text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company with our information technology partner regularly engages assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the VPBO who shares data with the SLT, Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Longeveron Inc.

ticker: LGVN


text: Employing robust encryption and anonymization technologies and other cybersecurity monitoring and auditing systems to fortify our cybersecurity framework, including through our Online Banking Enhanced Security Program, which requires the authorized users on a customer's account to be validated and employs multi-factor authentication (MFA), which requires each of our retail and commercial customers to authenticate their identities by entering a secure access code that our MFA system automatically generates and sends to the customer each time there is an attempted login to the customer's online banking account;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC

secItem: Item 1C


text: Caterpillar's board has oversight for risk management with a focus on the most significant risks facing the Company, including strategic, operational, financial and legal compliance risks. The board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which our cybersecurity processes are an integral component.

companyName: CATERPILLAR INC

ticker: CAT


text: Furthermore, our Board of Directors, both collectively and through its Risk Committee, holds responsibility for overseeing risk management, including cybersecurity risks. In this capacity, the Board and the Risk Committee, supported by management and third-party cybersecurity advisors, ensure that the risk management processes devised and executed by management are adequate and operational as intended. Annually, the Board reviews and approves our information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy, and business continuity planning policy. These policies are developed and implemented by our management team. To fulfill their duties, the Board receives regular updates from the Risk Committee regarding cybersecurity risks and management's endeavors to prevent, detect, mitigate, and address any cybersecurity incidents, at least quarterly.

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. Although the size and scope of our operations is limited compared to larger global operations, we are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial condition and results of operations. In that regard, we have increased our investment in information systems by hiring a Director of Technology in 2024 to replace limited outsourced services previously utilized.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: The Chief Financial Officer, who is responsible for assessing and managing our cyber-risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The Chief Financial Officer has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: Engage Third-Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Hilltop engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements. In particular, each year we engage a firm to perform penetration testing. We do not allow the same firm to be engaged for more than three years in an effort to obtain diversity in methods of testing. Additionally, at least every two years, we engage a firm to perform a red-team exercise for a simulated cybersecurity event.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Role of Management Our CIO defines and administers our cybersecurity risk management strategy. The CIO possesses both academic and industry experience, including leading multiple global retail and technology companies through technology implementation and modernization utilizing industry best practices. Our CISO reports to the CIO and directs, coordinates, plans and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy. The CISO possesses academic and industry certifications and experience in leading and managing information security programs, modernization and risk remediation work with multiple global companies, in addition to expertise in state and federal law enforcement cyber investigations. The CISO briefs the CIO regularly on current cybersecurity matters and relevant issues across the cybersecurity threat landscape. The CIO and CISO regularly report to our senior leadership team, as well as our Board of Directors and designated Board committees, regarding our cybersecurity risk management strategy. The CIO and CISO are supported by several dedicated teams of cybersecurity specialists, including teams responsible for vulnerability and penetration assessments, secure design of systems and applications, intrusion detection and monitoring and incident response. In addition, the CIO and CISO coordinate with other internal teams, including Digital, Data Governance, Operations, Finance, Legal and Internal Audit, to ensure our cybersecurity risk management strategy supports the Company's technology strategy and overall business goals.

companyName: Wendy's Co

ticker: WEN


text: Monitoring of Cybersecurity Incidents The Cybersecurity Director implements and oversees our processes for regularly monitoring our information systems. This includes security measures and regular audits to identify potential issues. In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the Cybersecurity Director or their designee, who in turn oversees our assessment of and response to the incident. The Cybersecurity Director is also responsible for informing the Risk Committee of cybersecurity incidents, which in turn has a detailed process for assessing the impacts of incidents and monitoring the Company's mitigation and remediation efforts. Depending on the nature of the incident, this process also provides for escalating notification to senior executives, including the Chair, President, and Chief Executive Officer and to the Board of Directors.

companyName: NUCOR CORP

ticker: NUE


text: Additionally, we developed a business continuity and disaster recovery program to help minimize the impact from certain types of cybersecurity risks. The Company's incident response plans include emergency response, systems recovery, and other plans that would be enacted in the event of certain types of cybersecurity attacks. Our business continuity and disaster recovery plans are updated regularly and tested each year or as needed.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: AutoZone, with the assistance of our managed security service provider, continuously monitors our threat intelligence and events within our digital environments. We employ a variety of methods designed to test and improve our controls, including vulnerability scanning, penetration testing, and attack simulation testing. We have an incident response plan which sets forth procedures to investigate, respond to, contain, and remediate incidents with the support of a cross-functional team. The incident response plan also outlines a process for escalating and communicating incidents to members of management.

companyName: AUTOZONE INC

ticker: AZO


text: Incident reports and learnings from any cybersecurity events; and requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.

companyName: Versus Systems Inc.

ticker: VS


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight of cybersecurity matters and other policies and internal controls regarding information security risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: SITIME Corp

ticker: SITM


text: We are a shell company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software in. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with. We may the future determine to engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our processes.

companyName: Allegro Merger Corp.


text: Our Chief Executive Officer and other members of our senior management as appropriate provide oversight and monitoring of these third parties, who provide regular reports to management. Management provides periodic reports to our Board of Directors as a whole, who are ultimately responsible for the oversight of risks from cybersecurity threats, which include updates on the Company's cyber risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape, and any recommendations for additional internal controls, systems, or insurance coverage for board approval.

companyName: Laird Superfood, Inc.

ticker: LSF


text: Sami Siddiqui. Mr. Siddiqui, age 40, was appointed Chief Financial Officer of RBI in March 2024. Prior to that he served as President, Popeyes U.S. & Canada from September 2020, as President of Asia Pacific for RBI from February 2019 to September 2020 and as Chief Financial Officer for Burger King Corporation from October 2018 to February 2019. From September 2016 to September 2018, he was President of Tim Hortons and from April 2015 to September 2016, he was Executive Vice President, Finance for Tim Hortons. Mr. Siddiqui joined Burger King Corporation in 2013 and served various capacities within the Global Finance groups of Burger King Corporation prior to joining the Tim Hortons team. Prior to that, he worked in the Private Equity Group at Blackstone.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery the formation of a multidisciplinary cybersecurity incident response team; integration of multiple threat intelligence sources into our cybersecurity tools and processes; retention of external cybersecurity threat response resources;

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: The Company's IT systems have been, and likely will continue to be, the target of computer viruses, cyberattacks, phishing attacks, and other malicious activity. While the Company has not experienced a known material breach to date, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that the Company will not suffer additional attacks or incur serious financial consequences or expense in the future. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks Governance

companyName: INVESTORS TITLE CO

ticker: ITIC


text: At the management level, Atkore's cybersecurity program is led by the Company's Vice President - Chief Information Officer ("CIO"), who is a member of the Executive Leadership Team. Atkore's CIO has over 30 years of experience in information technology roles with responsibilities including global cybersecurity strategy, global IT strategy, technology platforms and internal controls. The CIO has a Master of Business Administration from Kellogg School of Management at Northwestern University and a Bachelor of Science in Computer Information Systems from DeVry Institute of Technology. Reporting to the CIO is a Director of Cybersecurity. The current Director of Cybersecurity has over 20 years of experience in information technology roles with responsibilities including cybersecurity and security architecture and engineering. The CIO is supported by the Cybersecurity Steering Committee ("CSC"), a management committee comprising members of the Executive Leadership Team and the leaders of the information technology, legal, finance, human resources, commercial and communications functions that report to the Chief Executive Officer. The CSC supports the CIO in overseeing and managing information security risks and in the event of a cybersecurity incident provides oversight and leadership with respect to incident investigation, mitigation, and remediation.

companyName: Atkore Inc.

ticker: ATKR


text: Our cybersecurity risk management and strategy processes are led by our Chief Information Officer and our Director of Cybersecurity and Infrastructure. These individuals have collectively over 40 years of professional experience in various and progressive roles across multiple, regulated industries involving developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing information security infrastructure and operations, risk assessment and mitigation, and satisfactorily managing multiple industry and regulatory compliance environments. Prior to their current roles, both individuals previously held positions at other large publicly traded organizations where they were the chief stewards of cybersecurity strategy and operations.

companyName: BJs RESTAURANTS INC

ticker: BJRI


text: To mitigate the threat to our business, we take a comprehensive, cross-functional approach to cybersecurity risk management. Our management team is actively involved in the oversight and implementation of our risk management program, of which cybersecurity represents an important component. At least annually, we conduct a cybersecurity risk assessment that evaluates information from internal stakeholders and external sources. The results of the assessment inform our alignment and prioritization of initiatives to enhance our security controls. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are designed to follow nationally recognized frameworks. These include, among other things: security awareness training for employees; mechanisms to detect and monitor unusual network activity; services that identify cybersecurity threats; conducting scans of the threat environment; evaluating our industry's risk profile; utilizing internal and external audits; conducting threat and vulnerability assessments; and containment and incident response tools. We also actively engage with industry groups for benchmarking and awareness of best practices. We maintain controls and procedures that are designed for prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: Board Oversight and Governance Our Board recognizes the important role of information security and mitigating cybersecurity and other data security threats. While the full Board has overall responsibility for risk oversight, it is supported in this function primarily by its committees. The Audit Committee is responsible for reviewing and discussing our policies with respect to risk assessment and risk management, including risks related to cybersecurity and other technology issues. The Board periodically evaluates our cybersecurity strategy to help ensure its effectiveness. Management provides periodic reports to the Audit Committee regarding cybersecurity and other information technology risks, as well as our plans to mitigate cybersecurity risks and to respond to any breaches.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: HTLF has implemented a robust corporate governance framework comprised of the HTLF Board of Directors and its committees; which in turn delegate authority to management for implementation of the risk management program including cybersecurity as an integral component. The corporate governance framework is designed to provide transparency through routine reporting as provided by the CISO to facilitate effective oversight of cybersecurity risk by the Board and executive management. The management committee layer of the corporate governance framework is supported by an Operational Risk Committee which serves as a key forum for the CISO to report quarterly updates on HTLF's cybersecurity risk profile, key metrics and risk indicators used to monitor the operating environment, emerging risks and threats as well as any cybersecurity incidents or events. In addition, the CISO has a routine reporting cadence with the Executive Risk Management Committee and the HTLF Risk Committee on the status of the cyber security management program, including trending of key risk metrics, results of risk assessments, audits and regulatory examinations.

companyName: HEARTLAND FINANCIAL USA INC


text: Chipotle (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: Processes for Assessing, Identifying, and Managing Threats [Text Block] oversight from our board of directors, our advisor and our senior management have implemented an enterprise-wide information security program designed to identify, protect against, detect, assess, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity processes have been integrated into our overall risk management system. To protect our information systems from cybersecurity threats, our advisor uses various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. Our advisor also employs third parties to identify, prioritize, assess, mitigate and remediate information system risks; however, our advisor relies on such third parties to implement security programs commensurate with their risk, and our advisor cannot ensure in all circumstances that their efforts will be successful.

companyName: Moody National REIT II, Inc.


text: Our CISO and Chief Digital and Technology Officer advise the Audit Committee at least four times a year, and the Board of Directors regularly, on our management and oversight of information security risks, including data privacy and data protection risks. The Audit Committee also receives periodic updates on data privacy from members of management within our data privacy group in addition to the regular updates from our CISO. The Audit Committee provides a summary to the full Board at each regular Board meeting of the information security risk review together with any other risk related subjects discussed at the Audit Committee meeting.

companyName: YUM BRANDS INC

ticker: YUM


text: We have a written incident response plan and conduct tabletop exercises to enhance incident response preparedness. We have other response protocols to address operating impacts due to disruptions in services and technology, including scenario run books and mitigation plans for key vendors. Employees undergo security awareness training when hired and annually.

companyName: Designer Brands Inc.

ticker: DBI


text: The CISO reports monthly to the GRC, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel, among other members of senior management, regarding cybersecurity incidents from the preceding month.

companyName: Lazard, Inc.

ticker: LAZ


text: As part of the above processes, we have engaged with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: Independence Contract Drilling, Inc.


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; • A team principally responsible for managing our (i) cybersecurity risk assessment processes, (ii) security controls and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers, and vendors. We employ rigorous vetting processes and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.

companyName: VORNADO REALTY LP


text: Deutsche Bank Group employs a variety of mechanisms to self-identify areas for improvements and control enhancements. These include security testing, security problem management and lessons learned. The effectiveness of Deutsche Bank Group s overall information security program is evaluated on a regular basis by third-party organizations that compare Deutsche Bank Group's approach with industry benchmarks. Deutsche Bank Group s independent internal audit function frequently includes the assessment of security controls in its audit plan.

companyName: RREEF Property Trust, Inc.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and penetration testing firm consultants.

companyName: PlayAGS, Inc.


text: Our cybersecurity management strategy will consist of utilizing a combination of employee education, preventative controls, detective controls and periodic third-party cybersecurity testing. During fiscal year 2024, we began to deploy and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management, with deployment of these tools to be completed prior to March 31, 2025. As part of the service offering from our outsourced IT security services provider, cybersecurity related alerts will be issued to us as relevant situations develop. These alerts will be evaluated in concert with our IT provider and in the event an alert requires action within our environment, such actions will be taken promptly. Our process and cybersecurity posture will continue to be refined based on the results of periodic cybersecurity assessments conducted jointly with our IT provider. Upon implementation of this strategy, we will report on cybersecurity in reports to the Audit Committee on a semi-annual basis.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Core to our security model is our defense-in-depth framework, comprising multiple layers of processes and technologies that help prevent, detect and respond to threats. Our approach to safeguarding against external threats incorporates a suite of preventive technologies, including malicious email blocking, defenses against automated attacks and multifactor authentication. Event monitoring technologies run continuously, detecting suspected intrusion attempts and alerting our Cybersecurity Incident Response Team. We undertake a number of critical security processes to mitigate and protect against cybersecurity risks, which include but are not limited to (i) identity and access management; (ii) security awareness and training; (iii) security operations and monitoring; (iv) change management; (v) disaster recovery/business continuity; (vi) intelligence feeds; (vii) physical security; (viii) third-party vendor security reviews; (ix) vulnerability management/patching; and (x) cybersecurity incident reporting.

companyName: Cigna Group

ticker: CI


text: We have implemented a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Our Chief Commercial Operations Officer and Chief Product Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Commercial Operations Officer has played a pivotal role in enhancing the Company's cybersecurity frameworks across the enterprise through his experience in risk management and IT governance. He has overseen the implementation of data governance and data protection policies and has been instrumental in fostering a culture of cybersecurity awareness across the organization. Our Chief Product Officer has significantly contributed to the Company's cybersecurity efforts through his experience in product management and development. He has been instrumental in integrating security by design and privacy by design into our products, helping to ensure that cybersecurity is a core component of our product strategy. Collectively, they stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal and external security team members, threat intelligence and other information obtained from public or private sources and alerts and reports produced by security tools deployed in the IT environment.

companyName: CALIX, INC

ticker: CALX


text: Enterprise Risk Management, Operational Risk Management, and Technology Management) for oversight and direct management of the overarching risk management framework, which includes the information/cybersecurity risk management program and direct reporting by the Chief Information Security Officer ("CISO").

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: The CIO provides at least quarterly updates on the cybersecurity program, including the results of the cybersecurity risk assessments and the related responses, to the Company's Security Governance Council composed of members of the Executive Leadership Team. The Company has a Cybersecurity Policy, Privacy Policy, Cybersecurity Incident Response Plan, and a materiality assessment framework inclusive of disclosure controls and procedures to assist the Company in satisfying disclosure obligations. The Company continually monitors cybersecurity threats and has a dedicated cybersecurity team in place to identify if any of the threats may lead to a cybersecurity incident. In the event of such an incident, the Company will take decisive measures to thoroughly analyze, contain, and eliminate the threat. The Company reviews cybersecurity incidents through a materiality assessment framework, which provides quantitative and qualitative considerations for evaluating the magnitude of an individual event. Based on the preliminary evaluation of an event, the Company's Cybersecurity Incident Disclosure Committee will convene to assess materiality and determine corrective actions and internal and external disclosure requirements. The Cybersecurity Incident Disclosure Committee is composed of the following individuals: the Chief Financial Officer, Corporate Controller, CLO, and CIO.

companyName: SpartanNash Co


text: While our board of directors has oversight responsibility for risk management generally, the Audit and Finance Committee ("Audit Committee") is specifically responsible for overseeing our cybersecurity risk management program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. Our CISO provides periodic updates to the Audit Committee in this regard, and covers the state of our cybersecurity program, supported by key performance indicators across the range of cybersecurity functions related to risk management and governance, identity and information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents of interest, including those associated with our third-party service providers; the board will be informed promptly of material risks from cybersecurity threats.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: As a financial services company entrusted with the safeguarding of sensitive information, including sensitive personal information, we believe that a strong enterprise cybersecurity program is a vital component of effectively managing risks related to the confidentiality, integrity and availability of our data. While no organization can eliminate cybersecurity and information technology risk entirely, we devote significant resources to a cybersecurity program designed to mitigate such risks.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. On a regular meeting cadence, Coherent's President convenes a senior cybersecurity committee for reporting and planning. The committee consists of the Chief Information Officer (CIO), the Global Head of Cybersecurity, the Vice President of IT Operations, the Senior Director of IT Security, the General Counsel for Technology and Risk Management, and the CRO. Members of partner technology-risk advisory firms and Coherent internal experts from other disciplines participate in committee activities as needed from time to time.

companyName: COHERENT CORP.

ticker: COHR


text: BHE manages cybersecurity threats through its proactive risk management program and cybersecurity awareness program. BHE's businesses are certified against the ISO 27001 standard. The standard is authored by the International Organization for Standardization ("ISO") of Geneva, Switzerland. To achieve the certification, each business must sustain an information security management system that includes a risk-based framework to identify and manage information security risks through a continuous improvement cycle. The risks and controls identified in the system must be approved by top management and confirmed through annual internal and external ISO audits prior to certification.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: Our board of directors, in coordination with the board of director's Technology and Information Security ("T&IS") Committee, oversees the governance of the Company's technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies. The T&IS Committee receives quarterly updates from the CIO, including existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives. Our board also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs on a timely basis.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: The SVP, E&O is supported by critical internal positions within the Company, including but not limited to the Director of Information Technology, Vice President of Operational Technology and dedicated IT and OT resources with cybersecurity responsibilities. The SVP, E&O is further supported by various external parties, including but not limited to cybersecurity service providers, consultants, and other third parties engaged on an as-needed basis.

companyName: Summit Midstream Corp

ticker: SMC


text: Occidental has implemented and maintains processes for assessing, identifying and managing material risks from potential unauthorized occurrences on or through its IT and ICS networks that may result in material adverse effects on the confidentiality, integrity and availability of Occidental's systems and the information residing in those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, written policies, physical safeguards and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting Occidental's systems and the data it collects, processes, stores and transmits as part of its businesses.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: We maintain controls and procedures that are designed to ensure prompt review and escalation of certain cybersecurity incidents so that decisions regarding reporting and public disclosure of such incidents can be made in a timely manner to comply with cybersecurity incident reporting requirements.

companyName: CONSTELLIUM SE

ticker: CSTM


text: Solana, as with all digital assets, can be highly volatile. Management reviews the account balances and the total value held with a custodians to allocate the Company's holdings between multiple accounts and custodians to mitigate risk. We do not use self-storage for any of the SOL treasury assets.

companyName: UPEXI, INC.

ticker: UPXI


text: Although we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or have been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats and incidents we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A. "Risk Factors".

companyName: GRAY MEDIA, INC

ticker: GTN


text: Board delegated primary oversight authority to the Audit Committee who plays a pivotal role in ensuring the effectiveness of our cybersecurity strategy. Through regular updates provided by our leadership team, the committee actively evaluates the organization's cybersecurity posture and aids in prioritizing risk mitigation efforts aligned with our strategic objectives. These updates encompass detailed quarterly reports during audit committee meetings, covering key metrics, ongoing initiatives, and any cybersecurity incidents. Additionally, on an annual basis, the entire board receives updates on the progress of our cybersecurity program and strategy, including insights into emerging risks and industry trends. Moreover, the board benefits from supplementary educational briefings delivered by both internal and external experts, providing invaluable global threat visibility and enhancing the Board's understanding of cybersecurity challenges and opportunities.

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: Our board, through our Nominating and Governance committee and our Information Security committee, together with company executives, IT and security management teams in conjunction with third party service providers who specialize in cybersecurity help identify, assess and manage the Company's cybersecurity threats and risks. We have a quarterly review of cybersecurity by our Nominating and Governance committee and our Information Security committee. We use a number of processes to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example via manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting routine scans of the threat environments, evaluating our and our industry's risk profile, performing annual assessments and penetration testing, evaluating the threats reported to us, coordinating with law enforcement concerning threats, conducting internal and external audits, conducting threat assessments for internal and external threats, reviewing third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, using of external intelligence feeds, conducting third-party- red/blue team testing and tabletop incident response exercises. In addition, we conduct internal tabletop exercise, third party red-team pen testing and OT security monitoring.

companyName: Enovix Corp

ticker: ENVX


text: The CISO, in coordination with the Chief Information Officer ("CIO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee and the Board of Directors when appropriate.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: As of December 31, 2024, the Company was not aware of (i) any cybersecurity incidents, or (ii) any specific cybersecurity threats, that, in either case, materially affected or are reasonably likely to materially affect the business, strategy, results of operations, or financial condition of the Company. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect PSE, including our business, strategy, results of operations, or financial condition. For more information regarding risk from cybersecurity threats, see Item 1A, "Risk Factors" included in this report.

companyName: PUGET ENERGY INC /WA


text: We engage in processes designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: Our cybersecurity program team is led by our CISO (who ultimately reports to the Chief Operating Officer). The cybersecurity leadership team ("CSLT"), which is chaired by our Chief Operating Officer and includes our Chief Financial Officer, Chief Legal Officer, Chief Information Officer, CISO, and Chief Privacy Officer, among others, collaborates with enterprise risk professionals and is supported by an established Information Security ("InfoSec") function responsible for certain aspects of maintaining and monitoring our cybersecurity infrastructure. In addition, our Chief Privacy Officer, who reports to our Chief Legal Officer, manages processes and protections around our sensitive data and facilitates compliance with applicable data protection laws, rules, and regulations.

companyName: ADT Inc.

ticker: ADT


text: The CISO works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: Marpai, Inc.

ticker: MRAI


text: To aid our cybersecurity risk management strategy, we contract with dedicated third-party firms and assessors to identify risks and threats to our organization. These assessments adhere to leading cybersecurity standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework aligning with industry best practices. To oversee incident response and mitigation we utilize our incident response plan and processes to standardize our processes for assessing, identifying, and managing cybersecurity incidents. This includes a comprehensive reporting structure and analysis processes to provide visibility and determine incident business impact. Were a cybersecurity incident to occur, we have also implemented a cross-functional business team to aid in the determination of incident impact, severity, and materiality, with the support of standing external counsel and third-party incident response advisors. Additional to our third-party incident response advisors and support contracts, we undergo regular penetration tests to bolster our readiness in the event of cybersecurity incidents.


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require our key suppliers to comply with our security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us and require each to notify us in the event of any known or suspected cyber incident.

companyName: Qorvo, Inc.

ticker: QRVO


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: BOX INC

ticker: BOX


text: Board of Directors The Board of Directors oversees the management of risks related to the operation of our business. As part of its oversight, the Board receives periodic reports (no less often than annually) from members of senior management on various aspects of risk, including, among other things, our enterprise risk management program, business continuity planning, and cybersecurity. The Audit & Risk Management Committee of the Board of Directors has principal Board-level responsibility for reviewing and assessing our significant risks, including cybersecurity risks, and management's program to assess, monitor, and manage such exposures, and can raise any significant issues pertaining to these items with the full Board of Directors at each Board meeting. As part of this role, the Committee receives updates at most meetings from the Chief Information Security Officer (CISO) on various cybersecurity matters, including material risks and threat trends, mitigation strategies, security incidents, the status of priorities and initiatives, and other related matters of importance, as well as an annual in-depth review of cybersecurity strategy and initiatives for the coming year. The Committee also reviews the results of the independent cybersecurity assessments and compliance evaluations discussed above. In addition to these regular updates, the Committee and the full Board of Directors would also be promptly informed by the Chief Executive Officer of any cybersecurity incidents should they occur, as well as provided ongoing updates from lead members of the incident response teams, including the CISO, regarding any such incidents in accordance with our incident response plan.

companyName: PVH CORP. /DE/

ticker: PVH


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: KINETA, INC./DE


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. Our cybersecurity risk management processes include various security controls, enforcement of company policies, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and other industry-recognized standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program.

companyName: Daseke, Inc.


text: We maintain strategic partnerships with third-party service providers to enhance our security measures and improve resilience against cybersecurity threats. Annual penetration tests are conducted by a third party to evaluate existing security measures and identify improvements. Additionally, the Company engages a managed detection and response service to monitor our information systems environment, identify suspicious activity, and perform actions to prevent or stop attacks.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: Audits, cybersecurity simulations and employee testing results indicate that the Adviser's program is effective in protecting our information. The policies, standards, and guidance are structured to help us respond effectively to the dynamically changing environment of cybersecurity threats, cybersecurity risks, technologies, laws, and regulations. The Adviser modifies its policies, standards, and guidance as needed to adjust to this changing environment.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: While we have previously experienced security incidents related to our data and systems, to date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K titled "We depend on our information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."

companyName: Gritstone bio, Inc.


text: Cybersecurity risk management program, including, but not limited to, the following: • Risk assessment activities/analyses • Risk Committee oversight, documentation, escalation • Reporting of risk issues deemed material to our Audit Committee of the Board of Directors Global Cybersecurity services, including, but not limited to, the following:

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Our suppliers and third-party service providers are subject to cybersecurity obligations. Prior to engagement, we assess the cybersecurity posture of third-party service providers who store, process, or transmit Air Products' information.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Third Party Risk Management. To manage third-party risks, our cybersecurity team evaluates our partners, to provide an additional layer of scrutiny, and supervises and identifies material risks associated with the use of third-party service providers. These processes include a review of security controls and supplier contractual obligations for security and data protection requirements.

companyName: Archer Aviation Inc.

ticker: ACHR


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: As part of its overall risk oversight activities, with respect to cybersecurity risk management, the Board of Directors: oversees the quality and effectiveness of our policies and procedures with respect to our information technology and network provides oversight on our policies and procedures in preparation for responding to any material data security incidents; oversees management of internal and external risks related to our information technology systems and processes.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are dependent upon information technology systems, which are subject to cyber threats, disruption, damage and failure" which disclosures are incorporated by reference herein.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Our management team is charged with managing cybersecurity risk and identifying material cybersecurity risk exposures to our company and carries out this function primarily through our Information Security organization, which is led by our Chief Information Security Officer who has a master's degree in computer science, over a decade of information security leadership, and thirty years of combined IT leadership experience. Additionally, our Cyber Incident Response Plan discussed above calls for the establishment of a management Impact Assessment Committee, which consists of key leadership representatives from the organization and is convened on an ad hoc basis to assess the detailed business impact of a cybersecurity incident. The Impact Assessment Committee is led by our Chief Information Security Officer and includes key representatives from the Company's functional groups, including human resources, ethics and compliance, labor, privacy, internal audit, finance, communications, legal, risk and accounting. The Impact Assessment Committee receives updates and communications from the Security Operations Center on a fixed cadence determined by incident severity and follows our pre-established escalation framework provided by our Security Incident Response Plan to communicate with and include executive leadership, outside counsel and our Board of Directors, as appropriate. The Impact Assessment Committee works with our internal and external legal counsel to determine and facilitate appropriate communications with our Board of Directors.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our global cybersecurity team consists of multidisciplinary Information Technology ("IT") resources from key areas and locales led by our Global Director of Cybersecurity. They are primarily responsible for delivering comprehensive reporting to executive management and auditors, addressing a wide array of cybersecurity threats, assessments, findings and future direction and strategy.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: To date, we do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected our business strategy, results of operations, or financial condition. However, the sophistication of cyber threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cyber incidents and protect our systems and information may not successfully protect against future cyber incidents, which could materially affect our business strategy, results of operations, or financial condition. For additional information on certain risks associated with cybersecurity, refer to the risk factors related to cybersecurity and information technology systems in "Part I, Item 1A. Risk Factors."

companyName: TE Connectivity plc

ticker: TEL


text: TIAA has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Nuveen Global Cities REIT, Inc.


text: We have implemented and maintain a cybersecurity program that is aligned with the NIST Framework and reasonably designed to protect our information and to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Third Party Risk Assessments The Company conducts information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and its standard terms and conditions contain contractual provisions requiring certain security protections.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: In the event of, or the reasonably likely threat of, a cybersecurity incident, our cyber response procedures outline the tasks and timeline for the escalation of the incident to key members of the organization, including the information technology team, business unit management, and Albemarle executives and other key management. These individuals would participate in a special event management plan activation meeting to gain an understanding as to how the incident was detected and analysis of the incident. Each member of management involved would be responsible for assessing the risks, impact, and necessary response as determined by their role. The procedures include key considerations each manager should consider in their assessment as well as their responsibility for involvement in remediation efforts and post-incident strategic reviews. Specific legal and executive role procedures include the assessment of necessary internal communication and external reporting. The Chief Executive Officer, with the support of other executive officers, is responsible for approval of incident reporting and informing and updating the Board of Directors.

companyName: ALBEMARLE CORP

ticker: ALB


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to Company data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.

companyName: Laser Photonics Corp

ticker: LASE


text: Our cybersecurity risk management program is integrated into our enterprise risk management processes, and is informed by recognized cybersecurity industry frameworks and standards, including the National Institute of Standards and Technology. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information systems and assets (for example, B&W business information and information resources such as computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multi-factor authentication and malware defenses. We also work with internal stakeholders to integrate foundational cybersecurity principles throughout our operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including in some cases to our executive team. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.

companyName: Marker Therapeutics, Inc.

ticker: MRKR


text: We have established a cybersecurity risk management program that is integrated into our overall enterprise risk management system and provides us support in assessing, identifying, and managing material risks from cybersecurity threats. Our enterprise risk management program is fully updated annually and periodically updated and supplemented as new risks and opportunities are identified by management, including those related to cybersecurity risks. Our longstanding information security risk program is structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other global and local standards and regulations. This program includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls.

companyName: RALPH LAUREN CORP

ticker: RL


text: Beyond technologies, processes, and controls, the Company's cybersecurity program also includes exercises designed to sustain a high level of awareness and readiness across its employee base of the risks that threat actors pose to the Company. Whether it is through the Company's monthly company-wide cyber training; its frequent in-house phishing exercises, regular tabletop exercises with the Company's Board of Directors, management, and employees; or its cyber business continuity planning sessions, the Company strives to provide education so its employees can be a positive force in the protection of the Company's systems.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: The Enterprise Risk Management Committee provides reports to the audit committee of our board of directors on a quarterly basis to support its oversight of our cybersecurity risk management. Chief Information Security Officer.

companyName: Informatica Inc.

ticker: INFA


text: Our Vendor Management Policy contains policies and procedures to follow when utilizing external third-parties and due diligence is performed over new vendors prior to engaging in services. Vendor Management ensures key risk components are mitigated based on acceptable Company standards. Any third parties used in any cybersecurity processes are vetted through our vendor management process.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: The Audit Committee of our board of directors provides direct oversight over cybersecurity risk and provides updates to the board of directors regarding such oversight as deemed necessary. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: OCULAR THERAPEUTIX, INC

ticker: OCUL


text: In the past three years, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the risk factor entitled "Our information technology systems may be subject to breaches, cyber-attacks or other disruptions that could, among other adverse consequences, cause us to violate laws and regulations and could adversely affect our business, results of operations, financial condition, cash flows, reputation or competitive position."

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: The Company is not aware of any material breaches in its cybersecurity operations during the three years ended December 31, 2024. Further, the Company has not identified any specific cybersecurity threats likely to materially affect the Company's business strategy, results of operations, or financial conditions. For more information, please also refer to our risk factor related to our reliance on third-party service providers under Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: DYNEX CAPITAL INC

ticker: DX


text: Cybersecurity risk management is an integral part of the Company's overall enterprise risk management framework. Our technology team, together with third-party information security experts, has designed our cybersecurity risk management program with industry best practices in mind and to provide a roadmap for handling cybersecurity threats and incidents, including threats and incidents associated with our use of third-party service providers, and facilitate cross-functional coordination within the Company. This roadmap includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: The security of the Company's products, services and corporate network is a key priority both for the growth of the Company's business and its responsibilities as the leading financial guaranty insurance company. The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Risks and Outlook we have not experienced any material cybersecurity incidents during the fiscal year ended April 30, 2025, we acknowledge that evolving threats such as ransomware, social-engineering attacks and supply-chain vulnerabilities could materially disrupt our operations or expose sensitive information. We continue to: Invest in strengthening endpoint and network defenses;

companyName: ALEXANDER TECH CORP


text: Impact of Risks from Cybersecurity Threats We do not believe that any of the risks from cybersecurity threats we have faced to date have materially affected the Company, our business strategy, results of operations or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. See Item 1A. Risk Factors - We are subject to risks related to information technology systems, including cyber-security risks; successful cyber-attacks or technological malfunctions can result in, among other things, financial losses, the inability to process transactions, the unauthorized release of confidential information and reputational risk, all of which would negatively impact our business, financial condition or results of operations.

companyName: Liquidia Corp

ticker: LQDA


text: Security Program Overview The Company's cybersecurity program is framework-based, risk-focused, and metrics-driven. It is supported by a comprehensive set of policies, procedures, and standards based on the NIST cybersecurity framework, encompassing administrative, physical, and technical safeguards. As a service provider and technology partner, we continuously undertake initiatives to address the following areas, ensuring a comprehensive security program.

companyName: CINCINNATI BELL INC


text: Our Chief Information Security Officer, or CISO, regularly reports to the Technology and Cybersecurity Committee on an at least quarterly basis and leads the Company's overall cybersecurity function. The Technology and Cybersecurity Committee receives regular reports from our CISO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Technology and Cybersecurity Committee members also receive regular presentations on cybersecurity topics from our CISO, supported by our internal security staff, as part of the Board's continuing education on topics that impact public companies.

companyName: SolarWinds Corp


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents or current cybersecurity threats that have materially affected or are reasonably likely to materially affect us. Despite the cybersecurity and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. These threats and incidents originate from a variety of sources, including hackers, cybercriminals, nation-states, insiders, or other third parties. These threats and incidents target our network, our operational technology or other systems, our data and information, our employees, our customers, our partners, or our third-party service providers and vendors. Some of our third-party service providers have experienced security breaches. Should we be unable to successfully detect and defend against cybersecurity threats in the future, we may experience significant expenses, potential investigations and legal liability, liquidated contractual damages, a loss of current or future customers, and reputational damage. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: The Company's Chief Information Officer has been serving in this role for the company for 17 years and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees an internal information security team, which works in partnership with the Company's internal audit department to review information technology-related controls with our external auditors as part of the overall internal controls process. The Chief Information Officer, who is in regular communication with the information security team, reports regularly to the Chief Executive Officer regarding vulnerabilities, new and developing threats, and compliance matters and also reports to the Audit Committee. The Audit Committee receives reports from the Chief Information Officer on a periodic basis, and more frequently, as needed, regarding cybersecurity-related matters. Such reports include updates with respect to existing and new cybersecurity risks, cybersecurity risk management and mitigation, cybersecurity incidents, as applicable, and key information security initiatives and recent developments.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: We assess our cybersecurity risk management program at least annually and regularly review our cyber incident response plan. Our processes and policies also include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: Information Security Management. To prepare and respond to incidents, the Bank maintains implemented multi-layered cybersecurity protocols, integrating people, technology, and processes as part of the Bank's Information Security Program. The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity, third -party vendor management and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities, deploys current information security technologies and ensures awareness, accountability, and oversight for data protection throughout the Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Company engages qualified third -party vendors, consultants and independent auditors to, among other things, conduct network penetration tests and perform cyber/information security audits.

companyName: BankFinancial CORP


text: Our Board of Directors has delegated oversight of cybersecurity risks to our Nominating and Governance Committee. Executive management, inclusive of our Vice President of IT ("VP of IT") in conjunction with our National Vice President of Finance ("NVP of Finance"), provides regular updates to the Nominating and Governance Committee including any updates to our program in response to new or changed cybersecurity risks, as well as ongoing metrics around the effectiveness of our existing cybersecurity strategies.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition as of December 31, 2023. For more information, please see the risk factor disclosures included in Item 1A of this Annual Report on Form 10-K.

companyName: Scilex Holding Co

ticker: SCLX


text: Members of our Cybersecurity Management, including our CISO and our CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Members of our Cybersecurity Management, including our CISO and our CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Further, the Committee will, from time to time and as needed, engage subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Audit Committee of our Board of Directors (the "Audit Committee")

companyName: Ispire Technology Inc.

ticker: ISPR


text: The Audit Committee of our Board of Directors is responsible for board-level oversight of risks from cybersecurity threats, and the Audit Committee reports back to the full Board of Directors about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about the Company's practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates, from our Chief Technology Officer.

companyName: SONIDA SENIOR LIVING, INC.

ticker: SNDA


text: Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside partners to assist us in overseeing our cybersecurity risk management program.

companyName: Village Bank & Trust Financial Corp.


text: We have an information security program in place to safeguard our information systems and protect our confidential data. This cybersecurity risk management program is integrated into our broader enterprise risk management framework, under a Risk Committee that is led by our VP, Strategy & Transformation and includes our Chief Technology Officer, who is responsible for cybersecurity and information technology matters, General Counsel and other business and strategy leaders. The Risk Committee identifies, assesses, and manages enterprise level risks facing the Company, taking into account likelihood of occurrence and potential impact. The Risk Committee reports to our Executive Committee and this process is primarily overseen by the Audit Committee of our Board. Our Executive Committee consists of our executive officers and other senior members of management.

companyName: QXO BUILDING PRODUCTS, INC.


text: Our incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Privacy and Security Officer, Director of Information Technology, Vice President, Manufacturing and Commercial Operations and Information Technology and other designated individuals. Our Privacy and Security Officer works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: NeuroPace Inc

ticker: NPCE


text: We perform information technology supplier risk assessments on a periodic basis. Information technology suppliers to SS&C that access, process or store personal information or other customer data are assessed and are also subject to periodic due diligence procedures.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: Our Board of Directors consider cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: AMERICAN AIRLINES, INC.


text: Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CIO and the CISO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews the company's cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. Cecil D. Haney, a member of the audit committee, brings to the board valuable insights into cybersecurity, systems planning, and crisis and risk management. In addition to regular updates to the audit committee, we have protocols by which certain cybersecurity incidents are escalated within the company and, where appropriate, reported in a timely manner to the board and the audit committee.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: Management of the Company plays an integral role in assessing and managing risks from cybersecurity threats. The Company has a dedicated technology services department, led by the Company's Chief Technology Officer. The Company also has an in-house internal audit staff that is involved in risk management of cybersecurity threats. The Company solicits input from key employees regarding the overall risk environment, including cybersecurity threats. The Company requires all employees to complete cybersecurity training semi-annually and periodically facilitates penetration tests on the Company's systems.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: We have a cybersecurity risk management program consisting of policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these policies and procedures into our overall risk management systems and processes. Our cybersecurity policies and procedures are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We routinely assess material risks from cybersecurity threats and regularly assess and update our cybersecurity risk management program in response to emerging trends and changes in our operations.

companyName: Block, Inc.

ticker: XYZ


text: Key Management Personnel As disclosed above, the primary responsibility for our overall information security strategy and directive resides with our Senior Information Technology and Enterprise Applications Manager with reliance on our information security team. With over 50 years of cumulative experience in the field, ExchangeRight's information security team brings a wealth of expertise to our organization. The team includes individuals with backgrounds in Information Technology, Data Science, Enterprise Applications, and Business Development. Their in-depth knowledge and expertise are instrumental in developing and executing our cybersecurity strategies.

companyName: ExchangeRight Income Fund


text: Access Management. Utilizing a least privilege, need-to-know access methodology, access is controlled through a centralized user access management function responsible for the provisioning, transfer and de-provisioning of users' access. Access management also performs routine reviews of application and systems access to ensure access remains appropriate. For third-party hosted environments, access management works with security architecture to ensure single sign-on controls are employed or additional factors are utilized to prevent unauthorized access to these environments.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining incident response plans and policies, conducting periodic risk assessments, implementing security standards and certifications, encrypting data, maintaining network security controls, segregating data, maintaining physical security controls, system and data monitoring tools, periodic employee security training and simulation testing, penetration testing, and maintaining cybersecurity insurance.

companyName: Poseida Therapeutics, Inc.


text: We are actively integrating cybersecurity risk management into our broader enterprise risk management framework. This integration is designed to promote a company-wide culture of cybersecurity awareness and risk management. Our risk management team, in collaboration with external consultants, is assessing and addressing cybersecurity risks in alignment with our operational and business needs. This ongoing integration ensures that cybersecurity considerations are increasingly embedded in our decision-making processes at every level.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: Our Chief Digital Information Officer has managerial responsibility for our cybersecurity risk program and is a member of our cybersecurity incident response team. Our Chief Digital Information Officer has over 27 years of experience in information technology, including leadership roles responsible for cybersecurity and data privacy. He graduated from California State University, Bakersfield with a Bachelor of Science degree in Computer Science.

companyName: California Resources Corp

ticker: CRC


text: Our CDO has primary responsibility for, and works collaboratively across the Company to implement, our cybersecurity risk management program designed to protect our information systems from cybersecurity threats and to respond to any cybersecurity incidents in accordance with our incident response plans. Our CDO leads a team, including a number of cybersecurity professionals, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with senior leadership and other teams across the Company. In addition to our extensive in-house cybersecurity capabilities, at times we also engage consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. Our CDO leads the core elements of e.l.f. Beauty's IT and digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology. Our CDO has served in various roles in information technology and information security for over 25 years, and her background includes completing the Harvard Cybersecurity program and active involvement in the Silicon Valley Consortium, focusing on security and technological advancements in cybersecurity and data privacy. As a thought leader in the intersection of artificial intelligence and cybersecurity, her expertise aligns with the critical needs of the constantly changing cybersecurity landscape and managing digital risk. Working with our CDO in implementing our cybersecurity risk management program, our Chief Information Security Officer and our Associate Director, IT Infrastructure & Security, collectively have more than 30 years of experience in information technology and extensive education and industry experience managing cybersecurity risks, developing and implementing cybersecurity policies, and responding to cybersecurity incidents.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Physical Security. We control physical access to our facilities, areas within our facilities, data centers, server rooms, and equipment. Installation, maintenance, and repair of equipment is restricted to authorized personnel. We protect our Computer Equipment from power failure, surges, and other electrical anomalies, and cabling is protected from unauthorized access or damage. Access to our network services is restricted to authorized individuals and granted only following individual identification and authentication. Local wireless access is limited to authorized entry points, with various forms of authentication required before access is granted to authorized individuals.

companyName: Clene Inc.

ticker: CLNN


text: Board Reporting. At least annually, the CIO and ISO report to the Board, directly, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: At Clarivate, cybersecurity risk management is an integral part of our Enterprise Risk Management program. Because we are a global information services provider, our business is highly dependent on the protection of our proprietary software and content, as well as the timeliness, accuracy, and availability of our offerings. Consequently, we are highly sensitive to risks from cybersecurity threats to our information systems, particularly those threats that would affect our ability to continue to provide real-time access to our database content and analysis. To mitigate these threats, we utilize the following processes and governance structure.

companyName: CLARIVATE PLC

ticker: CLVT


text: Our Information Security function is overseen by our Chief Security Officer, or CSO, and is supported by our Chief Information Officer, Chief Product Officer and Product Engineering Team Leads, Chief Legal Officer, or CLO, and Head of Global Privacy. Our Information Security function is responsible for identifying, assessing and managing cybersecurity threats and risks and works to monitor and evaluate our threat environment and risk profile using various methods. These methods include conducting vulnerability assessments and threat assessments in certain environments for internal and external threats, scanning certain threat environments, analyzing certain reports of threats and actors, conducting internal audits for certain systems, evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third-party service providers to conduct external audits, threat assessments for certain systems, provide intelligence feeds, and conduct red/blue team testing and tabletop incident response exercises.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: The Company's cybersecurity risk management program consists of a layered cybersecurity approach and is organized pursuant to prevailing guidance such as the Federal Financial Institutions Examination Council, including its underlying handbooks and assessment tools, and incorporates guidance issued by the National Institute of Standards and Technology and the Cybersecurity Infrastructure and Security Agency. The Company's cybersecurity risk management program is designed to ensure the Company's data, information systems, networks and devices are appropriately protected from a variety of threats and that our third parties with access to the Company's data take similar precautions. Regular risk assessments are conducted to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity and value. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Liberty and Formula 1 have also established a Risk and Compliance Committee responsible for overseeing and monitoring all corporate compliance initiatives at Formula 1, including cybersecurity. The Risk and Compliance Committee is composed of members of Liberty's ISSC as well as members of Formula 1's executive leadership team, including the Chief Financial Officer and General Counsel. The Head of Information Security provides quarterly updates to the Risk and Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.

companyName: Liberty Media Corp

ticker: FWONA


text: The Audit Committee receives regular reports from our CFO concerning the Company's significant cybersecurity threats and risks, and the processes the Company has implemented to address them. The board of directors also has access to reports, summaries and presentations related to the Company's cybersecurity threats, risk and mitigation.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: In January 2025, the Company hired a Chief Technology Officer ("CTO"), who oversees the Company's information technology programs and investments. The CTO now encompasses the responsibilities previously held by the Chief Information Officer.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: Our Audit Committee oversees management's implementation of our cybersecurity risk management program. It receives regular updates from our CTO and other members of management on cybersecurity trends and developments, the cybersecurity risks that are most relevant to our business, and our cybersecurity strategy, as well as other updates, as appropriate, regarding certain cybersecurity incidents.

companyName: Vivid Seats Inc.

ticker: SEAT


text: The Audit Committee of our Board includes members with significant experience and/or expertise in technology or cybersecurity and is responsible for the primary oversight of enterprise risk assessment and management pertaining to the financial, accounting, liquidity, market, tax, cybersecurity and other information technology risks facing our company. At its regular meetings, the Audit Committee, which meets no less than four times per year, receives regular reports from our Company's Ethics & Compliance function, on matters relating to data privacy and compliance, as well as from our Vice President of Risk Management on enterprise risk management, including the activities of our internal audit department surrounding audits and risk assessments of our information security management system, coverage by our insurance carriers for cybersecurity incidents, and our ISO 9001 and 27001 certifications (described above under the heading "Compliance and Certifications" in Part I, Item 1 ("Business") of this Report.

companyName: Rimini Street, Inc.

ticker: RMNI


text: We maintain a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, contractors, consultants and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. Third parties are regularly assessed to determine the need for cybersecurity auditing based on risk evaluation.

companyName: Xencor Inc

ticker: XNCR


text: We have (i) engaged a third-party consultant to assist us with designing controls and our cybersecurity risk management framework; (ii) engaged third party applications to perform penetration testing, and (iii) retained third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: Pharma-Bio Serv, Inc.

ticker: PBSV


text: We regularly perform evaluations of our information security program and continue to invest in our capabilities to keep our customers, partners, suppliers and information assets in our possession safe. Although we employ service provider due diligence and onboarding procedures to identify potential cybersecurity risk, our ability to monitor the cybersecurity practices of our service providers is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks and other assets owned or controlled by our vendors.

companyName: EXP OldCo Winddown, Inc.


text: Our cybersecurity program has a set of controls and priorities with a multi-pronged approach that includes: quarterly cybersecurity awareness training for teammates, monthly phishing simulation testing and other cybersecurity awareness campaigns (e.g., articles, flyers, cybersecurity awareness month); a dedicated security operations team to monitor, analyze, and respond to security threats 24/7; security governance to manage and maintain security processes; intrusion, detection, and prevention systems; a vulnerability management program to identify and remediate security liabilities; a configuration management program to harden systems based on industry standards; industry-leading email security, endpoint detection, and response platforms; threat intelligence from multiple resources to identify and anticipate emerging threats; network and web application firewalls; multi-factor authentication; and network segmentation to isolate and safeguard critical systems and sensitive data.

companyName: MONRO, INC.

ticker: MNRO


text: The Company has policies, controls, and procedures in place for assessing, identifying, and managing material risks from cybersecurity threats, including, but not limited to: • Reviewing financial reporting systems and subsystems to ensure that access is limited to approved users; • Reviewing data recorded, processed, and reported to ensure that the data remains complete, accurate, and valid; • Conducting regular network and endpoint monitoring and vulnerability assessments to improve our information systems; • Reviewing system changes of financial reporting significance to ensure that they have been authorized and appropriately tested before being moved to production; • Monitoring and identifying cybersecurity threats in connection with the use of third-party providers; • Responding to and remediating any incident of damage or interruption to our information technology systems, including cyberattacks, internally and through the use of third-party providers as necessary; • Carrying information security risk insurance that provides protection against potential losses arising from a cybersecurity incident; and • Requiring regular cybersecurity training programs for employees, management, and directors. These approaches vary in maturity across our business, and we work to continually improve them.

companyName: WILLIS LEASE FINANCE CORP

ticker: WLFC