text: Our Board of Directors holds oversight responsibility over Cryoport's risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its committees. Our audit committee oversees the management of Cryoport's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds quarterly meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.

companyName: Cryoport, Inc.

ticker: CYRX


text: We (or third parties we rely upon) may not be able to fully, continuously and effectively implement security controls as intended, or the controls we implement may be inadequate or fail to address a particular risk. For further discussion of these risks, see "Risk Factors – Business and Operating Risks – Technology failures or cybersecurity incidents could disrupt our operations and negatively impact our businesses" in Item 1A of this report. While we are regularly targeted by cybersecurity threats, including cybersecurity attacks, ransomware and other cybersecurity breaches, and we expect them to continue in the future, during the year ended September 30, 2024, we did not identify any risks from cybersecurity threats that materially impacted or are reasonably likely to materially impact us.

companyName: Post Holdings, Inc.

ticker: POST

secItem: Item 1C


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cyber threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. BNY Mellon also has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.

companyName: VOC Energy Trust

ticker: VOC


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.

companyName: iShares S&P GSCI Commodity-Indexed Trust

ticker: GSG


text: The Board has overall responsibility for the oversight of risk management, which includes cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program. In addition, the Board receives annual briefings from our Chief Operations Officer and our third party service provider(s),on our cybersecurity program.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Additionally, we follow a cybersecurity incident response process that provides a framework for responding to cybersecurity incidents. The process identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, the Board and the audit committee. It also addresses requirements for our external reporting obligations. The cybersecurity incident response process is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer ("CISO") and General Counsel ("GC").

companyName: LendingTree, Inc.

ticker: TREE


text: The CISO is accountable for managing the enterprise information security department and delivering the information security program. The responsibilities of the information security department include threat detection and prevention, cybersecurity risk assessment, a portion of defense operations, incident management, vulnerability assessment, threat intelligence, and third-party risk management. The department also provides security awareness training. The Company's information technology department works together with information security in defense operations and is responsible for business resilience, including identity management.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: The Board's Oversight and Management's Role Our Board has delegated the responsibility for overseeing cybersecurity risk. Our Audit Committee oversees management's assessment and management of cybersecurity risk. Our Senior IT Director, who reports to our Executive Vice President, Chief Administrative and Accounting Officer, leads the Information Technology team, is a member of our management-level. Cybersecurity Governance Committee and management-level Cybersecurity Risk Committee manage our information technology and cybersecurity function.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: Reporting to the Board The Chief Administrative Officer and General Counsel has primary responsibility to report to the President and Chief Executive Officer and to the Board and presents with the CIO where appropriate for the content of the presentation and/or to facilitate a substantive discussion. The CIO, through the Chief Administrative Officer and General Counsel, ensures that the highest levels of the Company remain informed about the cybersecurity posture, potential risks, events, and response if they occur. Material cybersecurity matters, and significant strategic risk management processes and decisions are elevated to the Board by the Chief Administrative Officer and General Counsel, ensuring that the Board has effective and substantive oversight and may provide input and guidance on critical cybersecurity measures and issues.

companyName: YORK WATER CO

ticker: YORW


text: The Company's cybersecurity program is overseen by our CIO, who is responsible for global information technology, including cybersecurity. Our Vice President, Global Information Security, is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO is responsible for our information security organization, which is comprised of internal Owens Corning employees and external security suppliers. Our information security organization provides security monitoring and response and provides regular reports to our CIO and Vice President, Global Information Security. These regular reports inform our CIO and Vice President, Global Information Security as they monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents under the oversight of the risk committee. Our Global Information Services team is regularly engaged in cybersecurity training and awareness and incorporates relevant reviews in technology design and development.

companyName: Owens Corning

ticker: OC


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing Blue Owl's proactive and reactive measures, including monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: Blue Owl Technology Income Corp.


text: We also utilize internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate our security posture. We also engage external firms to measure our NIST CSF maturity level.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Our Chief Information Security Officer ("CISO") has over 20 years of experience in cybersecurity, including serving in similar roles at other public companies. Our CISO leads a team that focuses on the Company's cybersecurity, including primary responsibility for leading enterprise-wide information security strategy, processes, as well as assessing, identifying, and managing cybersecurity risks. The team is enhanced through ongoing interactions with third party experts to help protect the Company from the latest cybersecurity threats. In addition, we maintain a global cross functional cyber crisis team which is responsible for evaluating cybersecurity threats and overseeing compliance with regulatory security requirements. Our CISO reports to our Vice President of Information Technology who has 29 years of experience in Manufacturing and Financial Services and has been leading our IT function for 15 years. Our Vice President of Information Technology reports to our Chief Financial Officer. Our employees supporting our information security program have relevant educational and industry experience.

companyName: Amcor plc

ticker: AMCR


text: We have an overall incident management plan, which is intended to provide guidance and protocols to facilitate timely notification and communication to key internal and external stakeholders during an incident. A subset of this incident management plan is our Security Incident Response Plan, or SIRP, which is based on leading cybersecurity incident response practices. Incidents may be escalated to the CISO, our Chief Information Officer, our Chief Legal Officer, or other members of management or the Board, depending on the severity of the incident, and are handled according to the SIRP protocols, which includes incident detection and analysis; containment, eradication and recovery; and post-incident monitoring. We have developed a framework for assessing the materiality of any such incidents, including a committee responsible for determining whether the incident is material for disclosure. The committee includes our CISO, our Chief Information Officer, our Chief Legal Officer, our Senior Vice President and Controller (Principal Accounting Officer), our head of Internal Audit, and other members of management with relevant subject matter expertise.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: In the event of an incident that jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize a regularly updated information security incident response plan (IRP). The IRP is overseen by our executive Incident Response Committee (IRC), which consists of our Chief Financial and Investment Officer, Chief Administrative Officer, Chief Legal Officer, and CTO. The IRP guides our internal response to cybersecurity incidents. Pursuant to our IRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is generally led by the IRC with support from internal personnel and external counsel or other experts.

companyName: Public Storage

ticker: PSA


text: The Trust relies on the Sponsor's risk management program, which includes cyber risk assessments. These processes have been integrated into the Sponsor's overall risk management system.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: Our Advisor's information technology team is led by its Chief Information Officer who reports to its Chief Financial Officer and has extensive experience working with information security systems. Our Advisor's information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with our Advisor's senior management, our Advisor's cybersecurity governance committee, the Audit Committee and the Board. Our Advisor's cybersecurity governance committee, comprised of the Advisor's Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of its information technology team, are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies under the oversight of our Board.

companyName: Net Lease Office Properties

ticker: NLOP


text: We invest in information security and data privacy measures to safeguard our systems and data. This includes organizational investments, incident response plans, technical defenses, and employee training. We also utilize a third party to conduct vulnerability scans. Our approach to cyber-security risk management is designed to identify, assess, prioritize and manage major risk exposures that could affect our ability to execute our corporate strategy and fulfill our business objectives.

companyName: Li-Cycle Holdings Corp.


text: Our Board of Directors has risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from its committees. If applicable, these committees periodically report to the Board of Directors on their risk oversight activities. Cybersecurity is a critical component of our enterprise risk management program and our Board of Directors is involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis. The Audit Committee, comprised solely of independent directors, oversees our enterprise risk management process and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks, including cybersecurity.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: Cybersecurity Governance, Risk Management and Strategy In the current digital environment, companies like ours may be the target of cyber-attacks or other malicious efforts to cause a cyber incident. These cyber incidents can include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. The possible consequences of such an attack include but are not limited to loss of data, damage to our reputation, interruptions to our operations, and/or the need to pay ransom. Historically, we have not experienced cybersecurity incidents that materially impacted our business strategy, operating results and financial condition but we cannot guarantee a future cybersecurity incident would not materially impact us.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: With the goal of protecting against and managing cybersecurity threats, we have a cybersecurity risk management program designed to assess, identify, manage and mitigate cybersecurity threats that could adversely and materially affect our business.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: The VP of IT leads the operational oversight of company-wide cybersecurity strategy, policies, processes, and support staff. Additionally, the VP of IT works across all relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The VP of IT reports and provides regular updates to the Chief Operations Officer and Chief Financial Officer on the cybersecurity program as well as periodic updates to executive management, as needed. Our VP of IT has worked in the information technology field for over 20 years at biotechnology companies including publicly-traded organizations.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any material expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third-party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations. There can be no assurance that the Company's third-party vendors' and service providers' cybersecurity risk management processes, including their policies, controls or procedures, will be fully implemented, complied with or effective in protecting the Company's systems and information.

companyName: Microbot Medical Inc.

ticker: MBOT


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Lead. Our IT Lead has 5 years of experience in roles that include oversight of cybersecurity risk management programs. In addition, the IT Lead is assisted by an external agency with about 15 years of expertise in cybersecurity.

companyName: IGC Pharma, Inc.

ticker: IGC


text: Our incident response team, headed by the Director and VP of IT, reports material cybersecurity incidents to our executive officers and to our Board of Directors. The Company has an information security advisory board comprised of senior leaders within the Company. These senior leaders include representation from functions including product line, sales and marketing, manufacturing, legal, finance, human resources, supply chain, information technology and regional representation. Responsibilities of the advisory board include: • advise on creation and implementation of information security policy; • advise on information security strategic roadmap and investments; • review, advise, and promote security education, training and awareness; • review and advise on ongoing legal, regulatory, compliance, threat landscape, risks, industry news, and trends concerning cyber security; and • review and advise on the mitigation of cybersecurity risks and potential incidents.

companyName: DIODES INC /DEL/

ticker: DIOD


text: Our cybersecurity risk management program is closely based upon recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and certain other applicable industry standards. In 2024, we obtained our ISO/IEC 27001 certification.

companyName: AppLovin Corp

ticker: APP


text: We have a Vendor Management department that established policies and procedures to follow when utilizing external third-parties. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins. Vendor Management ensures key risk components are mitigated based on acceptable Company standards. Any third parties used in any cybersecurity processes are vetted through our vendor management process. Risks from Cybersecurity threats or previous incidents have not materially affected business strategy, results of operations, or financial condition. See cybersecurity risk factors in Item 1A. Risk Factors.

companyName: FNB CORP/PA/

ticker: FNB


text: We are committed to appropriate cybersecurity governance and oversight. Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our audit committee oversees risks related to cybersecurity and reports to the full board regarding its activities, including those related to cybersecurity.

companyName: Cardiff Lexington Corp

ticker: CDIX


text: 2. Risk Assessment - Relates to an evaluation and identification of risks, threats and vulnerabilities that exist or could exist, identifies the likelihood of occurrence and potential consequences. As part of the risk assessment management prioritizes the assessed risks from low to high based on likelihood and level of impact.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: We design and assess our cybersecurity program based on the CIS Controls and NIST Cybersecurity Framework (CSF). These frameworks provide us with a common language and structure for identifying, assessing, and managing cybersecurity risks across our organization. We do not claim to comply with any technical standards, specifications, or requirements by using these frameworks. They are guides that help us to deal with the cybersecurity risks that are relevant to our business.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. To help the Company address these risks, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: The purpose of the Cybersecurity Steering Committee is to oversee our compliance with reasonable and appropriate organizational, physical, administrative and technical measures designed to protect the confidentiality, integrity, availability, security and operations of our information technology systems, transactions, and data owned by us, by providing guidance and oversight of our information technology and cybersecurity program.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Our Audit Committee receives bi-annual updates from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding any significant cybersecurity incidents.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: data protection and cybersecurity training for employees with access to information systems, certain individuals with privileged access, such as system administrators and developers, are subject to additional controls and monitoring activities; periodic phishing campaigns to train our employees to better identify, report, and avoid malicious content; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems; a third -party risk management process for service providers, suppliers, and vendors who have access to our information systems.

companyName: FOOT LOCKER, INC.


text: Related to Cybersecurity Risks Our audit committee of the board of directors, or the Audit Committee, is responsible for overseeing cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and we have a process for the Audit Committee to be notified between such updates in the event of any significant new cybersecurity threats or incidents.

companyName: Upstream Bio, Inc.

ticker: UPB


text: We rely upon both internal and external resources for evaluating and enhancing our cyber posture. At least annually, our information security and internal audit teams conduct extensive internal and external penetration testing, supplemented by more frequent Purple-team Tests that are designed to identify critical areas of our technical environment and potential vulnerabilities that may need to be addressed. Our information security team also retains external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. We conduct a range of activities to assess our cybersecurity preparedness and processes and to prepare for potential cyber incidents, including tabletop exercises, simulations, and practical application drills with internal teams and external entities. We also require annual cybersecurity training by our employees, conduct regular exercises to help our employees recognize phishing attempts and other social engineering tactics, and provide various methods for employees to report suspicious activity that may give rise to a cyber incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program's continuous improvement process.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – System security risks, data breaches, and cyberattacks could compromise our proprietary information, disrupt our internal operations, impact services to customers, and harm public perception of our products, which could materially adversely affect our business, financial condition, operating results, and future growth prospects".

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: The IT Service Provider has implemented processes and procedures to assess, identify, manage and protect against material risks from cybersecurity threats including 24/7 network monitoring, ongoing vulnerability and penetration assessments, and employee security awareness training.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: We use third-party service providers to perform a variety of functions throughout our business, including manufacturing our product candidates and assisting with R&D and clinical activities. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider, our vendor contracting processes may include imposing certain contractual provisions related to privacy and cybersecurity.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: There have been no cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A. Risk Factors — "A significant disruption in, or breach in security of, our information technology systems or data could adversely affect our business, reputation and results of operations."

companyName: CRAWFORD UNITED Corp


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general risk oversight function, and has delegated responsibility to the audit committee for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The audit committee reviews the processes developed by management to assess, monitor, manage, and mitigate risks from cybersecurity threats to the Company. The audit committee will review our cybersecurity processes and cybersecurity threats, and will brief the entire board of directors on these processes and threats, in each case on at least an annual basis.

companyName: FrontView REIT, Inc.

ticker: FVR


text: Our policies and approach to cybersecurity include several key elements: • Continuous Monitoring and Defense: We work to protect our environments and products from threats through multi-layered defenses. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Operations Center provides comprehensive, around the clock, cyber threat detection and response capabilities. • Third-Party Software Risk Assessment: We complete security audits on all third-party platforms prior to selection. • Incident Response Plan: Our Incident Response Plan includes the investigation steps and notifications required on all actual and suspected information security incidences • Cybersecurity Training Programs: Our training program is multi-faceted and focused on awareness of new techniques that threat actors utilize both in the corporate environment, as well as their personal lives. Employees undergo regular training on information security best practices, including interactive training to confirm understanding and test employee skills. • Compliance Policy: Mandatory compliance with all cybersecurity programs, including applicable legislative and regulatory requirements. • Third-Party Cybersecurity Plan Assessment: We regularly engage with cybersecurity professionals in reviewing our cybersecurity plan.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: We strive to maintain a strong culture of cybersecurity awareness across the organization by conducting regular information security awareness training, and simulation exercises, for employees, and providing access to related educational materials.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A, Risk Factors-Risks Related to Our Business.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Our process for assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall risk management process. We have a robust enterprise risk management ("ERM") program that plays an important role in seeking to manage and address existing and emerging risks, including cybersecurity risks, which are critical to our overall business goals and objectives. The ERM team updates our Chief Executive Officer ("CEO") and his leadership team on cybersecurity risks as well as their potential impact, likelihood, potential mitigation plan and status.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Our processes for oversight of cybersecurity risks are integrated into our Enterprise Risk Management (ERM) program, which is led by the Executive Director, Global Risk. To govern the ERM program, we established an Executive Risk Council that meets regularly to review and monitor our most significant enterprise risks, including the prevention, detection and mitigation plans, including with respect to cybersecurity. The Executive Risk Council is comprised of senior leaders with cross-functional experience and responsibilities.

companyName: CUMMINS INC

ticker: CMI


text: We have previously experienced actual or attempted cyber-attacks on our information systems or networks; however, none of these incidents had a material impact on our operations or financial condition. For additional information on the impact of cyber risks, refer to Part I, Item 1A. Risk Factors on page 12.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: Incidents noted above, Mr. Geldenhuys is the sole Director of Rivulet Entertainment and the Company currently has a limited number of employees.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: We have in place a third-party risk management program to evaluate the cyber postures of our critical partners who handle the Company's sensitive data in order to identify, monitor and address material cybersecurity risks that may arise from such third-party relationships.

companyName: ANALOG DEVICES INC

ticker: ADI


text: Our management and Board of Directors (the "Board") recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, business partners, employees, and investors. The Board is involved in our risk management practices. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our systems.

companyName: SANUWAVE Health, Inc.

ticker: SNWV


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by specialized vendors that assist the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.

companyName: PEOPLES FINANCIAL CORP /MS/

ticker: PFBX


text: We are also subject to mandatory and enforceable regulatory standards for critical infrastructure protection, which include cybersecurity-related standards. We are subject to periodic audits by Texas RE of our compliance with critical infrastructure protection standards.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: We maintain cybersecurity insurance coverage at industry standard levels as a part of our comprehensive insurance portfolio to help mitigate risk in the event an information security event occurs.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: By prioritizing cybersecurity at the highest level of our leadership, we assess cybersecurity risk, allocate resources and maintain a culture of cybersecurity awareness throughout Chart. Chart ties cybersecurity or being cyber safe to our key theme of safety, as an industrial manufacturer. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through third-party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other programs: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Our Bank Technology Governance Committee, a management level committee, consisting of members of our senior leadership, including our chief risk officer and chief information officer, is responsible for approving policies to support the management and implementation of the cybersecurity program. This committee receives regular reporting from our director of information security similar to what is provided to the board of directors, and more detailed reporting regarding the availability of information technology assets and cybersecurity threats being monitored.

companyName: Federal Home Loan Bank of Boston


text: The Company maintains a cybersecurity insurance policy that provides coverage for potential losses arising from a cybersecurity incident. Although we maintain cybersecurity insurance, there can be no guarantee that our policy will cover all losses or all types of claims that may arise from such incidents.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: Incidents and Risks The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network such as Distributed Denial of Service attacks, Corporate Account Takeover schemes, or ransomware. Additionally, an event that disrupts one of the Bank's service channels, whether from a security incident or not, is also considered an incident requiring a response under this program. These disclosure controls and procedures compel the Company to make accurate and timely disclosures of material events and incidents to both customers and regulatory authorities. The reaction to an incident aims to reduce potential damage and loss and to protect and restore confidence through timely communication and the restoration of normal operating conditions for computers, services, and information. Management will work closely with its cybersecurity insurance provider, cybersecurity legal counsel, and forensic experts when investigating and responding to cyber or ransomware attacks.

companyName: ENTERPRISE BANCORP INC /MA/


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Global Head of IT. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committe of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (1) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (2) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (3) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (4) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.

companyName: World Gold Trust

ticker: GLDM


text: Our Board of Directors (the "Board") has designated the Audit Committee to oversee risk management associated with cybersecurity threats. The Audit Committee is comprised of board members with diverse expertise including risk management, technology, and finance, which we believe enables them to oversee cybersecurity risks.

companyName: Liberty Energy Inc.

ticker: LBRT


text: Our information security program is managed by our Chief Information Security Officer (CISO) with collaboration across lines of businesses and corporate functions. The CISO is a senior-level executive responsible for establishing and executing our information security strategy, including cybersecurity oversight. The CISO reports directly to our Chief Information Officer (CIO), who reports directly to our Chief Operating Officer (COO). The CIO and CISO are members of the management operational risk committee, which reports to the management risk committee. The COO is a member of the management risk committee, which reports to the board risk committee. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Committees of the Board of Directors—Management Committees for additional information about the management operational risk committee, which is responsible for overseeing operational risk, including cybersecurity risk, and the management risk committee, which is responsible for overseeing overall corporate risk.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our customers, colleagues, regulators, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see "A major information or cybersecurity incident or an increase in fraudulent activity could lead to reputational damage to our brand and material legal, regulatory and financial exposure, and could reduce the use and acceptance of our products and services." under "Risk Factors."

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Our Chief Information Security Officer has served in various senior roles in information technology and information security, in both the public and private sector, for over two decades and maintains a Certified Chief Information Security Officer professional certification. Similarly, the other members of our global cybersecurity services team have cybersecurity training and experience in both the public, including military and law enforcement, and private sectors and maintain various certifications in relevant subjects.

companyName: FISERV INC

ticker: FISV


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity challenges that have materially impaired our operations or financial standing in Fiscal 2024.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: Cybersecurity Technical Safeguards The Company invests in new information and cybersecurity services and technologies. Technical safeguards designed to protect the Company's information systems from cybersecurity threats include firewalls, continuous intrusion detection and response system(s), data leak prevention, enhanced email protection, antimalware functionality, and access controls, which are evaluated and improved through periodic assessments and cybersecurity threat intelligence.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows, or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business, however, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Relating to Our Business – We may have risks associated with security of our information technology systems".

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: As part of this framework, we have a set of enterprise-wide policies and procedures concerning cybersecurity matters which go through an internal review process and are approved by appropriate members of senior management or the Board, which include an Information Security Policy, as well as other policies and procedures that directly or indirectly relate to cybersecurity, and practices related to encryption, antivirus protection, remote access, multi factor authentication, the protection of confidential information and the use of the internet, social media, email, and wireless devices.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: The Board of Directors and the Audit Committee receive briefings from the Company's CFO and CEO on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to their regularly scheduled meetings, members of the Board of Directors, the CIO, CFO and CEO regularly engage in ad hoc conversations regarding emerging or potential cybersecurity risk and developments in the cybersecurity domain. The Board of Directors actively participates in strategic decisions making related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board of Directors conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review is helpful for identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: The Company's cybersecurity program comprises several components, including the adoption of information security protocols, standards, and guidelines consistent with industry best practices; engaging third-party service providers to conduct security assessments and penetration testing; and performing periodic internal audits of the Company's cybersecurity protocols. The Company employs a risk-based process designed to manage cybersecurity risk presented by third-party vendors that may have access to the Company's sensitive information and/or information technology ("IT") systems. This process may consider the nature of the services provided, the sensitivity and quantity of information processed, the criticality of any potentially impacted IT systems, and/or the strength of the vendor's cybersecurity practices.

companyName: ENVIRI Corp

ticker: NVRI


text: We recognize that effective cybersecurity governance is an on-going process, and thus, encourage those individuals with oversight responsibilities to stay abreast of emerging cybersecurity threats as well as pursue cybersecurity education opportunities. To this end, a number of our Cybersecurity Committee members, particularly the IT and OT representatives, hold one or more industry-recognized information security certifications such as the CISSP, CISM and CISA.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: Our cybersecurity program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • ad hoc internal review of the cybersecurity practices of service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: Additionally, our Corporate Cybersecurity Steering Committee, chaired by the CISO and whose members include our Senior Vice President, Corporate Controller (our principal accounting officer), as well as other members of the information technology, finance, supply chain, security and facilities, research and development, product, human resources, and legal teams, meets regularly to provide a forum for senior leaders and key stakeholders to strengthen their understanding and strategize on managing cybersecurity challenges at the Company.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Our Executive Vice President of Technology has extensive cybersecurity knowledge and skills gained from over six years of work experience on the security team at IRT and an extensive career in the technology and cybersecurity industries. Our Executive Vice President of Technology heads the team responsible for implementing and maintaining cybersecurity and data protection practices at IRT and reports directly to the President and Chief Financial Officer.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: Through our enterprise risk management ("ERM") program, we identify, assess and manage a broad range of risks across the organization. Through the ERM process, cybersecurity has been identified as an important risk facing our business. Accordingly, our cybersecurity risk management program is integrated into our overall ERM program and information about cybersecurity risks and our cybersecurity risk management program is reviewed as part of our ERM program.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: Blue Owl Capital Corp II


text: Related to Cybersecurity Risks Our audit committee of the board of directors, or the Audit Committee, is responsible for overseeing cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management and our contracted information technology consultant regarding cybersecurity matters. We have a process for the Audit Committee to be notified between such updates in the event of any significant new cybersecurity threats or incidents.

companyName: PepGen Inc.

ticker: PEPG


text: Our appetite for cybersecurity risk is established within our enterprise risk appetite. We undertake an information technology risk assessment annually. This assessment considers our information assets, the potential threats/risks to those assets and the effectiveness of existing controls to identify and assess inherent and residual levels of information security risks. This assessment also identifies any control gaps that may exist and informs appropriate mitigation strategies to conform to our appetite for cybersecurity risk. Remediation plans for any identified gaps are monitored by management quarterly. Results from this risk assessment may affect changes in the Information Security Strategy and information security budget. Annually, we engage a third-party audit firm specializing in information technology audits to review the risk assessment and our Information Security Program overall as part of our information technology general controls audit.

companyName: Sterling Bancorp, Inc.


text: We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. To prevent, detect and respond to information security threats, we maintain a cyber risk management program that employs Cyber Security Framework ("CSF") in accordance with the National Institute of Standards and Technology ("NIST") security framework. CSF is a set of voluntary guidelines that help organizations assess and improve their cybersecurity posture by implementing processes for identifying and mitigating risk, and detecting, responding to and recovering from cyberattacks.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team regularly monitors, alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard which covers cyber operational controls along with internal and external threats. Annual risk and cyber maturity assessments are conducted by independent third parties. Further, we conduct periodic external penetration tests and response testing to assess our processes and procedures against the evolving threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program that is designed to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments and conducting periodic reassessments during their engagement. Our IT security team conducts an annual review of third parties with a specific focus on any sensitive data shared with third parties. System and Organization Controls (SOC) reports are reviewed along with complementary user entity controls. If a third-party vendor is not able to provide a SOC 2 report, we take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: CINTAS CORP

ticker: CTAS


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents and threats to management members depending on the circumstances, including the Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and Chief Financial Officer work with our incident response team in an effort to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our management and its designees report to the board of directors for certain cybersecurity incidents.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.

companyName: Willow Tree Capital Corp


text: The Company's cybersecurity program includes the following areas of focus: • Technology that includes, among other things, encryption, threat management, monitoring, investigation support and backups for physical devices, such as mobile phones and computers, connected to the Company network; • Identity and access management controls that include, among other things, multi-factor authentication and safeguards associated with granting elevated privileges; • Proactive cybersecurity processes, including vulnerability scanning, penetration testing and periodic program assessments by outside security consultants and assessors; • Reactive cybersecurity processes that are regularly evaluated using various incident response and disaster recovery exercises; • Employee cyber risk awareness and training, including regular simulation exercises with employees, that covers cybersecurity threats and actions to prevent and report attacks; and • Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring and contractual obligations, and periodic review of third-party control environments to align the Company's risk exposure with its business requirements and risk tolerances.

companyName: American Water Works Company, Inc.

ticker: AWK


text: The Business Continuity and Incident Response Program is coordinated by the information security officer and key members of management are embedded into the Plan by its design. The Business Continuity and Incident Response Program facilitates coordination across multiple areas of our organization and is evaluated at least annually.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: The Company's management team is responsible for the day-to-day assessment and management of cybersecurity risks. As mentioned above, a dedicated CISO leads the information security team and is responsible for the Company's cybersecurity risk management and strategy. The CISO has a master's degree in cybersecurity from the University of Maryland Global Campus, a degree in computer science from Presbyterian College and more than 15 years of experience in technology, information security and risk management with companies in various sectors. The CISO reports to the CIO, who is responsible for global IT strategy and IT operations across the enterprise. The CIO has a degree in computer science and mathematics from Wofford College and has over 30 years of experience in the IT industry, spanning various roles and sectors.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: Sleep Number uses a "defense in depth" approach for its cybersecurity risk management program leveraging the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company regularly assesses the threat landscape for cybersecurity risks, with a strategy based on prevention, detection and mitigation. The Company's information technology (IT) security team--led by the VP of Information Security and Architecture and Chief Information Officer--reviews cybersecurity risks on an ongoing basis. IT security team members who support its information security program have relevant educational and industry experience. The VP of Information Security and Architecture, and their team, provide regular reports to senior management, the Audit Committee, and other relevant teams on various cybersecurity threats, assessments and findings. The IT Security team has established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, which are also identified and assessed through the Company's overall risk management program, including quarterly assessments of IT systems, cybersecurity and related risks.

companyName: Sleep Number Corp

ticker: SNBR


text: As part of our Third Party Risk Management program, we perform initial risk assessments prior to engaging third-party service providers and ongoing risk assessments annually thereafter, which follow an established process designed to identify, assess, and periodically review our exposure to risk through our partners.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: As of April 30, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: Natural Resource Holdings, Inc.

ticker: NRHI


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks we face and oversees the Information Security Committee. The Information Security Committee manages the oversight of the information security assessment, development of policies, standards and procedures, testing, training and security report processes for West Bank. The Information Security Committee is comprised of officers with the appropriate expertise and authority to oversee the Information Security Program.

companyName: WEST BANCORPORATION INC

ticker: WTBA


text: The Board is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and related exposures, as part of this oversight the Board has delegated certain of these responsibilities to committees of the Board. The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks program to the Nominating and Corporate Governance Committee. As part of this oversight, the Nominating and Corporate Governance Committee reviews the Company's cybersecurity program periodically, and at least annually. The Company's CDDATO and CISO update the Nominating and Corporate Governance Committee periodically, and at least annually, and the full Board as needed, on the Company's cybersecurity program, including with respect to particular cybersecurity threats, incidents or new developments in the Company's risk profile. The CISO is a member of the Company's disclosure committee, and the CPO advises the disclosure committee on cybersecurity matters on an as-needed basis. During 2023, the Board conducted a review of its overall committee structure, membership and responsibilities in an effort to enhance its oversight. As part of this review, the Board has determined that it will shift the delegation of the oversight of the Company's cybersecurity risks program to the Audit Committee effective March 2024.

companyName: CVS HEALTH Corp

ticker: CVS


text: As part of our focus on the use of AI technology in our business, we developed an AI cybersecurity strategy designed to enable the building of secure and reliable AI systems while also managing ethical, legal, cyber, data privacy, and other technology risks. The Company also established an AI Governance Committee, which is composed of leaders across a variety of business, technology, and support functions, to oversee the creation and implementation of risk control and strategic implementation frameworks. In addition to cybersecurity risks being tracked, managed, and monitored directly by the information security group, cybersecurity risks are also integrated into, and are among the risks evaluated and considered by, our enterprise risk management program. The Company's Chief Legal Officer provides centralized oversight of our enterprise risk management program, which is managed by our Chief Compliance Officer and the Office of Enterprise Risk Management in partnership with the Enterprise Risk Council (ERC). The ERC is comprised of senior Company leaders with broad enterprise experience, including our Chief Information Security Officer (CISO).

companyName: LOWES COMPANIES INC

ticker: LOW


text: We regularly engage independent third parties to assess our cybersecurity program and practices, and to assist with risk mitigation. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third parties. These assessments are performed in conformance with ISO standards and requirements. Enhancements to our cybersecurity program and practices are identified from assessment findings, and if deemed appropriate, implemented.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Our policies require each of our employees to contribute to our data security efforts. We regularly educate our employees about the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: We maintain cybersecurity risk insurance, conduct threat scenario exercises, provide end user cyber awareness and security training, perform regular vulnerability audits and formally report the relevant results, statuses or assessments to our senior management team or other identified key stakeholders.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Security Awareness Education. Understanding the need for regular cybersecurity training, we have instituted a mandatory training program for all employees around information security and data privacy.

companyName: Archer Aviation Inc.

ticker: ACHR


text: iv. Third-Party Risk Management – The Company's formal vendor management program includes security risk assessments requiring the vendor to meet or exceed appropriate security requirements prior to the hosting or sharing of sensitive information by third parties. The Company's standard contract provisions obligate third-party compliance with industry standard security protections.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: ACM Research, Inc.

ticker: ACMR


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any.

companyName: Four Leaf Acquisition Corp

ticker: FORL


text: Oversight and Governance The Corporation's Information Security Officer (ISO), with assistance from the Information Technology team, has the primary responsibility in maintaining, assessing, and updating the Information Security Program and for reporting cyber and information security matters to the Corporation's executive management and Board of Directors. The ISO maintains a presence on a variety of committees that work together to monitor and manage the Corporation's risk profile and approve any changes or enhancements to the risk management strategies, including the Board of Directors IT Committee and Audit Committee, and the Corporation's IT Steering Committee, Enterprise Risk Management Committee, and Vendor Management Committee. At least annually, the ISO also presents to the Board of Directors on the state of the Information Security Program. This includes an overview of the Program's strategy and processes for identifying and mitigating risks, employee security awareness and training efforts, and any enhancements or changes to the program since the previous report.

companyName: FIRST KEYSTONE CORP

ticker: FKYS


text: Our CISO has primary responsibility for managing our cybersecurity threat management program. The CISO is a Certified Information Security Systems Professional (CISSP), with more than 15 years of experience in building and leading information security teams and has worked at a variety of companies to implement and manage cybersecurity programs. Those entities have included large, publicly-traded companies. His experience includes developing and maintaining tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: We have developed and implemented a cybersecurity framework designed to evaluate, identify and manage risks stemming from threats to the security of our information, systems and network using a risk-based approach. The framework is informed, in part, by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not necessarily mean that we meet all technical standards, specifications or requirements outlined in the NIST framework. Additionally, we maintain a Systems and Organization Controls (SOC) 2 Type 2 attestation.

companyName: Option Care Health, Inc.

ticker: OPCH


text: We recognize the importance of maintaining the trust and confidence of our customers, business partners, and employees, and cybersecurity represents an important component of our overall approach to enterprise risk management. Our approach to cybersecurity risk management is aligned with our risk profile and business, and includes efforts towards meeting the standards for an organization of our size and type in conjunction with the National Institute of Standards and Technology. We also utilize a third-party IT vendor to manage the technological security and efficacy of our systems, including a Virtual Chief Information Officer, a Virtual Chief Information Security Officer, and other IT specialists who manage our IT and cybersecurity needs. In April 2024, the Company engaged the services of a cybersecurity company that works in conjunction with our managed IT vendor to provide additional cybersecurity management.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: Related to Cybersecurity Risks Our Chief Technology Officer, with over 15 years of experience in software development and security architecture, is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. Our Chief Technology Officer provides reports to and meets periodically with our General Counsel to discuss and review our information security and cybersecurity risk management processes.

companyName: Doximity, Inc.

ticker: DOCS


text: Management's Role in Cybersecurity Risk Management Our management, including our Response Team, is responsible for assessing and managing material risks from cybersecurity threats. Our management continuously assesses, meets and prioritizes cybersecurity risks and actions taken to mitigate these risks. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks. We leverage the resources of Monroe, including the Head of Information Technology, who provides resources and expertise to assist us in our cybersecurity program. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of our Advisor.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: The Advisor and its affiliates have a technology team, under the leadership of the Director of Information Technology, who has over 20 years of technology management experience, which defines a work plan designed to maintain strong cybersecurity maturity, sets improvement objectives of key controls and systems, including feedback from third-party assessments, and identifies and implements on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of this planning, management conducts regular testing of our incident response plan to increase awareness, establishes key decision-making criteria, ensures effective communication among key stakeholders, and complies with the Company's disclosure obligations.

companyName: Lightstone Value Plus REIT V, Inc.


text: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees. Our security program is overseen by our VP of Information Technology, supported by corporate leadership from legal, compliance and finance. Our VP of Information Technology and the support team is accountable for the program. Our functional area executive leadership, acting in support of the VP of Information Technology, the DPO and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization. Our VP of Information Technology and DPO, are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Cybersecurity Risks We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, unauthorized transactions, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A, "Risk Factors - Risks Related to Our Business - We face risks associated with cybersecurity incidents through cyber-attacks, cyber intrusions or otherwise, as well as failures of systems on which we rely and other significant disruptions of our information technology ("IT") networks and related systems."

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from TIAA's Cybersecurity leadership regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Account.

companyName: TIAA REAL ESTATE ACCOUNT


text: Our Board of Directors keeps apprised of and oversees technology risk and cybersecurity of the Company, and receives updates from the Company's Information Security Officer ("ISO") on a quarterly basis. However, the Board has delegated certain specific responsibility for overseeing cybersecurity threats, among other things, to its Audit and Risk Committee. Our ISO and Chief Risk Officer provide the Audit and Risk Committee and the Company's internal Enterprise Risk Management Committee periodic reports on our cybersecurity risks and cybersecurity incidents, if any. The Board, and the Audit and Risk Committee, have appropriate expertise in planning for and dealing with cybersecurity threats. Specifically, and without limitation, David Becker, Ann Dee and Justin Christian all possess specific expertise in this area.

companyName: First Internet Bancorp

ticker: INBK


text: Cybersecurity incident response plans are regularly updated to include structured processes encompassing identification, containment, eradication, recovery, and post-incident review. Continuous monitoring of systems and networks allows for the detection and response to potential cybersecurity threats. Response capabilities are regularly reviewed to align with the evolving cyber threat landscape and processes are fully integrated into our broader risk management system.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including annual training requirements, simulation exercises, threat monitoring and detection tools (including those using artificial intelligence and machine learning), threat containment methods, risk assessments, third-party penetration testing and security requirements for our suppliers and other third parties. We have established processes providing for review of identified cybersecurity incidents by a cross-functional cybersecurity incident response team who monitors and manages the detection, assessment, mitigation and remediation of cybersecurity incidents and escalates incidents to the Chief Information and Security Officer and to our disclosure review board, which evaluates such incidents for materiality and potential disclosure, and works to ensure that members of management responsible for overseeing the operation of our disclosure controls and procedures are informed of such cybersecurity risks and incidents. Our cybersecurity incident response team and disclosure review board are comprised of subject matter experts, including employees in cybersecurity, information technology and other areas to evaluate potential security, financial, operational, reputational and other risks, and to address our process. We also engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide periodic independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for security operations, incident response, and security remediation services.

companyName: ACCURAY INC

ticker: ARAY


text: We engage third parties to conduct risk assessments on our systems and other vulnerability analyses on a recurring basis and assist with containment and remediation efforts. In addition, third-party technology and analytics and penetration testing are utilized to identify potential vulnerabilities. To manage risks related to cybersecurity incidents that could impact our CROs, third-party vendors and other contractors and consultants, we maintain a third-party risk management program, which is designed to assess the security controls of our third parties. The assessment methodology is based on risk and relies on the data, access, connectivity, and criticality of the services that the third-party offers.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: The Company's information security function and third-party service providers help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk assessment process. The Company's information security function and third-party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: • automated tools; • subscribing to reports and services that identify cybersecurity threats; • analyzing reports of threats and actors; • conducting scans of the threat environment; • evaluating our and our industry's risk profile; • evaluating threats reported to us; • conducting audits; • conducting threat assessments for internal and external threats; • conducting vulnerability assessments to identify vulnerabilities; and • using external intelligence feeds.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: IT systems are protected using various tools like multi-factor authentication (MFA), virtual private network (VPN), firewalls, end-point protection, spam and web filters, mobile device management, and privileged access management. A third-party monitoring service aids in detecting any threats or anomalies with the network. A multi-department incident response plan has been developed to facilitate a swift response in the event of a cybersecurity incident, which includes notifying the appropriate regulatory agencies. IT systems critical to the business operations have been identified and plans have been developed for a swift recovery of IT services in the event of a service failure. We conduct annual security reviews of all service providers that provide critical service to the business. A cybersecurity risk assessment is conducted prior to contracting with a new IT cloud service provider providing high-impact services.

companyName: Koppers Holdings Inc.

ticker: KOP


text: Security Awareness and Training: We regularly conduct comprehensive security awareness training programs for all employees. These programs educate them on cybersecurity best practices, threat identification, and reporting procedures.

companyName: Mega Matrix Corp.


text: Our chief executive officer, chief financial officer and corporate controller have operational experience in assessing and managing cybersecurity risk. Our chief executive officer plays a pivotal role in informing the audit committee on cybersecurity risks. They provide comprehensive briefings to the audit committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: MetaVia Inc.

ticker: MTVA


text: Our chief financial officer ("CFO") has primary responsibility for assessing and managing material risks from cybersecurity threats. The CFO meets periodically with our external cybersecurity consultant to review security performance metrics and identify security risks. The CFO and our external cybersecurity consultant also consider and make recommendations on security policies and procedures, security service requirements and risk mitigation strategies to the Nominating and Corporate Governance Committee.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Dominion Energy maintains a robust, tested and regularly revised Cyber Security Incident Response Plan and a Vendor Compromise Response Plan. These plans detail roles, responsibilities, and actions to be taken in response to a detected event whether internal or associated with a third-party service provider. The plans provide clear direction for escalation of information to leadership, including Dominion Energy's Board of Directors as appropriate, and drive collaboration amongst relevant members of management representing cybersecurity, information technology, operations, supply chain, legal and accounting departments. As necessary, the COO, CFO and chief legal officer will advise the CEO on any incidents which could potentially have a material effect on Dominion Energy's business operations, results of operations or financial condition.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Management's Role in Assessing and Managing Cybersecurity Threats: Management's role in assessing and managing our material risks from cybersecurity threats is documented in the Company's IT and Cybersecurity Risk Management Strategy Plan (our Cybersecurity Plan), and our processes for identifying, assessing, prioritizing, and remediating vulnerabilities are documented via our Cybersecurity Plan (and the documents referenced therein) and our IRP. Our management cybersecurity team consists of a majority of the direct reports to our CEO, including our CIO, as well as dedicated cybersecurity personnel – including without limitation, our CISO, multiple cybersecurity engineers and other business level stakeholders. Although there is overlap between the CROC and our management cybersecurity team, the CROC is intended to function as a proactive group to assess and treat risks prior to an incident occurring and the cybersecurity management team is tasked with responding to threats or incidents. In connection with and pursuant to our enterprise risk management plan, our cybersecurity team, the CROC and our ERC work collaboratively across the Company to implement programs and processes designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to promptly respond to cybersecurity incidents.

companyName: Vertiv Holdings Co

ticker: VRT


text: We design and assess our program based on the National Institute of Standards and Technology (NIST), the International Organization for Standardization (ISO) and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST, ISO and other standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: Our cybersecurity risk management program also attempts to assess third-party vendor, service provider, business partner and supply chain risk management issues. Our efforts aim to better understand the cybersecurity posture of our third-party vendors, service providers, business partners and suppliers by analyzing their cybersecurity risk management programs. Our third-party cybersecurity risk management processes include reviewing and revising our service provider and vendor management programs and the related agreements to require prompt notification of cyber incidents, outages and software vulnerabilities to facilitate timely assessment and disclosure of third-party cyber risks. Generally, our agreements require our third-party providers to abide by specific privacy, confidentiality and security processes, particularly for third-party data-processing activities. For vendors that offer software as a service solutions involving personal information, our third-party risk management program generally requires third-party attestation of their security practices such as a System and Organization Controls 2 report or ISO 27001 certification. Our due diligence and selection processes also require third parties to complete a cybersecurity and data privacy questionnaire that includes questions about contractor track record. Our third-party security reviews are limited by their disclosures; therefore, a risk-based approach is used in making vendor and contractual decisions based on those disclosures and the totality of the circumstances, such as whether the third party will have access to personal information or our network.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: The Senior Director - Information Security has over 15 years' experience in the information technology and cybersecurity field, including previous roles in security architecture, audit and governance. The Senior Director - Information Security recently completed a CISO Academy Workshop, where he gained valuable insights to help improve our cybersecurity posture and program while also better aligning it to our overall business strategy and operating model. He received a BA in math and computer science from Ohio Wesleyan University and holds an Information Systems Auditor certification.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: Board of Directors' Oversight and Management's Role Through the Partnership's enterprise risk management program, the Board of Directors is responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. As part of its program of regular risk oversight, the Audit Committee assists the Board in exercising oversight of the Partnership's cybersecurity, information security, and information technology risks. The Board or Audit Committee periodically reviews and discusses with management the Partnership's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, the IT Director is responsible for upward reporting of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.

companyName: CSI Compressco LP


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – If our information technology systems, or those of our provider clinics, specialty pharmacies or other vendors lag, fail or suffer security breaches, we may incur a material disruption of our services or suffer a loss or inappropriate disclosure of confidential information, which could materially impact our business and the results of operations" in this annual report on Form 10-K.

companyName: Progyny, Inc.

ticker: PGNY


text: We rely on our information technology professionals at the subsidiary level to continuously monitor and update our information technology networks and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry-standard security technologies to protect the Company's and each subsidiary's data and business processes against cyber risks. To enhance our cybersecurity efforts and awareness, we have established an "IT Steering Committee," comprised of a team of information technology professionals from our subsidiaries, who will convene on a quarterly basis to discuss topics including cybersecurity threats, emerging attack methods, and best practices.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: Perficient's Information Technology, Data Security, Data Privacy, Finance and Communications teams conduct annual tabletop exercises in which various levels of management participate in simulated data security/privacy scenarios that Perficient, its clients and/or its personnel may face in the future. Perficient engages external resources to refresh the subject matter of these exercises and to continually challenge Perficient's management in these exercises. Annual formal training using an online platform is required for all Perficient employees and subcontractors. Topics include how to identify suspicious activities and occurrences related to social engineering, phishing, viruses, and insider threats. Certain employees complete additional role-based training. Perficient's formal training is supplemented throughout the year by regular "Securing Perficient" emails which reinforce relevant cybersecurity policies and procedures and cover topics such as emerging cybersecurity risks.

companyName: PERFICIENT INC


text: The Company has established a cybersecurity risk management program, designed to identify, assess, mitigate, and manage cybersecurity risks, incidents and threats that could potentially impact our business operations. Our internal cybersecurity committee (the "Cybersecurity Committee"), which includes our Chief Financial Officer and key representatives from the Finance, Information Technology ("IT"), and Legal departments, direct our cybersecurity efforts. The Cybersecurity Committee is primarily responsible for monitoring our cybersecurity risk management program, establishing and updating materiality thresholds for reporting cybersecurity incidents and determining whether specific incidents meet established disclosure criteria. The Cybersecurity Committee's role is focused on evaluating incidents against these thresholds to ensure that significant cyber risks are appropriately managed, addressed and if required, disclosed in line with our overarching cybersecurity strategy and policies. The Company has also established a Cybersecurity Incident Assessment and Reporting Policy (the "Cyber Incident Policy").

companyName: Celsius Holdings, Inc.

ticker: CELH


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. The CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Blackstone's CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as us, on technology-related matters.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Our CIO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CIO is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include log review from IT and operations teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.

companyName: GrowGeneration Corp.

ticker: GRWG


text: The Risk Committee meets no less than quarterly and provides oversight of PNC's ERM framework. Cybersecurity risk is integrated into PNC's overall ERM framework, and is represented as the Information Security domain, alongside seven other operational risk domains. See the Risk Management section of this Report for more details on our ERM framework.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC