text: Board Oversight of Cybersecurity The Audit and Risk Committees of the Board oversee cybersecurity risk and the information security program which includes overseeing management's actions to identify, assess, mitigate and remediate or prevent material cybersecurity risks. The Audit Committee receives, from the CISO, an annual report of the information security program and monthly reports of any security incident or on notable security events for the period. The Board Chairman and Vice Chairman are notified of any high criticality security incidents within 24 hours. The notable security event briefings by the CISO are intended to create discussion that allows Board members to understand the impact, controls and risk. The Risk Committee receives, from the CISO, annual reports on risk assessments and at least quarterly reports on key risk indicators. The Risk Committee receives at least one annual training from the CISO on the information security program, cybersecurity controls or cybersecurity threats.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: Our Vice President of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: SunPower Inc.

ticker: SPWR

secItem: Item 1C


text: In the last three fiscal years, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. The Company maintains cyber liability insurance coverage to minimize any potential financial impacts from cybersecurity incidents that may occur.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: Our IT Director is Joe Rogers. He has 35 years of experience in information technology and cybersecurity, having been at the Company in his role as IT Director since 2022.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: The Vice President of Information Technology has been with the Company for over 25 years in various roles in information technology and information security. The Company's CEO, CFO and CHRO each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis. We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Third-party risk management. We rely on certain third-party service providers, including custodians, cloud and data center providers, staking/validator services, and other vendors. We assess relevant providers' security controls during onboarding and periodically thereafter, including certifications, audit reports, incident history, and contractual commitments to notify us of security incidents that may affect our company. We incorporate cybersecurity requirements into applicable contracts. Governance.

companyName: BITMINE IMMERSION TECHNOLOGIES, INC.

ticker: BMNR


text: key components of our future cybersecurity program are expected to include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;

companyName: NexMetals Mining Corp.

ticker: NEXM


text: For additional information on our cybersecurity risks, see "Risk Factors" under the section entitled "Cyberattacks or other network disruptions could have an adverse effect on our company and GCI's business" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: In 2023, we did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Privacy, Data, and Cybersecurity" in this annual report on Form 10-K.

companyName: Mobileye Global Inc.

ticker: MBLY


text: In addition, the Company has made significant investments to fulfill the operational and financial regulatory requirements laid out by the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Sarbanes-Oxley Act of 2002. HCTI faces a number of cybersecurity risks in connection with its business.

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: Maintaining the safety and security of our systems and data is essential to the success of our company. As with other industries, there are several cybersecurity threats we encounter. These include phishing, ransomware, and denial of service, among others. Our suppliers, vendors, and other partners face similar threats. A cybersecurity incident impacting us or any of these entities could materially affect our operations, performance, or financial results. See Item 1A, Risks Related to Information Security for additional details.

companyName: J.Jill, Inc.

ticker: JILL


text: We are a global financial services firm, with a longstanding commitment to providing a reliable and secure trading environment for our customers.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: As part of its broader risk oversight activities, the Board oversees risks from cybersecurity threats, primarily through delegation to the Audit Committee. As reflected in its charter, the Audit Committee assists the Board in reviewing our significant cybersecurity matters and concerns. The Audit Committee engages on cybersecurity matters with our management team, including our Vice President of Product and Enterprise Security, who regularly provides presentations to the Audit Committee on our cybersecurity governance and compliance programs. These presentations address a range of topics including, for example, the threat landscape and cybersecurity events, vulnerability assessments, incident preparedness assessments, disaster recovery plans, and cybersecurity awareness training. Two additional members of our Board, who have cybersecurity experience but are not members of the Audit Committee, are invited to attend Audit Committee meetings when review of our cybersecurity program is on the agenda. In addition, the full Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight.

companyName: ROKU, INC

ticker: ROKU


text: We engage assessors, consultants, auditors and other third parties in connection with developing and evaluating our overall risk management framework. Additionally, our internal audit team periodically engages third parties to co-source internal audits of our information security processes. We strive to utilize best practices in our information security management and follow applicable industry standards.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: Team members who support our advisor's information security program have relevant educational and industry experience. The teams, led by our advisor's Vice President – Communications, provide regular reports to our senior management and other relevant teams on various cybersecurity threats, assessments and findings. Our board of directors receives updates regarding cybersecurity issues as and when deemed necessary by our senior management.

companyName: Moody National REIT II, Inc.


text: Third-party risk management is a critical component of IT risk management. We evaluate new vendors before onboarding to identify and manage potential risks and establish contractual requirements for security controls and notification. We also strive to monitor emerging risks associated with those third-party service providers. Assessment of these providers includes completing a standardized questionnaire and conducting risk evaluations for financial, reputational, information security, cybersecurity, and business resiliency risks.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a public company, we must comply with extensive regulations, including requirements for reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.

companyName: ZRCN Inc.

ticker: ZRCN


text: Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST") and the CryptoCurrency Security Standard ("CCSS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST and CCSS as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

companyName: MARA Holdings, Inc.

ticker: MARA


text: Integration into Enterprise Risk Management Framework Our cybersecurity risk management program is integrated into our overall Enterprise Risk Management framework. Our Enterprise Response Framework establishes the reporting structure and escalation process for managing all enterprise incidents, including cybersecurity-related incidents. The framework defines the relationship and notification steps among the various crisis management stakeholders, including the Board of Directors, the Management Committee, the CEO, other members of the executive leadership team, the crisis manager and crisis management coordinators. See "Cybersecurity Governance—Management Role" for a description of the oversight role of the Enterprise Risk Management division, Internal Audit and the management-level Technology Risk Committee and Enterprise Risk Committee relating to cybersecurity risk management.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Operating Officer and our General Counsel. Our Chief Operating Officer and our General Counsel will work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: We have adopted as the governance framework for our cybersecurity program the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • skilled internal information security (IS) and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, and to support risk mitigation efforts; • training for our employees on cybersecurity awareness and the importance of protecting information assets, including "phishing" tests; • periodic reviews of key cybersecurity policies, and updating as needed; • information governance policy and a cybersecurity incident response plan that includes procedures for monitoring data use and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: STAAR SURGICAL CO

ticker: STAA


text: The Company's processes also allow for the Board and the Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Committee are scheduled on a quarterly cadence, the Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the Committee. The Company's policy is for the Board and the Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.

companyName: Salesforce, Inc.

ticker: CRM


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in people and technologies have contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Cocrystal Pharma, Inc.

ticker: COCP


text: Our cybersecurity risk management program includes the following: • A dedicated staff of cybersecurity and risk management professionals; • Defined security policies and standards; • Annual mandatory employee cybersecurity and privacy compliance awareness training; • Cybersecurity tooling for detecting and responding to cyber incidents; • Cybersecurity incident response and major crisis plans that govern activities such as detection, coordination, remediation, recovery, and escalation to senior management and, where appropriate, our Audit and Finance Committee and our Board; • Back-up & recovery plans; • Periodic tabletop exercises to promote awareness and improve internal processes; • Periodic penetration testing and vulnerability management processes; and • Third-party risk assessments for suppliers and vendors, which may require such third parties to sign data processing agreements, comply with particular security controls, or complete an additional security and privacy assessment.

companyName: HOLOGIC INC

ticker: HOLX


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Company's cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from and reporting cybersecurity events. These processes and procedures for managing material risks from cybersecurity threats are integrated into the Company's overall enterprise risk management systems and processes.

companyName: Playa Hotels & Resorts N.V.


text: The oversight responsibility of our Board of Directors and its committees is facilitated through quarterly management-reporting processes designed to provide visibility to the Board and its committees on the processes for the identification, assessment, prioritization and management of critical risks and management's risk mitigation strategies. Such reporting includes providing regular updates to the Board Audit and Compliance Committee regarding the evolving cybersecurity threat environment, updates to our cybersecurity risk management program to address and mitigate such threats and providing quarterly reports to the Quality Committee on the Company's execution of its data and technology strategy. Management also escalates significant cybersecurity events to the Audit and Compliance Committee and the Board on a real time basis, as appropriate. Further, our Board also receives enterprise-wide risk management reports, which include significant cybersecurity risks, from our risk department multiple times per year. In addition, our Board and management have conducted tabletop cybersecurity crisis simulation exercises.

companyName: CENTENE CORP

ticker: CNC


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: a. Monitor emerging data protection laws and implement changes as necessary; b. Conduct periodic customer data handling and use requirement training for our employees;

companyName: Independence Contract Drilling, Inc.


text: From time to time, we also conduct exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals collaborates with legal, technical and business stakeholders to further analyze the risks to the company and form detection, mitigation and remediation strategies.

companyName: Bandwidth Inc.

ticker: BAND


text: We are not aware of any material cybersecurity incidents that have occurred in the last three fiscal years, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.

companyName: GLAUKOS Corp

ticker: GKOS


text: The Company's Senior Vice President and Chief Information Systems Officer also regularly reports to the Company's executive risk management ("ERM") committee, which oversees Company-wide risk at the management level, regarding cybersecurity risks. Members of the ERM committee include our President and Chief Executive Officer.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: Our Director of Cybersecurity is informed of cybersecurity incidents by applicable personnel, and oversees remediation efforts in accordance with our policies and processes. Our Chief Information Officer reports to our Audit Committee on significant incidents periodically. Our Chief Information Officer has over 30 years of technology leadership experience and is, among other things, a Certified Information Systems Security Professional and a Certified Secure Infrastructure Specialist. Our Director of Cybersecurity has over 20 years of experience as a cybersecurity and information technology professional. He has held various leadership positions where he developed, managed and implemented security programs and controls. He also holds, among other information technology certifications, the Certified Information Systems Security Professional designation.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Our Information Security organization addresses cybersecurity risks with a broad spectrum of technologies, controls, and processes that focus on mitigating these risks. Our cybersecurity strategy is designed to be dynamic and adaptive to combat the rapidly-evolving cybersecurity threat landscape and is influenced by commonly leveraged frameworks such as the NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). Our program includes, but is not limited to, advanced systems and network security protocols, electronic communications protections, vulnerability management programs, least-privilege access controls, third-party risk management procedures, workforce education and training exercises, and compliance programs.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our Acting Chief Executive Officer, CFO and Vice President of Information Technology, are responsible for assessing and managing our material risks from cybersecurity threats and have decades of experience in overseeing operations, including information technology functions, in the public company environment. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants as needed.

companyName: Lite Strategy, Inc.

ticker: LITS


text: Our cybersecurity incident response plan describes the activities we take to identify, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to provide appropriate reporting and escalation. The program includes appropriate activities to escalate potentially material security incidents to our disclosure committee for review.

companyName: Sabre Corp

ticker: SABR


text: As noted in Item 1A. Risk Factors, FMC recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we are committed to an ongoing and comprehensive program to protect all company data, as well as data in our supply chain, from these threats. Our cybersecurity program includes governance defined by IT policies and standards and a robust IT risk management program. FMC uses several tools and controls to manage IT risk including, but not limited to, controls for the management of privileged access, anti-malware tools, required trainings for employees including an annual training module, simulated email phishing attacks, and other email security tools to detect and prevent intrusions as well as monitor threats. FMC employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. The Company has a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and continuously engages in response planning, simulations, trainings, tabletop exercises, and other efforts to mitigate risk and prepare for a rapid response to any incidents should they occur. Additionally, our contracts with third-party providers require those organizations to notify FMC of any cyber incident that occurs when our information has been impacted. FMC frequently communicates with our third-party service providers to ensure timely notification of any matters that may impact our data security.

companyName: FMC CORP

ticker: FMC


text: Inc. has implemented basic but targeted cybersecurity risk management measures appropriate for its early-stage operations and limited digital footprint. As a digital marketplace operating in a primarily cloud-based environment, the Company's exposure to cybersecurity threats is continuously monitored by executive management.

companyName: Mercalot Inc.


text: The Corporation has developed an information security program to protect the confidentiality, integrity, and availability of our data, information systems, and digital assets from disruption, breach, or theft. As a financial institution we store and protect nonpublic data related to customers, employees, and business operations. Securing this data at all times is critical to our business. The Corporation's information security program was developed to assess, identify, and monitor cybersecurity risks.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Vice President of Information Technology who reports to our Acting Chief Executive Officer, Chief Financial Officer to manage the risk assessment and mitigation process.


text: At least annually, our internal audit team conducts a formal risk assessment and develops an audit plan that identifies, assesses, and prioritizes risks that include cybersecurity. The results of the risk assessment and the proposed audit plan are communicated to various leaders within the Company as well as the audit committee of the board of directors for input. The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, or internal or external risk factors. The CISO also issues an annual written report to the board of directors on the Program and material cybersecurity risks.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: We use the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. We have designed and assessed our program based on the NIST CSF. This does not imply that we meet any particular technical standards, specifications or requirements.

companyName: Mersana Therapeutics, Inc.


text: Cybersecurity Practices We have implemented various measures to manage our risk of information technology systems and networks damage, disruption, or unauthorized access, including employee training, monitoring of our systems and networks, maintenance of backup and protective systems, and use of modern endpoint detection and response tools which are integrated into urban-gro's risk management systems and processes. We also operate in a fully cloud-based environment, which enhances our scalability, flexibility, and resilience and utilize 3rd parties to perform early internal and external vulnerability assessment and risk identification. We have established extensive backup and recovery procedures to ensure the continuity of our operations in a cyber incident. We also maintain cyber liability insurance coverage as part of our comprehensive risk management program. However, these measures may not be sufficient to prevent, detect, or mitigate the impact of such damage, disruption, or unauthorized access. Moreover, the regulatory environment related to information security, data protection, and privacy is increasingly demanding and complex, and compliance with applicable laws and regulations may result in significant costs or require changes in our business practices that could adversely affect our operations.

companyName: urban-gro, Inc.

ticker: UGRO


text: Our cybersecurity processes, technologies, and controls aid in our efforts to assess, identify, and manage material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risks and reputational risks.

companyName: Inari Medical, Inc.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have established and maintain a comprehensive Information Security Program that is designed to support us in assessing, identifying, protecting, managing, responding to, and recovering from cybersecurity threats and cybersecurity incidents.

companyName: GREEN DOT CORP

ticker: GDOT


text: JFG employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors and service providers. This assessment is conducted on the basis of, among other factors, the types of products or services provided and the extent and type of data accessed or processed by the third party.

companyName: Senior Credit Investments, LLC


text: Key elements of our cybersecurity program includes but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • ad hoc internal review of the cybersecurity practices of key service providers, suppliers, and vendors who have access to our critical systems and information based on our assessment of their criticality to our operations and respective risk profile.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: Our Board of Directors (the "Board") has delegated responsibility for enterprise risk management, including cybersecurity risk oversight, to our Audit Committee (the "Committee"). The Committee receives quarterly information security updates from our Chief Financial Officer and Senior Director of Governance & Information Security (the "Senior Director, GIS"). The Committee in turn reports to the full Board regarding its activities, including those related to cybersecurity, on at least a bi-annual basis.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: No risks from any current or previous cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, except to the extent that such strategy, operations, and conditions are affected by our employment of the cybersecurity risk assessment programs and procedures discussed in this Item. We have not, as of the date of this filing, experienced a cybersecurity breach that has materially affected our business or financial condition. However, because our business involves the collection, transmission, and storage of sensitive customer and employee data, we are susceptible to various cybersecurity threats, including cyberattacks, unauthorized access, and similar events. We employ ongoing processes and strategies to guard against those threats, as discussed in this Item.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: The Board of Directors has designated its Risk Committee to assist it in overseeing management's responsibility to implement an effective risk management framework designed to identify, assess, and manage key risks, including cybersecurity risk. As part of our ERM program, executive management, with review and oversight of the Risk Committee, establishes key risk indicators to measure ongoing alignment with the firm's risk appetite and tolerance levels related to cybersecurity risk. Risk appetite and tolerance thresholds are periodically reviewed by management and approved by the Risk Committee. The Risk Committee receives regular presentations and reports from our Chief Information Security Officer ("CISO"), which address a wide range of cybersecurity risk topics, including emerging threats and recent developments, cybersecurity policy and standards updates, vulnerability assessments, risk assessment outcomes (including third-party and independent reviews), technology trends, and information security considerations arising with respect to the firm, our peers, and third-party vendors. Additionally, the Board of Directors receives reports at least annually on the performance of the firm's cybersecurity risk metrics.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Cybersecurity risk is an important and continuously evolving focus for us, EQT, and EQT's affiliates. EQT maintains a cybersecurity program as part of its Risk Management Framework, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by EQRT, from anticipated threats or hazards. EQT utilizes a variety of protective measures as a part of its and our cybersecurity program. These measures include: • IT General Controls: including physical and digital access controls, patch management, identity verification and mobile device management. • Risk Identification: EQT utilizes a combination of internal processes and third-party services to identify potential information security vulnerabilities and threats. This includes threat intelligence, vulnerability management and various security assessments. • Risk Assessment: Identified risks are assessed and ranked on at least an annual basis using a likelihood and impact assessment as part of EQT's enterprise risk framework. In addition, the security team has in place an information security risk management process through which risks are assessed, managed and reported upon continuously. • Risk Management: Risks are managed based on their severity in relation to the established risk appetite. EQT has in place several risk-mitigating controls, blending preventative, detective, and reactive measures with an emphasis on identity verification, least privilege, micro-segmentation, and a strong security culture. To this foundation, EQT adds critical components like data protection endpoint security, secure configurations, advanced monitoring and threat detection, robust incident and business continuity plans for effective response. EQT continuously modifies its controls in line with our current risk landscape. • Incident Management: EQT has implemented a security incident response plan for prompt and effective handling of cyber incidents. This plan is executed by a tiered response team: a 24/7 Security Operations Center serves as the first line of defense, followed by EQT's internal security team as the second tier, and an expert incident response and forensics firm as the third. Additional support from external legal counsel is available when necessary. The strategy ensures collaboration with key functions like Risk, Regulatory & Compliance, Corporate Legal and Communications. Detailed playbooks within the plan outline specific actions for various security incident types. At the corporate level, an incident reporting and management process involves EQT's Chief Information Security Officer ("CISO"). Should an incident pertain to cybersecurity, it activates the security incident response plan. • Ongoing Testing: EQT's comprehensive program encompasses a range of measures and enterprise-level drills. This includes conducting phishing test campaigns, mandatory annual training, annual penetration tests, and disaster recovery tests to ensure EQT's systems resilience. At the enterprise level, EQT also holds an annual tabletop exercise for EQT's core and extended crisis management teams, simulating various hypothetical scenarios to assess our preparedness and response strategies.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2024 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors — Our success depends on the security and integrity of the systems and products offered, and security breaches or other disruptions could compromise certain information and expose us to liability, which could cause our business and reputation to suffer."

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: We also leverage third-party expertise to audit and test our cybersecurity program. These include periodic reviews of cybersecurity threats and related controls, including reviews of periodic penetration tests conducted by independent third parties. We have implemented processes to manage the cybersecurity risks associated with our use of third-party service providers. This includes proactive monitoring of third party's configurations, risk questionnaires for new technology vendors, and other processes to minimize risks associated with our third-party providers.

companyName: Caribou Biosciences, Inc.

ticker: CRBU


text: We have also implemented a process to review contractual requirements related to information security obligations included in our agreements with certain third-party vendors and service providers, as appropriate.

companyName: Disc Medicine, Inc.

ticker: IRON


text: The mission of our information security organization is to design, implement, and maintain an information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. The information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats.

companyName: American Bitcoin Corp.

ticker: ABTC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We have in the past experienced adverse events that have not resulted, and are not expected to result, in a material impact on the Company's business operations or financial results. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We have experienced cybersecurity attacks and could in the future be subject to significant disruption, data loss or other security incidents or breaches".

companyName: Kimco Realty OP, LLC


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is Systems and Organization Controls (SOC)-certified and incorporates a number of components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, internal audits, and employee training. We deploy a wide range of security tools across the environment, require multifactor authentication, hold client data on a separate virtual private cloud (VPC), and implement access control policies that further limit access to data within the systems.

companyName: Genprex, Inc.

ticker: GNPX


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for DuPont's Board of Directors and management. The CIO and the CISO are primarily responsible for assessing and managing material risks from cybersecurity threats. The CIO has sixteen years of cybersecurity experience, including seven years with DuPont, and the CISO has seventeen years of cybersecurity experience, including over three years with DuPont. Each of the CIO and CISO maintain industry recognized credentials relevant to their roles.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Our Chief Information Security Officer and Chief Technology Officer are the members of our executive team who are principally responsible for overseeing our cybersecurity risk management program. Our Chief Information Security Officer and Chief Technology Officer are informed about cybersecurity threats through their involvement with the processes set forth above. For example, our Chief Information Security Officer receives regular reports on identified cybersecurity risks and progress toward remediation from our security teams and both our Chief Information Security Officer and Chief Technology Officer are notified of cybersecurity incidents and the management of such incidents in accordance with the escalation procedures of our incident response plan.

companyName: Datadog, Inc.

ticker: DDOG


text: Risks from Cybersecurity Threats We have not encountered any incidents from cybersecurity threats to date, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. Although we have not yet been materially impacted by any cybersecurity incident, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "We face continually evolving cybersecurity risks, which could result in the loss, theft, misuse, unauthorized disclosure, access, or destruction of confidential information or data, disruption of our solutions, damage to our brands, reputation and relationships with customers, legal exposure and financial losses." The Board of Directors (the "Board") has established oversight mechanisms designed to manage risks associated with cybersecurity threats.

companyName: WORKIVA INC

ticker: WK


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by Ares' dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Ares' CISO who has a Master's degree in Cybersecurity from Brown University and over 25 years of experience advising on, and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Ares CISO is also a member of the Ares ERC. The Ares ERC is a cross-functional committee that governs and oversees the Ares Enterprise Risk Program, including cybersecurity. The Ares ERC includes members of Ares' senior executive management, including its CEO, CFO, General Counsel, Global Chief Compliance Officer, Chief Information Officer, CISO, and Head of Enterprise Risk, who acts as chairperson of the Ares ERC. The Ares ERC, through regular consultation with the Ares internal cybersecurity team and representatives from our Advisor, assesses, discusses, and prioritizes Ares' approach to high-level risks, mitigative controls, and ongoing cybersecurity efforts.

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats such as loss or theft of data, ransomware or other disruptive attacks from financially motivated bad actors, and third-party supply chain issues that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and financial condition. For further discussion, see "Item 1A. Risk Factors – Risk Management" and "Item 1A. Risk Factors – Cybersecurity, Technology and Vendor Risks".

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: We maintain a dedicated cybersecurity department, which consists exclusively of Company employees, within our broader information technology department. Functions within this department range from new information technology solution design and implementation, vulnerability management, phishing awareness, threat detection, BLOOMIN' BRANDS, INC.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Addressing cybersecurity risks is a priority for us. We have in place systems of internal controls as well as business continuity and disaster recovery plans, and we regularly perform assessments of these systems and plans to address cybersecurity and technology. Our cybersecurity program has been developed based on industry standards set by the National Institute of Standards and Technology ("NIST") and includes a comprehensive set of security policies and procedures that guide our protection strategy against threats by utilizing the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls, and remediation practices; implementing a third-party risk management program to evaluate our cyber position; and, evaluating our cybersecurity program effectiveness by performing both internal and external testing and auditing risk. In addition to a dedicated information technology cybersecurity team monitoring our daily operations, we annually assess our cybersecurity program against the NIST framework and engage outside security firms to conduct penetration tests and assist with monitoring of daily operations. We require annual cybersecurity awareness training for all of our employees to aid in promptly identifying and reporting potential or actual issues. Additionally, our dedicated information technology cybersecurity team undertakes regular robust cybersecurity training to increase cybersecurity awareness, internal expertise, and readiness efforts. We install and regularly update antivirus software on all Company managed systems and workstations in an effort to detect and prevent malicious code. We conduct ongoing security breach and phishing simulations to raise awareness of various critical security threats. Periodically, we run tabletop exercises involving members of the Company's management team intended to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures. All third-party service providers or vendors utilized as part of the Company's cybersecurity framework are required to comply with our policies regarding non-public personal information and information security.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: The Chief Executive Officer, Chief Financial Officer, Chief Commercial Officer, Chief Operating Officer, and General Counsel comprise the Company's ERM Committee. The ERM Committee is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, including controls and procedures related to managing material risks from cybersecurity threats, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Audit Committee, as appropriate, to allow for timely decisions regarding such disclosures.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: The P&S Committee, ORC, CIMT and IT Committee are comprised of executives with reporting lines to the CIO and/or the COO.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: In addition, a cross-functional team of senior executives from across the John Deere enterprise known as the Digital Risk Governance Council (DRGC) provides oversight at the management level of our and John Deere's structures for managing digital risk, including the Cybersecurity Team. The Audit Review Committee (ARC) of the Deere & Company Board of Directors (Board) shares oversight responsibilities of our cybersecurity program, including oversight of related risks, with the full Board. Information on trends, strategic initiatives, and metrics is presented quarterly to the ARC by the CISO and/or members of the Cybersecurity Team. The ARC also receives periodic updates and information from subject matter experts in areas such as risk management, identity and access management, product security, and information technology.

companyName: DEERE JOHN CAPITAL CORP


text: As of the date of this report, Seaboard is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect Seaboard's business strategy, results of operations or financial condition. However, cybersecurity threats and cyber-attacks continue to increase in sophistication and volume. As a result, Seaboard frequently updates its information security plan to address new threats, and Seaboard continues to make investments to protect its information technology infrastructure. Cybersecurity risks that may materially impact Seaboard are discussed in more detail in Item 1A "Risk Factors," under the heading "Operational Risks," which should be read in conjunction with this Item 1C.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: The Company and the Board of Directors are committed to remaining updated on evolving cybersecurity regulations and best practices, as well as the development and amendment of processes to meet these changing demands. The Company did not experience any cyber security incident during 2023.

companyName: UNIVERSAL BIOSENSORS INC


text: Our information security program and cyber risk management program is managed by our Chief Information Officer ("CIO") and a team of information security personnel reporting to the CIO. Our CIO brings over 30 years of experience in information technology and information security, working as an executive within data-driven companies for the last 20 years.

companyName: Red Violet, Inc.

ticker: RDVT


text: In addition, we use third party service providers, when appropriate, to assess, test or otherwise assist with certain aspects of our cybersecurity risk management program. For example, we leverage external assessors such as security researchers and penetration testers to identify vulnerabilities in our information systems.

companyName: Compass, Inc.

ticker: COMP


text: We operate in an environment where cybersecurity risks is a dynamic and evolving factor. We are committed to appropriately managing and minimizing the impact of cybersecurity risk on the achievement of our business objectives. We view cybersecurity risk management as a fundamental business process essential to our overall success. As such, we have integrated our cybersecurity program into our comprehensive Risk Framework, which is in place to support the management and oversight of risk across our organization. The Risk Framework establishes a consistent approach for identifying, assessing, measuring, mitigating, and reporting on material risks, including cybersecurity risks. The Risk Framework is composed of process components such as risk governance, risk identification and assessment, risk measurement, risk response and remediation and risk analysis and reporting.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the Audit Committee and our Board of Directors. Additional information about cybersecurity threats we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We are subject to data privacy laws and our failure to comply with them could subject us to substantial liabilities," which should be read in conjunction with the information above.

companyName: GLOBUS MEDICAL INC

ticker: GMED


text: The Audit Committee receives periodic reports from management on potential cybersecurity risks and threats. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: Reborn Coffee, Inc.

ticker: REBN


text: The Senior Director Infrastructure & IT Operations has primary responsibility for assessing, monitoring and managing our cybersecurity risks, informed by thirty years of experience focusing on cloud, cybersecurity, and privacy in leadership roles at public companies. The Security Director also has thirty years of experience in the software and security industry, with executive positions in product security, security intelligence and data science. In his capacity at iRobot, the Security Director implements and oversees information security processes and regularly informs the Chief Financial Officer and Senior Director Infrastructure & IT Operations of cybersecurity developments, including potential threats and risk management techniques.

companyName: IROBOT CORP

ticker: IRBTQ


text: While our Board is responsible for ensuring that our entire ERM process is in place and functioning, our Audit Committee has the primary oversight responsibility for risks relating to cybersecurity. Our Vice President of Information Security regularly attends and presents to our Audit Committee on material cybersecurity risks and mitigating procedures. Our Vice President of Information Security oversees ProAssurance's information security and data privacy programs and is responsible for establishing and implementing our security strategy alongside our General Counsel, to whom the Vice President of Information Security reports directly. Our Vice President of Information Security has been with ProAssurance since 1998 and has over 25 years of IT and cybersecurity experience.

companyName: PROASSURANCE CORP

ticker: PRA


text: Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. The audit and risk committee of our board of directors specifically oversees critical risks and opportunities facing the Company and, in this context, reviews and provides feedback on our company-wide enterprise risk management program, which encompasses risks related to information technology and cybersecurity and mitigations put in place, or to be put in place, in response to such risks. The audit and risk committee periodically reports to the full board of directors regarding the audit and risk committee's oversight of the Company's enterprise risk management program and periodic risk assessment results. In addition, our board of directors receives periodic updates from our Chief Information Officer and our Executive Director of Information Security on the ISMS and other information security initiatives, and on our information security governance framework.

companyName: Alkermes plc.

ticker: ALKS


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee of the Board, the Risk Committee, the Technology Committee and the Board. The Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Operational risk is inherent in the Corporation's activities and can present itself in numerous ways, including internal or external fraud, business disruptions or failures, noncompliance with applicable laws and regulations, cyber breach, or failure of third parties, among other events. The result of these could be reputational harm, financial losses, or litigation and regulatory fines for the Bank. The Corporation operates in a fashion that allows operational risk to be in line with its risk appetite. To govern, monitor and control operational risk, the Corporation maintains an ERM Program, which sets thresholds for risk appetite by key risk areas, such as strategic risk and operational risk. These thresholds are monitored by the Compliance and Internal Audit Departments and key metrics are reported to management and Board committees. The ERM Program includes managing material risks from cybersecurity threats.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: We engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks as needed. We also have standing engagements with incident response experts and external counsel. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices and trends.

companyName: AAON, INC.

ticker: AAON


text: As of the date of this report, the Company has not identified any cybersecurity incidents or threats that have materially affected its operations, financial condition, or results of operations. However, the Company faces ongoing risks from potential cybersecurity threats that, if realized, could materially affect its business, results of operations, or financial condition. Board of Directors oversees the Company's cybersecurity risk management activities as part of its overall risk oversight responsibilities.

companyName: Hartford Creative Group, Inc.

ticker: HFUS


text: In fulfilling its responsibility, the Cybersecurity Group manages formal documented internal processes such as risk management and vulnerability scanning, as well as other processes, such as assessing threat intelligence, that include outside partners. Intelligence sharing comes from industry sources such as the Electricity Information Sharing and Analysis Center, government sources, as well as commercially purchased information sources. The Cybersecurity Group also engages third parties for assessments and audits of its systems periodically and as needed. Such assessments and audits may include, among other things, pre-production evaluation of technologies, overall program assessments, and compliance program assessments including audits by our regulators.

companyName: ARIZONA PUBLIC SERVICE CO


text: Our overall strategy in combatting cybersecurity risks includes a variety of measures, including: use of antivirus software, virtual private networks, email security, as well as other software and system-wide measures such as multi-factor of updates and patches as they become available from our software suppliers and consultants and maintaining the current versions of major software to reduce the exposure to vulnerabilities;

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: The Company's CISO is primarily responsible for the implementation of defense capabilities and risk mitigation strategies. T he Company's CISO, Timothy J. Held, has over 27 years of information technology and cybersecurity experience. He holds the title of Executive Vice President and Chief Information Security Officer and has been in his role since 2018, having served as the Company's Deputy CISO from 2015 to 2018 and Head of Cyber Defense, Threat Intelligence, and Incident Response from 2012 to 2018. The CISO is supported by his direct reports and their teams, many of whom hold cybersecurity-related certifications.

companyName: US BANCORP \DE\

ticker: USB


text: Our cybersecurity strategy prioritizes detection, analysis, and response to mitigate unknown and unexpected threats and security risks. Our cybersecurity risk management processes include technical security controls, monitoring systems, employee training, and management oversight to assess, identify, and manage risks from cybersecurity threats. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See "Risk Factors" in Item 1A of this Annual Report for additional information about our cybersecurity risks.

companyName: MIND TECHNOLOGY, INC

ticker: MIND


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: ALIMERA SCIENCES INC


text: Lastly, we use technology to minimize our exposure to cybersecurity vulnerabilities and promote a safe information and communications systems environment. We avail ourselves of third-party technologies and tools, including tools provided by the Cybersecurity and Infrastructure Security Agency (CISA), other government agencies and third-party cybersecurity experts.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Our CISO and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: As part of our overall risk management, we focus on a comprehensive approach to identifying, preventing and mitigating cybersecurity threats and incidents. We deploy technical safeguards that are designed to protect our Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which we evaluate and improve on a periodic basis.

companyName: GenFlat Holdings, Inc.

ticker: GFLT


text: In the event of a breach or incident, our Director of Information Technology leads our response to mitigate impact and initiate the recovery processes. Following the identification of a breach or incident, the Director of Information Technology reports incidents of a medium or high severity level2 to our senior leadership team. Incidents of a high severity level are also reviewed by our Disclosure Committee to assess materiality and any disclosure obligations. All incidents are reported to the Audit Committee at the next scheduled Board meeting, and incidents of high severity level are immediately reported to the Audit Committee.

companyName: Rayonier, L.P.


text: We face a number of risks from cybersecurity threats, which may materially affect our business, financial condition, and results of operations, because our business is dependent on the successful operation of our payroll, transaction, financial, accounting, and other data processing systems. Although such risks have not materially affected us, including our business, financial condition, and results of operations to date, we have, from time to time, experienced threats to and breaches of our data and systems, and our third-party partners' data and systems, including malware and computer virus attacks. Businesses we acquire maintain separate cybersecurity programs and processes that may differ in scope and complexity from our overall programs and processes as we set about integrating the acquisition target's systems into ours. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not detected a cybersecurity incident. Please refer to Part I, Item 1A, "Risk Factors" for further discussion of our cybersecurity-related risks.

companyName: Dayforce, Inc.

ticker: DAY


text: Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data. Management also conducts annual cybersecurity training and periodic phishing tests, which provide contemporaneous feedback and instruction to our employees and strengthen the Company's defenses against cyber threats. Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident. A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.

companyName: CVR ENERGY INC

ticker: CVI


text: IT team is responsible for day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Global AI, Inc.

ticker: GLAI


text: cybersecurity awareness training for our employees, incident response personnel, and senior management. This includes mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.

companyName: NEPHROS INC

ticker: NEPH


text: Communication channels between our cybersecurity teams and other risk management personnel are established to facilitate the timely sharing of information about potential cyber threats. For example, our Data Protection and Information Security working group, which includes representation by our Chief Information Security Officer (who reports directly to our COO) and CIO, and our Legal, ERM, Information Governance and Finance departments, among others, meets regularly to discuss key risks, strategies and threats related to information security.

companyName: HERBALIFE LTD.

ticker: HLF


text: Board's Role in Oversight Our Board oversees our cybersecurity risk management program, and includes cybersecurity as part of the assessment of the Company's overall Enterprise Risk Management program. At least twice per year, and more frequently, if necessary, our CIO updates our Board on the Company's cyber risk profile and the steps taken by management to mitigate those risks. In the event of a material cybersecurity incident, the Board would receive prompt and timely information regarding the incident, as well as ongoing updates regarding such incident until it has been addressed. Cybersecurity-related risks are included in the Enterprise Risk Management committee's evaluation of top risks to the enterprise, which are also presented to the Board and executive management twice per year.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: Board of Directors' Oversight and Management's Role Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. The Company focuses on current and emerging cybersecurity matters. The Company's cybersecurity processes are led by the Vice President of Information Technology, who reports to the Company's Chief Financial Officer, including with respect to emerging cybersecurity incidents. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. To facilitate effective oversight, our Vice President of Information Technology holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. Our Vice President of Information Technology has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by us.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: We regularly review our cybersecurity defenses to assess our vulnerability to cybersecurity attacks from viruses, malware and more sophisticated and targeted cyber-related attacks such as hackers looking to demand ransomware or access our systems to obtain information and data, as well as our vulnerability to cybersecurity failures resulting from human error and technological errors. We rely upon internal IT personnel working in conjunction with specialized outside security consultants on a day to day basis to conduct reviews and upgrade our systems when determined to be necessary.

companyName: AiXin Life International, Inc.

ticker: AIXN


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers, as well as third-party security firms used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform Chipotle during contracting and vendor selection processes. Additionally, when third party risks are identified, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), Chipotle has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans to prepare for and respond to the potential for a disruption in the technology we rely on.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: To mitigate risk to its systems, endpoints and data, the Company evaluates internal and external threat intelligence, deploys encryption and authentication technologies and other protective measures, maintains security policies and procedures, and conducts awareness training. The Company also conducts penetration and vulnerability testing and other risk assessments, implements appropriate internal controls, and engages independent third-party auditors to evaluate its compliance with security industry standards.

companyName: BLACKBERRY Ltd

ticker: BB


text: This program includes, but is not limited to: • Regular risk assessments and vulnerability assessments. • Implementation of industry-accepted cybersecurity controls and best practices. • Employee training and awareness programs to enhance the company's overall cybersecurity posture. • Continuous monitoring and incident response plans to detect and mitigate potential threats promptly.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: We engage external cyber vendor consultants, auditors, and other third parties in connection with our risk assessment processes. These service providers assist us to assess, design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: ESS Tech, Inc.

ticker: GWH


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and exploit attempts of our and our third-party vendors' data and systems. For more information, please see the section titled "Risk Factors—Risks Relating to Information Technology, Intellectual Property, Data Security and Privacy—Compromises of our data security could cause us to incur unexpected expenses and may materially harm our reputation and results of operations."

companyName: ThredUp Inc.

ticker: TDUP


text: We have implemented a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: password protection; multi-factor authentication; monitoring and alerting systems for internal and external threats; and regular evaluations of our cybersecurity program.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – The occurrence of cyber incidents or cyberattacks could disrupt our operations, result in the loss of confidential information and/or damage our business relationships and reputation.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: We have incorporated cybersecurity risk into our extensive risk management framework by aligning it with our overall risk strategy. This involves identifying potential cybersecurity threats, assessing their impact and developing mitigation strategies. These governance processes apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, ensuring that cybersecurity risks are managed effectively and are in line with the organization's risk tolerance and business objectives. Our cyber risk program leverages internationally recognized standards as appropriate. All employees participate in multiple information security training programs. Employees receive training on how to identify and report cyber risks and events through our cybersecurity awareness program. Additionally, we hold cybersecurity risk insurance.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: Our Program takes a holistic approach to organizational security, focusing on protecting our core technologies and the operations and areas of business it supports. The Program manages numerous metrics and operates on a 24x7x365 basis to meet the growing needs of Customers and ensure the continued protection of its customers.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example assessors, cybersecurity consultants, auditors, and outside legal counsel.

companyName: Cidara Therapeutics, Inc.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our audit committee is responsible for the oversight of risks from cybersecurity threats. Members of our audit committee receive updates on a quarterly basis from senior management, including leaders from our Information Technology team regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we depend on the digital technologies of third-party IT service providers, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our Board of Directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the Board of Directors deems have not encountered any cybersecurity incidents since the closing of the Transfer Agreement."

companyName: Agassi Sports Entertainment Corp.

ticker: AASP


text: run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team;

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: We conduct targeted security assessments and penetration tests throughout the year by internal teams as well as through engagements with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

companyName: BERRY GLOBAL GROUP, INC.


text: The Company identified another email spoofing effort in May 2014 by a scammer pretending to be one of the Company's subsidiaries and asking an existing customer for payment owed to the subsidiary to be sent to the scammer's bank account. This effort was detected by the Company and the customer and no money was sent to the scammer's bank account.

companyName: Value Exchange International, Inc.

ticker: VEII


text: Our VP of IT brings over 15 years of experience in cybersecurity, including serving as Chief Information Security Officer for a multinational company in the specialty materials industry. Our VP of IT has experience with compliance programs for cybersecurity-related regulations and standards.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: We conduct technical risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We also plan to conduct programmatic risk assessments including identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Peraso Inc.

ticker: PRSO


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures;

companyName: VICTORY CLEAN ENERGY, INC.

ticker: VYEY


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with the DIT, Mr. Roberts Hoenisch. With over 30 years of experience in the information technology field, Mr. Hoenisch brings a wealth of expertise to his role. He, in conjunction with his staff and external consultants, oversees our governance programs, tests our compliance with standards, remediates known risks, and implements our employee training program.

companyName: HMN FINANCIAL INC


text: Consistent with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while our Board and its Audit Committee play an active, ongoing oversight role.

companyName: NEOGENOMICS INC

ticker: NEO


text: Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and third-party risk and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: The Company's Chief Information Security Officer is responsible for the assessment and management of material risks related to cybersecurity. The CISO reports directly to the Chief Information Officer (CIO) and has served in the CISO role since its creation in 2021 and in similar roles with the Company since 2011. The CISO has more than 30 years of experience in the information technology field, including more than 20 years of experience helping secure organizations in the professional services, manufacturing and US Intelligence/Department of Defense sectors. He holds a BS in Business/Information Systems. In addition, the Company's Management Team and Cybersecurity and Privacy Governance Team is composed of individuals with collective decades of experience in information technology, data protection, threat response, emergency management, business continuity, and disaster recovery.

companyName: KELLY SERVICES INC

ticker: KELYA


text: In addition, we have an employee awareness program to regularly educate our workforce on the cybersecurity risks they face and how they can operate safely. We provide all associates that have network access with annual data-security training. Our training and education programs include specialized training for associates handling confidential information, associates with privileged access, executive specific training, general information security awareness training, periodic anti-phishing campaigns, one-click email-enabled phish alert reporting functionality and advisory emails on emerging threats.

companyName: US Foods Holding Corp.

ticker: USFD


text: Dale Dwaileebe, IT Manager - Mr. Dwaileebe has over 20 years of IT experience, is a current member of Infragard, and holds multiple industry recognized certifications. Michael O'Malley, Chief Risk Officer – Mr. O'Malley oversees entity-wide risk management, including cybersecurity related risk.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Our cybersecurity risk management program includes a cybersecurity incident response plan ("CIRP"). Corning's CIRP provides the Company with the capability for responding, reporting and remediating cybersecurity incidents. It has been established to reduce or minimize the impact of cybersecurity incidents on the Company's networks, IT systems, users or business processes. Corning's Cyber Security Incident Response Team, led by the Chief Information Security Officer ("CISO"), handles the response process for all cybersecurity incidents and Corning's Corporate Crisis Response Team ("CCRT") is mobilized and involved in any significant incidents.

companyName: CORNING INC /NY

ticker: GLW


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we would require those third parties, although there are currently none, that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor heading " Security incidents, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability " which disclosures are incorporated by reference herein. have no t experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Management oversees the Company's cybersecurity risk management process. Management has adopted a charter that provides to periodically review and discuss with the Board the guidelines and policies with respect to risk assessment and risk management of cybersecurity and other risk exposures relevant to the Company's computerized information system controls and security. Management may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks. Management will report to the Board on the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as the Management deems appropriate.

companyName: SHF Holdings, Inc.

ticker: SHFS


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of significant threats and incidents to management, including the Chief Digital and Technology Officer and the Chief Security Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit and Finance Committee and appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: The Company's Internal Audit function performs audits to evaluate and report on compliance with cybersecurity policies and procedures, reviews internal control certifications from relevant third-party service providers, and tests IT system and network controls as part of its annual assessment of the effectiveness of the Company's internal controls. Additionally, the Company engages third-party specialists to conduct periodic tests, incident simulations, and assessments to verify and continuously enhance its cybersecurity risk management program.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: Our cybersecurity team utilizes a cyber risk management and quantification system ("CRQ"). The CRQ provides intelligence and insights on potential areas of cyber risk and analyzes risk across the major stages of typical cyberattacks and covers a number of entities in our environment, including third party providers. The CISO monitors the CRQ to help ensure that cyber risk assessment and reduction is integrated into the Company's overall risk management system.

companyName: DOC DR Holdco, LLC


text: Our Vice President of Information Technology is responsible for developing, implementing, and maintaining our cybersecurity risk management policies and procedures. The Vice President of Information Technology has over twenty years of information technology management experience. The Vice President of Information Technology and his team hold regular meetings focused on prevention and detection of cybersecurity threats, business continuity and identity protection.

companyName: CareMax, Inc.


text: Risk Identification Potential malicious threats are identified through both internal and external resources and tools including, but not limited to, software information and event management software ("SIEM"), endpoint detection ("EDR"), threat intelligence services, network monitoring, and cloud monitoring. In addition, cybersecurity risks identified through external audits, customer audits, third-party monitoring services and industry benchmarking are reviewed for likelihood and impact and addressed accordingly.

companyName: Adient plc

ticker: ADNT


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is initially focused on containing the cybersecurity incident as quickly and efficiently as possible, consistent with the procedures in the incident response plan. Containment procedures may include shutting down systems; disconnecting systems from a network, disabling specific ports, protocols, services, functions, etc., disabling access to compromised systems; examining code in a controlled environment and making forensic backups of affected systems for possible legal action for third party forensic analysis.

companyName: W. P. Carey Inc.

ticker: WPC


text: Risks And Impact From Cybersecurity Threats To date, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding our cybersecurity risks, refer to Item 1A. "Risk Factors – We and our tenants face risks related to cybersecurity attacks that could cause loss of confidential information and other business disruptions." included elsewhere within this Annual Report on Form 10-K.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Management and Strategy are committed to protecting information and the underlying information systems involved in the functionality of our products and the operation of our business. We assess, identify, and manage material risks from cybersecurity threats through various processes and procedures, including: assessing risks, ad hoc, to identify the potential impact and likelihood of various risks and scenarios and to determine appropriate mitigation strategies and controls; manufacturer, partner, and supplier selection processes; (iii) procedures for responding to cybersecurity incidents; our employees, incident response personnel, and senior management on cybersecurity awareness; the responsibilities of our information technology team and evaluating our cybersecurity posture and performance on an ongoing basis;

companyName: DNA X, Inc.

ticker: SONM


text: Information security risk includes the risk that cyber incidents and threats could result in a failure or interruption of our business operations. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations. We have implemented processes to identify, assess, and manage material risks from cybersecurity incidents or threats that may directly or indirectly impact our business strategy, results of operations, or financial condition. Please refer to " Item 1A. Risk Factors " for additional information on our operational risk, which includes the risk of failures or interruptions in information systems resulting from cybersecurity threats or incidents.

companyName: Federal Home Loan Bank of Des Moines