text: Our cybersecurity team implements measures to ensure that Atkore can quickly identify and mitigate cybersecurity risks. Our controls are designed to restrict access to locations that house significant physical information technology assets. Other controls include the use of multifactor authentication, various third-party tools, network security technologies, and a crisis playbook. Our notification policies and processes are escalated to the appropriate personnel on a timely basis to support effective review, response, and compliance with legal requirements. Data is also aggregated to support the identification of trends for forward looking oversight.

companyName: Atkore Inc.

ticker: ATKR


text: Our cybersecurity incident response plan provides for escalation of certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, COO, and CEO. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our incident response team also reports material cybersecurity incidents to the Chair of the Audit Committee.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK

secItem: Item 1C


text: We perform cybersecurity risk assessments of the third-party vendors we utilize and have processes to identify cybersecurity risks posed by using third-party systems. We also request our third-party vendors to promptly notify us of any actual or suspected breach that could impact our data or operations.

companyName: Amcor plc

ticker: AMCR


text: We recognize the increasing importance of cybersecurity and its potential impact on our business operations, financial condition, and reputation. We are committed to protecting our information assets and have implemented a comprehensive cybersecurity risk management program to identify, assess, and mitigate cybersecurity risks. We have not experienced any material cybersecurity incidents in the last three years.

companyName: NVE CORP /NEW/

ticker: NVEC


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences. "

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: BioAtla, Inc.

ticker: BCAB


text: Our cybersecurity program includes risk-based procedures for the detection, analysis, and mitigation of cybersecurity incidents. Our cybersecurity incident response includes criteria for prioritization and escalation based on severity under an established incident prioritization framework. Incidents are reported internally to senior management, the Board or the Board's Audit and Finance Committee, as appropriate based on this framework. Incidents that are elevated based on their potential severity, including any event that is potentially material, are promptly escalated and analyzed for potential external reporting requirements.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. As such, we rely on our advisor's cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: We have a process to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers. We conduct a third-party risk assessment program through the use of assessment templates, surveys and contractual requirements that evaluates certain potential and current vendors in connection with our security standards. If, following an evaluation, a third-party's cybersecurity controls are assessed by us as inadequate based on risk, we work with our business partners to engage a replacement vendor and remediate or seek to reduce our exposure, if any.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: Cybersecurity is an important part of our Audit Committee, Board and ELT's risk management focus. The Board coordinates with the Audit Committee for active Board- and Committee-level oversight of the Company's technology and cyber risk profile, cyber strategies and information security initiatives.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our cybersecurity program is led by our CISO who manages a team of cybersecurity professionals. Our CISO has over 20 years of experience in cybersecurity and technology, including as a CISO at another public company. Members of our cybersecurity team, combined, have over 80 years of cybersecurity experience and hold professional certifications, including Certified Information Systems Security Professional ("CISSP").

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Various management committees exist including the Information Technology Steering Committee, which focuses on technology impact. This committee provides oversight and governance of the technology program and the information security program. This committee is chaired by the Chief Information Officer and includes other executives across the Bank and the Chief Information Security Officer is a part of this committee. This committee meets quarterly to provide oversight of technology projects and services including strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: The VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The VP of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: We use an internal management team to run our information technology and cybersecurity functions, which includes our information and cybersecurity team leads who have collectively served in various roles in information technology and information security for over 25 years, including at other public companies. Through ongoing communications with this management committee, senior management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time and reports such threats and incidents to the Audit Committee, when appropriate. Management updates the Audit Committee quarterly regarding our cybersecurity threat risk management and strategy programs. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related topics and discuss any updates to our cybersecurity risk management and strategy programs. The Audit Committee is notified between such updates regarding significant new cybersecurity threats or incidents that meet pre-established reporting thresholds and any ongoing updates regarding any risk, as needed.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: Our board of directors plays an important role in our risk oversight and discharges its duties both as a full board and through its committees. Our board is involved in risk oversight through its direct decision-making authority with respect to certain significant matters and review of our overall business strategy, as well as indirectly through the further oversight of management delegated to each of the board's committees. Our board of directors relies on management to bring significant matters impacting our company to its attention but has processes for receiving information regarding such matters and providing oversight.

companyName: Terreno Realty Corp

ticker: TRNO


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: The Company's cybersecurity environment is led by its Chief of Staff with input from the Chief Executive Officer and sole director, who in addition to cybersecurity matters, oversees the Company's IT infrastructure and is responsible for monitoring and managing the security of the Company's corporate network and enterprise systems, including technical controls, and safety protocols and responding to security threats. The Company establishes safeguards for protecting the confidentiality, integrity, and availability of our data, technology, and information systems.

companyName: Onar Holding Corp

ticker: ONAR


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees our risk management program, which focuses on the most significant risks we face. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity. Our Chief Financial Officer or Chief Operating Officer reports on our enterprise risk profile on an annual basis or as needed. Our Audit Committee also engages with external counsel on legal matters related to cybersecurity incident management and reporting.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: Disclosure of Risk Management, Strategy, and Governance Regarding Cybersecurity Risks Our Board of Directors engages in regular discussions to address our Company's principal risks, including those related to cybersecurity, ensuring comprehensive management and oversight. In alignment with this commitment, our cybersecurity leadership, comprising the Chief Operating Officer, DevOps Resource Manager of Security, Senior Systems Architect, DevOps Engineer, and Senior Technical Project Manager, forms a core committee dedicated to the review and strategic planning of our cybersecurity initiatives. This team's collaborative efforts are instrumental in steering our Company's approach to identifying, evaluating, and mitigating cybersecurity risks.

companyName: PAID INC

ticker: PAYD


text: We have established cybersecurity and privacy programs to maintain the confidentiality, integrity, availability, and privacy of protected information and ensure compliance with relevant security/privacy regulations, contractual requirements, and industry-standard frameworks. Our cybersecurity program includes annual review and assessment by external, independent third parties, who certify and report on these programs. For example, our Information Security Management System (ISMS) is certified as being in conformity with ISO/IEC 27001 by SRI Quality System Registrar. We maintain cybersecurity and privacy policies and procedures in accordance with industry-standard control frameworks and applicable regulations, laws, and standards. All corporate cybersecurity policies are reviewed and approved by senior leadership at least annually as part of our ISMS.

companyName: DEXCOM INC

ticker: DXCM


text: Partnering with risk owners to develop risk management action plans focused on mitigating the drivers of the enterprise risks Identifying key metrics to objectively assess the risk to the Company applying both a short-term and long-term perspective Informing our strategic planning based on risks assessments after consideration of action plans and residual risk Developing a risk-aware culture throughout the organization Our Board of Directors and its Audit / Finance Committee play an active part in overseeing cybersecurity risks relevant to the Company. The Board and its Audit / Finance Committee routinely receive reports from our management and external advisors on critical risk areas.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: All business-requested technologies and third-party service providers must successfully complete a thorough cybersecurity and contract review before being approved for use, after which they are continuously monitored as part of our supply chain risk management program. Cybersecurity risks and potential costs are evaluated as a part of business operations, and the respective business impacts are continuously assessed to address evolving threats and vulnerabilities. We engage a third-party global firm to conduct an annual cyber assessment using the CSF, and we engage external vendors to validate our security controls and procedures through periodic penetration tests.

companyName: ALBEMARLE CORP

ticker: ALB


text: Our Board has overall responsibility for risk oversight, with its committees assisting our Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is charged with reviewing our overall guidelines, policies, processes and procedures with respect to risk assessment and risk management, including risks related to cybersecurity. Our CISO and our information security team provide more in-depth reporting on cybersecurity risks to the Audit Committee at least annually based on our established enterprise risk categories. These briefings include assessments of the threat landscape, updates on incidents, results of client security audits, and reports on our investments in cybersecurity risk mitigation. In addition, given its overall importance to the organization, our CISO also provides cybersecurity risk reporting to our Board on at least an annual basis as well as from time to time as needed.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: Our risk management program is designed to identify, assess and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational and legal. Cybersecurity is a critical component of this program as we rely extensively on various information systems and other electronic resources to operate our business. Additionally, we rely to a great extent on third-party service providers to perform critical functions to assist in maintaining customer accounts, providing electronic banking services and financial reporting. Our Information Security Officer, who is a member of our Executive Management Team, is primarily responsible for managing our cybersecurity program. Our Information Security Officer has direct access to our Board of Directors and is authorized to evaluate our cybersecurity posture throughout the Company to ensure the implementation of appropriate controls over our systems and applications to maintain an effective cybersecurity program. The information security officer consults, where appropriate, with both our staff of IT professionals and, at times, outside security professionals to ensure the implementation of appropriate controls.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: Management, in coordination with our information technology department, is responsible for assessing the risk of cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Specifically, these processes are overseen by our multidisciplinary Technology Risk and Information Security Committee, which consists of leaders from our Information Technology, Operations, Internal Audit and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles across multiple industries involving information technology, risk management, operations and legal matters.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: We have established and implemented security measures, controls and procedures in an effort to safeguard our information technology systems and to prevent unauthorized access to these systems and any data processed and/or stored in these systems. We evaluate the adequacy of our third-party service providers' cybersecurity measures through periodic due diligence and contractual obligations.

companyName: AMERISAFE INC

ticker: AMSF


text: Our CTO holds a bachelor's degree in technology and over 25 years of experience in application development and technology management. This experience includes 12 years of application management at a Fortune 50 financial services company.

companyName: AdTheorent Holding Company, Inc.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant stakeholders at our US headquarters, and each of our international subsidiary locations. Our CISO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. The CISO works in conjunction with our Nominating and Governance Committee Chair and committee members.

companyName: Enovix Corp

ticker: ENVX


text: Our Board of Directors is tasked with overseeing data privacy and cybersecurity risks. They regularly review the Company's cybersecurity program with management, evaluating the adequacy of controls and security for our information technology systems. Additionally, they assess the Company's response plan in case of a security breach affecting these systems. Annually, the Board of Directors receives updates on potential cybersecurity incidents, data privacy, and compliance programs, engaging in active discussions with management on cybersecurity risks.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: We have an information security on-boarding and off-boarding process to oversee and identify information security related risks from cybersecurity threats associated with the use of any third-party service providers and vendors. This process includes the completion of information security vendor questionnaires before on-boarding. Our information security department reviews these questionnaires to ensure that any third-party company that will host our non-public data has an information security program whose strength level is at least materially equivalent to our information security program.


text: Our Board of Directors and management team recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Our cybersecurity risks are considered individually as part of our enterprise risk management program alongside other risks, and prioritized and discussed with our Board of Directors.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: To gather information about risks to the organization, including cybersecurity, the Risk Committee identifies primary areas that generate enterprise risk and then distributes a survey to a group of our top leaders. The Risk Committee periodically summarizes its activities and findings (including the results of its survey and heat map analysis) related to cybersecurity and other risks directly to our CEO, as well as the Audit Committee and our full Board. The Risk Committee's work is also used by our management team as part of our disclosure controls and procedures to ensure that information regarding material risks applicable to the Company are appropriately disclosed in our public filings.

companyName: REGAL REXNORD CORP

ticker: RRX


text: A dedicated security consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents; Engagement with external service providers to evaluate, enhance, or support our security measures; Comprehensive cybersecurity training programs for employees, incident responders, and senior management to foster a culture of security awareness;

companyName: GridAI Technologies Corp.

ticker: GRDX


text: In particular, the Senior Vice President, Engineering and Operations (SVP, E&O) reports directly to the President, Chief Executive Officer, and Chairman of the Board and holds the highest level of executive responsibility for assessing and managing all cybersecurity threats, incidents, and risks at the Partnership, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations.

companyName: Summit Midstream Partners, LP


text: Arrow's Board of Directors, Chief Information Officer, Director of IT and the Enterprise Risk Management ("ERM") committee at the senior management level all have a role in the cybersecurity risk management program. The Board receives periodic reports from the ERM committee, which is chaired by the Director of Compliance and Risk and includes executive, senior, and other designated managers as appropriate.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Both the Enterprise and Product Cybersecurity functions administer policies related to cybersecurity in consultation with other stakeholders at the company. We have a third-party risk management process, which is designed to assess and manage cybersecurity risks posed by third parties. This process is administered by the Enterprise Cybersecurity function.

companyName: CUMMINS INC

ticker: CMI


text: SPS is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: SOUTHWESTERN PUBLIC SERVICE CO


text: The Company's board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risks, and has not delegated oversight authority for cybersecurity risks to any committee. Our management, led by our Chief Executive Officer and Chief Financial Officer, is responsible for assessing cybersecurity risks and supervising relevant personnel with respect to our efforts and measures with the aim we have an appropriate cybersecurity strategy to assess and manage those risks, including responding to attacks or breaches. Our Chief Executive Officer and Chief Financial Officer meet periodically with the individuals charged with the day-to-day operations supervisory responsibilities including IT operations and infrastructure regarding cybersecurity to review and assess potential issues and any changes needed to be made related to our information technology system and cybersecurity measures. Cybersecurity awareness trainings are provided for all employees.

companyName: Fortune Valley Treasures, Inc.

ticker: FVTI


text: Cyber Risk Management and Strategy Under the oversight of our board of directors and the Audit Committee of the board, we have adopted cybersecurity risk management processes that take a risk-based approach to assessing, identifying, and managing risks from cybersecurity threats. Management of cybersecurity risks is part of our overall risk management strategy.

companyName: TELA Bio, Inc.

ticker: TELA


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: The Audit Committee regularly reviews and discusses FOX's cybersecurity risks and receives updates from the CISO on how the Company identifies, assesses and mitigates these risks. The CISO provides the Audit Committee with quarterly reports regarding cybersecurity issues and risks, including information regarding progress on efforts to strengthen and enhance the Company's cybersecurity program. The Audit Committee also periodically devotes additional meeting time, as needed, to in-depth discussions on a particularly relevant cybersecurity topic, including industry trends and relative risks. In addition to the quarterly reports, cybersecurity incidents meeting certain criteria are reported to the Audit Committee outside of regularly scheduled quarterly updates as necessary.

companyName: Fox Corp

ticker: FOXA


text: This structured approach to governance and oversight, with a clear emphasis on receiving feedback allows us to align with the entire Alta organization. By prioritizing the identification and management of cybersecurity risks at the highest levels, we aim to safeguard our assets, protect shareholder interests, and maintain the continuity of our business operations in the face of evolving cyber threats.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: Meridian Corp

ticker: MRBK


text: Our Application Security program performs static and dynamic scanning of systems and software code. In addition, we perform vulnerability scans daily on our systems and assets.

companyName: Bandwidth Inc.

ticker: BAND


text: As of the date of this Annual Report, we are no t aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition or are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement security measures adequate to prevent cybersecurity incidents or fully mitigate their impact. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A—Risk Factors".

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of enterprise level risks, including any cybersecurity-related risks faced by the Company. At least quarterly, the Audit Committee reviews cyber risks and mitigation strategies with senior management. The Audit Committee periodically reports to the full Board regarding its activities, including those relating to cybersecurity. Additionally, on an annual basis, the Chief Technology Officer ("CTO") presents to the Audit Committee on any material updates to the cybersecurity program, such as process improvements, new initiatives and key vendor performance. Material cybersecurity events, if any, are escalated to the Board on an ongoing basis. The Board is also briefed annually on all major enterprise risks, including cybersecurity risks.

companyName: ESSEX PORTFOLIO LP


text: Our management companies are ultimately responsible for our guests' information, and we monitor these companies, as well as other third party service providers, to ensure that they are complying with our privacy, information security and cybersecurity policies. We also assess the cybersecurity proficiency of potential third party cloud suppliers before utilizing their services.

companyName: RLJ Lodging Trust

ticker: RLJ


text: Recognizing the complexity and evolving nature of cybersecurity threats, Graphjet Technology has started in negotiating and engaging with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships will enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.

companyName: GRAPHJET TECHNOLOGY

ticker: GTIJF


text: We recognize the critical importance of maintaining the trust and confidence of our patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Inhibrx, Inc.


text: We recognize the importance of maintaining the confidence and trust of our customers, suppliers, employees, audience, and communities by maintaining our data and information security. In managing our cyber risk, we utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. In addition, we have established security control requirements for our third-party vendors based on global standards.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: We promote a company-wide culture of cybersecurity risk management to ensure that cybersecurity risk considerations are an integral part of decision-making at every level. We have implemented cyber defenses to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our information technology (IT) department continuously evaluates whether our cybersecurity risk management is aligned with our business objectives and operational needs. Our cybersecurity program is comprehensive in scope and covers the systems supporting our various lines of business.

companyName: Green Plains Inc.

ticker: GPRE


text: During Fiscal year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these Governance

companyName: IGC Pharma, Inc.

ticker: IGC


text: The Audit Committee reports to the entire Board of Directors periodically regarding its oversight of cybersecurity matters. In developing such updates to the Board of Directors, the Audit Committee relies in large part on periodic updates from Partnership management. Management of Cybersecurity Matters The Partnership's management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.

companyName: Summit Midstream Partners, LP


text: The board committee receives periodic reports from our information security function (including our IT Director) concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Turnstone Biologics Corp.


text: Cybersecurity threats are monitored and acted upon by the Company's outsourced information technology security group. The executives meet periodically or as needed with third-party advisors to receive information on all cybersecurity initiatives or suggestions as well as all cybersecurity incidents, if any.

companyName: International Land Alliance Inc.

ticker: ILAL


text: In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal), senior leadership and the board, as appropriate.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: Old National's Information Security Department includes information security professionals with a range of varying cybersecurity experience and education, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold certain cybersecurity certifications. The Company's CISO has extensive experience managing cybersecurity programs and assessing cybersecurity risks, with more than 30 years of experience in developing, managing, and testing information security and technology risk management programs. That includes over 13 years of experience in building and managing cybersecurity and technology risk programs for multi-national, Fortune 500 financial services firms, and over 10 years of experience building and managing information security consultancies specializing in cybersecurity program development and cybersecurity control testing. He is a frequent lecturer and author on information security and technology risk topics and maintains his Certified Information Security Manager (CISM) and Certified Data Privacy Solutions Engineer (CDPSE) certifications through the Information Systems Audit and Control Association, Inc. (ISACA).

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: While we and our IT providers employ appropriate security technologies to address the rapidly changing and evolving IT environment (including data encryption processes, intrusion detection systems), conduct comprehensive risk assessments, and other internal control procedures to assure the security of our and our customers' data, we acknowledge that no system can completely eliminate cyber attacks and the security technologies and program can provide only reasonable, assurance that these objectives will be met. Further, the design of any cybersecurity risk management program or control system must reflect the fact that there are resource constraints, and the benefits must be considered relative to their costs. As a result, the possibility of material financial loss remains despite our significant and comprehensive cybersecurity efforts. An investor should carefully consider the risks, and all other information set forth in this Annual Report on Form 10-K, including disclosures in Part I - Item 1A—Risk Factors.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: Our Principal Financial Officer provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: • Security Risk Assessment. The Security team performs an annual enterprise security risk assessment of the information security program that is provided to management, the Board of Directors and other relevant parties. The security risk assessment provides a detailed understanding of the information security program in order to inform decisions and support risk response. The security risk assessment process evaluates the program's control domains through various analyses and testing methods to determine the overall level of risk present within the environment over the period evaluated. The risk assessment identifies risks and considers observations from multiple business process- and system-level assessments.

companyName: EQUIFAX INC

ticker: EFX


text: Impact of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material impact on the Company's results of operations and financial condition. As described above under "Item 1A Risk Factors "Technology Disruptions, Failures or Breaches, Hacking Activity, Ransomware Attacks or Other Cybersecurity Events Could Materially and Adversely Affect Our Financial Condition and Results of Operations" a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial damage, in addition to litigation or remediation costs or penalties.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: For the year ended December 31, 2023, Everest has not experienced any cybersecurity incident that materially affected the Company, including its business strategy, results of operations or financial conditions.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: We have implemented an extensive cybersecurity program that leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our cybersecurity program is designed to assess, identify, and manage risks from cybersecurity threats while maintaining the confidentiality and availability of our information systems. We have also established and maintain a comprehensive Global Security Incident Response Plan designed to enable compliance with reporting standards and provide a robust response to global cybersecurity events. We perform periodic assessments to identify and assess cybersecurity risks, including through the utilization of third parties to assess our system vulnerabilities. We also regularly train employees on cybersecurity risks, including through monthly phishing simulations.

companyName: Amcor plc

ticker: AMCR


text: As of the date of this report, though the Company and its third-party service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, financial condition, results of operations or cash flows. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: OneWater Marine Inc.

ticker: ONEW


text: Like other major corporations, DuPont is the target of cyber-attacks from time to time. However, risks from previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, see "The Company's business, results of operations, financial condition and cash flows could be adversely affected by interruption of the Company's information technology or network systems and other business disruptions" in Item 1A. Risk Factors of this Annual Report.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: As of the date of this Annual Report on Form 10-K, information security threats have not materially affected and we believe are not reasonably likely to materially affect Silvercrest, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Operational risks, including the threat of cyber-attacks, may disrupt our business, breach our clients' security, result in losses or limit our growth" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on Silvercrest.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: We rely on the information technology and systems maintained by our managers, including RMR, and rely on our managers to identify and manage material risks from cybersecurity threats. RMR and our senior living community managers take various actions, and incur significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: DIVERSIFIED HEALTHCARE TRUST

ticker: DHC


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all cybersecurity threats and incidents. For more information on the risks that we face from cybersecurity threats, see "Risk Factors – Risk Factors of General Applicability—New rules have recently become effective that will require the Company to provide disclosures regarding cybersecurity management and events." in Part 1, Item 1A of this report.

companyName: Gold.com, Inc.

ticker: GOLD


text: We partner with third parties to implement and assess the effectiveness of our cybersecurity prevention and response systems and processes. We have a Managed Security Services provider (MSSP) that provides a 24 x 7 x 365 Security Operations Center (SOC) and works with our information technology (IT) team to employ a variety of monitoring technologies to detect and be alerted to potential cyber threats, as well as establish and implement procedures for the mitigation and remediation of any cybersecurity incidents. We conduct an annual penetration test, regular phishing tests, and annual cybersecurity training for our employees.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: For a description of the risks from cybersecurity threats that may materially affect our business and how they may do so, see the section titled "Risk factors" in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are compromised now, or in the future, we could experience adverse consequences resulting from such a compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: The CSO provides, at least annually, updates to the Chief Executive Officer and BHE's Board of Directors on: • Updates on strategic cyber and physical security initiatives • Current threat and risk landscape impacting the organization • Security compliance with regulatory requirements • Compliance with ISO 27001 framework • Number and impact of incidents reported through the BHE cybersecurity incident reporting process A BHE Cybersecurity Reporting Framework has been adopted so that BHE has a repeatable and timely process to identify, assess and manage any security incidents for materiality reporting. Each BHE business is required to report significant cybersecurity events to BHE. BHE's senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: Our Board of Directors is also committed to data security and is regularly updated by the CIO on cybersecurity and other relevant technology risks facing the Company. Each quarter, the Audit Committee receives an IT risk update from the CIO, and discusses emerging technology and cybersecurity risks. This risk update includes an overview and discussion of our cybersecurity and risk management programs. In addition, technology risk is a key component of our overall enterprise risk assessment, which is conducted annually and presented to the Board of Directors. Through these processes, the Board of Directors is apprised of, and given the opportunity to discuss at length, any meaningful cybersecurity risks we face. Directors Scott E. Lamb, Gregory K. Morris, and John G. Nackel, Ph. D. provide key oversight on cybersecurity matters. Our executive team is also briefed on any significant security risks during monthly leadership meetings.

companyName: Pennant Group, Inc.

ticker: PNTG


text: Detection and Analysis. Cybersecurity incidents may be detected through a variety of means, which include, but are not limited to, automated event-detection notifications or similar technologies that are monitored by our security operations team, as well as notifications from employees or third-party providers. Once a cybersecurity incident is identified, including third-party cybersecurity events, our incident response team investigates the incident, determines the nature of the event and assesses the severity of the event, including any operational impact and sensitivity of any compromised data.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: In response to such risks, we have implemented initiatives such as our cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on Company cybersecurity risks.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: We use consultants and other third parties to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity software providers, managed cybersecurity service providers, professional cybersecurity advisors, and penetration testing firms.

companyName: PATTERSON COMPANIES, INC.


text: In the event of an incident, the President would immediately notify our outside consultant to take those steps required for maximum recovery.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party CROs, CMOs, or other vendors, contractors or consultants.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: Our cybersecurity controls are monitored and refined based on learnings from regular red team engagements and analysis by third party threat hunters. All cyber defense operations are supported through a dedicated cybersecurity threat intelligence function. We collaborate with information security peers across the industry to augment threat intelligence. Our threat intelligence program helps create awareness and understanding of potential cybersecurity threats and adversaries.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The CISO also leads a cross-functional Incident Response Team (“IRT”) responsible for responding to and managing cybersecurity incidents in coordination with our Legal department and ECDP department. The IRT consists of professionals from various departments, including Information Technology and Security, Legal, ECDP, Finance, Public Relations, and other key business areas as needed. The IRP is tested annually via a tabletop exercise, focused on executive strategy and communication processes during an incident.

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: We maintain a comprehensive cybersecurity program, including policies and procedures designed to protect our systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. The cybersecurity program is integrated into our enterprise-wide risk management system, illustrated by conducting planning exercises involving disaster recovery testing and designing and implementing systems to include backup and recoverability principles, protecting sensitive data through encryption techniques, hypothetical cybersecurity incidents to test its cyber incident response processes. Learnings from these exercises are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. We test our cybersecurity defenses through automated and manual scanning, to identify and remediate critical vulnerabilities. We examine our cybersecurity program every year, evaluating its effectiveness in part by considering industry standards and established frameworks and working in conjunction with external advisors in connection with our annual cybersecurity insurance renewals to ensure our program keeps paces with new threats.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Partnership engages with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. Our collaboration with these third parties includes regular audits, network penetration testing, threat assessments, and consultation on security enhancements.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Our cybersecurity policies and processes are fully integrated into our Risk Management procedures and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is reinforced with our employees through education and periodic testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. Management also periodically briefs the Board of Directors on our strategy and roadmap in alignment with the NIST Cybersecurity Framework and we plan to continue providing the Board with regular updates regarding cybersecurity risks, threat landscape and overall program progress.

companyName: EACO CORP

ticker: EACO


text: We model our cybersecurity program to align with the practices and standards referenced within the National Institute of Standards and Technology cybersecurity framework. Our information security program is integrated within our larger enterprise risk management program and includes, but is not limited to: Following the methodology of Identify, Protect, Detect, Respond, and Recover; Mandatory annual cybersecurity awareness training for all teammates accessing our network; Monthly Company-wide phishing prevention and awareness exercises;

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: We rely on information technology ("IT") systems, including data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. Our IT systems, like those of most companies, may be vulnerable to certain cybersecurity threats such as ransomware, interruption of services, data breaches, or any other cybersecurity incident that could adversely impact our ability to operate our core business functions. As a real estate finance services firm, we do not maintain a significant level of personally identifiable information data, so our exposure to data breaches is limited. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. However, we have, from time to time, experienced threats to our data and systems, including from malicious software and computer virus attacks. We anticipate we will continue to face similar threats, including attempts for unauthorized access, in the future. We also maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents, though coverage may not be available or sufficient to cover costs of certain cybersecurity incidents.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: Information security, which includes cybersecurity, is a significant operational risk facing our business. Cybersecurity risks include intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our or our clients' or third parties' operations, systems or data.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: The responsibility for day-to-day management of cybersecurity risks lies with our management team, including the Interim Chief Financial Officer and Chief Executive Officer. This team will be at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach will include regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.

companyName: NKGen Biotech, Inc.


text: Data privacy and cybersecurity also are areas of increasing state legislative focus. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA") applies to covered businesses that conduct business in California and meet certain revenue or personal information collection thresholds. The CCPA contains several exemptions, including that many, but not all, requirements of the CCPA are inapplicable to personal information that is collected, processed, sold or disclosed pursuant to the GLB Act. The CCPA imposes obligations on covered companies, broadly defines personal information, expands California residents' rights with respect to personal information, and provides for civil penalties for violations. The CCPA may be interpreted or applied in a manner inconsistent with our understanding, resulting in further uncertainty and potentially requiring us to incur additional costs and expenses in an effort to comply with these requirements. Similar laws have been adopted by other states where we do business, or may in the future do business. At least four such laws (in Virginia, Colorado, Connecticut and Utah) took effect in 2023. In addition, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach. Moreover, the federal government has recently considered, and is currently considering, various proposals for more comprehensive data privacy and cybersecurity legislation, to which we may be subject if passed.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, vulnerability management, disaster recovery and business continuity planning, risk assessments, encryption of certain data, network security controls in certain environments and systems, data segregation of certain data, access controls for certain environments and systems, physical security, asset management, vendor risk management, employee cybersecurity training, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: Veritone, Inc.

ticker: VERI


text: Cybersecurity is reviewed as part of our overall enterprise risk management program, led by our Chief Administrative Officer, which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to our Board of Directors. Cybersecurity risks are reviewed by the Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.

companyName: Streamex Corp.

ticker: STEX


text: Managing Material Risks & Integrated Overall Risk Management Arcosa has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Arcosa's Chief Information Security Officer ("CISO") and Senior Director of Information Security work closely with the IT department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the CIS Critical Security Controls and National Institute of Standards and Technology ("NIST") frameworks.

companyName: Arcosa, Inc.

ticker: ACA


text: 4.Mitigation Strategies: We develop and implement robust mitigation strategies tailored to address specific cybersecurity risks. These strategies may include the deployment of technical controls, such as firewalls, intrusion detection systems, and encryption protocols, as well as the implementation of policies, procedures, and employee training programs to promote cybersecurity awareness and adherence to best practices.

companyName: NewtekOne, Inc.

ticker: NEWT


text: We structure our information security program around the Federal Financial Institutions Examinations Council (FFIEC) Information Security program guidance, including the FFIEC Cybersecurity Assessment Toolkit, regulatory guidance, and other industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to promote program effectiveness. Our Chief Technology and Innovation Officer ("CTIO"), along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.

companyName: Kearny Financial Corp.

ticker: KRNY


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and application providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment and security questionnaire for certain providers, review of security assessments for certain providers, and System and Organization Controls report reviews when determined necessary. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Vice President of Information Technology and Information Security Officer ("VP of IT"), who is supported by other members of management, as necessary. Our VP of IT is responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. The Company also has an IT Executive Steering Committee comprised of the VP of IT, CFO, General Counsel, Chief Operating Officer and Chief Technology Officer and Vice President of Operations. The VP of IT provides regular cybersecurity updates to the Audit Committee. The Company's VP of IT has served in this role for three years and has more than 25 years of relevant experience. In addition, we have an information security team comprised of dozens of employees dedicated to cybersecurity with extensive experience and relevant certifications. The VP of IT is responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating in the event of a cybersecurity incident.

companyName: GENTEX CORP

ticker: GNTX


text: Our outside consultant evaluates our security controls and provides overall information security strategy for the protection, detection and response capabilities used. The current consultant has extensive information technology and program management experience and evaluates our security with the ultimate goal of preventing cybersecurity incidents to the extent feasible.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: Cybersecurity Governance Astrana Health's governance framework reflects our commitment to managing cybersecurity risks with accountability and transparency. This framework is rooted in collaboration between executive leadership, employee operational teams, and the Board of Directors, resulting in comprehensive oversight at every level of the organization.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The CISO provides leadership, strategic direction, and oversight for NetApp's Global Security Risk and Compliance functions and security program. Global Security executives oversee management of risks and track projects progress, remediations, and any issues related to cybersecurity risks.

companyName: NetApp, Inc.

ticker: NTAP


text: We also have a standing risk committee. The purpose of the risk committee is to oversee a sustainable dynamic process that enables enterprise-wide cross-functional analysis and assessment of risks that may threaten the Company or provide opportunities to leverage resources to create growth opportunities. Under its charter, the committee is to be comprised of at least three members of the Board, selected by the President. The committee has established a working group that is comprised of representatives from the following functional areas of the Company: treasury, human resources, legal, supply chain management, sales, and marketing. Currently, the Senior Vice President, Secretary and General Counsel, a member of the risk committee, apprises the Board quarterly of the working group and this Committee's activities.

companyName: GRAYBAR ELECTRIC CO INC


text: We have established processes for assessing, identifying, and managing material risks from cybersecurity threats and have integrated these cybersecurity processes into our overall risk management system. Specifically, we have adopted a cybersecurity framework that, where appropriate, aligns with the NIST's Cybersecurity Framework, and we have maintained systems that, where appropriate, are PCI compliant under current standards.

companyName: MEDIFAST INC

ticker: MED


text: As of December 31, 2024, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Attacks are increasingly sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. Accordingly, risks related to a cybersecurity event, including litigation and enforcement risks, are elevated due to the dynamic nature and sophistication and frequency of these threats.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: The Company provides training to all employees that reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The training assists employees with identifying potential cybersecurity risks and threats and how to protect the Company's resources and information. This training is mandatory for all employees globally on a periodic basis, and it is supplemented by firmwide internal and external service providers testing initiatives, including frequent phishing tests. In addition to the employee training program, the Company has created an information security incident response policy and team. The risks related to cybersecurity, including the effectiveness of our training programs, are monitored on an ongoing basis by our information technology department and external service providers. In addition, to assess the incident response policy, periodically the Company engages a third-party expert to oversee a cybersecurity incident response training exercise and to facilitate group discussions regarding the effectiveness of the Company's cybersecurity incident response strategies and tactics.

companyName: GORMAN RUPP CO

ticker: GRC


text: Internal Cybersecurity Team Our Incident Management Team (IMT) is led by our SRC Director, who serves as the point of contact for all IT security related matters within our Company, and also includes our Chief Information Officer. Our IMT is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across our Company. Our SRC Director is responsible for ensuring the regular review and maintenance of the Computer Security Incident Response Plan (CSIRP) and the execution of all procedures within it. Our SRC Director has technical leadership experience and cybersecurity expertise gained from over 25 years of experience, including security leadership, program development, strategy formulation, data protection, and IT risk management within the health care, pharmaceutical, and biotechnology industries. The security professionals in the IMT have cybersecurity backgrounds and expertise relevant to their roles, including, in certain circumstances, relevant industry certifications. In addition to our internal cybersecurity capabilities, we also have engaged outside experts to assist with assessing, identifying, and managing cybersecurity risks. The IMT meets as necessary to discuss, investigate, and respond to any cybersecurity incidents, to allocate resources to respond to incidents, and to confirm incidents are appropriately documented. We have protocols by which the IMT escalates certain cybersecurity incidents within our Company and, where appropriate, the IMT will notify appropriate stakeholders and our Audit Committee and provide updates on the status of the incident. A number of experienced employees responsible for various parts of our business and a team of trained cybersecurity professionals assist our SRC Director and the IMT. A number of internal teams, including our Operations Infrastructure Team, Operations End User Computer Team, Operations Engineering Team, Security, Risk and Compliance Team, Operational Technology Team, and Application Administrators and certain external vendors (together, the Incident Response Team Members), collectively with the IMT, form the Incident Response Team (IRT), which investigates and responds to privacy or cybersecurity incidents.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to its audit committee (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, and it reports to the full board of directors regarding its activities, including those related to cybersecurity. Our CTrO and CISO provide updates on significant risks to the Audit Committee quarterly and also provide updates to the full board of directors at least biannually. Outside of regular meetings, depending on the nature and severity of an incident, our CTrO and CISO will also inform the Audit Committee, Chief Executive Officer, and the rest of the board of directors of significant cybersecurity incidents.

companyName: Atlassian Corp

ticker: TEAM


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes several safeguards, such as password protection; multi-factor authentication; continuous monitoring and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic audits and incident response simulations; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees and contractors, as well as annual cybersecurity awareness training for our employees and contractors. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: MARINUS PHARMACEUTICALS, INC.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our management team's cybersecurity risk management is led by our Vice President of IT, who has over 20 years of experience in both restaurant and technology sectors and has held technology leadership roles at major national restaurant companies.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: We regularly engage independent third-party security consultants to help assess and monitor our IT and OT environments for vulnerabilities, to conduct penetration testing and to recommend mitigation strategies. In addition, we use third-party tools for vulnerability scans to identify external and internal risks.

companyName: HF Sinclair Corp

ticker: DINO


text: We also recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Cybersecurity Program Manager and other subject matter experts monitor and identify known cybersecurity threats and incidents at third-party service providers on a regular basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process. A vendor management policy is in place, which is approved by the Board of Directors annually. The vendor management policy calls for the evaluation of risk for each vendor based upon an assessment of the degree to which their relationship could expose the Company to risk in relation to the Company's reliance on the vendor's promise to perform and to protect customer privacy and based on the vendor's fiscal strength.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: Our board of directors and audit committee addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: In addition, we have Company-wide policies and procedures concerning cybersecurity matters, including access security, system change management, development lifecycle, incident management and business continuity/disaster recovery policies. These policies go through an annual internal review process and are approved by appropriate members of management. Presidio Property Trust uses a third-party consultant to assess the Company's compliance with Sarbanes Oxley.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team and IT consultants, which includes individuals who have a diverse combination of relevant expertise, experience, education and training. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our team have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Material Cyber Risks, Threats and Incidents We actively monitor the evolving cybersecurity and geopolitical landscapes that could result in new or increased cybersecurity threat including geopolitical events such as the Russia invasion of Ukraine in March 2022.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize, or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2023 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "We face risks related to cyber security attacks and other incidents."

companyName: Village Farms International, Inc.

ticker: VFF


text: Managing cybersecurity risks is an important component of our approach to enterprise risk management. As part of our overall risk management system, we have established certain procedures to assess, identify, mitigate and respond to risks from cybersecurity threats. We have regular programs to evaluate cybersecurity threats and to assess our systems, procedures and processes in order to identify areas of potential vulnerability and to improve our protection against evolving cybersecurity threats. We use a number of different methodologies in our regular assessment of cybersecurity risks with respect to our information systems, including vulnerability testing, security enhancement and evaluation of external threats, including in connection with potential data breach, ransomware and other forms of unauthorized access.

companyName: RH

ticker: RH


text: 1. Board Oversight: The Board of Directors provides oversight of PyraMax Bank's cybersecurity posture, including reviewing and approving cybersecurity policies, strategies, testing, and investments.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: To ensure alignment with industry best practices we engage consultants or other third parties in conducting periodic assessments and testing of our policies, standards, processes, and practices.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: The Company has implemented the Committee of Sponsoring Organizations ("COSO") Enterprise Risk Management ("ERM") Framework, which outlines the process by which an organization can view any risk by way of governance and culture, integration into strategy, risk assessments, reviewing capabilities and practices, and monitoring and reporting. This process would apply to the cybersecurity risk as it would any of the other enterprise risks. We follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") with layered security controls to help identify, protect against, detect, respond to, and recover from cyber-attacks. To safeguard our information assets, we have put various procedures and technologies in place. For example, our Cybersecurity Incident Response Plan clearly defines roles and responsibilities for the investigation of and response to information security incidents to minimize disruption of critical computing services and operations and prevent the loss or theft of sensitive or mission-critical information. Our plan covers various cyber incidents like ransomware attacks, cyber-intrusions, data loss, denial of service, insider threats, malware attacks, and others. In a material cybersecurity incident, our D&T team, inclusive of our Chief Information Officer and our VP of Cybersecurity and Infrastructure Support, address the threat via established escalation procedures, roles, responsibilities, and communication. Any cybersecurity incident that is declared as a crisis would follow our global Incident and Crisis Response and Management Procedure, which includes escalation to the West Leadership Team and Board of Directors, as deemed necessary pending the materiality of the incident. We have not encountered cybersecurity challenges that have materially impacted our operations or financial condition. In addition, we retain an external cybersecurity consultancy company to assist when a cybersecurity event arises, as needed and, in addition we maintain appropriate cybersecurity liability insurance.

companyName: WEST PHARMACEUTICAL SERVICES INC

ticker: WST


text: Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process described above, including the operation of our incident response plan. Annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials if necessary, including current and emerging material cybersecurity threat risks and describing the company's ability to mitigate those risks, and discusses such matters with our IT Manager.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: In the ordinary course of our business, we collect, maintain and transmit large amounts of confidential information in digital form, including intellectual property, proprietary business information, financial information, personal information, protected health information and data to comply with cGMP and data integrity requirements. It is critical that we do so in a secure manner to maintain data security and data integrity of such information. We have established physical, electronic and organizational measures to safeguard and secure our systems to prevent a data compromise. We have also outsourced elements of our information technology infrastructure and data security processes to a number of expert qualified third-party vendors to help us stay current with data and electronic information security best practices.

companyName: NextCure, Inc.

ticker: NXTC


text: DTE Energy engages third-party service providers to assist with managing various aspects of its business. These service providers are subject to due diligence reviews of their information security programs prior to onboarding. DTE Energy also contractually requires service providers with access to its information technology (IT) systems, sensitive business data, or personal information to implement and maintain appropriate security controls and restricts their ability to use such data for purposes other than to provide services to DTE Energy, except as required by law. Third-party service providers are also contractually required to notify DTE Energy promptly of cyber incidents that may affect any systems or data. DTE Energy collaborates with its service providers to help determine whether their information security protocols are sufficient. If a service provider experiences a cyber incident, DTE Energy monitors their compliance with our security requirements; however, DTE Energy may not have the ability in all cases to effectively oversee the implementation of these control measures.

companyName: DTE Electric Co


text: Management and Strategy one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas: Governance:

companyName: MANHATTAN BRIDGE CAPITAL, INC

ticker: LOAN


text: As part of our risk management process, our cybersecurity risk management team oversees our vulnerability management practices and conducts routine application security assessments, yearly penetration testing, periodic security audits and ongoing risk assessments designed to identify cybersecurity risks to our environment. We also subscribe to third-party services for security operations through a dedicated managed security service provider responsible for mitigating threats to our environment and alerting and responding to events and incidents in coordination with our team. In addition to our routine practices, we also conduct testing, audits and assessments in connection with acquisitions, the implementation of new software, processes or activities requiring changes in our information technology environment, new cybersecurity events or developments and receipt of new risk intelligence. Further, we have adopted an enterprise-wide cybersecurity training and awareness program requiring all employees to complete annual cybersecurity training. The program is supported with monthly education and simulations with remedial training assignments to increase user awareness.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: At ADP, security is integral to our products, our business processes and infrastructure. We have an enterprise-wide approach to security with the objectives of protecting client data and funds, and preventing security incidents that could adversely affect the confidentiality, integrity, or availability of our information systems and data that resides in those systems, while also improving our system resilience with the aim of minimizing the impact to our business when incidents do occur.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: DFIN's Board and senior management are engaged in managing and overseeing the Company's cyber risks. Internal Audit periodically reviews enterprise risk management topics as well as the effectiveness of information security controls and other procedures and reports significant findings to executive management, the Board or the Audit Committee, as appropriate. The Company's Chief Information Security Officer ("CISO") has approximately 30 years of cybersecurity experience overseeing enterprise cybersecurity risk management and compliance programs and has responsibility for assessing and managing cybersecurity risks. The CISO reports to the Chief Information Officer and leads multiple cybersecurity functions that consist of Cyber Defense and Threat Intelligence, Application Security, Network Security Engineering, Security Architecture, Identity Services and IT Governance as well as Risk and Compliance functions. As the front line of defense against cybersecurity risks, these functions employ numerous tools, processes and procedures to detect attempted cyber attacks, prevent cyber threats and monitor cyber risks. The functions are also engaged in incident response should incidents occur and are accountable for remediating cyber threats, if manifested.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: The Company previously experienced a cybersecurity incident in August of 2020. Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Company's business strategy, results of operations or financial condition, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A. "Risk Factors - Unauthorized or improper disclosure of personal information, breach of privacy, whether inadvertent or as the result of a cyber-attack or improperly by our employees, has resulted in liability and could harm us." which should be read in conjunction with the foregoing information.

companyName: IBEX Ltd

ticker: IBEX


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.

companyName: North Haven Private Income Fund LLC


text: While our Board and Risk Committee oversee risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within our subsidiary NTS, which is led by our CTO. Reporting to our CTO is the CISO, the individual who provides day-to-day oversight of our cybersecurity program. Our CISO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees a team that regularly communicates with respect to the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO's team consists of individuals that have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the Company's and our subsidiaries' executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Risk Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Despite ongoing efforts to continually improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions and statutory penalties, among other consequences. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, there can be no guarantee that we will not be the subject of future successful cybersecurity attacks, threats or incidents that materially affect our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Information Technology."

companyName: DocGo Inc.

ticker: DCGO


text: In order to protect our assets, we utilize a multi-layer defense strategy to control who logs on to our network and uses our computers and other devices. We have enforced multi-factor authentication, implemented firewalls, and deployed a VPN alternative solution that delivers a zero trust model for access to our network and resources. We also protect our data through our use of security software, which is regularly updated, encryption of sensitive data, both at rest and in transit, and by conducting regular data backups. We have formal policies for safely disposing of electronic files and old devices and we train all employees annually on cybersecurity and their crucial role in protecting the Company's assets.

companyName: Anywhere Real Estate Group LLC


text: At an operational level, the Company's cybersecurity strategy is shaped by its CISO who is ultimately responsible for implementing the Company's cybersecurity policies, procedures and strategy under the oversight of the Enterprise Risk Committee. The Company's CISO regularly provides updates to the Enterprise Risk Committee at relevant meetings and provides additional updates to the Company's Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, General Counsel and Corporate Secretary and CTO on a regular basis in between the meetings of the Enterprise Risk Committee. Such updates are designed to ensure the Enterprise Risk Committee and Company executives remain informed about and are able to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The Company's CISO has multiple decades of experience in the cybersecurity and information security fields with relevant experience supplemented by undergraduate and post-graduate degrees in information technology and security and completion of additional related executive education, along with holding several industry-recognized cybersecurity certifications. The Company's CTO supplements the expertise and experience of the CISO.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: We also require cybersecurity training for relevant employees, focusing on the appropriate protection and security of confidential company and third-party information. The IT team provides regular updates to senior management on various cybersecurity threats, assessments and findings and effectiveness of the Company's cyber risk management program. Our Board of Directors through the Audit Committee oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Reservoir Media, Inc.

ticker: RSVR


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board, the audit committee and disclosure committee. Our CISO has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.

companyName: Sinclair, Inc.

ticker: SBGI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with, or effective in protecting our systems and information.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO