text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.

companyName: scPharmaceuticals Inc.


text: For additional information about the cybersecurity risks, see "Risk Factors" under the section entitled "Risks Related to Information Security, Cybersecurity and Data Privacy" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: TripAdvisor, Inc.

ticker: TRIP

secItem: Item 1C


text: The Trust depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Trust, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers. The frequency of such reviews is generally based on the nature of Trust's information processed by the vendor and the vendor's criticality to business operations.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For further discussion of the cybersecurity risks and threats we face, please see Item 1A. "Risk Factors".

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Our CSO is responsible for implementing and maintaining our cybersecurity risk assessment and management processes. Our CSO has over 25 years of experience in cybersecurity, including serving as a chief security and strategy officer at another company and founding a cybersecurity operational technology threat intelligence and solutions platform. Our CSO oversees and maintains our information security management framework and is responsible for defining and implementing our information security strategy, hiring appropriate personnel, communicating key cybersecurity priorities to relevant personnel, and managing cybersecurity budgets and cybersecurity processes.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: As part of our overall risk management processes, we engage in a multi-departmental strategy to assess and incorporate the above processes and involve other departments as needed, including IT, Systems, Risk Management, and Legal. We engage assessors, consultants, auditors, or other third parties to assist with some of the processes above, including conducting risk and gap assessments, IT audits and consulting, system monitoring, vulnerability testing, and penetration testing. To oversee and identify material cybersecurity risks associated with our use of third-party service providers, we limit data access for third-party service providers to only the data that is necessary for the given function and conduct due diligence on our service providers including their information security practices. We require our service providers to maintain appropriate safeguards for the security of consumer information.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: We and Hess design and assess the program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we or Hess meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our businesses.

companyName: Hess Midstream LP

ticker: HESM


text: The Company's cybersecurity risk management program is overseen by management at multiple levels. Under the direction of our DIT, the DIS plays a key role in assessing, monitoring and managing the Company's cybersecurity risks with the support of Company management, external cybersecurity consultants, as well as dedicated information technology and security personnel. Our DIS has 39 years of IT experience, 34 years of which are specializing in cybersecurity practices. Our DIS holds numerous certifications including as an ISC2, Certified Information Systems Security Professional (CISSP), and ISACA Certified Information Security Manager (CISM). Our DIS also has extensive experience in architecting, implementing, and managing cyber security control systems including vulnerability management, endpoint detection and response (EDR), security information and event management (SIEM), email fraud defense, and identity access management (IAM) solutions.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, to the Technology Committee of our board of directors, and external agencies. The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.

companyName: TRANSCAT INC

ticker: TRNS


text: Network Segmentation Issues: Poorly segmented networks can allow attackers to move laterally within the system, increasing the potential impact of an attack and impact to water services.

companyName: YORK WATER CO

ticker: YORW


text: Peoples Bank also has an executive governance structure which includes the Capital and Risk Management Committee ("CRMC"). The CRMC, which is comprised of individuals representing each of the functional areas of Peoples and its subsidiaries, meets monthly and is responsible for the review of risk issues faced by Peoples, including material risks from cybersecurity threats. Summaries of the topics and discussions at CRMC meetings are provided to the Risk Committee along with an overview and recommendations regarding key risks and mitigating actions.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: The Company engages third party assessors, consultants, and auditors to assist in assessing, identifying, and managing risk from cybersecurity threats. Third parties assist the Company by (i) providing regular penetration testing and vulnerability assessments; (ii) assessing and maintaining our formal incident response policies, including through the use of tabletop testing; and (iii) providing multiple sources of threat intelligence information that are fed directly into our technical security platforms, including ongoing network monitoring. The Company also has a comprehensive third party information security audit program in place.

companyName: Alcoa Corp

ticker: AA


text: We have processes to identify, assess, monitor, and manage material risks related to information technology, including, but not limited to: cybersecurity threats, vulnerability management, incident management, data protection and retention, recoverability, and fraud prevention. Our Enterprise Risk Management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs. We periodically engage third-party security firms and consultants to oversee and identify cybersecurity risks; the results of these assessments are reported to our Audit Committee.

companyName: MARZETTI CO

ticker: MZTI


text: Notwithstanding our efforts to manage cybersecurity risks as described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, including our business strategy, results of operations and financial condition. Cybersecurity threats are constantly evolving and we may not be able to anticipate, detect or recognize cybersecurity threats to our systems and assets, or to implement effective preventive measures against all cybersecurity threats, especially because the techniques used in cyber attacks are increasingly sophisticated, change frequently, are complex, and are often not recognized until launched. We routinely identify cybersecurity threats as well as vulnerabilities in our systems and work to address or mitigate those we have identified; however, some cybersecurity vulnerabilities take a substantial amount of time to resolve or mitigate and therefore we continue to have cybersecurity vulnerabilities that we have identified but not resolved or mitigated. As a result, we could experience a cybersecurity incident that materially affects our business in a quarterly or annual fiscal period. See " Risk Factors — Operational and Model Risk " for additional discussion of cybersecurity risks to our business.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: The Company has incorporated evaluation of cybersecurity threats into its overall risk management strategy. As such, Willdan has established a cybersecurity program designed to address applicable legal requirements. Through its internally dedicated cybersecurity team, combined with cybersecurity-specific technologies and external cybersecurity service professionals, the Company assesses, identifies, and manages material risks from cybersecurity threats to its critical computer networks, hardware and software, and data.

companyName: Willdan Group, Inc.

ticker: WLDN


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly reviewed incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, determining any public disclosure obligations with respect to the incident, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain an Incident Response standard operating procedure ("IRP SOP") and business continuity and disaster recovery plans in the event of a significant cybersecurity incident.

companyName: OptiNose, Inc.


text: We also conduct regular cybersecurity training for employees to ensure they are aware of potential cybersecurity threats and understand the role they play in maintaining our defenses. We also monitor evolving regulations and standards to review industry best practices and legal and regulatory obligations.

companyName: EVgo Inc.

ticker: EVGO


text: We manage risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by our Board. Our cybersecurity risks are considered individually as part of our enterprise risk management process alongside other risks, and priorities and discussed with our Board. Management has created an information security program, which is comprised of a dedicated information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Our policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization, as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of data created, collected, stored, and used to operate our business.

companyName: VAIL RESORTS INC

ticker: MTN


text: Tom Curtis. Mr. Curtis, age 61, was appointed President, Burger King U.S. & Canada in October 2021. From May 2021 to October 2021, he was the Chief Operating Officer, where he was responsible for overseeing field operations, restaurant development and restaurant operations. Prior to joining BKC, Mr. Curtis spent 35-years at Domino's Pizza, Inc., where he most recently served as Executive Vice President, U.S. Operations and Global Operations Support, overseeing both franchise and company-owned operations from March 2020 to April 2021. Prior to that, he served as Executive Vice President, Corporate Operations from July 2018 to March 2020, and as Vice President of Franchise Relations and Operations Innovation from March 2017 to July 2018. Mr. Curtis joined Domino's in 2006, after being a Domino's franchisee since 1987.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Cybersecurity Program Governance Our cybersecurity program is governed by the information security committee ("ISC"), composed of our leaders from information technology, enterprise risk, legal, compliance, strategy, human resources, finance, internal audit, and various business units. On a quarterly basis, the CISO reports to the ISC on topics such as risk mitigation project status, audit results, security metrics, cyber incidents investigated and impact, if any, and significant changes that contribute toward protecting the enterprise from cybersecurity threats.

companyName: TE Connectivity plc

ticker: TEL


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.

companyName: Rubber Leaf Inc

ticker: RLEA


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "A cyberattack that bypasses our information technology ("IT") security systems or the IT security systems of our third-party providers, causing an IT security breach or cybersecurity incident, may lead to a disruption of our IT systems and the loss of business information which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: FTAI Infrastructure Inc.

ticker: FIP


text: Our Director of Information Technology reports directly to our executive leadership team on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology team, led by the Director of Information Technology, meets regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics.

companyName: BROADWIND, INC.

ticker: BWEN


text: Our CISO provides reporting to the Risk Management Committee and Operations and Technology Committee of our Board of Directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, as needed when there are status updates or changes. Our CISO reports annually (or more often as needed) to the full Board of Directors on the Bank's cybersecurity risk management program. The Bank's Enterprise Risk Management team, which is part of the Bank's risk management function, provides quarterly reports to the Risk Management Committee (and ultimately, the Board of Directors) on the Bank's risk tolerance conditions, including reports on any cybersecurity matters that may fall outside of the Bank's risk tolerance conditions. Our Board of Directors provides Federal Home Loan Bank of Chicago (Dollars in tables in millions except per share amounts unless otherwise indicated)

companyName: Federal Home Loan Bank of Chicago


text: During the fiscal year ended January 31, 2025, no known cybersecurity threats materially affected, or we believe are reasonably likely to materially affect, our business, our business strategy, financial reporting, or results of operations.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: We have developed an incident response plan designed to coordinate the activities that we and our third-party service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: We recognize the critical importance of maintaining the trust and confidence of our customers, business partners, employees and other stakeholders. We engage in active oversight of cybersecurity, a cornerstone of our comprehensive enterprise risk management (ERM) program. Our cybersecurity framework is rooted in the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, as well as the International Organization for Standardization (ISO/IEC 27001), reflecting our commitment to uphold the highest cybersecurity standards. We align our policies, standards and practices with these benchmarks and dynamically refine them to address evolving cybersecurity threats.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: The Vice President of Informatics reports to our Chief Financial Officer and is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Vice President of Informatics is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Personalis, Inc.

ticker: PSNL


text: In addition, our board of directors is responsible for the oversight of risk management. In that role, our board of directors, with support from our cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receives quarterly reports from our management team regarding cybersecurity risks, and our efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Our Chief Technology Officer is responsible for monitoring and coordinating the Company's Information Security Program, which is managed on a day-to-day basis by our Information Security Officer. This program has been designed to: • Ensure appropriate security of all information systems data, equipment and processes; • Ensure the security and confidentiality of nonpublic customer information; • Protect against any anticipated threats or hazards; and • Protect against unauthorized access to, or use of, such information.

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Compliance Officer and Vice President of Information Technology, both of whom have previously served in management roles at other public biotechnology companies.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: The Company is committed to continuously improving its cybersecurity safeguards as part of overall risk management and will update these disclosures should circumstances change.

companyName: Naploy Corp.


text: This approach involves continuous oversight and improvement based on evolving cyber threats. Materiality also considers both quantitative and qualitative factors in determining impact.

companyName: Kaival Brands Innovations Group, Inc.

ticker: KAVL


text: Cybersecurity Risk Management & Strategy Our business requires the use of information technology (IT) and operational technology (OT) resources, including those to carry out our day-to-day operational activities both onshore and offshore, to maintain our business records and to proactively monitor internal and external cybersecurity threats. To respond to cybersecurity risks and threats, we have developed a cybersecurity risk management program designed to identify, assess, manage and respond to cybersecurity incidents while also preserving the confidentiality, integrity and continued availability of our information and assets. The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001 Information Security Management System Requirements.

companyName: TIDEWATER INC

ticker: TDW


text: (iv) cybersecurity operations designed to prepare, identify, contain, eradicate, and recover from cyber-related incidents; and (v) identity and access management defining global practices for access, authentication, and authorization to technology systems.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Our CSRM program includes risk assessments designed to help identify potentially material cybersecurity risks to our critical systems, information, products and services, as well as our broader enterprise IT environment; an IT security team principally responsible for managing our cybersecurity risk assessment processes, security controls and response to any cybersecurity events; the use of third party experts and service providers, where appropriate, to assess, test and otherwise assist with protecting our security environment; cybersecurity awareness training for our employees and further training for our incident response personnel and senior management; a cybersecurity incident response plan that includes procedures for assessing and coordinating our response to cybersecurity events; and a third-party risk management process for service providers, suppliers and vendors.

companyName: Avery Dennison Corp

ticker: AVY


text: Our Cyber Security team is made up of highly experienced professionals with an extensive background in information security and risk management, including disciplines such as security architecture, system security, identity and access management, communication and network security, security operations and software development security. This background includes experience across a variety of industries and various relevant degrees and certifications. The Cyber Security team is supported by managed service providers who bring diverse expertise in areas such as network security, data protection, and threat intelligence.

companyName: Enviva, LLC


text: Our Board understands the critical importance of managing evolving risks associated with cybersecurity threats. The Board has responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. Our CISO reports directly to the Chief Information Officer and is responsible for the operation of our Cybersecurity Program. Our CISO brings over 25 years of experience in information security, including more than 10 years as a Chief Information Security Officer in the retail industry. With a diverse background in both industry and consulting, our CISO has led major security programs, implementing practical strategies to protect critical data and systems.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: The Company manages cybersecurity risk as part of our overall enterprise risk management strategy, which is overseen by the Audit Committee and the Board. The Company employs robust cybersecurity and data privacy programs that are largely aligned to, among others, the U.S. National Institute of Standards and Technology Cybersecurity Framework to assess, identify and manage material risks from cybersecurity threats.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: We monitor risks through active (e.g., vulnerability scans) and passive (e.g., end-point protection) methods and addresses system alerts on a constant basis.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Chief Executive Officer. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: IDEANOMICS, INC.

ticker: IDEXQ


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For the years presented, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that had, or were reasonably likely to have, a material effect on the Company, including our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see "Operational Risks - Our business and operations could suffer in the event of cybersecurity breaches," in "Item 1A. Risk Factors" in this report.

companyName: UNIFI INC

ticker: UFI


text: Despite the Company's efforts, cyber attacks, unauthorized access, security breaches, ransomware, social engineering attacks or other cyber incidents could materially affect the Company and disrupt its business. Potential consequences of a successful cyber attack or cybersecurity incident could include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. While the Company is regularly exposed to such malicious threats, none of these threats, individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report.

companyName: LINDSAY CORP

ticker: LNN


text: Our CISO has over 13 years of experience overseeing cybersecurity strategy, risk management, cyber defense and regulatory compliance, including for a large casino and hospitality company and a large, nationwide health system. Additionally, our CISO holds the Certified Information Security Manager (CISM) credential. Our CISO is supported by a leadership team with over 75 years of combined experience and extensive expertise in cybersecurity, risk management, and compliance. Team members hold numerous globally recognized certifications, including Certified Information Systems Security Professional (CISSP) from ISC2 and Certified Information Systems Auditor (CISA) from ISACA, Security+ and Network+ from CompTIA, and Certified Ethical Hacker (C|EH) from EC-Council, among others.

companyName: Callaway Golf Co

ticker: CALY


text: Impact of risks from cybersecurity threat As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our operational and financial results. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: Vital Energy, Inc.

ticker: VTLE


text: The Audit Committee is primarily responsible for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: Blue Owl Technology Income Corp.


text: Our Trust and Security organization ("T&S") is responsible for implementing the ISP. T&S is led by our Chief Information Security Officer ("CISO"), John Heasman, who reports to our Chief Technology Officer ("CTO"), Chuck Geiger. T&S is made up of three sub-teams, each led by a director who reports to the CISO: • Information Security, which is responsible for implementing all aspects of the ISP and is structured around the following pillars: (i) Application Security, (ii) Infrastructure (Cloud) Security, (iii) Corporate IT Security, (iv) Security Operations, and (v) Governance and Risk Management. • Compliance and Privacy, which is responsible for assessing and preparing internal teams for regulatory compliance pertaining to information security, secured financial reporting, and privacy and is structured around the following pillars: (i) Privacy, (ii) Compliance, (iii) Vendor Risk Management, and (iv) Security Awareness. • Operations and Analytics, which is responsible for identifying and measuring consumer fraud and abuse of our customer-facing services, implementing manual and automated operations to ensure these are within acceptable bounds, and working with our product and engineering teams to design and implement longer term solutions.

companyName: CHEGG, INC

ticker: CHGG


text: Although we have experienced cybersecurity incidents in the past, none of these incidents to date have materially affected our business strategy, results of operations or financial condition. Despite our efforts, there can be no assurance that our risk management program will be effective in preventing cybersecurity incidents that could adversely affect our business strategy, results of operations or financial condition. For more information regarding risks from cybersecurity threats, please refer to the Risk Factors entitled "If our security measures are breached or unauthorized access to client data or funds is otherwise obtained, our solutions may be perceived as not being secure, clients may reduce the use of or stop using our solutions and we may incur significant liabilities." and "Any failure to protect our intellectual property rights could impair our ability to protect our proprietary technology and our brand." in Part I, Item 1A, Risk Factors.

companyName: Paylocity Holding Corp

ticker: PCTY


text: The IT Security Director has over 9 years of experience leading the Bank's IT Security program. The Director has a Bachelor of Science in Software Engineering and Computer Science from Radford University and is a member of the Association of Information Technology Professionals. His credentials include experience and competency with several different programming languages and a multitude of software.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: Access Control and Authentication: The IT department maintains strong access controls and multi-factor authentication to ensure that only authorized personnel have access to sensitive systems and data. This access is regularly reviewed and updated as needed based on job roles and responsibilities.

companyName: DallasNews Corp


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems.

companyName: BRAINSTORM CELL THERAPEUTICS INC.

ticker: BCLI


text: Our Incident Response Team has the primary responsibility of assessing and managing risks from cybersecurity threats and implementing the various stages of our IRP set forth above. The Incident Response Team is comprised of the following IT Systems management personnel and members of senior management: • Chief Information Officer ("CIO") – Our CIO has over 25 years of information technology experience across a wide range of industry sectors including life sciences, medical device, pharmaceutical, real estate and software development with responsibility in cybersecurity, data analytics and GenAI implementations for the last 10 years, and 20 years of business continuity planning and disaster recovery planning and execution. Our CIO has oversight of our cybersecurity strategy and building out our cybersecurity capabilities and infrastructure in response to the growing threat from potential cyber security incidents on our IT Systems. Our CIO is also responsible for the integration of our cybersecurity management into our overall enterprise risk management strategy; • Associate Director, Information Technology ("IT Security Director") – Our IT Security Director has approximately 20 years of relevant information technology experience including at least 15 years of hands-on experience working in various cybersecurity domains, including asset and network security and architecture, identity access management, disaster recovery and business continuity. Our IT Security Director's responsibilities include serving as the lead for cybersecurity under the direction of the CIO and maturing our cybersecurity program across all cybersecurity domains, including security and risk management. Our IT Security Director is a Certified Information Systems Security Professional and has an NACD CERT certificate in cybersecurity oversight; • Senior Vice President, Chief Legal Officer – Our Chief Legal Officer oversees our enterprise risk management strategy and serves as the executive management representative on our Incident Response Team; and • Vice President, Business Continuity & Sustainable Operations ("VP Business Continuity") – Our VP Business Continuity has responsibility for overseeing our Business Continuity Plan which incorporates our IRP. Our VP Business Continuity has over 15 years leading the business continuity programs for various companies and has training on ISO 22301 (the Business Continuity ISO Standard).

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: As part of our incident response planning, Westlake also maintains cross-functional response teams involving personnel outside of its cybersecurity organization, both globally and regionally, in order to be prepared to respond to an incident.

companyName: Westlake Chemical Partners LP

ticker: WLKP


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, have not materially affected and are not reasonably likely to materially impact our operations materially, including our business strategy, results of operations, or financial condition.

companyName: Canopy Growth Corp

ticker: CGC


text: During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors.

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: We routinely conduct risk assessments to identify cybersecurity threats and weaknesses, as well as risk assessments of events that could potentially materially change our business practices and affect our information systems that could be impacted by cybersecurity threats and vulnerabilities. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: QUALYS, INC.

ticker: QLYS


text: • External Threat Landscape Assessment. Our integrated privacy, legal, and security teams are continuously monitoring for any external threat that may impact our operations. Third-party threat intelligence feeds are leveraged to monitor Insulet's digital footprint and activity that may cause brand damage. • Insider Risk Detection. We have targeted tools aimed at detecting insider threats and suspicious data movement. • Cloud and Vulnerability Management. To enhance cloud and data security, we reduce the attack surface by establishing secure defaults, implementing least privilege, and monitoring configurations continuously. As part of vulnerability and overall security posture management, we have a focused cross-functional team that meets regularly to address issues identified by security scans and security configuration checks to maintain hygiene of Insulet's computing devices. • Testing and Audits. Regular penetration testing, incident response tabletop testing, and audits are performed by trusted third-party security consultants. These final reports and gap analysis documents are logged into our risk register as appropriate. • Operating Technology ("OT") Visibility. As a manufacturer of medical devices, OT is a vital component of our business operations. Interconnectedness between OT technology and other business critical IT infrastructure can create a material cyber risk. Insult deploys segmentation and OT-specific monitoring capabilities to mitigate and monitor this risk as our OT environment continues to expand to meet the needs of our business. • Vendor Management. Vendors and key partners are subject to Insulet's Vendor Risk assessment process and subsequently monitored by our threat intelligence capability, which tracks our key vendors and suppliers. • Training and Culture. Training, awareness, and incorporating security into Insulet's culture is key to reducing risk around common threats such as phishing. We have an operational information security training program for all employees. In addition to annual trainings, we have frequent "nanolearning" targeted trainings. These quick trainings encourage participation, provide constant reminders to our employees to be vigilant and give them the tools to recognize and protect against cyber threats. We also conduct phishing simulations to test effectiveness of our training program with the aim of reducing the percentage of employees who click on suspicious emails.

companyName: INSULET CORP

ticker: PODD


text: Our Technology and Operations Committee provides independent and integrated oversight over our information security program, physical security program, business continuity program, security policies and procedures, and security exceptions and violations. This committee is comprised of leadership representatives from our operational risk, information security, IT, and legal departments, as well as other departments that provide both specific, technical and multidisciplinary expertise to the committee. This committee is responsible for reviewing and approving our Information Security Policy. It also receives regular, prompt, and periodic information from the Information Security Department, which in turn provides periodic, regular and prompt reporting to the Technology Committee of the Board of Directors on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted us, as well risk assessment, management, and monitoring updates, as applicable or needed.

companyName: Federal Home Loan Bank of Des Moines


text: We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Power REIT

ticker: PW


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A.— Risk Factors —Risks Relating to Intellectual Property, Data Privacy and Cybersecurity—Hostile cyber intrusions, or other issues with our information technology, could severely impair our operations, lead to the disclosure of confidential information, damage our reputation and otherwise have a material adverse effect on our business of this Form 10-K.

companyName: Venture Global, Inc.

ticker: VG


text: Additionally, our team of dedicated cybersecurity experts/professionals maintain a comprehensive set of cybersecurity policies and standards, including a security incident response framework. The framework is a set of coordinated procedures and tasks that our incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the Board of Directors and Audit Committee are kept informed on the status of potential cybersecurity incidents. A summary of recent incidents is also presented by the Chief Law Officer ("CLO") at each regular Audit Committee meeting. Our policies and standards were developed in collaboration with a wide range of disciplines, including information technology, cybersecurity, legal, compliance and business. Our cybersecurity strategy and policies are continually reassessed to ensure they attempt to identify and proactively address the constant changes in the global threats. Decision makers such as the CLO, executive team, and Audit Committee are regularly kept up to date on cybersecurity trends. Ongoing collaboration with stakeholders throughout the business also helps to build continued awareness and visibility of future needs.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: Cybersecurity Insurance To help mitigate the financial risks associated with any cyber security incidents, Wyndham Hotels also maintains cyber insurance that is renewed annually and covers both cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: In addition, we engage independent third-party cybersecurity providers for testing and vulnerability detection. We regularly engage with these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and provide security awareness training and supplemental training as needed.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: Our management team, including the CSO, is responsible for assessing and managing our risks from cybersecurity threats. The CSO partners with the security, technical operations, legal, internal audit, engineering and product development teams to supervise both our cybersecurity program and our retained third-party cybersecurity consultants, and to stay informed on security at Okta, Inc. and the overall security landscape. Our current CSO brings over 20 years of cybersecurity and risk management experience to his work at Okta, Inc., having held numerous security leadership positions in highly-regulated industries such as finance. His experience delivering cybersecurity at scale extends internationally, and includes security and risk management roles at companies in Australia, the United Kingdom and the United States. The Okta, Inc. security team includes individuals with experience across a broad range of cybersecurity areas, including product security; cloud security; infrastructure security; security monitoring and incident response; identity and access management; vulnerability management; and governance, risk and compliance.

companyName: Okta, Inc.

ticker: OKTA


text: Our board of directors is responsible for overseeing our enterprise risk management activities in general, and each of the committees of our board of directors assists the board of directors in the role of risk oversight. The Audit Committee of the board of directors oversees our cybersecurity risk and receives reports from time to time from our CFO on cybersecurity risk management. Promptly after becoming aware of a material cybersecurity incident affecting our IT systems or data, the IT Director would work with management to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.

companyName: FutureFuel Corp.

ticker: FF


text: Education and Awareness We regularly remind employees of the importance of handling and protecting resident and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: Strategic Student & Senior Housing Trust, Inc.

ticker: STSR


text: The Audit Committee of our Board of Directors has overall responsibility for the oversight of cybersecurity risk. The Audit Committee receives updates, on at least a quarterly basis, from our Chief Information Officer (the "CIO") and our Chief Information Security Officer (the "CISO") regarding our enterprise-wide cybersecurity program, which may address a range of topics, including the health, efficacy and maturity of our cybersecurity programs, the results of various assessments periodically performed on our IT environment, emerging threats and trends and cybersecurity events.

companyName: Post Holdings, Inc.

ticker: POST


text: Role of the Board of Directors Our Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately. In that regard, our Board is actively engaged in the oversight of our cyber risk profile, which includes risks from cybersecurity threats, enterprise cyber strategy, and key cyber initiatives. Our Board regularly receives reports on such matters from our Chief Information Officer, Chief Information Security Officer, and other relevant personnel. Our Board also meets with our internal and external auditors, and federal and state regulators to review and discuss reports on risk, examination, and regulatory compliance matters.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President ("SVP"), Head of Finance and Investor Relations, Chief Legal Officer, internal security staff and external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management processes. Our internal audit program executes a comprehensive and layered auditing approach including people, processes and technology in order to evaluate the effectiveness of existing controls and ensure that cybersecurity risk has been adequately mitigated within our institution. Periodic phishing tests, network and application security reviews, third-party vulnerability assessments and penetration testing are used to gauge the overall effectiveness of our cybersecurity defenses. The audit program and cybersecurity defense evaluations are key parts of our overall risk management processes.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: • Our CISO oversees the information security group and program within our IT department with over 25 years of experience, including similar roles at other financial services companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Our CTO oversees our IT department and has served in various roles in information technology for over 29 years, including senior leadership roles at another financial services company. • Our Head of IT Infrastructure oversees the infrastructure and service desk within our IT department and has served in various roles in information technology for over 21 years.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Risk Management and Strategy Ryan Specialty's processes for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management program, which is overseen by the Audit Committee of the Board (the "Audit Committee"). The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically. We have established comprehensive cybersecurity policies, standards, processes, practices, and controls to mitigate the risk of cyber threats, and we continually invest in prevention and detection technology and employee training to enhance our cybersecurity posture. Our cybersecurity risk management program leverages and strives to align with the U.S. National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond, and recover.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: Our SVP of Group Operations and our Cybersecurity Steering Committee, which includes a cross-functional leadership team, are primarily responsible for assessing and managing our material risks from cybersecurity threats. As part of our risk identification, assessment, and mitigation activities, we leverage the experience of our external cybersecurity advisor/consultant (CISSP, CISA, CISM, CRISC, QSA) who has extensive cybersecurity expertise across various industries. Our SVP of Group Operations, who manages our cybersecurity program, has over 25 years of experience in the Life-Sciences IT space, with over 8 years in IT security and cybersecurity functions.

companyName: IGM Biosciences, Inc.


text: Our overall cybersecurity program includes: security tools, technologies and processes, control reviews and penetration tests; cybersecurity awareness training exercises for our employees, including phishing simulations to raise internal awareness of manipulated electronic communications; and an annual review of System and Organization reports for critical third-party service providers.

companyName: ASCENT INDUSTRIES CO.

ticker: ACNT


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: Our cybersecurity approach is designed to minimize risks from cybersecurity threats identified by internal stakeholders, threat intelligence providers, vulnerability management programs, and security management programs. Our internal team manages and maintains remediation strategies for identified risks, and reports on them periodically to senior leadership. We also require our employees to participate in monthly cybersecurity awareness trainings, which include phishing awareness simulations, to raise employee awareness of cybersecurity risks.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: of Consultants and Advisors engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with protection and monitoring of our systems and information, including with respect to protection of our e-mail, system access, network monitoring, endpoint protection, vulnerability assessments and penetration testing. We engage cybersecurity consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as a third party consulting firm to perform tabletop exercises and evaluate our cyber processes including an assessment of our incident response procedures.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: The Audit Committee, comprised entirely of independent directors, reviews and discusses with management our guidelines, policies and practices regarding risk assessment and risk management as they relate to our financial condition, and oversees our financial risk exposures, including planning regarding business continuity and cybersecurity. In addition, the Audit Committee oversees our annual enterprise business risk assessment, which includes the review of cybersecurity risks we face and our associated risk mitigation measures, and receives semi-annual reports from management on cybersecurity matters, including areas such as threat intelligence, major cybersecurity risk areas, regulations and cybersecurity incidents. In addition, management updates the Audit Committee, as necessary, regarding significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: As of December 31, 2023, no risk from cybersecurity threats, including as a result of any previous cybersecurity incident, has materially affected our business, results of operations or financial condition. Although we have implemented controls to protect our data and information systems and monitor our systems on an ongoing basis, such efforts may not prevent material compromises to our information systems in the future, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with external advisors regarding opportunities and enhancements to strengthen our policies and procedures.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating prospective acquisition candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Target Global Acquisition I Corp.

ticker: TGAAF


text: Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats, and is a component of our overall enterprise risk program. We deploy multiple strategies and dedicate significant resources toward systems designed to identify, assess, manage, mitigate and respond to cybersecurity threats. We also consistently strive to improve the detection and response capabilities of our cybersecurity program. To do this, we monitor best practices across the cybersecurity space and endeavor to incorporate those in our own cybersecurity program.

companyName: POOL CORP

ticker: POOL


text: The third line of defense is independent Internal Audit, led by our Head of Internal Audit, who is responsible for ensuring that the first and second lines of defense are both designed and operationally effective in mitigating cybersecurity risk through internal audits of including but not limited to: cybersecurity, electronic banking, GLBA/Privacy, information security, information technology, and vendor risk management. The Head of Internal Audit is independent of management and reports to the Board Audit Committee Chair.

companyName: Capital Bancorp Inc

ticker: CBNK


text: We routinely assess our systems and processes for modifications in advance of evolving state privacy regulations and other applicable industry standards and regularly update our privacy and information security policies to remain current with industry practices. We are continually adapting to the ever-changing cyber risk landscape and have a team of information security professionals committed to maintaining the highest levels of systems and data security. The Company itself conducts, and has engaged external information security firms to conduct, assessments, including penetration tests, to continually improve security controls and ensure security controls. We continue to expand and grow our security team and their skillsets and make regular enhancements to our cybersecurity risk management goals.

companyName: VOXX International Corp


text: Risk Response: We have developed various playbooks that comprise a comprehensive written incident response plan (collectively, our IRP). This IRP describes the procedures for handling a variety of cybersecurity incidents; categorizes the types of potential cybersecurity incidents and the timeframe for reporting each; establishes cybersecurity incident response levels; provides for the conducting of legally privileged investigations to enable us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident, including but not limited to, the process to escalate risks to our Board, Audit Committee and our executive management, as necessary. Incidents with respect to third parties are managed internally using the same basic processes as managing internal cybersecurity incidents.

companyName: Vertiv Holdings Co

ticker: VRT


text: Our cybersecurity risk management and strategy processes are led by our CSO. This individual has over 25 years of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments.

companyName: Digital Media Solutions, Inc.


text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address risks from cybersecurity threats. Our information security management program seeks to follow processes set forth in recognized industry standards, and we evaluate and evolve our security measures as appropriate. We maintain a cybersecurity incident response plan that we periodically practice and update as needed. The identification, assessment and management of cybersecurity risk is integrated into our overall enterprise risk management program that is ultimately overseen by the Board.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes.

companyName: Gogo Inc.

ticker: GOGO


text: Financial reports (10-Q and 10-K) will include disclosure of cybersecurity risks, governance, and any material incidents. The cybersecurity disclosures are reviewed and approved by the Cybersecurity Committee, Audit Committee, the officers of the Wind-Down Entity, and the Liquidation Trustee as part of the overall approval of all applicable 8-K, 10-Q and 10-K filings.

companyName: Woodbridge Liquidation Trust

ticker: WBQNL


text: We have implemented a cybersecurity risk management program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework and International Organization for Standardization 27001 Framework.

companyName: Septerna, Inc.

ticker: SEPN


text: We conduct a Testing, Training & Exercise program to test, sustain and refine our ability to respond to cybersecurity incidents in accordance with the best practices. We also maintain an information security training program for our employees.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: The CIO is the management position with primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. The CIO has deep experience in information systems and technology, including developing information and cybersecurity programs, roll-outs of new technology, information security audit and assessments, and cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CIO has experience overseeing and executing technology strategies in complex, global, and matrixed environments. The CIO joined the Company in 2020, bringing over 15 years of experience leading IT strategy and change initiatives in the consumer packaged goods industry, and reports directly to our interim CEO.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our cybersecurity risks.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Our information security team promptly informs our Incident Response Team of potentially material cybersecurity incidents, including with respect to our third-party service providers. The Chief Information Officer briefs our Co-Chief Executive Officers and reports to the Audit Committee. The Audit Committee, in turn and if appropriate, briefs the Board on, among other matters, our cyber risks and threats, the status of projects to strengthen our information security systems (such as employee cybersecurity training), an assessment of the information security program, and the emerging threat landscape. The Cybersecurity and Compliance Steering Committee, comprised of senior members of management, convenes on a quarterly basis to review all matters related to strengthening our cybersecurity posture and providing governance.

companyName: Monster Beverage Corp

ticker: MNST


text: The information security team undertakes or engages in the following practices and activities, among others, as part of the Company's risk management system: • updating of software and hardware (including firmware) for vulnerabilities and required patches; • regular employee training and education to identify and avoid cybersecurity risks and threats at each level of the organization; • developing, implementing and testing incident response and information recovery plans to assess and respond to cybersecurity threats and incidents; • collaborating with our internal audit function and other internal teams for the testing of cybersecurity controls and procedures; • identifying and managing cybersecurity risks presented by third parties, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to the Company's systems and data; as well as the systems of third parties that could adversely impact our operations or business in the event of a cybersecurity incident affecting those third-party systems; • overseeing threat intelligence systems and notification procedures; and • maintaining technology solutions for cybersecurity prevention and defense, including outside firewalls, multifactor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy strategy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: Currently, we are not aware of any risks from cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: Our SVP Security has a strong background in engineering with over 30 years' of industry experience in technology and security, and previously operated one of the world's largest retail websites instituting and undergoing PCI and HIPPA certifications.

companyName: PubMatic, Inc.

ticker: PUBM


text: Internal IT Management has the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), GIAC/SANS Certified Forensic Examiner, Magnet Certified Forensic Examiner, BBA Information Technology Emphasis Security, and CompTIA Security+.

companyName: BADGER METER INC

ticker: BMI


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board and members of management. Risk assessment is integral to all engineering, business and operational decisions and in addition to the annual reviews, is an ongoing effort, as circumstances and facts arise.

companyName: authID Inc.

ticker: AUID


text: We have also created, and tested through incident response drills, the Freshpet Incident Response Plan and Playbook, which together set forth policy-level directives as well as specific guidelines for implementation, that describe our process for responding in the event of certain defined cyber incidents. These protocols (i) define the roles and responsibilities of participants, relationships to other Company policies and procedures, and reporting requirements needed during an incident, (ii) provide a framework by which our Incident Response Team ("IRT") shall determine the scope and risk of an incident, respond appropriately to that incident, and inform the Board and others depending upon the nature and severity of the incident, and (iii) reduce the likelihood of a similar incident from reoccurring following identification of such an incident.

companyName: Freshpet, Inc.

ticker: FRPT


text: Our cybersecurity risk management program encompasses such items as simulations and tabletop exercises with management's participation and incorporates external resources and advisors as necessary. All employees undergo security awareness training, with regular testing through simulated phishing emails. Certain employee positions require additional role-based, specialized security awareness or other cybersecurity training, as applicable. We maintain a security operations center, which is staffed 24/7, to strengthen our monitoring and alerting efforts. Regular simulations, drills and assessments are conducted to test our defenses from both a technical and an operational perspective.

companyName: MASTEC INC

ticker: MTZ


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" Risks."

companyName: INTELLINETICS, INC.

ticker: INLX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms including outside legal counsel, cybersecurity consultants, threat intelligence service providers, managed cybersecurity service providers and forensic investigators.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: We maintain business continuity and disaster recovery plans to prepare for and respond to the potential for a disruption in the technology we rely on.

companyName: Digital Media Solutions, Inc.


text: We maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer and Global Head of Cybersecurity, to manage the risk mitigation process.

companyName: COHERENT CORP.

ticker: COHR


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention material, which educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Our information technology team is responsible for identifying and managing any cybersecurity threats that occur with our vendors and suppliers. The team communicates with our suppliers and vendors and relies on them to apprise Holley of any cybersecurity issues.

companyName: Holley Inc.

ticker: HLLY


text: deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and systems if necessary, the use of third-party security experts if and when an incident is detected are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.

companyName: VIVIC CORP.

ticker: VIVC


text: Chief Executive Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: Our cybersecurity risk management is integrated into our overall risk management system through our internal business risk management process. Our business risk management group works closely with our ICSP group to regularly assess and identify possible material risks from cybersecurity threats, including but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported to our Executive Risk Committee on a quarterly basis. The Executive Risk Committee, which is comprised of our executive officers, meets quarterly to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented. During these meetings, the Executive Risk Committee reviews significant and emerging risks, including cybersecurity risks, and assesses the Company's plans to mitigate or otherwise manage and monitor those risks.

companyName: Otter Tail Corp

ticker: OTTR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO and members of our legal and cybersecurity teams. Our CTO has more than three decades of experience working in technology for global companies in the technology, retail, and food services industries and has served in senior management at another public food service company.

companyName: Sweetgreen, Inc.

ticker: SG


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at Formula 1. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.

companyName: Liberty Media Corp

ticker: FWONA


text: The CISO, who reports to the Chief Technology Officer ("CTO"), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process. The Chief Information Officer ("CIO"), who also reports to the CTO, focuses on our technology modernization priorities, integrating innovative technology solutions to support our business goals, and leading enterprise-wide IT transformation initiatives. Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company's global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees.

companyName: HERSHEY CO

ticker: HSY


text: In the event of a cybersecurity incident, we have an incident response plan which sets forth a framework to report and document such incidents to our cybersecurity incident response team. This framework aims to enable the response team to take actions to monitor, mitigate and remediate such incidents in a timely manner. Cybersecurity incidents are regularly reported to the CIO and CISO and certain critical events are reported to the CEO and the crisis management team comprised of senior executives. We also have protocols in place by which certain cybersecurity incidents are reported to the Board of Directors as part of their oversight of cybersecurity matters.

companyName: FLUOR CORP

ticker: FLR


text: Cybersecurity risk management and its governance are integrated into J.P. Morgan's operational risk management framework, including through the escalation of key risk and control issues to our Company's management team and our board of directors. In addition, the Adviser works with J.P. Morgan to assess and challenge activities and risk management practices relating to the identification, assessment, measurement and mitigation of cybersecurity risk.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Our IT executives report on our cybersecurity practices and risks at each meeting of the Audit Committee of our Board of Directors. In addition, our IT executives provide periodic updates on cybersecurity risks to our management at regularly held executive committee meetings.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: As of the date of this report, no cybersecurity or data security incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the comprehensive approach we take to information security, there can be no assurance that our security efforts and measures, and those of our third-party service providers, will prevent or mitigate all incidents that could have a material adverse effect on our business, financial condition or results of operations. For additional information regarding the risks to us associated with cybersecurity incidents, see Item 1A entitled "Risk Factors."

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: We rely on third-party service providers to help manage our information systems, including network security service providers with experienced information technology professionals. We also work with third parties to identify, assess, and manage actual and perceived cybersecurity threats and risks, and we evaluate cybersecurity risk as part of our overall risk management strategy. With the assistance of these third-party service providers, we implement and maintain various technical, physical, and administrative controls and processes to manage and mitigate material risks from cybersecurity threats to our information systems. This includes procedures for incident detection and response, network security controls, access controls, physical security, systems monitoring, and backup and recovery procedures.

companyName: MAYS J W INC

ticker: MAYS


text: Security Awareness and Training – Littelfuse has an IT security awareness program consisting of training on the fundamentals of information security protection. These training courses are provided annually.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Historically, risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations or financial condition. As previously reported, in November 2023, the Company initiated its cyber response protocol in response to a cybersecurity incident that resulted in a disruption of portions of its information technology systems. Promptly after detecting the issue and per LivaNova's cyber response protocol, the Company began an investigation with assistance from external cybersecurity consultants and coordinated with law enforcement. The Company continues to assess what information was impacted and to implement remediation measures to mitigate the impact of the incident.. While the Company has taken and will continue to take actions to enhance its information security framework, LivaNova cannot determine at this time the extent of the impact from this event on its business, results of operations, cash flows, or financial condition. For further information, please refer to "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Report. Additionally, for a description of the Company's evaluation of its disclosure controls and procedures, management's report on internal control over financial reporting and changes in internal control over financial reporting, see "Item 9A. Controls and Procedures."

companyName: LivaNova PLC

ticker: LIVN


text: We have implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that we store or process and the maintenance of critical services and systems. Our cybersecurity program is managed by our Chief Technology Officer and Head of Technology Infrastructure (together, "IT Management"), who report to our Chief Operating Officer. IT Management and its team are responsible for implementing our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and our policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Our processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with our physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to our devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: We have an Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the enterprise cybersecurity program. The Enterprise Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. This MRG meets regularly with our Chief Information Security Officer to review the enterprise cybersecurity program and related risks. The MRG receives updates on the status of key cybersecurity initiatives and is responsible for our response to material cybersecurity incidents. For material cybersecurity incidents, our process is to escalate through the MRG to the Audit Committee and Board.

companyName: CUMMINS INC

ticker: CMI


text: Our Senior Director leads our internal team responsible for assessing and managing cybersecurity risks. The Senior Director has approximately 10 years of experience being responsible for cybersecurity at multi-site industrial companies, in addition to IT infrastructure and strategy, and has earned the Global Information Assurance Certification ("GIAC") Defensible Security Architecture, Security Leadership and Strategic Planning, Policy and Leadership certifications, respectively. The Senior Director reports directly to the General Counsel and regularly engages with and briefs other members of senior and executive management on cybersecurity issues. A number of IT professionals with experience implementing cybersecurity defenses and responding to cyber attacks report to the Senior Director and, as noted above, the Senior Director also oversees third-party firms specializing in security monitoring and vulnerability assessment.

companyName: Coeur Mining, Inc.

ticker: CDE


text: Our CISO has over 18 years of experience leading cybersecurity oversight for several companies and is updated on cyber events related to the monitoring, prevention, detection, mitigation, and remediation efforts from our IT security team. The IT security team have broad cybersecurity expertise or industry certifications and are knowledgeable in the use of cybersecurity tools and software. In addition, third-party cybersecurity services are used to augment our in-house capabilities, as needed.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: Cyber partners are a key part of SLB's cybersecurity infrastructure. SLB partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. SLB engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in SLB's environment as well as, if necessary, assist in responding to cyber attacks.

companyName: SLB LIMITED/NV

ticker: SLB


text: Our management recognizes the critical importance of addressing cybersecurity threats and risks to our business and operations. Therefore, we have established a comprehensive framework to assess, respond to, and manage material risks arising from cybersecurity threats.

companyName: ARBOR REALTY TRUST INC

ticker: ABR


text: Regular risk assessments evaluate cybersecurity and technology threats, employing a widely adopted risk management model to prioritize risks and develop corresponding security controls. Our information security program undergoes regular reviews, audits, tests, and exercises to ensure effectiveness and enhance security measures.

companyName: Skillsoft Corp.

ticker: SKIL


text: The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, employee and customer data. Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. Our team maintains processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management approach. Our team regularly reviews significant risks to our Company, including significant cybersecurity risks and the potential for future cybersecurity incidences. Through these reviews, we discuss the identified risks, describe the likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team, continuously monitoring and identifying potential threats with the ability to take immediate mitigation actions when required. In addition to these services we conduct periodic network penetration tests conducted by an independent third party.

companyName: CARRIAGE SERVICES INC

ticker: CSV


text: Our cybersecurity program is designed to address and minimize the risks posed by evolving threats. However, no system can completely eliminate the possibility of a significant cybersecurity incident. Therefore, we continuously assess and enhance our cybersecurity measures to adapt to the changing threat landscape and ensure organizational resilience. For more information about the potential impact of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: HEICO CORP

ticker: HEI


text: Our incident response plan outlines our approach to preparing for, detecting, responding to, and recovering from cybersecurity incidents, including severity assessment, containment, investigation, and remediation processes.

companyName: ARTIVION, INC.

ticker: AORT


text: NTIC maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. NTIC takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect its operations, finances, legal or regulatory compliance, or reputation. The scope of NTIC's evaluation encompasses risks that may be associated with both its internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and employee training, education, and awareness initiatives.

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: Our Audit Committee of our Board of Directors, or the Audit Committee, provides direct cybersecurity risk oversight, and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management and the Cybersecurity Board, as discussed in further detail below, regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity risks, threats or incidents. We also provide updates to the full Board of Directors regarding cybersecurity risks, threat landscape and risks, as appropriate.

companyName: ARVINAS, INC.

ticker: ARVN


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with an incident response plan. This plan includes actions to mitigate the impact of any current cybersecurity incidents and long-term strategies for remediation and prevention of future incidents.

companyName: WORKIVA INC

ticker: WK


text: Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have developed the following processes as part of our strategy for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Biostax Corp.


text: The Company faces a variety of cybersecurity threats that could impact its business, financial condition, results of operations, cash flows or reputation. The Company has established a Cybersecurity Incident Response Team (the "CIRT") to develop and continually enhance a cyber incident response plan, which guides the Company in identification, containment, eradication and recovery from cybersecurity incidents. The CIRT is led by the Company's Director of Information Technology (the "Director of IT"), who reports to the Company's Chief Financial Officer. The Director of IT has a formal education in Computer Information Systems and is a Microsoft Certified Information Systems Professional with 28 years of experience. The Director of IT has comprehensive experience in cybersecurity controls, including intrusion detection, network security, operating systems, incident response and a track record of identifying cyber risks and implementing countermeasures to mitigate cyber attacks.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: Our CIO is responsible for our Information Security Program and our information security leaders report directly to our CIO. In order to maintain a separate reporting line for our information security leaders, we also maintain a standing committee, the Information Security Governance Committee, which consists of certain members of executive management and the information security leaders. Our Information Security Governance Committee allows for direct management reporting for IT Risk management, audit/examination report(s) review, and oversight of our IT Security strategy and daily Security Operations.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Risk Management and Strategy Incident Response Lifecycle - Assessing and Responding to Cyber Incidents Our IRP sets forth the Company's process for assessing cyber threats. The IRP serves as the incident response plan to effectively manage, mitigate, and contain the risk of a security incident or data breach and it applies to all ContextLogic personnel, including employees, contractors, consultants, and any other individuals acting for or on behalf of the Company. The IRP incident response lifecycle is comprised of four phases: (1) Preparation, (2) Detection and Analysis, (3) Incident Response, Investigation, and Notification, and (4) Post-Incident Analysis and Lessons Learned.

companyName: ContextLogic Inc.


text: To date, the Company is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, business strategy, results of operations or financial condition. For additional information, see "Item 1A—Risk Factors—Risks Related to Our Business—Cyber-attacks and other security breaches could have an adverse effect on our business" and "Item 1A—Risk Factors—Risks Related to Our Business—Disruptions in the operation of our computer systems and third-party data centers could have an adverse effect on our business."

companyName: Open Lending Corp

ticker: LPRO


text: As the Company has no operations and no employees, we have no operating procedures related to cybersecurity. We do design and monitor reasonable technical safeguards to minimize any identified risks with our financial reporting. management strategy also considers cybersecurity risks associated with the use of our third-party vendors and service providers.

companyName: NovelStem International Corp.

ticker: NSTM