text: The Ameren Companies have identified cybersecurity as an enterprise risk, which is managed through Ameren's integrated enterprise risk management program. The program is designed to continuously assess risk and evaluate the likelihood and probability of impact to determine the appropriate risk tolerance and risk management strategies that inform our cybersecurity policies, investments, practices, controls, and countermeasures. The program is a comprehensive, consistently applied management framework that is designed to ensure all forms of material risk and opportunity are identified, reported, and managed in an effective manner overseen by the risk management steering committee. The risk management steering committee, which is composed of executive management and senior-level Ameren officers, with Ameren board of directors' oversight, oversees and governs Ameren's enterprise risk management processes, which include the identification, assessment, mitigation, and monitoring of risks including strategic, operational, and cybersecurity risks.

companyName: AMEREN CORP

ticker: AEE


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our management team has a comprehensive understanding of the Company's cybersecurity posture and associated risks. The team possesses significant expertise and experience to develop, implement and maintain appropriate cybersecurity controls to reduce risk and seek to keep the Company safe from malicious attacks.

companyName: Arcadium Lithium plc

secItem: Item 1C


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under "Part 1. Item 1A. Risk Factors" in this Annual Report on Form 10-K, including under the section titled "—Risks related to employee matters, managing our growth and other risks related to our business."

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics. In addition, management works collaboratively with our third-party provider to test our systems security processes and prevent, monitor, detect, mediate and remediate cybersecurity threats and incidents, and will report such threats and incidents to the Audit Committee when appropriate. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: We evaluate our controls and response protocols at least twice a year using external third-party assessors and consultants in both advisory and adversarial engagements. These third-party experts are familiar with our systems and could be retained in the event of a significant incident to assist us in evaluating and responding to such an incident. We also regularly test our environment as part of our focus on identifying and eliminating vulnerabilities. We incorporate the lessons learned from these engagements into our cybersecurity program. Recognizing the risks posed by external partners, we have implemented a third-party risk management program, which includes due diligence assessments, contractual safeguards, and regular monitoring of vendors and partners with access to our systems or data; however, we cannot ensure in all circumstances that their defensive efforts will be successful.

companyName: POOL CORP

ticker: POOL


text: As of December 31, 2023, cybersecurity risks have not materially affected our business strategy, results of operations, or financial condition.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: We also utilize third-party service providers as a normal part of our business operations. These third-party service providers may have access to our systems and/or sensitive information. To address cybersecurity risks arising from our third-party service providers, we assess and monitor risks relating to potential compromises of sensitive information at our third-party service providers and reevaluate these risks periodically. We categorize our third-party service providers by criticality, based on the criticality and sensitivity of our data each third-party service provider has access to, and, based on this, we employ a risk-based approach for review of the security measures implemented by each third-party service provider. In addition, we obtain periodic attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Cybersecurity risk management is integrated within our risk management framework. See Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk Management" for additional information on our risk management. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.

companyName: PRUCO LIFE INSURANCE CO


text: Assess We evaluate the exposure of our assets to identified cyber risks and determine the potential operational or reputational impact if access or utilization is compromised. This assessment includes determining the materiality of these risks based on their potential impact.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: The Board has direct oversight of the Registrants' cybersecurity programs through periodic reports from the CSO, at least twice a year, regarding cybersecurity matters and risks as well as the adequacy and effectiveness of our cybersecurity risk management program. Through these reports, the Board monitors the Registrants' programs, processes and procedures related to cybersecurity. The Board has directed the CEO and CSO to promptly inform the Board in the event of a material or potentially material cybersecurity event. Each member of the Board has access to management, including the CEO and CSO, to ask questions and engage on the company's approach to prevent, detect, assess, and mitigate cybersecurity risk. PPL's Board has several Board members with experience in cybersecurity, including one with a certificate in Cyber-Risk Oversight from the National Association of Corporate Directors.

companyName: PPL ELECTRIC UTILITIES CORP


text: Management, under the supervision of our Chief Information Security Officer (CISO), is directly responsible for assessing and managing cybersecurity risks and otherwise implementing our cybersecurity program, which includes our Incident Response Playbook. The CISO reports directly to our Chief Information and Digital Officer (CIDO), who is a member of our Executive Committee and leads our information technology, cybersecurity, digital health, and advanced analytics and data science functions. Our CIDO in turn regularly updates our Executive Committee on cybersecurity matters. Our CISO and CIDO have significant experience managing global cybersecurity threats across the pharmaceutical, technology, entertainment, and defense industries. In addition to providing regular updates to the CIDO and his staff, the CISO is a member of our Executive Information Security Governance function (EISG), which meets regularly and is composed of executive and senior leadership from a variety of functions, including information security, legal, finance, audit, and ethics and compliance to assess and manage cybersecurity developments and risks and our internal programs. Each of the CIDO, the CISO and the EISG may call upon business and legal stakeholders across our company to manage cybersecurity threats and incidents.

companyName: ELI LILLY & Co

ticker: LLY


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Board receives periodic updates from the Company's management regarding TIAA's cybersecurity program, information on current threat landscape and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: The Company's cybersecurity risk management program is an integral part of its overall enterprise risk management efforts. The Company manages cybersecurity risks within its products and services, infrastructure and corporate resources using a framework that is based on applicable regulations, industry standards and recognized best practices. Through this framework, the Company devotes significant resources to identifying, monitoring, assessing and responding to cybersecurity threats and incidents, including those associated with its use of third-party software, applications, services, and cloud infrastructure.

companyName: BLACKBERRY Ltd

ticker: BB


text: The Information Security Program is intended to provide effective governance and oversight for assessing cybersecurity risks, recognizing that no program, no matter how well designed and implemented, can prevent all potential cybersecurity risks and that the benefits of any potential controls or mitigations should be considered in relation to their costs. While we have experienced cybersecurity incidents in the past, to date, cybersecurity incidents and threats have not materially affected our business strategy, results of operations or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Form 10-K.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: The ISO maintains risk assessments for key IT systems. A third party cybersecurity risk assessment tool, as well as the FFIEC's Cybersecurity Assessment Tool (CAT) are also used annually to assess cybersecurity risk.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: Our security team follows an incident response process which we are continuing to evaluate and enhance. Pursuant to this process, incidents which may result in economic loss to the company, reputational harm or require notifications to individuals and government authorities are reported to our executive team. Our Chief Security Officer also provides a quarterly summary of investigations given to an executive data council, and our Data Privacy Officer reports on our compliance posture with respect to new and pending laws and regulations.

companyName: Unity Software Inc.

ticker: U


text: TEP's Security Steering Committee provides management oversight to its cybersecurity strategy, performance, and risk assessment and management. This committee also reviews significant cybersecurity events, including the scope of the incident and the associated prevention, detection, mitigation, and remediation efforts. This committee includes the Chief Operating Officer, Chief Legal Officer, Senior Vice President of Finance, Senior Director of IT Operations and Enterprise Security, and others with the requisite cybersecurity experience, training, and skills who oversee TEP's ERM program. The Senior Director of IT Operations and Enterprise Security has 16 years of experience in managing technology and risks and advising on cybersecurity issues and holds CISSP and GICSP certifications.

companyName: TUCSON ELECTRIC POWER CO


text: We engage in an annual assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, focused on evaluating the effectiveness of our cybersecurity measures and planning.

companyName: Velo3D, Inc.

ticker: VELO


text: the review of the security procedures used by third parties that may host or otherwise have access to the Company's data. if necessary, the use of third-party security experts if and when an incident is detected.

companyName: Birchtech Corp.

ticker: BCHT


text: Our management team, including our Vice President, Information Technology, and senior information technology staff, collectively have more than 40 years of experience assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes information systems architecture, operations, cybersecurity, data privacy protection, quality, and regulatory compliance experience.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: In addition, Orchestra maintains policies over areas such as information security, IT change and configuration management, acceptable use, access on/offboarding, and data backup and recovery to help govern the processes put in place by management designed to protect Orchestra's IT assets, data, and services from threats and vulnerabilities. Orchestra partners with industry recognized cybersecurity providers leveraging third-party technology and expertise. Cybersecurity partners to the Company, including consultants and other third-party service providers, are a key part of Orchestra's cybersecurity risk management strategy and infrastructure and provide services including maintenance of an IT assets inventory, periodic vulnerability testing, identity access management controls, including restricted access of privileged accounts, physical security measures at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and traffic monitoring and automated alerting, ongoing cybersecurity user awareness training, remote monitoring and management, capacity management, industry-standard encryption protocols, formalized processes over asset and data destruction, formalized change management processes, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, and assessment. In the event of an incident, the Cyber Risk Committee would be notified and appropriate action would be taken to resolve the incident, including notifying senior management and, as appropriate, the Board.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors.

companyName: Motus GI Holdings, Inc.

ticker: MOTS


text: Members of our senior management team supervise our IT function and its efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents. In addition to day-to-day management, our senior management team's supervision of these efforts includes receiving and responding to briefings from IT personnel, updates on cyberthreat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and notification of significant alerts and reports produced by third parties and security tools deployed in our IT environment.

companyName: REDWOOD TRUST INC

ticker: RWT


text: Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: VIVOS INC

ticker: RDGL


text: We have an overall incident management plan, which is intended to provide guidance and protocols to facilitate timely notification and communication to key internal and external stakeholders, as appropriate, during an incident. A subset of this incident management plan is our Security Incident Response Plan, or SIRP, which is based on leading cybersecurity incident response practices. Incidents may be escalated to the CISO, our Chief Information Officer, our Chief Legal Officer, or other members of management or the Board, depending on the severity of the incident, and are handled according to the SIRP protocols, which includes incident detection and analysis; containment, eradication and recovery; and post-incident monitoring. We have developed a framework for assessing the materiality of any such incidents, including a committee responsible for determining whether the incident is material for disclosure. The committee includes our CISO, our Chief Information Officer, our Chief Legal Officer, our Senior Vice President and Controller (Principal Accounting Officer), our head of Internal Audit, and other members of management with relevant subject matter expertise.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: The Executive Team, comprised of chief-level officers, annually reviews and provides recommendations on the Enterprise Security Policy, Security Incident Response Plan, and the Business Resiliency Management Policy. The President and CEO annually approves each policy for submission to the board of directors for its consideration and ultimate approval. In addition to the board of directors and management committees, we have an Information Security Working Group (ISWG). Membership in the ISWG consists of leadership and business partners from a cross section of areas, including operational risk, information security, information technology, legal, operations, and others throughout FHLBank. The breadth and depth of experience of members of the ISWG allows for detailed discussions on information security trends and emerging risks which can be elevated to the Technology Committee for action or further discussion, as necessary and appropriate.

companyName: Federal Home Loan Bank of Topeka


text: As discussed above, our cybersecurity team oversees information security, cyber and technology risk and IT compliance. As of December 31, 2024, our cybersecurity team consisted of 14 associates with an average of over ten years of cybersecurity experience, most of whom hold advanced degrees in the fields of information security and/or cybersecurity, along with over 50 professional certifications in the aggregate. Our cybersecurity team is led by a Senior Director of Cybersecurity, who has over 30 years of global experience across various industries in the areas of information risk, privacy, security and the leadership of cybersecurity teams dedicated to the identification of risks and protection against potential threats as well as the swift detection, response and recovery from adverse incidents. Our Senior Director of Cybersecurity has earned several professional certifications including Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified in Risk & Information Systems Control (CRISC) and Certified Information Security Manager (CISM) and reports through one of our Senior Vice Presidents to our Chief Operating Officer, who is a member of the executive team.

companyName: Cable One, Inc.

ticker: CABO


text: We benchmark and evaluate our Cybersecurity and Data Protection Program and data protection maturity against the NIST Cybersecurity Framework and the HIPAA Security Rule. Consistent with these frameworks, our program includes recurring third-party assessments and a vendor risk management program. Our vendor risk management program conducts security assessments to determine a risk profile of potential vendors and third-party partners and integrates ongoing monitoring and periodic re-assessments to ensure compliance with RadNet's security standards. RadNet's Vendor Risk Management Team works closely with RadNet Legal, Compliance and Operations teams to address data safety, compliance and legal requirements for each of our vendor/partner engagements.

companyName: RadNet, Inc.

ticker: RDNT


text: Risk Management Approach We have documented cybersecurity policies and standards, and we assess risks from cybersecurity threats and monitor information systems for potential cybersecurity issues. These processes are managed and monitored by a dedicated cybersecurity team, including third-party service providers, and led by our Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to help prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and help maintain a stable information technology environment. For example, we use processes, tools and external services to conduct regular vulnerability testing, penetration testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Our cybersecurity incident response plan provides that our ERM, strategic crises management coordinator is informed about significant cybersecurity incidents for escalation to our internal Incident Disclosure Committee, SLT, and Board, as appropriate in accordance with our strategic crisis management action plan. Our cybersecurity incident response team is responsible for maintaining our cybersecurity incident response plan, which is periodically tested through our tabletop exercises. We have involved outside experts, our strategic crises management coordinator, members of our SLT, and members of our Incident Disclosure Committee in our tabletop exercises and preparedness drills to strengthen these response plans.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Incident Response Planning Our incident response policies and procedures are aligned with applicable laws and state policies. They encompass the identification of roles and responsibilities, investigation, containment and escalation procedures, documentation and preservation of evidence, communication protocols, and lessons learned.

companyName: CSP INC /MA/

ticker: CSPI


text: If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could delay our regulatory approval efforts and significantly increase our costs as a result of efforts to recover or reproduce the lost data. Moreover, if a real or perceived security breach affects our systems (or those of our third-party service providers), or result in the loss of or accidental, unlawful, or unauthorized access to, use of, release of or other processing of personally identifiable information or clinical trial data, our reputation could be materially damaged.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: The Company's cybersecurity program is managed by a dedicated cybersecurity function reporting to the Chief Information Security Officer ("CISO") who reports to the Chief Information Officer ("CIO") and is responsible for the Company's cybersecurity strategy, policies, standards, architecture and process. The CISO has over 20 years of executive experience in IT operations and security, primarily in the airline industry, and maintains several active certifications in Risk and Information Security including CIPPUS, CISSP-ISSMP, CISM, CRISC, and CISSP. The program includes periodic and ad hoc reporting on relevant developments, including monitoring, prevention, detection, mitigation and remediation of the current cybersecurity landscape as well as reporting on any cybersecurity incidents to the Company's CEO and the Safety, Security and Operations Committee of the Board of Directors, which has oversight of management's cybersecurity function. The CISO also engages external government and commercial expertise to continuously evaluate, test and adapt the program. External vendors participate in in-depth security assessments based on the Company's vendor management security policy.

companyName: Spirit Aviation Holdings, Inc.

ticker: FLYYQ


text: We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities. We periodically engage third parties to perform cybersecurity audits to measure the maturity of our cybersecurity program against the National Institute of Standards and Technology (NIST) Framework. We also engage third parties to conduct security reviews of our network, processes and systems on a regular basis to identify opportunities and enhancements to strengthen our policies and practices.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, IT Systems are inherently vulnerable to disruption and compromise due to a broad range of risks from cybersecurity threats, and we face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Disruptions or security compromises affecting our information technology systems or those of our critical service providers could adversely affect our operating results by subjecting us to liability, and limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, or implement strategic initiatives."

companyName: Custom Truck One Source, Inc.

ticker: CTOS


text: If deemed appropriate, we would design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer ("CISO"). Our CISO and dedicated personnel are certified and experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the Center for Internet Security (CIS) benchmarks. CIS controls map to many established standards and regulatory frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and NIST SP 800-53, the ISO 27000 series of standards, PCI DSS, HIPAA, and others.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: We have implemented a Vendor Cybersecurity Risk Management Program ("VCRMP"), which is in the scope of our ISO 27001 certifications. The VCRMP controls are designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. These providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in making these risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities, and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Board Oversight of Cybersecurity Matters Assessing and managing information security matters is the responsibility of our full Board of Directors. The Board meets with the senior executives, specifically the Chief Development Officer, Chief Executive Officer, and Executive Vice President of Finance on at least an annual basis to discuss cybersecurity posture. The Board also periodically receives targeted briefings related to cybersecurity and reviews our incident response capabilities.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the risk factor within Item 1A "Risk Factors" in this Annual Report on Form 10-K, entitled "We, as well as our suppliers and partners, are subject to cybersecurity risks to operational systems, infrastructure, integrated software in our lidar solutions, and the data processed by those solutions, and any material failure, weakness, interruption, cyber event, incident, or breach of security could adversely affect our business by causing a disruption of our operations, a compromise or corruption of our confidential or other business-critical information, and/or damage our business relationships, all of which could negatively impact our business financial condition, and operating results."

companyName: AEye, Inc.

ticker: LIDR


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Risk, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company. Those processes are periodically tested through tabletop exercises.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Our board of directors has oversight of overall risk management, prioritizing the most significant risks including strategic, operational, financial and legal compliance risks. The board's risk oversight process builds upon management's risk management processes, which include processes for identifying, assessing and managing material risks from cybersecurity threats. The board implements its risk oversight function primarily through its audit committee, which receives reports about our practices, programs, notable threats or incidents, and other developments related to cybersecurity throughout the year. To this extent, the audit committee receives information about cybersecurity risks as part of our enterprise risk management framework and reporting. The audit committee then assesses implemented cybersecurity controls to monitor and evaluate the mitigation of cybersecurity risks.

companyName: DONALDSON Co INC

ticker: DCI


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's Vice President, Business Operations ("VPBO"), other members of management and relevant management committees, including Company's Senior Leadership Team ("SLT"). The Company, as part of cost-cutting initiatives in 2024, has eliminated the VBPO position;

companyName: Longeveron Inc.

ticker: LGVN


text: Our cybersecurity committee monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents. Our cybersecurity committee also consults with internal and external cybersecurity personnel and threat intelligence, obtains other information from governmental, public or private sources, and communicates with senior management about cybersecurity threats and resources for managing them.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Executive management plays a significant role in assessing and managing material risks from cybersecurity threats. Our Chief Technology Officer manages our information security program.

companyName: Outset Medical, Inc.

ticker: OM


text: Advisor and its affiliates have a technology team, under the leadership of the Director of Information Technology, who has over 20 years of technology management experience, which defines a work plan designed to maintain strong cybersecurity maturity, sets improvement objectives of key controls and systems, including feedback from third-party assessments, and identifies and implements on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of this planning, management conducts regular testing of our incident response plan to increase awareness, establishes key decision-making criteria, ensures effective communication among key stakeholders, and complies with the Company's disclosure obligations.

companyName: Lightstone Value Plus REIT II, Inc.


text: Our Cybersecurity Program ("Program") is designed from a risk- and compliance-based approach for resilience and protection across our operations and the appropriate access, use, and/or disclosure of PHI and PII. Our Program employs the National Institute of Standards Technology (NIST) Cybersecurity Framework (CSF) and strategy to deliver multi-layered defenses and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources to inform our cybersecurity efforts and allocate resources.

companyName: InnovAge Holding Corp.

ticker: INNV


text: Third-Party Risks. We have established processes to oversee and identify cybersecurity risks presented by third parties. Under these processes, contracts with third parties are to be reviewed for proper contractual controls, to include provisions mandating the implementation and maintenance of appropriate cybersecurity measures as well as legal recourse in the event of a security incident. We periodically conduct assessments of key vendor and business partners' cybersecurity practices and require them to adhere to our security standards, as appropriate. Additionally, we may perform additional due diligence on select third-party service providers by collecting and reviewing certifications when available. The Company also conducts periodic audits of third-party processes and certifications to consider their use of industry best practices.

companyName: IBEX Ltd

ticker: IBEX


text: The Company has developed and implemented a Cybersecurity program intended to ensure the confidentiality, integrity, and availability of the Company's critical systems and information.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: We have implemented policies and processes to evaluate and manage cybersecurity risks, incorporating them into our broader risk management framework. We regularly examine cybersecurity threats that could compromise our information systems' security or data.

companyName: Revolve Group, Inc.

ticker: RVLV


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers (all of whom are executive officers of our Manager) under the oversight of our board of trustees. We rely on our Manager for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Manager has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Star Holdings

ticker: STHO


text: We have an Information Security area of the Information Technology department comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk. The area handles processes and procedures to mitigate and implement protective, proactive and reactive measures to protect FHLBank against cybersecurity risks and is responsible for the practices designed to prevent unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information.

companyName: Federal Home Loan Bank of Topeka


text: The program also includes training that reinforces our policies, standards, and practices, as well as the expectation that employees comply with these policies. The training engages personnel on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests. We maintain a cybersecurity risk insurance policy.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX


text: The ORIX USA Information Technology and Cybersecurity Team monitors security events via a SIEM (security information and event management) and SOAR (security orchestration, automation, and response) platform. Mobile device management software is employed with the objective of protecting corporate email and data on mobile devices and is designed to prevent unauthorized data transfer.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, managed cybersecurity service providers, darkweb monitoring services, and forensic investigators.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: The Audit Committee receives quarterly reports from management regarding our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as certain other incidents that have lesser impact potential.

companyName: Teads Holding Co.

ticker: TEAD


text: Our Enterprise Risk Management Committee – a management level committee, including senior management and other leadership representatives from our operational risk, information security, information technology, legal, operations, and other departments – is responsible for approving policies to support the management and implementation of the cybersecurity program and recommending the annual information technology strategic plan to senior management prior to Board review and approval. This committee receives regular reporting from our chief information security officer similar to what is provided to the Board, and more detailed reporting regarding the availability of information technology assets and cybersecurity threats being monitored.

companyName: Federal Home Loan Bank of Cincinnati


text: Additional information We describe how the risks related to cybersecurity could materially impact our business strategy, results of operations, or financial condition, in more detail under the heading "Risks Related to Cybersecurity, Data Privacy and Information Security," see Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: TrueBlue, Inc.

ticker: TBI


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to patient and employee data or our systems. Third-party risks are included within our risk management process discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, cybersecurity threats may affect our business. See " Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed. " in "Item 1A. Risk Factors" of this Annual

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management includes interaction with the Company's Chief Information Officer ("CIO") at least quarterly and similar interaction on this topic with other members of management.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: Our SVP of Group Operations provides quarterly briefings to the audit committee and our executive management regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: IGM Biosciences, Inc.


text: The Information Security Program employs various information security controls, tools, and strategies to combat threats and to ensure the Company's information and systems remain secure. The Information Security Program contains specific provisions for identifying, assessing, and mitigating cyber threats, including but not limited to social engineering, credential theft, and vulnerability exploitation.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents;

companyName: Electromed, Inc.

ticker: ELMD


text: We have implemented and recently enhanced various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer systems, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies, manufacturing, and employees. We engage an external entity to employ processes for assessing, identifying, and managing material risks from cybersecurity threats that are incorporated into our overall risk management system. These items are designed to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our system includes procedural and technical safeguards, response plans, and reviews of our policies.

companyName: ACTUATE THERAPEUTICS, INC.

ticker: ACTU


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.

companyName: AGL Private Credit Income Fund


text: RCSC meetings include discussions of specific risk areas throughout the year including, among others, those relating to cybersecurity. The CISO provides at least two updates each year to RCSC on cybersecurity matters. These reports include an overview of the cybersecurity threat landscape, key cybersecurity initiatives to improve the Company's risk posture, changes in the legal and regulatory landscape relative to cybersecurity, and overviews of certain cybersecurity incidents that have occurred within the Company and within the industry.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: Our computer systems have been and will likely continue to be subjected to cybersecurity threats. To date, we have not experienced a cyber security threat that has materially affected the Company, including its business strategy, results of operations, or financial conditions.

companyName: KELLANOVA


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: SKINVISIBLE, INC.

ticker: SKVI


text: We face significant and persistent cybersecurity risks due primarily to: the substantial level of harm that could occur to us and our customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components. We are committed to maintaining strong governance and oversight of these risks and to implementing mechanisms, controls, technologies and processes designed to help us assess, identify and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats.

companyName: KonaTel, Inc.

ticker: KTEL


text: As part of our overall risk management system, we provide periodic mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with information and tools to address cybersecurity threats, and to communicate our information security policies, processes and practices. We also perform periodic email phishing tests to evaluate and maintain cybersecurity awareness among our employees.

companyName: AMBARELLA INC

ticker: AMBA


text: In the last three fiscal years, we have not experienced a material information security breach incident, and the expenses we have incurred from information security breach incidents have been immaterial. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the Adviser and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors—Cybersecurity risks could result in the loss of data, interruptions in our business, damage to our reputation and subject us to regulatory actions, increased costs and financial losses, each of which could materially adversely affect our business and results of operations." in this Annual Report on Form 10-K.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: Deutsche Bank Group's security policy framework defines the core principles of security risk management and the fundamentals for security management. The complete framework is reviewed annually. The framework is governed centrally and applied globally across all product groups and business and infrastructure divisions. The framework includes a clear description of the risk tolerance related to information security. It also sets out the roles, responsibilities and accountabilities of key personnel identified to manage information security risk; the strategy and measures to cope with information security breaches, and related communication procedure.

companyName: RREEF Property Trust, Inc.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. Refer to the risk factor captioned " An information security incident, including a cybersecurity breach, could have a negative impact on our business or reputation" in Part I, Item 1A. "General Risk Factors" for additional description of cybersecurity risks and potential related impacts on our company.

companyName: Semler Scientific, Inc.


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations and the services we provide to clients as well as loss, misuse or theft of personal information (candidates, associates, vendors, clients and employees) and other data, confidential information or intellectual property, and we have experienced data exposures in the past. However, to date these incidents have not had a material impact on our services, information systems or business. Any significant disruption to our services or access to our systems could result in a loss of clients and adversely affect our business and results of operations. Further, a penetration of our information systems or a third-party's information systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. See Item 1A of Part I, "Risk Factors," under the heading "We could incur liabilities or suffer reputational damage from a cyberattack or improper disclosure or loss of personal or confidential data, and our use of data is subject to complex and ever-changing privacy and cybersecurity legal requirements that could negatively impact our business or subject us to claims and/or fines for non-compliance," which should be read in conjunction with the information above.

companyName: ManpowerGroup Inc.

ticker: MAN


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our IT Director. Our current IT Director has been in his position since 2014 and has over 30 years of information technology, finance, and operational experience in our organization. Our IT Director is certified in governance of enterprise IT (CGEIT), is a Certified Data Privacy Solutions Engineer (CDPSE) and a Certified Information Systems Auditor (CISA). Our IT Director and other IT leaders systematically use the Control Objectives for Information and Related Technology (COBIT) framework as an IT governance framework and remain educated on other best practices in compliance, projects, and processes. In addition, our IT Director reviews our operational plan annually with our operating segments, which includes review and discussion of a cybersecurity risk management framework.

companyName: BOISE CASCADE Co

ticker: BCC


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and other data related to our ongoing research and development initiatives, which we refer to as Information Systems and Data.

companyName: Repare Therapeutics Inc.


text: Management provides cybersecurity-related legal, regulatory, compliance, risk, and relevant industry and internal threat updates to the Board of Directors on a quarterly basis; or more frequently as needed. The reports provide information regarding the state of the Company's information security program, the nature, timing and extent of cybersecurity incidents, if any, and the Company's resolution to such matters.

companyName: DIODES INC /DEL/

ticker: DIOD


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors ("Board") and management.

companyName: MSCI Inc.

ticker: MSCI


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of business. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. For more information, see the section titled " Risk Factor— Our business and operations would suffer in the event of computer system failures, including but not limited to our information technology systems, infrastructure and data, or those of our third-party vendors, contractors or consultants failing, becoming unavailable, or suffering security breaches, losses or leakages of data and other disruptions, which could result in disruption of our services, compromise sensitive information (including personal information) related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business. "

companyName: AEON Biopharma, Inc.

ticker: AEON


text: The Director of Information Technology, along with management, is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security-related reports.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: These risks include the risk of cyber-attacks on IT infrastructure and intellectual property, as well as on cybersecurity for our online product offerings. The Company has adopted Risk Assessment Methodology Policy, Information Security Policy and Incident Response Plan Policy to managing material risks from cybersecurity threats and hired IT consultant to help managing cybersecurity risks. When the Company uses a third party service provider and shares sensitive data such service provider, it must adhere to the compliance requirements in the Service Agreement which includes an acknowledgement that the service provider is responsible for safeguard and the security of the sensitive data. As of date of this report, there has been no previous cybersecurity incidents, have materially affected the Company yet.

companyName: XMax Inc.

ticker: XWIN


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.

companyName: AIM ImmunoTech Inc.

ticker: AIM


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes, and practices are being integrated into the Company's enterprise risk management program and are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FARO TECHNOLOGIES INC


text: Cybersecurity and IT risks are reported to the Board through multiple channels. The IT Committee Chair periodically reports to the Board summarizing key issues, risk assessments, and compliance matters. Additionally, the Director of Technology submits semi-annual reports to the Board, providing insights into ongoing and emerging risks, technology developments, and IT security initiatives. In cases where significant IT or cybersecurity risks arise, such matters are escalated to the Company's Board through the Chair of the Risk Committee or the Chief Risk Officer, for timely awareness and response.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: The Company has implemented comprehensive procedures and infrastructure to protect our network from cybersecurity attacks. However, since such threats are ongoing and continue to evolve, we regularly consider the effectiveness of our cybersecurity framework. Our Director of IT, reporting to our Chief Financial Officer, has primary management responsibility over day-to-day oversight and evaluation of cybersecurity systems and processes, including monitoring for potential cyber threats. The Director of IT meets with the Chief Financial Officer and senior management, and when appropriate, the Board of Directors, to provide updates when there are changes to our risk management, systems, processes, or efforts. The Company conducts regular training for employees to mitigate cyber risks such as exposure to phishing and social engineering attacks. In the event of a network security incident, senior management and our Audit Committee are notified immediately. The Audit Committee takes the lead on behalf of the Board of Directors. The full Board of Directors is informed regularly of the status of any and all cyber incidents. We have a comprehensive incident response plan which is carried out by our IT department under the oversight of senior management and our Audit Committee and includes engagement of third party cybersecurity experts and our cyber insurance carrier and legal teams, as needed.

companyName: GEE Group Inc.

ticker: JOB


text: The Adviser and the Administrator manage the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee. T he Audit Committee is responsible for ensuring that management has processes in place that are designed to identify and evaluate cybersecurity risks to which we are exposed and has implemented processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is overseen by our Chief Information Security Officer, who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Security Officer and cybersecurity team are experienced information systems security professionals and information security managers with many years of experience. Management, including our Chief Information Security Officer and cybersecurity team, regularly update the Audit Committee on our cybersecurity program, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of our cybersecurity program, developments in cybersecurity and updates to our cybersecurity program and mitigation strategies.

companyName: Progyny, Inc.

ticker: PGNY


text: Security Officer reports to NeurAxis' Chief Regulatory Officer and together, they lead the Company's overall cybersecurity function. The Security Officer has over 13 years of experience in managing and leading IT or cybersecurity teams and participates in various cyber security trainings frequently. The Security Officer collaborates with NeurAxis personnel and our outside IT vendors to identify and analyze cybersecurity risks to NeurAxis, considers industry trends, implement controls, as appropriate and feasible, to mitigate these risks and enables business leaders to make risk-based business decisions that impact cybersecurity considerations. The Security Officer meets with senior leadership to review and discuss NeurAxis' cybersecurity program, including emerging cyber risks, threats, and industry trends. The Security Officer also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with external security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to strengthen our cybersecurity technologies and processes.

companyName: Neuraxis, INC

ticker: NRXS


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has over 20 years of experience in information security, including serving as head of cybersecurity and privacy response at a global public company and information security leadership positions with the United States government. Our CISO holds undergraduate and graduate degrees in computer information systems and computer science with an information security focus and possesses various certifications, including the Information Systems Security Professional (NSTISSI No. 4011) and Information Systems Security Officer (CNSSI No. 4014) certifications.

companyName: Block, Inc.

ticker: XYZ


text: As part of its overall enterprise risk management framework, the Company maintains both an Information Security Program ("ISP") and an Incident Response Plan ("IRP"). The Company's ISP is managed by its Chief Information Officer (the "CIO") whose team (the Security Incident Response Team, or "SIRT") is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company's IRP is based on applicable federal and state laws as well as cybersecurity incident response best practices. The purpose of the IRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident. These objectives include maximizing the effectiveness of the Company's operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: Honda develops rules and procedures based on laws and regulations, formulates response flows, verifies and implements measures for improvement through cybersecurity exercises, and develops human resources, among other things. Honda also utilizes solutions for managing cybersecurity information and monitoring malicious activities to monitor and analyze cybersecurity threats and vulnerabilities, and in the event of a security incident related to a cyberattack with a significant impact on Honda, a Global Emergency Headquarters will be established under the supervision and monitoring of Honda's Risk Management Officer, and the supervisory division in charge of risks from cybersecurity threats plays a central role in quickly ascertaining the actual situation and taking measures to minimize the impacts of cybersecurity incidents from a company-wide perspective.

companyName: AMERICAN HONDA FINANCE CORP


text: Equinix conducts regular employee training on how to spot suspicious activity, educates employees on potential security risks, and periodically runs simulations of cyber incidents for employees across various functions to assess and refine response capabilities. Equinix also offers a role-based security certification for its software engineering employees.

companyName: EQUINIX INC

ticker: EQIX


text: While the Evergy Companies have a cybersecurity program designed to protect and preserve the integrity of their information systems, the Evergy Companies also maintain cybersecurity insurance to manage financial statement risk resulting from specific cyber-attacks. Although the Evergy Companies maintain cybersecurity insurance, there can be no guarantee that the Evergy Companies' insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid in a timely manner.

companyName: Evergy, Inc.

ticker: EVRG


text: We have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Signing Day Sports, Inc.

ticker: SGN


text: Although we have not experienced cybersecurity breaches or incidents that have significantly impacted our financial condition, results of operations, or business strategy, the effectiveness of our measures to prevent, detect, mitigate, or recover is based on currently known threats and recovery methods. There is no guarantee that cybersecurity breaches or incidents will not impact our business operations, strategy, financial condition, or operations.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A.

companyName: Longduoduo Co Ltd

ticker: LDDD


text: We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response Plan, which includes an Incident Response Process in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our head of administration will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Process to guide the response.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: Given the regulatory framework under which we operate, we follow a cybersecurity incident response plan that is tested annually in compliance with NERC's critical infrastructure protection standards and includes external disclosure procedures. This plan identifies the members of our cybersecurity incident response team and the criteria to identify, classify and respond to a cybersecurity incident. Cybersecurity incidents are communicated to internal stakeholders, such as management and the Board of Directors, and external stakeholders based on severity of the incident in accordance with the cybersecurity response plan.

companyName: ITC Holdings Corp.


text: The Company employs an in-depth, layered, defensive strategy that embraces a "secure by design" philosophy when designing new products, services, and technology. The Company leverages people, processes, and technology as part of its efforts to manage and maintain cybersecurity controls and employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity. The Company also actively monitors its email gateways for malicious phishing email campaigns and monitors remote connections as a portion of its workforce has the option to work remotely.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: We manage cybersecurity risks by maintaining various protections designed to safeguard against cyberattacks, including firewalls and virus detection software, and periodic end user training on common cybersecurity threats (e.g. phishing exercises and interactive trainings). We have established our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess effectiveness of our data security practices. A third party security consultant conducts regular network security reviews, scans and audits, and we may consult with other external experts as warranted by a particular cybersecurity incident or threat. In addition, we maintain insurance that includes cybersecurity coverage.

companyName: CODEXIS, INC.

ticker: CDXS


text: We have established comprehensive incident response and recovery plans that guide our response in the event of a cybersecurity incident. We continuously test and evaluate the effectiveness of those plans.

companyName: GRESHAM WORLDWIDE, INC.


text: Cybersecurity Risk Management Strategy Identification, Response and Reporting: The Company has adopted a cyber incident response procedure to primarily: • assess, identify and manage material cybersecurity threats and incidents; • comply with our contractual obligation to safeguard covered defense information; and • report on cyber incidents in accordance with the relevant DFARS.

companyName: V2X, Inc.

ticker: VVX


text: Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: Blue Owl Real Estate Net Lease Trust


text: Cyber Risk Management and Strategy Under the board of directors'and audit committee's oversight, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This risk management program addresses, but is not limited to, risks identified by internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. We also engage external independent assessors from time to time to conduct cyber risk assessments and to report both findings and recommendations to management.

companyName: HUBSPOT INC

ticker: HUBS


text: Cybersecurity threats have not materially affected the Company, including its business strategy, results of operations or financial condition. The Company does not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which it is aware are reasonably likely to materially affect the Company.

companyName: Loop Industries, Inc.

ticker: LOOP


text: Our VP of IT/CISO and CFO & COO are responsible for assessing and managing our material risks from cybersecurity threats. The cyber security risk management team is led by our VP of IT/CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance. The team, which includes personnel with Certified Information Systems Security Professional ("CISSP") certification from the International Information System Security Certification Consortium, has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: Board Oversight and Governance As mentioned above, the Board established the Committee to provide dedicated oversight of cybersecurity-related management, strategy, initiatives, risks, threats and remediation activities. The Committee receives regular presentations, reports and updates from the Company's Chief Trust Officer ("CTrO") and other members of management on developments regarding the Company's cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics. After each quarterly meeting of the Committee, the Board receives a report from the Chair of the Committee with an update on the Company's oversight of cybersecurity risks and mitigation efforts. The Committee also receives periodic reports from an experienced outside consultant with information security expertise providing insights on key focus areas to aid in the Committee's oversight of the Company's cybersecurity program.

companyName: Salesforce, Inc.

ticker: CRM


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages a third-party independent cybersecurity company that provides security testing and monitoring, including penetration testing, auditing, and security assessment, for the Company. The results of such assessments and reviews are reported as part of the technology and cybersecurity update to the Company's executive leadership team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: As mentioned above, our SIEM tool monitors threat detection and response 24/7/365. Identified threats are alerted and addressed by our information technology team in accordance with internal policies, industry standard practices and regulatory requirements. Audit logs of external security threats are reviewed weekly as part of general event threat intelligence monitoring procedures. Other ongoing monitoring includes data from our information services team, which maintains an audit trail to detect risks in areas such as unauthorized local connections, network use and remote connections. Vulnerability scans are performed weekly and are supplemented on an ad-hoc basis for specific threats or to test patch status.

companyName: CoreCivic, Inc.

ticker: CXW


text: Additionally, management conducts regular tabletop exercises and incident simulations to assess readiness for potential cyber threats and continuously evaluates the effectiveness of our cybersecurity defenses.

companyName: Luvu Brands, Inc.

ticker: LUVU


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Versus Systems Inc.

ticker: VS


text: Our cybersecurity program, led by our Global Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), is designed to protect and preserve the confidentiality, integrity and availability of all information and systems owned by us or in our care. The Audit and Risk Committee of our Board of Directors oversees cybersecurity, as outlined in its charter and disclosed in our proxy statement.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: We have extensive incident response plans in place that provide a documented framework to, among other things, identify the critical steps to be taken for immediate access, rescue and recovery actions when a system disruption occurs. We also have comprehensive business continuity plans in place for disruptions, including a system disruption, that include recovery actions and alternate methods including manual work arounds that allow us to continue operating and shipping products. Our incident response plans and business continuity plans are regularly reviewed and updated, with a focus on continuous improvement.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate- and long-term timeframe. Our Executive Director of Information and Technology Services ("IT Director"), who reports to our Chief Financial Officer, is responsible for the operational oversight of company-wide cybersecurity strategy, policy and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our IT Director has multiple university certifications in advanced cybersecurity with over 30 years' experience in cybersecurity and technology roles, most of which have been held with the Company. Meetings of our Risk Management Committee and Board of Directors include discussions and presentations by management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats and reports from management on our enterprise risk profile on an annual basis. The Board of Directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.

companyName: NATURES SUNSHINE PRODUCTS INC

ticker: NATR


text: Our cybersecurity framework is evaluated by internal and external experts on an ongoing basis or within the scope of certain projects or engagements. Where we use third-party service providers, we endeavor to ensure that cybersecurity threats are minimized including establishing contractual protections including minimum security and breach notification requirements. We regularly evaluate and adjust these processes based on changes in the threat landscape and business environment.

companyName: California Resources Corp

ticker: CRC


text: The Company employs an in-depth, layered, defense strategy to mitigate information systems and cyber security risks. The Company leverages people, processes, and technology as part of its efforts to manage and maintain cybersecurity controls. The Company uses a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. Processes and systems designed to mitigate cybersecurity risks, including regular and on-going education and training for our associates, preparedness simulations and tabletop exercises, and recovery and resilience testing, have been established. The Company engages in regular assessments of our technology infrastructure, software systems, network architecture, and data repositories, including periodic penetration tests and vulnerability assessments and social engineering simulations performed by third-party specialists. Additionally, vulnerabilities are identified via the use of internally-managed automated scanning tools. Vulnerabilities identified via third-party assessments and internal scans, and the status of corresponding remediation efforts, are inventoried and tracked by the Information Security department, under the direction of the CISO, and regularly reported to management. Summarized results of external and internal assessments and related remediation efforts are reported to the Risk Committee on a quarterly basis.

companyName: LAKELAND BANCORP INC


text: Assessment and management of material risks from cybersecurity threats are performed by the Executive Director, Information Security, Risk & Compliance and the Vice President, IT and Facilities, reporting to the Executive Vice President, Technical Operations and Administration. Our Executive Vice President, Technical Operations and Administration reports to the President and Chief Executive Officer. This group holds primary responsibility for our overall cybersecurity governance program, along with our internal Cybersecurity Oversight Committee, which includes senior personnel from key departments in the organization. The collective experience of the individuals listed above, along with the Cybersecurity Oversight Committee, includes decades of experience working in and overseeing IT and cybersecurity functions and enterprise, IT and cybersecurity risk management functions, in addition to holding active technical cybersecurity certifications and maintaining active membership in cybersecurity professional organizations, as well as local groups, to support knowledge share and ongoing cybersecurity professional development.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: To meet business objectives, we rely on both internal information technology systems and networks, and those of third parties and their vendors, to process and store sensitive data, including confidential research, business plans, financial information, intellectual property, and personal data that may be subject to legal protection, and to ensure the continuity of our supply chain.

companyName: AZZ INC

ticker: AZZ


text: We rely on products and services provided by third parties for portions of our IT infrastructure, including business management, operations and finance systems. These providers may also experience breaches and attacks on their products which may impact our systems. Further we may also face additional cybersecurity risk due to error or intentional misconduct by contractors and other third-party service providers related to the use of these systems as part of our IT infrastructure.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Board of Directors is responsible for overseeing our risk management and strategy and cybersecurity is a critical element of this strategy.

companyName: Guardion Health Sciences, Inc.


text: Chemours educates its employees and contractors annually on cyber risks and prevention, monthly using online situational awareness training, active employee engagement, and ongoing phishing simulations.

companyName: Chemours Co

ticker: CC


text: Governance Overview Our Board oversees cybersecurity risk through multiple methods. The Audit Committee of the Board has been delegated certain cybersecurity oversight responsibility and, among other things, receives quarterly updates and presentations from our Chief Information Officer regarding our cybersecurity environment, cybersecurity risks and threats, cybersecurity projects we have implemented and plan to implement and other cybersecurity developments. The chair of the Audit Committee reports to the full Board after each meeting. In addition, our information security team regularly interacts and discusses cybersecurity matters with a member of the Board who serves as the Board's primary contact on cybersecurity matters as part of our company-wide risk management system. On a quarterly basis, the Board receives a Quarterly Enterprise Risk Assessment Update that typically includes content regarding Information Technology systems and cybersecurity.

companyName: Simply Good Foods Co

ticker: SMPL


text: As part of the above processes, we engage with subject matter expert consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: The CSO reports cybersecurity threats and incidents to the Audit Committee. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee. In addition, pursuant to our internal procedures, in the event of a significant cybersecurity incident, members of senior management will report such threats and incidents in a timely manner directly to the Audit Committee and, when appropriate, to the full Board of Directors.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: ASPAC I Acquisition Corp.


text: Our Information Security Committee is responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. The Information Security Committee includes our Chief Financial Officer and Chief Compliance Officer. At times we may also engage assessors, consultants, or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of RGC who provide services to us pursuant to the Advisory Agreement and Administration Agreement.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: W e have not identified risks from cybersecurity threats that have materially affected us, including our financial position, results of operations, cash flows, or reputation, although certain risks, if realized, are reasonably likely to materially affect us. For more information regarding the risks we face from cybersecurity threats and how those risks could affect us, please see Item 1A. "Risk Factors. "

companyName: Holley Inc.

ticker: HLLY


text: Currently, the Corporate Governance & Nominating Committee ("CGNC") has oversight of the Company's cybersecurity risk management program. The CGNC will receive reports regarding a cybersecurity breach and impact incidents through the Company's cybersecurity incident reporting process. Moreover, the CGNC is updated on cybersecurity trends and common deficiencies.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's business strategy, results of operations or financial condition. However, the Trust can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect the Trust. For more information regarding the risks the Trust faces from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program while our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly, as well as through the Audit Committee of the Board of Directors, and receives regular updates on relevant information regarding cybersecurity.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Our management, including the REIT Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring all our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We also assess third party risks when determining the selection and oversight of applicable third-party service providers.

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: The ISIRP also includes action plans for responding to third-party cybersecurity threats and incidents. We undertake due diligence of third-party systems with which we interact, in addition to requiring data protection covenants in the related third-party provider agreements, as appropriate. Our vendor management program includes ongoing monitoring and oversight of the third-party providers, including performance and information security reviews utilizing System and Organization Control reports, when available, and risk based re-assessment of high inherent-risk third-party providers on an annual basis. Any unsatisfactory reviews are escalated for consideration of appropriate steps to appropriately manage the related risk.

companyName: Federal Home Loan Bank of Indianapolis


text: Our CISO executes the Cybersecurity Program with the support of the Cybersecurity Management Team, which has extensive cybersecurity expertise to protect and defend our networks, physical systems, infrastructure, and data from cybersecurity risks. Our CISO has 33 years of experience in cybersecurity and information technology, over 20 years working with NAVSEA 08Y, approval authority of HII's unclassified Naval Nuclear Propulsion Information networks, and holds a Master's degree in Cybersecurity. He has specific experience in the following cybersecurity areas: Cyber & IT security policy & governance; information risk management; cybersecurity strategic planning and integration; enterprise infrastructure; cybersecurity engineering; incident response and remediation; supply chain cyber risk management; cybersecurity awareness training; M&A cyber risk management; cloud security; identity management; disaster recovery; cybersecurity regulation compliance; and cybersecurity damage assessment.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats: Our CISO is a member of the senior leadership team and oversees our Information Security and Privacy Team. The CISO provides regular updates to the Board on cybersecurity threats facing the organization, including developments in our ongoing information security and privacy programs. As noted, the CISO meets in dedicated sessions with the Finance and Risk Committee to review and discuss in-depth cybersecurity risks facing the Company.

companyName: Jackson Financial Inc.

ticker: JXN


text: Our IT Lead is responsible for engaging and overseeing our IT Firm. In consultation with our IT Firm, our IT Lead, Principal Financial Officer and General Counsel integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicate key priorities to relevant personnel, help prepare for cybersecurity incidents, approve cybersecurity processes, and review security assessments and other security-related reports.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: As of the date of this report, though the Partnership and our service providers have experienced certain cybersecurity incidents, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite implementation of our cybersecurity process, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors – Our business is subject to cybersecurity risks" included elsewhere in this Annual Report on Form 10-K.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP