implement cybersecurity training for all employees upon onboarding, and then annual follow-up training courses to ensure that all employees understand the risk and implications of a cyber event.

companyName: Ispire Technology Inc.

ticker: ISPR


text: We collaborate with our third-party IT vendor to assess the effectiveness of our cybersecurity prevention and response systems and processes and have not had a need to utilize cybersecurity assessors, consultants or other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks or to support any necessary mitigation plans.

companyName: Emmaus Life Sciences, Inc.

ticker: EMMA


text: The NGC, comprised solely of independent directors, is charged with oversight of risks related to global cybersecurity and operational resiliency. The NGC routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments, policies and practices, technology trends and regulatory developments from the Chief Financial Officer ("CFO") and Senior Vice President, Information Technology and Services ("IT&S") Strategy and Business Partnering. The NGC meets separately in advance of each regular Board meeting and when needed in the event of a specific cybersecurity threat, and its Chair regularly reports out to the Board on key matters considered by the NGC. The Board is periodically briefed on related cybersecurity matters from other executives from Legal, Privacy, and IT&S, as well as external experts related to breach management, external attestation of the company's cybersecurity practices and processes, and evolving cybersecurity matters that may inform the company's cybersecurity strategy and approach. The Board has received and will continue to receive cybersecurity training.

companyName: PERRIGO Co plc

ticker: PRGO


text: Like other companies with a large technology footprint and high-profile client base, we are regularly subject to cyberattacks. While certain attacks have been successful, thus far none have had a material impact on our or our clients' operations. In addition, we acknowledge that cybersecurity threats could significantly impact our business strategy, operations, or financial condition. As such, we continue to enhance our infrastructure, monitor for threats, and evaluate our response capabilities as we deploy additional mobile and cloud technologies. Also refer to our discussion of material cybersecurity risks in the "Operational Risk Factors" section of Item 1A, Risk Factors, of this report.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Our security and resiliency organization includes a dedicated cybersecurity function led by our Chief Information Security Officer ("CISO"). As part of our cybersecurity function, the cybersecurity and intelligence response team ("CSIRT") administers a program to monitor, detect, investigate, respond to, and escalate management of internal and external cybersecurity threats and incidents. The CSIRT provides threat intelligence information to our CSO, broader security and resiliency organization, and relevant business units and functional areas.

companyName: Dell Technologies Inc.

ticker: DELL


text: The Company has a Cyber Incident Response Plan ("IRP") which details the Company's policies and procedures in the event of a cyber incident. The Company's IT department, led by Mr. Osbeck, logs all potential cybersecurity incidents reported which are then reviewed by an Incident Response Team ("IRT"), a cross-functional internal team including IT, risk management, legal and other departmental representation as necessary to identify the potential impact of the cybersecurity incident. As needed, the IRT will consult with third party legal counsel and IT advisory firms to appropriately respond to existing cyber threats. In the event a material incident is identified, the Company will report such incidents in compliance with applicable law. Material cyber events, if any, are reported to the Board of Directors as they occur. Additionally, the Chief Compliance Officer provides quarterly updates to the Audit Committee on all cybersecurity matters during the quarter.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: communicate necessary information with respect to material risks to senior executives and, as appropriate, to our directors (3) implement or oversee implementation of appropriate and responsive risk management and mitigation strategies consistent with our risk profile, and (4) integrate risk management into our decision-making.

companyName: Blue Line Protection Group, Inc.

ticker: BLPG


text: Our DDS has more than 20 years of expertise in the information technology sector, with 11 years specifically dedicated to cybersecurity. This experience has fostered a thorough comprehension of cyber threat landscapes, defense strategies, and security technologies.

companyName: WATSCO INC

ticker: WSO


text: Storage and Backup of Source Systems: Implementing robust data storage solutions and backup protocols to ensure data integrity and availability. Policy Management: Developing and enforcing comprehensive security policies that govern all aspects of our cybersecurity efforts. Response Management: Rapid identification and response to security incidents to minimize impact. Software Implementation: Deployment of state-of-the-art security software solutions that complement the security features of the Microsoft cloud ecosystem.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: We, our Sponsor and Advisor maintain a robust cyber incident response plan that includes controls and procedures designed to allow timely and accurate reporting of any material cybersecurity incident. They and we view cybersecurity as a shared responsibility, and they periodically perform simulations and tabletop exercises at a management level and incorporate external resources as well. They provide at least annual information security training program for our Advisor's employees who have access to Company related sensitive or personal information and regularly conduct phishing trainings.

companyName: JLL Income Property Trust, Inc.


text: Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee of our Board of Directors. The Audit Committee of our Board of Directors is responsible for reviewing internal risk assessments with respect to cybersecurity, including assessments of the overall threat landscape and related strategies and investments.

companyName: Nextpower Inc.

ticker: NXT


text: The Company's maintains a Cyber Governance Committee, which meets quarterly, and interfaces with other functional areas within the Company, including, but not limited to, legal, internal audit, accounting, risk management, human resources, as well as external third-party partners. The CISO serves as the chair of the committee, which has been tasked with providing governance and oversight of the Information Security and Management System and to provide governance during major cybersecurity incidents.

companyName: Vestis Corp

ticker: VSTS


text: Recognizing our employees as a vital defense mechanism, we provide cybersecurity, privacy and information-handling training. Additionally, we conduct regular phishing exercises to enhance employee vigilance. Our educational programs aim to raise awareness about cyber risks and teach employees to safeguard the Company, our customers and themselves against cyber threats. These programs inform our workforce about the latest cybersecurity dangers and safe online practices, including secure access, phishing awareness, remote work security and reporting suspicious activities.

companyName: EZCORP INC

ticker: EZPW


text: Day-to day management of cybersecurity threats is conducted by our IT department in conjunction with outside service providers, which is charged with identifying and reporting threats to senior management. On a quarterly basis, cybersecurity is reviewed by our Chief Executive Officer and Chief Financial Officer, who are expected to report to the Audit Committee.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS"), as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. In 2022, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: We collaborate with third party vendors as deemed necessary to assess the effectiveness of our information technology environment, which is inclusive of our cybersecurity prevention and response systems and processes. These third party vendors include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have implemented a third-party cybersecurity risk management process to conduct due diligence on external entities that are determined to be of higher risk due to the Sensitive Information that they have access to, including those that perform cybersecurity services.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: Cybersecurity threats, a security strategy roadmap, and key risk indicators are shared with management and the board of directors through both committee reporting structures and periodic reports of the Chief Security Officer. In addition, management updates our Enterprise Risk Management Committee, as necessary, regarding significant cybersecurity incidents. Our Enterprise Risk Management Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Technology Governance Committee, a management level steering committee also receives periodic reports from the Chief Security Officer for security risk assessments, security program effectiveness evaluations, occurrence and response to cyber incidents, effectiveness of mitigation strategies, regulatory compliance, and external assessments and benchmarking. As part of the Enterprise Risk Management Framework, cybersecurity oversight also utilizes the concept of three lines of defense which allows for multiple challenge response processes to continually mature the cybersecurity program. Cybersecurity best practices from the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") are used to establish, operate, and validate security controls.

companyName: WESBANCO INC

ticker: WSBC


text: Our Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: Cybersecurity Risks We do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed more fully in "Part I. Item 1A. Risk Factors—Risks Relating to Our Business—Our business is subject to various cybersecurity and other operational risks" of this filing, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents may be insufficient. Accordingly, our controls and procedures may not be able to address or limit all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: PJT Partners Inc.

ticker: PJT


text: The Board of Directors of the Company provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Company's Chief Information and Technology Officer ("CITO") and Chief Information Security Officer ("CISO") provide annual written reports and quarterly briefings on the Company's cybersecurity program to the Board of Directors. They also provide quarterly cybersecurity updates to the Audit and Compliance Committee. The reports to the Board of Directors include details and metrics on, among other things, the Company's quarterly Cybersecurity Framework assessment updates, internal and external threat intelligence, quarterly information security program progress, business associate risk assessments and ongoing monitoring, company-wide awareness training, device security compliance, routine resilience efforts including disaster recovery exercises, tabletop security incident response exercises, and cyber penetration tests.

companyName: Concentra Group Holdings Parent, Inc.

ticker: CON


text: Our Head of IT oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. Our Head of IT also coordinates with our legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our management team is informed about the effectiveness of the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes.

companyName: RYVYL Inc.

ticker: RVYL


text: We recognize the crucial importance of identifying, assessing, and managing material risks from cybersecurity threats. We are committed to implementing and maintaining a comprehensive cyber and information security program to manage such risks and safeguard our systems and data, including the data of our customers.

companyName: COMMUNITY WEST BANCSHARES /


text: We utilize a broad team of in-house information technology and security personnel, as well as third-party consultants, services and software, to help manage our cybersecurity efforts and initiatives. We regularly assess our threat landscape and monitor our systems and other technical security controls. Additionally, we maintain information security policies and procedures, including a breach response plan and maintenance of backup and protective systems.

companyName: AMETEK INC/

ticker: AME


text: The Board of Directors delegates oversight of information technology and cybersecurity to the Audit Committee of the Board of Directors. As part of this oversight, information technology leadership annually provides a detailed cybersecurity update to the Audit Committee. Additionally, on a quarterly basis, the Audit Committee receives a summarized cybersecurity update, including the results of teammate phishing testing programs and the results of the quarterly cybersecurity disclosure questionnaires. In the event of a material cybersecurity incident, the Audit Committee will report such incident to the full Board of Directors.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: IT Manager provides timely reports on cyber security incidents to the FSO, Danny Schoening, who also serves as the CEO and as Chairman of the board of directors. These reports may in turn be presented to the full board depending on the severity of the incident. In the event of a major incident, the Company's Incident Response policy will be executed and the appropriate parties notified.

companyName: Optex Systems Holdings Inc

ticker: OPXS


text: Our cybersecurity function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO and cybersecurity function are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: The Company's policies, practices and technologies allow it to protect its information systems and operational assets from threats. The Board of Trustees and its Finance and Audit Committees continue to provide substantial and focused attention to cyber and system security. The Finance Committee of the Board of Trustees is responsible for oversight of the Company's enterprise-wide risk s, including risks associated with cyber and physical security, and the Company's programs and practices to monitor and mitigate these risks.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: Monitoring Testing and Auditing We monitor the evolving cybersecurity landscape that could result in new or increased cybersecurity threats. We also engage in the periodic assessment and testing of our policies, standards, processes and practices. These efforts include audits, vulnerability and penetration testing, table-top exercises, social engineering campaigns and other internal and external assessments. We evaluate the effectiveness of our information technology-related internal controls annually.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: The Company maintains cyber risk management designed to preserve the security of our data and technology infrastructure. On an annual basis we conduct assessments to identify cyber risks and have developed plans on how to address any such risks for remediation of vulnerabilities.

companyName: Linkhome Holdings Inc.

ticker: LHAI


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Novo Integrated Sciences, Inc.

ticker: NVOS


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors.

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: The audit committee of the board of directors oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee.

companyName: Brookfield Oaktree Holdings, LLC

ticker: OAK-PA


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense is led by our management-level Enterprise Risk Committee which governs our technology and operational risk tolerances, including cybersecurity and third and/or fourth party provider risks. This committee includes the Information Security Officer and is co-sponsored by the Chief Information Officer and the Chief Operating Officer. These individuals have relevant financial, technical, and business degrees, hold relevant certifications, and each have over 20 years of experience in their respective areas of expertise, with a minimum of 10 years in leadership roles, including multiple years at financial institutions. The Committee is responsible for escalating key risks to our Management Risk Committee, which includes all members of our Executive Leadership Team.

companyName: AMERICAN NATIONAL BANKSHARES INC.


text: Management provides cybersecurity-related legal, regulatory, compliance, risk, and relevant industry and internal threat updates to the Board of Directors on a quarterly basis, or more frequently as needed. The reports provide information regarding the state of the Company's information security program, the nature, timing, and extent of cybersecurity incidents, if any, and the Company's resolution to such matters.

companyName: DIODES INC /DEL/

ticker: DIOD


text: Our Cybersecurity team also provides reports to the Board's Digital Transformation Committee. The Digital Transformation Committee is charged with oversight of the Company's omni-channel development and digital transformation to enhance membership and stockholder value. In this capacity, the Digital Transformation Committee oversees the Company's design and implementation of various IT systems, with emphasis on maintaining a secure digital environment.

companyName: PRICESMART INC

ticker: PSMT


text: We regularly experience cyberattacks and other incidents and will continue to experience varying degrees of attacks and incidents in the future. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents (including the Cybersecurity Incident), that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however we cannot guarantee that material incidents will not occur in the future.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: Oversight responsibility for information security matters is shared by the Board (primarily through the Audit Committee) and senior management. The Audit Committee oversees the company's cybersecurity and information security program and receives periodic updates from senior management on cybersecurity and information security matters. The Director of Global Information Technology or key members of the executive leadership team update the Audit Committee periodically on the cybersecurity landscape, including the status of ongoing threats and company initiatives.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Trusted partners are an important part of our cyber risk management program. We partner with leading cybersecurity advisors and service providers to conduct periodic risk assessments and to monitor and maintain the performance and effectiveness of security controls used in our environment.

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: Both management and the Company's board of directors are involved in the oversight of risks from cybersecurity threats. The Company's information security program is designed to ensure that management and the board of directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) the Company's efforts related to the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: DallasNews Corp


text: Our cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered, and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the source of the communication. Any such communications are then subject to quarantine or removal depending on the severity of issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business. If our applications fail or our software does not successfully block a malicious electronic communication, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Multi-factor authentication We utilize a third-party consultancy to provide services including security audits, CISO, risk management and response strategies. This consultancy provides the Chief Technology Officer, who is responsible for leading our cyber security strategy, guidance on policy, standards and processes alongside managing the risk management process.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Our information technology systems are equipped to detect directed and non-directed attacks such as viruses and malware that can lead to interruptions and delays in the sale and service of our Delivery Systems and Consumables, general business operations, as well as loss, misuse of data, or theft of intellectual property, confidential information, and personal information (of third parties, employees, providers, and end consumers). However, as of the date of this report, these incidents have not had a material impact on our systems or business operations. Any significant disruption to our business operations or access to our systems could lead to a decline in operational effectiveness, result in a loss of our providers, and adversely affect our business and results of operation. In addition, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. For more information about the cybersecurity risks that we face, see the risk factor entitled, "We are increasingly dependent on information technology, and if we are unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, our operations could be disrupted" in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K.

companyName: Beauty Health Co

ticker: SKIN


text: We also engage other consultants and other third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: The audit committee holds regular meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.

companyName: Triller Group Inc.

ticker: ILLR


text: Our corporate information security team is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current Senior Director of Information Security has extensive information technology and program management experience. The corporate information security organization manages an enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this effort will be our technical solution that we are implementing that will provide near real time monitoring of our data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.

companyName: RideNow Group, Inc.

ticker: RDNW


text: To operate our business, we utilize certain third-party service providers to support a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.

companyName: Gentherm Inc

ticker: THRM


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, BKV engages with external experts, including, but not limited to a managed security service provider ("MSSP"), the Cybersecurity Operations Center ("CSOC") team to evaluate, monitor, and test BKV's cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, IRP testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements. Third-party experts have assisted BKV in conducting cross-functional tabletop exercises and quarterly strategic meetings as well as developing comprehensive remediation plans following cybersecurity assessments.

companyName: BKV Corp

ticker: BKV


text: The role of the Board of Directors with respect to our cybersecurity program is one of oversight of management, and the Board has delegated primary oversight authority over the program to the Audit Committee. The Audit Committee oversees these risks as outlined in its Charter, which mandates reviewing the company's information technology framework, practices, and implemented controls to monitor and mitigate IT risks.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is responsible for containing the cybersecurity incident, consistent with the procedures in the incident response plan.

companyName: W. P. Carey Inc.

ticker: WPC


text: At least annually, we conduct information security awareness training for all employees. In addition, we have retained a third-party vendor to provide regular online awareness training modules for our employees. Each module contains a video extract followed by a short quiz.

companyName: Silk Road Medical Inc


text: We address cybersecurity risk with input from our employees and Audit Committee. The Audit Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a universal view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation. Our information technology (IT) security team reviews enterprise risk, including management-level cybersecurity risks annually.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: Management Oversight Senior management's Technology Committee includes the CIO, the CISO and other senior executives who oversee the Company's enterprise IT infrastructure and ensures that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The Technology Committee, the CIO and the CISO periodically provide cybersecurity reports about our Cybersecurity Program to senior management's Executive Committee and the board of trustees and its Risk Committee.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, product candidates and our broader enterprise IT environment. • A team principally responsible for managing: (a) our cybersecurity risk assessment processes, (b) our security controls, and (c) our response to cybersecurity incidents. • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model. • Threat intelligence that informs our third party IT service provider and us about new vulnerabilities and risks that require timely intervention or remediation. • Cybersecurity awareness training of our employees, incident response personnel, and senior management. • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Rallybio Corp

ticker: RLYB


text: As a result of these factors, the Company has adopted a strategic multi-year cybersecurity plan. This plan is not meant to be all encompassing as the cybersecurity landscape shifts and evolves, and the Company is continually assessing its risks and the evolving cybersecurity threat landscape. This plan includes implementing additional and/or fortifying existing defenses and capabilities necessary to protect and preserve the integrity of the Company's information assets and mitigate the risks to the Company's business operations. As part of this plan, the Company requires regular cybersecurity training for all employees and periodically conducts tests to assess employee comprehension and evaluate training effectiveness.

companyName: Veris Residential, L.P.


text: To ensure the continued effectiveness of our information security controls, we regularly engage both internal and external experts to evaluate our program. The results of these evaluations are reviewed by senior management and reported to the Board. In addition, we proactively collaborate with key vendors, industry peers, and relevant government and law enforcement entities to remain informed about new threats and best practices. This integrated approach enables us to continuously refine our cybersecurity posture, helping protect the confidentiality, integrity, and availability of our systems and data, as well as evaluate and mitigate the risk of threats from third parties.

companyName: NEOGENOMICS INC

ticker: NEO


text: Mobile device management software monitors security events via a Security Information and Event Management platform, managed by a detection and response provider. Mobile device management software is employed with the objective of protecting corporate email and data on mobile devices and is designed to prevent unauthorized data transfer.

companyName: BCTC IV ASSIGNOR CORP


text: We aim to incorporate industry best practices for companies of our size and financial strength throughout our cybersecurity program. Our Board has ultimate oversight of cybersecurity risk. The Chief Executive Officer reports to our Board. Our Chief Executive Officer provides periodic updates to the Board on (1) any critical cybersecurity risks; (2) ongoing cybersecurity initiatives and strategies; (3) applicable regulatory requirements; and (4) industry standards. The Chief Executive Officer also notifies the Board of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Sonnet BioTherapeutics Holdings, Inc.


text: Technical Safeguards The Company's cybersecurity program evaluates new threats to learn new attacker techniques, adopt defenses and implement new safeguards to protect our information systems from cybersecurity threats. These safeguards are evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Independent assessments of the safeguards by external third-party consultants, which also include the detection of threats, are evaluated and improvements to systems are incorporated.

companyName: CPI Card Group Inc.

ticker: PMTS


text: We have processes designed to protect our information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks. Our cybersecurity strategy includes the use of managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform periodical penetration testing and other logical, physical and technical controls designed to deter, prevent, mitigate and respond to cybersecurity threats. Further, our information systems include continuous alert plans, and we provide periodical cybersecurity reminders to our employees to emphasizes the importance of adherence to our security policies.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: The governance of our cybersecurity efforts is overseen by the Audit Committee, which includes individuals with experience in technology and cybersecurity. The board regularly reviews and guides our cybersecurity policies and practices. Management plays a critical role in implementing these policies and in the day-to-day management of cybersecurity risks. They are empowered with the maintenance, communication and enforcement of cybersecurity policies and employ proactive measures to improve cyber security through review of various third party cyber tools for potential implementation. Our Head of IT and CFO are responsible for overseeing the implementation of cybersecurity strategies and ensuring compliance with regulatory standards. In addition to our in-house expertise, the Company employs independent external auditors and an outsourced internal audit team, who regularly test and asses our cybersecurity controls. Any cyber incidents that occur are escalated to the CFO to facilitate resolution. Any incident determined to be material is discussed with the Audit Committee and communicated to the company's internal and external auditors as well as the company's third party virtual environment service provider, when relevant).

companyName: INNOVATE Corp.

ticker: VATE


text: Our cybersecurity strategy and program are led by our Executive Vice President of Technology and Chief Security Officer ("CSO"), who reports to the CEO. Our CSO has over 25 years of experience in technology and cybersecurity leadership positions and has authored several security-related books and numerous patents, IP standards, and security research publications. He has served in various capacities on various technology working groups and standards setting organizations including the Internet Architecture Board and the Internet Engineering Task Force. Our CSO manages a converged security, engineering and operations organization that helps to ensure that cyber and other security priorities are appropriately integrated throughout technology and operations, as well as more broadly across the Company. Our CISO, Chief Information Officer ("CIO"), Chief Technology Officer ("CTO") and the head of architecture and engineering report to our CSO. These and other experienced employees lead the teams responsible for implementing various parts of our cybersecurity program.

companyName: VERISIGN INC/CA

ticker: VRSN


text: Our Board oversees our risk management efforts and has created a dedicated cybersecurity committee to specifically oversee our cybersecurity risk policies, plans, and programs. The cybersecurity committee typically meets at least quarterly and at each regular meeting, management, including from our Chief Information Security Officer (CISO), provides an update to the committee regarding our cybersecurity risk management program, including with respect to plan design, recent cybersecurity incidents (if any), and general cybersecurity developments.

companyName: SailPoint, Inc.

ticker: SAIL


text: The CISO partners closely with the Legal, Privacy and TRC teams, allowing for coordination with respect to policy design and providing domain expertise for incident response, as well as setting strategy. The CISO's updates to the overall risk management strategy and policy incorporate real-time operating metrics from the Company's technology environment as well as industry knowledge from team members and consultants, internal and external auditors, participation in professional peer networks, membership in Information Sharing and Analysis Centers, and commercial threat intelligence. Additionally, on a regular basis, the CISO briefs the CIO and other executive management committee members on emerging threats.

companyName: Walgreens Boots Alliance, Inc.


text: We back up our systems and data to mitigate the impact of a cybersecurity event that would impact our ability to operate or result in the loss of data. We partner with strategic managed cybersecurity service providers to supplement the capabilities of our internal team. We periodically test, evaluate and refine our CIRP in response to identified risks.

companyName: JBG SMITH Properties

ticker: JBGS


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial.

companyName: TEL INSTRUMENT ELECTRONICS CORP

ticker: TIKK


text: Under the direction of AEI Capital Ltd., the Company has strategically repositioned itself and established a wholly-owned subsidiary, CapForce, which has launched a new business offering listing sponsorship and consultancy services to international companies seeking to list their securities on securities exchanges. Additionally, CapForce contemplates entering the financial technology industry with a focus on developing and supporting advanced digital investment banking activities, cross-border securities trading, advanced computational model-enabled investment banking advisory, asset management services, and FinTech-enabled capital table management. As part of this plan, risk management processes have been implemented to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection/onboarding process and a review of SOC 1 reports on an annual basis and other relevant security attestations, where applicable.

companyName: CapForce Inc.

ticker: OPGN


text: The Information Technology Team has processes designed to keep us apprised of the different threats in the cybersecurity landscape – this includes working with consultants, discussions with peers at other companies, and reviewing government alerts and other news items. The team also regularly monitors our network(s) to identify security risks.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO