text: We maintain a cybersecurity Incident Response Plan ("IRP") designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, threats and incidents. The IRP was developed in consultation with common cybersecurity frameworks, including NIST Cybersecurity Framework, to provide efficiency, familiarity and consistency in design. As part of our IRP, we have established a Cybersecurity Incident Management Team ("CIMT"), comprised of senior level executives and management, that defines overall policy and strategy when faced with a cybersecurity incident. The CIMT provides cross-functional and geographical visibility, as well as executive leadership oversight, to address and mitigate associated risks. Among our CIMT, our VP - IT holds the highest level of executive responsibility for assessing and managing cybersecurity threats, incidents, and risks, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations. Our VP - IT leads all components of our information technology functions and reports to our Executive Vice President and Chief Financial Officer.

companyName: Coterra Energy Inc.

ticker: CTRA


text: We leverage technology for our business advantage and have invested in internal and external business applications. Our regular operations involve handling sensitive data, including proprietary business information, intellectual property, and personally identifiable information of our customers, suppliers, and employees. To ensure the safety of this data, the Vice President of Information Security provides oversight and establishes central, standardized frameworks for identifying and tracking cyber-related business and compliance risks across the Company. Any risks from cybersecurity threats to our products and services are communicated to our general counsel and senior management and if deemed material, are further reviewed by the Audit Committee of our Board of Directors. We also periodically engage third-party consultants to help us assess, enhance, implement and monitor our cybersecurity risk management programs and respond to any incidents.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH

secItem: Item 1C


text: Protecting our information from cyber threats remains a persistent priority, and we are committed to identifying and assessing emerging risks related to data protection and cybersecurity. This commitment extends to our internal operations and our collaborations with third-party service providers.

companyName: Harbor Custom Development, Inc.


text: The audit committee has formal oversight responsibility for cybersecurity and is responsible for reviewing the Company's policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, the Chief Information Officer ("CIO") provides quarterly updates to the audit committee with respect to security improvement projects, cybersecurity incidents, mitigation, and management.

companyName: AGREE REALTY CORP

ticker: ADC


text: Additionally, the Company maintains an Information Security Program designed to prevent, detect, and respond to cyberattacks, and maintains a cybersecurity incident response plan designed to enable the Company to respond to cybersecurity incidents, coordinate such responses with law enforcement and other government agencies, and notify clients and customers, as applicable. The Company's risk and technology teams, led by the Company's Chief Risk Officer ("CRO") and Chief Technology Officer ("CTO"), respectively, are responsible for leading the incident response team, identifying technology and cybersecurity risks, utilizing management's expertise in assessing the materiality of cybersecurity events, and are responsible for the controls to manage threats. The Company's risk team in conjunction with the broader incident response team conduct periodic tabletop exercises and business continuity simulations to train and align on best practices and assessment of potential cyber events. Management utilizes the incident response plan and incident response team to assesses materiality of any cyber event through a qualitative and quantitative assessment. The information security program and overall cybersecurity risk management processes are aligned and integrated into the Company's overall risk profile and appetite through the Company's Enterprise Risk Management Committee.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: We have a detailed Incident Response Plan that outlines how we would respond to an actual or potential cybersecurity incident. The plan includes the appropriate notification and escalation requirements including timely reporting to our CEO and Board of Directors and engagement of appropriate third parties such as insurance providers and incident response professionals.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the section titled "Risk Factors—Risks Related to Data Privacy, Data Protection, Cybersecurity and Technology—The collection, processing, storage, use and disclosure of personal information are governed by a rapidly evolving framework of privacy, data protection, cybersecurity information transfers or other laws or regulations worldwide and may limit the use and adoption of our services and adversely affect our business."

companyName: ServiceTitan, Inc.

ticker: TTAN


text: Our cybersecurity risk management initiative is a cornerstone of our information security program, which includes a cross-functional management team with representatives from Legal, Enterprise Risk Management, Information Security, Information Technology, and Engineering. The cybersecurity risk management work is directed by the Enterprise Risk Management Team in collaboration with the Information Security Team and is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our information security program includes a cybersecurity incident response plan and playbook.

companyName: Vertex, Inc.

ticker: VERX


text: The CIO has dual degrees in Accounting and Computer Science from the University of Montana. The CIO has over 31 years of experience managing information technology at the Company.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: The Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO") provide comprehensive briefings throughout the year to the Cybersecurity subcommittee, which meets quarterly. The chair of the Cybersecurity subcommittee provides updates on the subcommittee's activities to the Board of Directors and, from time to time as warranted, the CISO and CIO will present to the full Board of Directors as well. The briefings include the current landscape of cybersecurity risks and emerging threats, relevant Company infrastructure and tools employed to address these risk and threats, status of ongoing initiatives, incident reports and learnings and compliance with regulatory requirements and industry standards.

companyName: CLEAN HARBORS INC

ticker: CLH


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: Stirling Hotels & Resorts, Inc.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our CFO and Chief Executive Officer. Senior management through the CISSC works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: The Risk Assessment consists of: • Listing the vulnerabilities company assets are exposed to; • Identifying the threats that may exploit such vulnerabilities; • Calculating inherent risk rating based on impact and exploitability; and • Calculating residual risk by assessing mitigating controls.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: The Company has developed and implemented a Cybersecurity and Information Technology Incident Response Plan intended to ensure the confidentiality, integrity, and availability of the Company's critical systems and information.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: Our CISO and/or his senior team leaders, in addition to our CIO and CTO, also provide regular reports to executives leading our Finance, Compliance, Law and Human Resources functions on potentially significant cybersecurity incidents and the progress made towards mitigation and remediation of those incidents. These leaders oversee reporting to our CRCC and Audit Committee, and reporting of such cybersecurity incidents is included in the course of regular meetings of such committees. Additionally, in appropriate circumstances, reporting of potentially significant cybersecurity incidents is made directly to the leaders of our CRCC and Audit Committee or directly to the Board of Directors outside of their regular meeting schedule. Further, in support of our internal controls, our CISO also reviews cybersecurity matters and trends with our Accounting and Law functions at least on a quarterly basis.

companyName: AMGEN INC

ticker: AMGN


text: Our management oversees and reviews any reports of cybersecurity risks or breaches provided by our third-party providers of IT services. Additionally, management assesses potential improvements to our cybersecurity policies and procedures based on recommendations from third-party experts, including our providers of IT services, in a matter that's suitable for a company our size and nature.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: collaboration, risk assessment, technical safeguards, incident response and recovery planning, third-party risk management, education and awareness, and governance.

companyName: Strategic Storage Trust VI, Inc.

ticker: SGST


text: The Company's cybersecurity risk program is supervised by members of our executive team. The program is led and managed by the Director of Information Technology, whose experience includes over ten years in information security leadership roles, with the assistance of third-party experts, including consultants and a computer security firm. The Audit Committee and the Board of Directors receive periodic reports on the Company's actions to respond to the cyber security incidents and the overall cyber risk environment. In accordance with our Security Incident Response Plan ("SIRP"), the Audit Committee is to be promptly informed by management of cybersecurity incidents with the potential to have a material impact on the Company, its financial results, or its information systems.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees our management of enterprise risks, including cybersecurity risks. Members of the management team brief the Board of Directors and Audit Committee on the effectiveness of risk management efforts on an annual basis.

companyName: INTEGRATED BIOPHARMA INC

ticker: INBP


text: The Company incorporates learning from its cybersecurity risk management process into its overall cybersecurity program. To date, the Company has not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see " Item 1A. Risk Factors — We face risks related to our information technology systems, including potential cyber-attacks and security and privacy breaches ".

companyName: Vireo Growth Inc.

ticker: VREOF


text: Our CISO, working with his team and the Information Security Committee, has primary responsibility for assessing and managing our cybersecurity threat management program. The current CISO has more than 20 years of experience in building and leading security, risk management, and compliance organizations across several industries, including med-tech, healthcare, and financial services, and many of these companies include highly-regulated Fortune 500 companies. The current CISO is an expert in NIST 800-53 (Rev-5), ISO 27001, and other national and international security risk management disciplines.


text: The Company utilizes various continuous monitoring methods for identification and notification of attempted unauthorized system access. Tools deployed throughout the Company track these attempts, allowing for trend analysis and strategic adaptation. The Company has also established an incident response policy that thoroughly and systematically documents the Company's response and assigns responsibility to facilitate timely, organized and appropriate action during a security event or incident, including assessment of the impact and materiality of the event or incident. Incident management is led by the Security Incident Response Team, under the primary leadership of the Vice President, IT Operations and Security, in which the process is categorized by the detection, analysis, containment, eradication and recovery phases and is inclusive of post-incident activities.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: At the management level, the ERM Committee, CRO, COO, CSO, Director of Information Technology and Director of Operational Risk Management are responsible for assessing and managing material risks from cybersecurity threats. The ERM Committee reports information to the Risk Committee on a quarterly basis, or more often as needed.

companyName: S&T BANCORP INC

ticker: STBA


text: During fiscal year 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our Reputation and Business Could Be Materially Harmed as a Result of Data Breaches, Data Theft, Unauthorized Access or Hacking" in Part I, Item 1A of this report.

companyName: VIASAT INC

ticker: VSAT


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer (CFO) and CEO. Our CFO and CEO work with the Company's Incident Response Team to help the Company triage, contain, mitigate and remediate cybersecurity incidents of which they are notified.

companyName: GENELUX Corp

ticker: GNLX


text: Leading the Company's cybersecurity risk management and strategy at the management level is our Senior Director of Information Security, who reports directly to the Vice President of Information Technology. The Senior Director of Information Security has been with the Company for over 18 years, serving in various capacities with deep understanding of the underlying architecture, technologies, and systems utilized by the Company. The Senior Director of Information Security and his team are responsible for designing and implementing the Company's strategies, policies, and processes to assess, identify, and manage risk related to cybersecurity threats, along with threats associated with our use of third-party service providers. A combination of industry-leading tools, relationships with external experts, in-house expertise, and in-house technologies are integral to the Company's strategy for managing cybersecurity threats. The Company executes ongoing assessment and testing of processes and practices through regular teammate training, phishing exercises, network and endpoint monitoring, penetration testing, vulnerability scanning, and attack simulations. The Company's incident response plan is based on recognized industry best practice security standards and control frameworks, such as the National Institute of Standards and Technology Cybersecurity ("NIST") Framework. Third parties are also engaged to perform assessments and validate the Company's cybersecurity measures, including information security maturity assessments and independent reviews of the operating effectiveness of the information security control environment.

companyName: BUCKLE INC

ticker: BKE


text: In today's increasingly interconnected world, cybersecurity is not just a concern, it's a fundamental responsibility. At Monarch Casino & Resort, Inc., we understand that the security of our digital assets is essential to safeguarding our critical infrastructure, ensuring the confidentiality and integrity of sensitive information, maintaining business continuity, and fostering trust with our stakeholders.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: It is possible that Cleco's information technology systems and networks, or those managed by third parties, could have vulnerabilities and those vulnerabilities could go unnoticed for a period of time. Cleco may also be exposed to, and adversely affected by, interruptions to its computer and information technology systems, and sophisticated cyberattacks, including cybersecurity threats and vulnerabilities in its systems, malware, and attacks targeting its information technology systems and networks. Any such prior events, to date, have not had a material impact on Cleco's results of operations, financial condition or cash flows. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls Cleco has implemented and is implementing, or which Cleco causes or has caused third party providers to implement, will be sufficient to protect its systems, information or other property. For more discussion of potential cyber threats that may affect Cleco, see Item 1A, "Risk Factors — Operational Risks — Technology and Terrorism Threats."

companyName: Cleco Corporate Holdings LLC


text: Cybersecurity attacks impact businesses and organizations of all sizes and sectors on a global basis. At Trio, we recognize the importance of developing, implementing and maintaining a cybersecurity risk management program. We are currently implementing resources to protect our systems and data, from cybersecurity threats. We are dependent on internal and external information technology systems and infrastructure to securely process, transmit, and store critical information. We are currently in the process of engaging an outsourced security firm for overseeing our cybersecurity.

companyName: Trio Petroleum Corp

ticker: TPET


text: Please refer to "Item 1A. Risk Factors – Risks Related to Our Business – We are highly dependent on information systems and third parties, and systems failures or cybersecurity incidents could disrupt our business."

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: We rely on our technology network infrastructure and information systems to operate our business, rent our equipment, interact with vendors and customers, support and grow our customer base and bill, collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Such attacks have become more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: H&E Equipment Services, Inc.


text: Our cybersecurity incident response plan was developed to respond to the threat of security breaches, the threat of cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate material cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: Cybersecurity threats have the potential to impact our operations, financial condition, and reputation. While we have not experienced any material cybersecurity incidents during the reporting period (See Note 21 - Subsequent Events), we recognize that such incidents could result in: • Disruption of operations, impacting revenue and productivity; • Unauthorized access to or theft of sensitive data, potentially leading to regulatory and legal implications; and • Reputational harm, affecting customer trust and investor confidence.

companyName: URBAN ONE, INC.

ticker: UONE


text: The Cybersecurity Incident affected certain of our information technology systems, and as part of the containment effort, we suspended affected systems and elected to temporarily suspend additional systems in an abundance of caution. We reactivated and restored our operational systems over the course of the week following the Cybersecurity Incident. In 2023, the Cybersecurity Incident related costs net of an expected insurance receivable totaled $1.0 million. Our system remediation efforts regarding the Cybersecurity Incident were concluded as of December 30, 2023. In the fourth quarter of 2024, we received proceeds from our insurance claim that exceeded the amount recorded as a receivable by $0.6 million. These proceeds represented the cost associated with lost revenue and incremental expenses incurred.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: The CISO leads our Information Security team and is responsible for establishing and maintaining the Enterprise Information Security Policy (the "Policy"). Our CISO has over a decade of experience in information security strategy, audit and risk management, as well as technical leadership expertise. To stay abreast of the evolving threat landscape, the CISO is active in the cyber community through discussions with peer groups, industry experts and law enforcement agencies. Members of the Information Security team have backgrounds in cybersecurity or experience applicable to their roles, including relevant industry certifications.

companyName: Evercore Inc.

ticker: EVR


text: Cybersecurity risk management is an integral part of Mullen's overall enterprise risk management framework. We have implemented comprehensive measures to safeguard our information systems, protect sensitive data, and identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program encompasses threat prevention, detection, mitigation, and remediation strategies tailored to the dynamic risk landscape in the automotive sector.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: The Company engages third parties to assist with the monitoring components of the security infrastructure that we have deployed. As required, the Company engages consultants and third parties to assist with penetration testing, tabletop incident response exercises, or other activities necessary to comply with various standards and certifications that are necessary for the Company's business operations. The Company provides regular awareness training to its employees and consultants using its collaboration platforms to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments that routinely process, store or handle sensitive data types. Where service providers are materially utilized, the company obtains SOC1 or SOC2 reports and complies with complementary user entity controls to keep those attestations valid. Where needed, the Company requires appropriate certifications and contractually requires adherence to data privacy and security requirements from its vendors.

companyName: Vestis Corp

ticker: VSTS


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting, including controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.

companyName: TaoWeave, Inc.

ticker: TWAV


text: Cybersecurity Risks We maintain a Risk Management Policy that governs the process in which we identify cybersecurity risks, and quantify and evaluate their associated impacts and risk levels. A Cybersecurity Risk Register is also leveraged to track identified cybersecurity risks to date and update treatment of such risks accordingly.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: a Management regularly informs and updates the Board and the Audit and Risk Committee on cybersecurity risks, incidents, and the effectiveness of risk management strategies.

companyName: IREN Ltd

ticker: IREN


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of our management team, led by our chief information officer, who has 20 years of experience in information technology roles and supported by our director of information security, who holds several certifications in the field of information security and technology. In addition to our chief information officer, our internal management security committee includes our chief executive officer, chief financial officer, chief operations officer and chief legal officer, as well as others within our organization in information technology roles.

companyName: Iridium Communications Inc.

ticker: IRDM


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, calls with vendors security personnel, and contractual obligations regarding cybersecurity imposed on each vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Rubrik, Inc.

ticker: RBRK


text: Employees receive information security training annually on policies and procedures, recent cyber-attacks, the firm's defense-in-depth controls strategy, incident response reporting, and cybersecurity at home. Lord Abbett conducts e-mail phishing campaigns using a variety of templates geared around topical or seasonal themes to simulate phishing messages and reinforce training.

companyName: Lord Abbett Private Credit Fund


text: We also maintain business continuity and disaster recovery plans to prepare for and respond to the potential for any disruption in the technology we rely on. Additionally, we maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.

companyName: TREVENA INC


text: Maintaining a clearly defined ISSP, which prescribes measures to establish and enforce our security program, addresses each component of our information security (IS) position, and advances our objectives of protecting and managing risks to our data and security systems by establishing policies, standards, controls, procedures, and guidelines that address topics such as security and privacy governance, statutory, regulatory, and contractual compliance, business and disaster recovery, change management, identification and authentication processes, expectations for continuous monitoring, asset management, third-party provider management, endpoint security, and incident responses, among others;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Risk Management & Strategy Our management is principally responsible for defining the various risks facing us, formulating risk management policies and procedures, and managing our risk exposures on a day to-day basis. Our information is processed, transmitted, and stored in a secure environment using hardened, proven enterprise grade technologies to protect both our data and the physical computing assets. We guard against business interruption by maintaining a disaster recovery plan, which includes storing critical business information in multiple off-site data centers, testing the disaster recovery plan at a host-site facility, and providing fault tolerant devices, communication services, and utilities. We have independent third-party cybersecurity audits conducted no less than annually, following the standard set by the National Institute of Standards and Technology. We also have third-party security reviews and testing of our network, processes and systems conducted on a regular basis. We use internally developed proprietary software, cloud-based software as a service ("SaaS") as well as purchased software, with proven, non-proprietary hardware. While we believe that our internal policies, systems and procedures for cybersecurity are thorough, the risk of a cybersecurity event cannot be eliminated. We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply or our systems are compromised, we could be subject to government enforcement actions, private litigation and adverse publicity.

companyName: BJs RESTAURANTS INC

ticker: BJRI


text: Our Board of Directors has delegated oversight of our cybersecurity program, which includes oversight of cybersecurity threats, to the Risk and Governance Committee. Throughout the year, at each quarterly Risk and Governance Committee meeting, or as needed, the committee is updated on IT security by senior management, including industry IT breaches, cybersecurity incidents and employee cybersecurity training. Our Head of Information Technology is a Certified Information Systems Security Professional and is responsible for day-to-day assessment and management of our information systems and cybersecurity program. Our Head of Information Technology reports directly to our Chief Financial Officer.

companyName: Aircastle LTD

ticker: AYR


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each of our associates is required to complete information security and data privacy training on an annual basis to reinforce awareness of cybersecurity risks to the organization. Updates are provided to associates on an ongoing basis through cybersecurity awareness email campaigns, break room posters, and other methods of communication.

companyName: Playa Hotels & Resorts N.V.


text: Engage Third-parties on Risk Management Due to the difficulties and evolving nature of cybersecurity threats, AppTech engages with external experts, including cybersecurity consultants and auditors to evaluate and test its risk management systems. These relationships allow us to utilize specialized knowledge and insights, ensuring our strategies and processes remain in-line with current best practices. These third-parties provide the Company with regular audits, threat assessments, and consultations on security enhancements. Also, during onboarding and periodically thereafter, we conduct trainings for the Company's employees, contractors, and temporary workers about cybersecurity risks, including sending test phishing emails for training purposes to all users of the Company's email system.

companyName: AppTech Payments Corp.

ticker: APCX


text: External Assessments We obtain periodic assessments by third party experts to assess our vulnerability management and security controls and to assist us in identifying and mitigating security risks.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: Our comprehensive vendor management program and processes assess all new vendors and segments them into criticality tiers. Our most critical vendors (tiers 1 and 2) are evaluated annually based on requested vendor documents, such as Statements on Standards Attestation Engagements No. 18 (SSAE 18), financial statements, insurance, and due diligence questionnaires. The vendor management team also monitors all news alerts related to all critical vendors.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: We assess and manage risk at the enterprise level according to our Framework using a three lines of defense model.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Risk Management and Strategy Marine Products approaches cybersecurity as an enterprise-wide risk and has created a Cybersecurity Risk and Compliance Program that outlines governance programs in place and outlines efforts undertaken to mitigate cyber risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, the Company uses the Center for Internet Security (CIS) Controls framework to provide best practices for securing IT systems and data. We have implemented a majority of version 8.0 of the CIS Controls which supports a Zero Trust architecture.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: We have aligned our information security management system to the International Organization for Standardization ("ISO") 27001 standard and our privacy management system to the ISO 27701 standard. An outside auditor tests the effectiveness of our security and privacy controls against the ISO 27001 and 27701 standards on an annual basis. We also undergo client security audits and cybersecurity program assessments by outside consultants, and we regularly update our program and processes to incorporate recommendations from auditors, consultants and other experts. Finally, we maintain a third-party risk management process that includes screening and evaluation by the Information Security team of service providers who will have access to our systems or confidential information, in order to identify and manage cybersecurity risks associated with our use of such providers.

companyName: COMSCORE, INC.

ticker: SCOR


text: To validate our security posture, we engage independent external parties to conduct regular penetration testing and security audits, and to provide cybersecurity consulting services. We maintain ISO 27001 certification for our global enterprise. Additionally, our IT General Controls (ITGC) undergo annual testing through Sarbanes-Oxley audits, which examine security controls relating to system changes, access management, system configurations, and data backup processes.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: At a management level, our cybersecurity program is led by our Information Technology manager, who reports to the Chief Financial Officer. Our Information Technology manager is supported by our third-party consultants. Our Information Technology manager along with the support of our third-party consultants, is equipped to help navigate the landscape of cybersecurity risks and challenges and to implement and to manage a comprehensive security strategy.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: Our information technology function is overseen by our Chief Information Officer ("CIO"), with support from our Cybersecurity Steering Committee, and helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, and conducting vulnerability assessments to identify vulnerabilities.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 20 years of experience as a CISO at the Company and elsewhere, has responsibility for HP's global cybersecurity program, including infrastructure and technology platforms, overseeing governance, regulatory and compliance, operations, strategy, and architecture. The CISO reports to our Chief Financial Officer. This role is responsible for building out a cybersecurity organization that is designed to enable robust security coupled with productivity for more than 70,000 global employees, contractors, and partners. The CISO supports HP's business acceleration and transformation by identifying and managing cybersecurity risks, balancing them with business priorities, and using a contemporary security posture to support HP's position as an industry leader. As part of this, the CISO receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

companyName: HP INC

ticker: HPQ


text: Our Board Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Board Risk Committee actively engages with our Chief Risk Officer and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Board Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Board Risk Committee is engaged, as needed, in accordance with our Incident Response Plan.

companyName: Village Bank & Trust Financial Corp.


text: The Company's business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset management firm. We, in conjunction with our Manager and its affiliates, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Company's data and systems along with other material risks to its operations.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: As of the date of this report, the Company has not identified breaches from any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to affect operations, business strategy or financial condition. For additional information regarding our cybersecurity risks, see "Item 1A. Risk Factors - We rely on information technology in our operations, and any material failure, inadequacy, interruption or cyber-attack of that technology could harm our business."

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: One of the functions of our Audit Committee is to identify principal risks related to our company and ensure implementation of appropriate systems to manage these risks, including risks from cybersecurity threats. Our Audit Committee works with members of our management to identify and manage these risks, including cybersecurity risks. We currently outsource a qualified Information Technology Administrator who reports to our Chief Executive Officer. This consultant has over 25 years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management. Our Information Technology Administrator regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. To the extent necessary, our Chief Executive Officer reports such risks to our Board of Directors.

companyName: RenovoRx, Inc.

ticker: RNXT


text: Management Responsibility: a Day-to-day responsibility for managing cybersecurity risks lies with our Chief Technology Officer (CTO) who leads a dedicated cybersecurity team. This team includes internal and external security professionals with expertise in cybersecurity management.

companyName: IREN Ltd

ticker: IREN


text: There have been no material cybersecurity incidents that have affected AIG for the period covered by this annual report. For a discussion regarding risks associated with cybersecurity threats, see Part I, Item 1A. Risk Factors – Business and Operations – "Our risk management policies, standards and procedures may prove to be ineffective and leave us exposed to unidentified or unanticipated risk, which could adversely affect our businesses, results of operations, financial condition and liquidity" and "We are exposed to certain risks if we are unable to maintain the availability of our critical technology systems and data and safeguard the confidentiality and integrity of our data, which could compromise our ability to conduct business and adversely affect our consolidated business, results of operations, financial condition and liquidity."

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: Our organizational cybersecurity program is under the direction of our Chief Information Security Officer ("CISO") who receives reports from our cybersecurity team and oversees the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. Our CISO reports to our Chief Operating Officer ("COO"), who may discuss cybersecurity risks and other operational risks with other senior management as appropriate. Our CISO and dedicated cybersecurity team personnel are certified and experienced information systems security professionals and cybersecurity managers with many years of experience. Our CISO has served in that position since 2019 and has over 25 years of managerial and professional cybersecurity expertise. He has held the role of CISO and other senior management positions with NDS, Cisco and Deloitte and has also served as cybersecurity consultant for companies in multiple global industries. Our COO has extensive experience in project management and cybersecurity, including from past roles with Verint - Systems and Cisco Systems as well as the establishment and management of the Company's cybersecurity team prior to our CISO joining the Company.

companyName: Mobileye Global Inc.

ticker: MBLY


text: Our Board of Directors, primarily through the Audit Committee, oversees our enterprise risk management program, including cybersecurity risks. The enterprise risk management program is utilized in making decisions with respect to company priorities, resource allocation, and oversight structures. Our CIO delivers updates on the Cybersecurity Program to our Board of Directors semi-annually, including with respect to significant projects and initiatives. These updates consist of a report to the full Board of Directors and to the Audit Committee, and cover a wide range of topics, including evolving regulations and standards, vulnerability assessments, mitigation strategies, third-party and independent reviews, the evolving threat environment, technological and industry trends, and information security considerations arising with respect to the Company's peers and other third parties. Our CIO will also provide reports of material cybersecurity incidents or other relevant developments to our Board of Directors and Audit Committee as and when needed. Furthermore, our CIO provides periodic updates to our senior management regarding cybersecurity risks, as well as interim updates during regular meetings with our leadership team.

companyName: ROGERS CORP

ticker: ROG


text: The Audit Committee is provided with updates on technology and cybersecurity risks at least four times annually, including annual reviews of the Company's cybersecurity program and technology risks and controls, and bi-annual updates on operational risks (in spring and fall). Given its importance, the full Board of Directors is invited to attend the annual cybersecurity program update and time is reserved at each Audit Committee meeting for cybersecurity technology matters that warrant discussion between the standing sessions. In addition, Enterprise Risk Management provides FIRMCo an assessment of cyber insurance risk once per year. The Audit Committee, FIRMCo and the full Board of Directors are apprised of developments in the external environment and business strategies that present additional potential cyber risk exposure to the Company on an as-needed basis. As a result, cybersecurity and cyber risk are typically discussed more frequently than the annual minimum requirements.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: While everyone at Target plays a part in information security, cybersecurity, and data privacy, oversight responsibility is shared by our Board of Directors, its committees, and management.

companyName: TARGET CORP

ticker: TGT


text: Cybersecurity risks for financial institutions have significantly increased in recent years in part because of the proliferation of new technologies to facilitate and conduct financial transactions. The Company maintains a comprehensive risk-based cybersecurity program to identify, measure, manage, and disclose material cybersecurity risks. The Company utilizes the Federal Financial Institution Examination Council's ("FFIEC") Cybersecurity Assessment Tool ("CAT") as a diagnostic test to help identify the Company's cyber risk level and determine the maturity of our cybersecurity program. The CAT is supplemented by an annual self-assessment and external audits and reviews, the results of which drive the development and implementation of the Company's cybersecurity strategy to ensure that cyber risk management practices are aligned with the risk profile of the Company.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: Our CISO supervises and assists the ERMC in staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: TransUnion

ticker: TRU


text: The IT Steering Committee focuses on the identification, monitoring, assessment, and management of risk associated with the Company's cyber and information security programs. The IT Steering Committee reviews key metrics summarizing the Company's cyber security risk profile on a quarterly basis.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Since the beginning of the last fiscal year, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches."

companyName: Ultragenyx Pharmaceutical Inc.

ticker: RARE


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, (3) vulnerability management program and (4) detection and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • policies, procedures and standards that are utilized to outline expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical IT service providers, suppliers, and vendors.

companyName: AMERICAN AIRLINES, INC.


text: The Company's Senior Manager of Information Security, reporting to the Vice President of Information Technology, is the leader of the Company's cybersecurity team. The Senior Manager of Information Security is responsible for assessing and managing the Company's cybersecurity program, informs the Vice President of Information Technology and other senior management as appropriate regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our Senior Manager of Information Security and Vice President of Information Technology have decades of collective experience in managing information technology and cybersecurity functions, both at the Company and in prior positions. Management also periodically evaluates the experience of the Company's entire cybersecurity team to ensure adequate coverage across all eight key knowledge domains identified by the Certified Information Systems Security Professional certification.

companyName: Andersons, Inc.

ticker: ANDE


text: Following a cybersecurity incident, the General Counsel will direct the development of documentation regarding lessons learned in the response, including evaluation of preparedness capability, to continuously strengthen the cybersecurity posture of the Corporation.

companyName: UNITED STATES STEEL CORP


text: Reporting to the Board of Directors. Our CTO and CISO report to the audit committee at least quarterly about the detection, prevention, mitigation and remediation of cybersecurity events, including information about the latest cybersecurity threats, the status of our prevention and detection measures and the effectiveness of our mitigation and remediation efforts, as well as any other cybersecurity risk management activities and the progress of related projects. These briefings include updates on the formalized incident response plan, communications and escalation procedures. Management will apprise the board of directors of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.

companyName: Frontdoor, Inc.

ticker: FTDR


text: The Board, through its Cybersecurity and Environmental Oversight Committee, oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer (CISO), quarterly or as needed briefs the Board of Directors on our cybersecurity and information security posture, and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.

companyName: GEO GROUP INC

ticker: GEO


text: an Email Banner for external emails, which assists us in identifying any phishing / impersonation firewall appliances with a security suite; endpoint security software for our team and utilizing Cloudflare for protecting and securing our cloud environments.

companyName: Loop Media, Inc.

ticker: LTPVQ


text: We engage external resources that contribute to, and provide independent evaluation of, our existing cybersecurity practices and organizational risk assessment systems. We use established processes designed to identify, assess, and manage third-party service provider risks when third parties handle, possess, process, and store the Company's material information.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: Key's CISO oversees the IS Program and its related policies and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 30 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems.

companyName: KEYCORP /NEW/

ticker: KEY


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. This program includes: • Robust Firewalls and Intrusion Detection Systems: The company has invested in state-of-the-art firewalls and intrusion detection systems designed to prevent unauthorized access to its networks. • Regular Security Assessments: The company conducts regular security assessments to identify vulnerabilities and address them promptly. This includes penetration testing, vulnerability scanning, and third-party audits. • Employee Training and Awareness: The company provides comprehensive cybersecurity training to all employees to educate them about potential risks, phishing attacks, and best practices for protecting sensitive information. • Incident Response Plan: The company has developed an incident response plan that outlines the steps to be taken in the event of a cybersecurity breach. This includes isolating affected systems, investigating the breach, and notifying relevant stakeholders. • Cyber Insurance: The company has obtained cyber insurance coverage to mitigate the financial impact of a cybersecurity breach. This insurance policy covers expenses related to incident response, legal fees, and potential customer compensation.

companyName: Arcellx, Inc.

ticker: ACLX


text: Management's Role Managing Risk We have established a Cybersecurity Governance Committee, which meets monthly or more frequently, if needed, to monitor: • our current cybersecurity controls and our ability to address emerging threats; • the status of our ongoing cybersecurity initiatives and strategy; • incident reports from any cybersecurity events; and • compliance with regulatory requirements and industry standards.

companyName: FTC Solar, Inc.

ticker: FTCI


text: We evaluate our third-party information system providers, as well as any other provider that may have access to our data, for their maturity and reliability, and as a matter of policy we choose to only work with reputable vendors.

companyName: MICROVISION, INC.

ticker: MVIS


text: Our CISO regularly informs our Chief Executive Officer and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This helps ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to our Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: AUTONATION, INC.

ticker: AN


text: See Item 1A of this Annual Report on Form 10-K for more information of risks relating to cybersecurity, including the risk factors "We Rely on Information Technology Systems, including Third-Party Cloud-based Solutions, and Any Failure of These Systems May Result in Disruptions or Outages in Our E-Commerce and In-Store Retail Platforms, Loss of Processing Capabilities, and/or Loss of Data, Any of Which May Have a Material Adverse Effect on Our Financial Condition, Results of Operations or Cash Flow" and "A Security Breach of Our or Our Third-

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: The Company has adopted the Center for Internet Security ("CIS") framework for cybersecurity defense. The CIS framework is a leading set of best practices for cybersecurity policies and procedures created by the non-profit Center for Internet Security, which are used or referenced by multiple legal, regulatory, and policy frameworks. The CIS framework includes: (1) a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems; and (2) a set of a recommended actions for cyber defense that provide specific and actionable ways to thwart the most pervasive attacks.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A. under the heading "We may be unable to adequately protect our internal information systems, or those used by our CROs, clinical sites, or other contractors or consultants upon which we rely, from cyberattacks, compromises, cybersecurity incidents, or other disruptions, which could result in the compromise of sensitive or proprietary information, lead to operational or service interruption, harm our reputation, and subject us to litigation, fines and other significant financial and legal exposure, and other adverse consequences," which disclosures are incorporated by reference herein.

companyName: GRI Bio, Inc.

ticker: GRI


text: We manage cybersecurity threats as part of our oversight, evaluation, and mitigation of enterprise-level risks. We have based our cybersecurity program on industry frameworks, including, among others, the U.S. National Institute of Standards and Technology Cybersecurity Framework, with the goal of building enterprise resilience against an evolving landscape of cybersecurity threats and responding to cybersecurity threats as they materialize. Our program includes monitoring, identification, assessment, and management components, as well as information sharing and escalation components designed to inform management and the board of directors of prospective risks and developments.

companyName: ELI LILLY & Co

ticker: LLY


text: Cybersecurity threats are one of the Company's most critical risks, with our Senior Vice President -Technology assigned as the executive risk owner. Our Senior Vice President - Technology, in coordination with our senior management team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President - Technology and the senior management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board and Audit Committee, when appropriate.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: The Information Security Officer presents an Annual Information Security Review to the board which summarizes the previous year's threat landscape, risk assessment, service provider, and audit testing activities, results of security incidents, information security program changes, and future strategies and recommendations.

companyName: Merchants Bancorp

ticker: MBIN


text: concepts. They are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: GAN Ltd


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Our management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Jet.AI Inc.

ticker: JTAI


text: As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Our information and cybersecurity policy, standards, strategy, roadmap and processes are aligned with industry-recognized security risk management framework and practices, including detailed tasks, plans and initiatives, which are reviewed and updated periodically, and at least annually. Our program also incorporates incident response plans and notification protocols, to assess and manage security incidents and threats, including their materiality.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Cybersecurity threats that are identified and deemed material are escalated and communicated directly to Senior and Executive Management and the Risk Committee of the Board of Directors. Materiality determinations are made under the Company's Disclosure Controls and Procedures to ensure timely cybersecurity incident disclosure notification in accordance with securities laws and/or regulations.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Our cybersecurity program is overseen by our CIO, who has been a Caterpillar employee for over twenty-five years. Prior to her current appointment as our CIO in September 2020, she was the Chief Information Officer for the Company's Financial Products Division. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. Our CIO leads a cross-functional cybersecurity team comprised of professionals from our product, cybersecurity, legal and compliance organizations who focus on managing the security of our connected solutions. This team manages the Company's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.

companyName: CATERPILLAR INC

ticker: CAT


text: Management and Strategy have no employees. Our business is externally managed by the Advisor, an affiliate of Lightstone. We are dependent on the Advisor and affiliates of Lightstone (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each of which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on the them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT V, Inc.


text: The Company's Chief Information Security Officer ("CISO") is the member of the management team with primary responsibility for the development, operation and maintenance of the Company's information security program. The CISO holds a master of science degree in information assurance and has over 20 years of cybersecurity experience with Fortune 500 financial, defense, consulting and retail companies. The Audit Committee oversees the Company's information security program at the Board level. The Audit Committee, which is composed entirely of independent members of the Board, receives reports directly from the CISO at least three times per year regarding the Company's information security program, including reports regarding items such as cybersecurity policies and practices, cybersecurity program resources, third-party assessments of the Company's information security program, key risks related to the Company's information security program and the Company's security measures and controls. As described above, the Company maintains an information security incident response plan that includes processes and procedures for evaluating and escalating cybersecurity threats and incidents to, as determined to be appropriate, the Company's executive management team and members of the Board. The initial impact level of each cybersecurity threat or incident is evaluated by a designated team of information security specialists using risk criteria that have been defined and approved by the Company's executive management team and reviewed with the Audit Committee. If escalated, the threat or incident is evaluated by a cross-functional core and extended team, as applicable, of managers that includes the CISO and designated internal legal counsel with extensive cybersecurity experience, as well as identified associates from across the Company's business and functions, as applicable. Cybersecurity threats and incidents are assigned incident impact levels based on the core team's determination of potential impact to the Company. The core team employs defined risk criteria to classify incidents and escalate incidents accordingly. Based on the severity classification assigned by the core team, incidents may be escalated to, as applicable, representatives of the Company's executive management team (which includes the Disclosure Committee), the Chairs of the Board and the Audit Committee, other members of the Audit Committee and/or the full Board.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Our cybersecurity efforts also include mandatory information security awareness training for all employees, clearly defined expectations for acceptable use policies, and certification of adherence to a code of conduct. The IT Governance, Risk, and Compliance ("IT GRC") team conducts periodic audits to evaluate policy and regulatory compliance, recording findings for subsequent review and remediation initiatives. We also leverage internal and external security subject matter experts to conduct comprehensive risk assessments, including architecture reviews, vulnerability scans, penetration tests, application security evaluations, and technical compliance reviews.

companyName: CLARIVATE PLC

ticker: CLVT


text: Management's Responsibilities The Company's information security program is led by our corporate Chief Information Security Officer ("CISO"), who works closely in a cross-functional capacity with key corporate and operational business stakeholders. The individuals supporting the Company's information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. The CISO collaborates with these functions for the purpose of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality, and other information security incidents, and maintaining our cybersecurity program. The CISO provides regular updates on the Company's cybersecurity posture and preparedness to senior management.

companyName: Science Applications International Corp

ticker: SAIC


text: To preserve the confidentiality, integrity, and availability of our information systems, and to safeguard our assets, data, intellectual property, and network infrastructure, while meeting regulatory requirements, it is crucial to effectively manage cybersecurity risk.

companyName: AIRWA INC.

ticker: YYAI


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For a disclosure of our cybersecurity risks, see Risk Factors in Part I, Item 1A.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: Company management, including members of the Risk Committee, provides regular updates to the board of directors regarding material matters with respect to the Company, including cyber matters. These updates include quarterly updates to the board with respect to material cyber events and an annual cybersecurity program overview covering cybersecurity strategy, assessment, risks, notable events and governance. The Company also conducts an annual enterprise risk assessment through which it identifies and assesses material risks to the Company, including both cyber and non-cyber risks. This assessment is reviewed and discussed with the board of directors.

companyName: Orion Properties Inc.

ticker: ONL


text: of any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents experienced by us or, to our knowledge, by any of our third-party service providers, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For further discussion of cybersecurity and data privacy risks that may materially affect the Company and how they may do so, see "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could face clinical trial delays; regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; and other adverse consequences,"

companyName: Celcuity Inc.

ticker: CELC


text: Role of the Board Dow's Board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk, at least annually. While the full Board is accountable for cybersecurity and AI risk management, the Board has delegated responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee of the Board. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders, including the Chief Information and Digital Officer and Chief Information Security Officer, with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee also reviews external firms' assessments of the Company's security posture and NIST CSF maturity level. Information made available to the Audit Committee is also made available to the full Board. The Audit Committee includes members with significant experience and/or expertise in technology or cybersecurity, including information systems.

companyName: DOW INC.

ticker: DOW


text: Our Board of Directors oversees our risk management, including our information and cybersecurity policies and risk assessments. Our management reports to our Board of Directors on information security as necessary, regarding any significant cybersecurity incidents.

companyName: XERIANT, INC.

ticker: XERI


text: We design and implement risk management strategies for identification and management of material risks rising from cybersecurity threats and alerts. Our method involves a systematic evaluation of all potential threats reported and discovered, vulnerabilities, and their possible impacts on the Company's operations, data, and systems health. Our cybersecurity risk management strategy includes: Identify the risk to our environment; IT to identify and resolve the threat; cybersecurity training to our staff; and cybersecurity incident response plan.

companyName: Linkhome Holdings Inc.

ticker: LHAI


text: Cyber Risk Management and Strategy At Fulcrum Therapeutics, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards and is integrated into our enterprise risk management process.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls, and information systems.

companyName: Cohen & Co Inc.

ticker: COHN


text: Material Incidents We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. We, and the third parties that we engage, are subject to constant and evolving threats of attack and cybersecurity incidents may be difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.

companyName: ENTERPRISE BANCORP INC /MA/


text: Our employees complete training on data security and our policies when they join us and annually thereafter. We review the content of our mandatory training annually, and provide access to a comprehensive set of supplemental training.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Our security program is designed to reflect our business objectives, meet relevant laws and regulations, prevent unauthorized use of or access to our information systems, and maintain information assets' confidentiality, integrity, and availability. Our policies and processes are guided by security requirements specific to our operating environment, laws, and regulations that are relevant to us and information security best practices.

companyName: SelectQuote, Inc.

ticker: SLQT


text: Cybersecurity is integrated into the Company's Risk Framework through which the Company identifies, assesses, monitors, controls, communicates and escalates risks. The Risk Framework, which is reviewed and approved by the Risk Committee of the Board of Directors at least annually, represents the Company's overall risk management approach, including the policies, processes, controls and systems, through which the Company seeks to manage risk, including cybersecurity risk. It provides a common foundation for all employees and officers as well as directors to understand and communicate the types of risks that the Company faces in pursuit of its business objectives. The Risk Framework includes oversight by management through a multi-tiered committee structure responsible for overseeing proactive risk identification, developing an aggregated view of risks, and providing a consistent governance methodology across the Company. All such committees, including the Operational Risk Committee which has primary authority for oversight of cybersecurity, report up to the Management Risk Committee, which is chaired by the Chief Risk Officer, and serves as the executive level committee responsible for the implementation and oversight of the Risk Framework. The Risk Framework is designed to ensure the Board of Directors and its Risk Committee, which is the primary Board committee that oversees cybersecurity, are provided the information necessary to be effective in its risk management oversight responsibilities.

companyName: M&T BANK CORP

ticker: MTB


text: The Audit Committee receives comprehensive briefings from the Cybersecurity Leadership Team on an annual basis. These briefings help identify areas for improvement and ensure the alignment of cybersecurity efforts with our overall risk management framework. The broad range of topics encompassed in these briefings includes: The current cybersecurity landscape and emerging threats; Our cybersecurity posture and the effectiveness of our risk management strategies; The status of ongoing cybersecurity initiatives and strategies; and Our compliance with regulatory requirements and industry standards.

companyName: CubeSmart

ticker: CUBE


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our VP Information Security in connection with our Chief Technology Officer, Chief Legal and People Officer, our Senior Vice President of Legal and Vice President, Internal Audit. Such individuals have extensive prior work experience and expertise spanning over three decades in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing cybersecurity operations and incident response, and incorporating security and privacy by design into software development programs.

companyName: Sunrun Inc.

ticker: RUN


text: Deutsche Bank's Chief Security Officer has served in various roles in information security for more than 20 years. This includes the role as global Chief Information Security Officer ("CISO") / CSO for three different large European financial institutions and a partner position in a global strategy and consulting firm, leading security work for financial service clients. The Chief Security Officer is supported by information security role holders at various seniority levels to help ensure that security requirements are met from a regional, divisional, and technical perspective.

companyName: RREEF Property Trust, Inc.


text: We have also implemented a process to evaluate and review potential cybersecurity risks arising from our use of third-party vendors. As part of our vendor engagement protocols, we will consider, among other things, each potential vendor's data backup procedures, incident reporting protocols and data privacy and encryption practices. In addition to our internal exercises to test aspects of our cybersecurity program, we engage independent third parties annually to assess the risks associated with our IT resources and information assets. Among other matters, these third parties analyze information on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes. Annually, we examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as those set by NIST as guidelines.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Our cybersecurity incident response and vulnerability management follow our information security and privacy policy framework. This framework is designed to escalate certain cybersecurity incidents to the Chief Financial Officer and, depending upon an incident's particular facts, the Chief Financial Officer will report certain cybersecurity incidents to the Nominating and Corporate Governance Committee of the Board of Directors.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Board of Directors, both directly and through the delegation of responsibilities to the Audit committee oversees the proper functioning of our cybersecurity risk management program. In particular, the Audit Committee assists the Board of Directors in its oversight of management's responsibility to assess, manage and mitigate risks associated with the Company's business and operational activities, to administer the Company's various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data. The Audit Committee, which is comprised entirely of independent directors, is responsible for periodically reviewing and assessing with management (i) the adequacy of controls and security for our information technology systems, processes and data, and (ii) our contingency plans in the event of a breakdown or security breach affecting our information technology systems, it being understood that it is not possible to eliminate all such risks and that the Company will necessarily face a variety of risks with respect to information technology in the conduct of its business. The Audit Committee is additionally responsible for reviewing the cybersecurity disclosures required to be included in our filings with the SEC.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: We have adopted an Information Security Incident Response Policy that applies in the event of a cybersecurity threat or incident (the "ISIRP") to provide a standardized framework for responding to security incidents. The ISIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The ISIRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third party vendor on retainer to assist in such incidents.

companyName: ProFrac Holding Corp.

ticker: ACDC


text: To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations or financial condition, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors," cybersecurity attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cybersecurity incident, our efforts may not be effective in preventing breakdowns or breaches in our systems.

companyName: Construction Partners, Inc.

ticker: ROAD


text: First Financial's board of directors is responsible for overseeing the Company's cybersecurity risk management objectives and risk tolerance as part of its oversight of the Company's compliance and risk management activities. Specific oversight of the cybersecurity function is delegated to the Board Risk Committee. The Chair of the Board Risk Committee has extensive cybersecurity experience, including both experience as a chief information security officer of a publicly traded financial institution and as an outside cybersecurity consultant. The committee chairperson maintains CISSP and CRISC certifications. Through the Board Risk Committee, the Board's oversight responsibilities include: a.establishing and guiding the Company's cybersecurity risk tolerance, including the determination of the aggregate risk appetite and identifying the senior managers who have the responsibility for managing risk; b.ensuring that the Company implements sound fundamental principles that facilitate the identification, measurement, monitoring and control of risk;

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: Third-party risk management is a critical component of our cybersecurity strategy. We maintain oversight of service providers through proactive monitoring, leveraging a cybersecurity questionnaire and security and privacy addenda to our contracts where applicable. We evaluate third party providers to ensure they maintain effective security management programs, compliance with information handling and asset management protocols, and provide prompt notification of any known or suspected cybersecurity incidents.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: Under the leadership of the Company's Chief Technology Officer, the SITE Centers' information technology department is primarily responsible for assessing and managing material risks to SITE Centers' information systems, including from cybersecurity threats. The Company's Chief Technology Officer has over 30 years' experience working in information technology and managing information technology systems and holds several specialized security certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association. In addition, certain members of the SITE Centers information technology department have obtained specialized security certifications, including accreditation as Certified Information Systems Security Professionals, and have prior work experience in various roles involving technology and security. The Company has established an internal Security and Privacy Governance Committee, comprised of the Chief Technology Officer and other senior members of management that generally meets quarterly. This committee receives updates from the SITE Centers' information technology department with respect to the implementation of various systems and security measures, the Company's cybersecurity training and awareness program, enhancements or modifications to the security program, and the impacts of such changes to the Company's information security risk environment. The Company has adopted a Cybersecurity Incident Response Plan, which requires communication of cybersecurity incidents to varying levels and personnel within the organization depending on the severity of the threat impact and encompasses tactics related to cybersecurity, systems and facilities availability, and information privacy.

companyName: Curbline Properties Corp.

ticker: CURB


text: Our CISO has many years of experience in creating and implementing cybersecurity risk management programs and using cybersecurity management technologies and infrastructure solutions. Our CISO works under the supervision of our CIO, who has extensive experience in information technology and cybersecurity functions. Both the CISO and the CIO have daily responsibility for cybersecurity risk management and establishing risk management practices, and are involved in the execution of the response plans described above when a possible cybersecurity incident occurs. We engage a third-party service provider on a bi-annual basis to evaluate our cybersecurity risk management program and perform health checks on key applications. We also complete annual penetration testing to test our defenses against potential threats or risks.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: In the fiscal year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Risks Related to Our Technology Infrastructure" in Item 1A-Risk Factors.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We devote appropriate resources and designate members of our management, including our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Sharplink, Inc.

ticker: SBET


text: As of the date of this Annual Report on Form 10-K, the Company is no t aware of any cybersecurity incidents that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: We periodically engage external consultants to assess our cybersecurity program. In addition, management's annual assessment of the effectiveness of the Company's internal control over financial reporting assesses the effectiveness of certain controls relating to cybersecurity, and the Company's independent registered public accounting firm audits the effectiveness of the Company's internal control over financial reporting.

companyName: DANAHER CORP /DE/

ticker: DHR


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and maintaining an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, as needed. We had no material cybersecurity incidents in 2023.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CISO Team, along with other members of management.

companyName: Rubrik, Inc.

ticker: RBRK


text: We conduct tests of our cybersecurity program on a regular basis that are designed to identify our cybersecurity risks. We use third-party security service providers and cybersecurity consultants to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats and review our cybersecurity program. The results of such reviews are reported to certain members of our senior management, who evaluate material risks from cybersecurity threats against our overall business objectives and report to our board of directors, which evaluates our overall enterprise risk. Within our senior management, our Chief Financial Officer and Chief Technology Officer (CTO) review our cybersecurity program at least quarterly. Our CTO is one of our founders and has been in technology since 1996. One of our board members has been employed with a cyber security company.

companyName: INTELLINETICS, INC.

ticker: INLX


text: As part of the governance and oversight of the Cybersecurity Program, regular reporting is performed for the Legal and Regulatory Oversight Committee of our Board of Directors along with SEI's various subsidiaries' boards of directors. The reports include cybersecurity metrics/statistics, details of relevant events, results of testing, and overview of current threats. Should any material incidents arise, those will be timely and appropriately communicated to the relevant subsidiary's board of directors.

companyName: SEI INVESTMENTS CO

ticker: SEIC


text: Material Effects of Cybersecurity Risks Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats or incidents. However, we cannot provide assurances that they will not be materially affected by such risks or material incidents in the future. We continually assess the material effects of potential cybersecurity risks on our financial and operational performance and maintain comprehensive insurance coverage to mitigate financial losses from potential cybersecurity incidents.

companyName: INNOVATE Corp.

ticker: VATE


text: To date, the risks from cybersecurity threats, including as a result of any previous immaterial cybersecurity incidents, have not materially affected, or are reasonably likely to materially affect, our strategy, financial condition, liquidity or results of operations.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: We regularly perform internal testing and engage independent third parties to perform audits and assessments as we deem appropriate. For example, our alignment with NIST standards has been reviewed by an industry-leading auditing firm. We also maintain a cyber insurance policy to help manage, in part, costs associated with significant cybersecurity incidents that may occur. We continue to invest in our cybersecurity program and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: In the ordinary course of our business, we collect and store sensitive data, including intellectual property, proprietary business information of ours and that of our suppliers and partners, and personally identifiable information of persons who use our medicines, clinical trial participants and employees. Our partners and third-party providers also possess certain of our sensitive data. The secure maintenance of all such information and the secure performance of our information technology ("IT") systems are critical to our operations and business strategy. As our dependency on, and the complexity of, our IT systems increases, the confidentiality, integrity and availability of our IT systems and the data that they store is critical to managing our business.

companyName: Alkermes plc.

ticker: ALKS


text: Our CIO receives status reports from our cybersecurity department regularly and reports to our Chief Executive Officer, who receives updates on incidents, trends, projects and other relevant information regularly. In addition, as part of our incident response planning, we maintain cross-functional response teams to be prepared to respond to an incident.

companyName: Bloomin' Brands, Inc.

ticker: BLMN