text: We use third-party service providers to perform a variety of functions throughout our business, such as electronic communications service providers, cloud-based file storage service providers, and contract research organizations ("CROs").

companyName: Longboard Pharmaceuticals, Inc.


text: o Legal Oversight: Management and the Board ensure we have appropriate legal counsel to address cybersecurity-related issues, including incident notification requirements.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS

secItem: Item 1C


text: Our cybersecurity and IT teams prepare for and respond to cybersecurity attacks and incidents, including defending against unauthorized access to our systems, and crafting response plans intended to significantly reduce impacts on operations and customers. We understand that cyber threats are unwavering and evolving in this digital age, and because of that we continue to increase investments in people and technology to help us mature our practices and maintain confidence in our ability to safeguard our assets. While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A. Risk Factors.

companyName: WAFD INC

ticker: WAFD


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization.

companyName: DIH HOLDING US, INC.


text: g. Conducting annual cybersecurity and insider threat training for all employees. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to provide a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: The Board has overall responsibility for the oversight of risk management and has delegated oversight of cybersecurity risk management to the Audit Committee. The Company's CIO and CISO regularly report to the Audit Committee on cybersecurity risks, updates on key initiatives, and progress toward the Company's objectives. In addition, the CIO provides updates to the Board, at least annually, on the Company's broader IT strategy and key initiatives.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: Based upon results of the foregoing, we deploy a wide variety of technical safeguards that are designed to protect our information systems from cybersecurity threats, including advanced endpoint detection and response, next-generation firewalls with intrusion detection systems, access and credential controls, and multifactor authentication. We have also developed, implemented, and maintain a cyber incident response plan, which is periodically reviewed and updated and includes procedures for addressing and recovering from cyber incidents while reducing the impact on the business and operations. This plan provides a framework for identifying, controlling, and mitigating the attack while reducing the recovery time and keeping the executive management team and Audit Committee of our Board of Directors informed.

companyName: HURCO COMPANIES INC

ticker: HURC


text: As part of engaging a new third party provider, we assess their security standards, require security terms and conditions and work with risk management to ensure insurance coverage is adequate for the exposure risk. Service providers and vendors must adhere to security requirements such as security incident or data breach notification and response protocols, appropriate data encryption requirements, and data disposal. Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident. In addition, we leverage third party consultants to perform penetration (PEN) studies. These independent third party assessments provide valuable insight to enhance our cybersecurity posture.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have such a material effect.

companyName: NEXTNAV INC.

ticker: NN


text: Cybersecurity threats, have not materially affected, and are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition while its operations are suspended. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact us by causing a disruption to our operations, if any, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business, if any, and results of operations. There can be no assurance that the Company's third-party vendors' and service providers' cybersecurity risk management processes, including its their policies, controls or procedures, will be fully implemented, complied with or effective in protecting the Company's systems and information.

companyName: Polomar Health Services, Inc.

ticker: PMHS


text: Despite our commitment to cybersecurity, no system can fully eliminate technology risks. As of now, we are unaware of any cybersecurity incidents that have had, or are reasonably likely to have, a material impact on our business or operations. However, the increasing volume and sophistication of cyberattacks—including data breaches, ransomware, and similar threats—pose ongoing risks. Incidents that occur could result in reputational, competitive, operational, or financial harm, as well as regulatory consequences. For a more detailed discussion of how cybersecurity threats may affect our business strategy, operations, or financial condition, see Item 1A, "Risk Factors," which is incorporated by reference into Item 1C.

companyName: ALT5 Sigma Corp

ticker: ALTS


text: Our information security team and members of IT monitor the effectiveness of preventative measures, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, external consultants, and reports produced by security tools we have deployed in our IT environment.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: We recognize the importance of maintaining the integrity of our information systems and safeguarding the confidential business and personal information we receive and store about our residents, prospective residents, employees and suppliers. As such, we have implemented a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ what we believe are industry best practices, including monitoring and analysis of the threat environment, vulnerability assessments and third-party cybersecurity risks; detecting and responding to cyber attacks, cybersecurity incidents and data breaches; cybersecurity crisis preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Key processes in our program include: • regular cybersecurity training and testing for employees with company email and access to connected devices; • continuous security event monitoring, management and incident response; • regular testing of incident response procedures; • regular internal reporting; • regular consulting with external advisors and specialists regarding opportunities and enhancements to strengthen our cyber practices and policies and enhance our cybersecurity maturity; • independent third-party testing of our information technology controls and defenses, including penetration tests; • independent third-party audits of our cybersecurity controls; and • annual independent third-party reviews of program maturity based on the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: Mid-America Apartments, L.P.


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on the Advisor and the Firms information security team, the CCO relies on the cybersecurity expertise of the Advisor's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over 8 years of experience as a technology and information security leader. The CISO has served as the Advisor's CISO since 2023. Prior to this role, the CISO was the Deputy CISO for 3 years. The CCO has been responsible for this oversight function as CCO to the Fund for 6 years, and has worked in the financial services industry for over 30 years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: The Adviser has a dedicated cybersecurity team, led by its Vice President, IT Security, who works closely with the Adviser's Information Security Steering Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. The Adviser 's Information Security Steering Committee includes its Chief Information Officer, Chief Risk Officer, and General Counsel.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: Governance; Board Oversight The Audit Committee of our Board provides direct oversight over cyber security risk and provides updates to the Board of Directors regarding such oversight, when and if appropriate. Management provides periodic updates to the Audit Committee regarding cyber security matters including significant new cyber security threats or incidents, when and if appropriate.

companyName: TOMI Environmental Solutions, Inc.

ticker: TOMZ


text: Risk Management & Strategy Perficient proactively manages its cybersecurity and data privacy risks with organizational and technical controls including a comprehensive set of policies, procedures, required annual and role-based training, cybersecurity insurance, security assessments for vendors with access to Perficient and/or Perficient client networks, and use of technology such as Multi-Factor Authentication (the "Program"). Perficient regularly tests and validates its Program using internal resources, external auditors, and rigorous industry certifications. After maintaining a Systems and Organization Controls 2 (SOC2) certification, Perficient achieved its global ISO 27001:2022 certification, an international standard for information security management systems, in October 2023.

companyName: PERFICIENT INC


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to critical systems integral to our exploration, development and production activities as well as the activities of our business partners and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • ongoing cybersecurity awareness and compliance training that occurs quarterly and is mandatory for all our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: HESS CORP


text: The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Cybersecurity Sub-Committee of the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.

companyName: NN INC

ticker: NNBR


text: We believe cybersecurity is critical to advancing our business securely. We face a multitude of cybersecurity threats, and may experience cyber incidents in the normal course of business. Such cybersecurity threats could have a material adverse effect on our business, financial condition, operations, results of operations, performance, cash flows or reputation. Our service providers (including the transfer agent), and other business contacts may face similar cybersecurity threats, and a cybersecurity incident impacting these persons or entities could materially adversely affect our operations, performance and results of operations.

companyName: Arogo Capital Acquisition Corp.


text: Consideration of Cybersecurity Risks in Business Strategy, Financial Planning, and Capital Allocation Cybersecurity risks are considered as part of our business strategy, financial planning, and capital allocation. We regularly review and update our cybersecurity posture to address emerging threats and ensure the protection of our information systems.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: Although we maintain a robust cybersecurity program, due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we are not aware of having experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. To mitigate against such risks, the company carries information security risk insurance that provides protection against potential losses arising from a cybersecurity incident. Refer to Item 1A. "Risk Factors" for additional information related to cybersecurity risks and the impact they may have on our operations.

companyName: MAGNITE, INC.

ticker: MGNI


text: The RFC is the board committee that oversees our cybersecurity risk management. Our CISO makes quarterly reports to the RFC about material cybersecurity risks, updates to the cybersecurity program, metrics that evaluate the effectiveness of the cybersecurity program, material cybersecurity incidents and remediation plans. The RFC also receives timely reports from the CISO when there are significant cybersecurity incidents or updates to the cybersecurity risk assessment. The board of directors also takes an active role in overseeing cybersecurity risk, including receiving an annual report from the CISO that provides an overview of the status and effectiveness of our cybersecurity risk management program and participating in cybersecurity incident response tabletop exercises.

companyName: Unum Group

ticker: UNM


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the enterprise has the ability to notify and update the Board of Directors in the event of a possible crisis situation.

companyName: XCEL ENERGY INC

ticker: XEL


text: The Company's cybersecurity strategy is enabled by people, processes, and technology that provide multilayered defenses including advanced capabilities for early and rapid cyber threat identification, detection, protection, response, and recovery. The Company employs a team of dedicated, skilled talent to operationalize the cybersecurity strategy. The internal team is supported by arrangements with a third party to provide continuous endpoint monitoring and incident response.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: For additional information related to the risks associated with cybersecurity threats, refer to the Information Security, Cybersecurity and Data Privacy Risks section of Item 1A. Risk Factors.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats. a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section.

companyName: Titan Environmental Solutions Inc.

ticker: TESI


text: Our cybersecurity program is also supported by a cross-functional leadership team that contributes to our information security and privacy programs and practices, as well as identifies and mitigates security and privacy risks. This team includes our CIO and our Chief Legal Counsel. This team contributes to the development of our cybersecurity strategy and is periodically updated regarding evolving cybersecurity risks and the in-place responsive actions. This team is also informed about the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan.

companyName: Workday, Inc.

ticker: WDAY


text: We have a cybersecurity training program designed to educate and train employees on how to identify and report cybersecurity threats, which includes regular phishing exercises and recurring cybersecurity awareness training to all our associates and third parties who have access to Company email and networks. Training programs are conducted on a periodic basis and are focused on giving employees awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. Specialized training is also offered to employees in sensitive roles.

companyName: Hillenbrand, Inc.

ticker: HI


text: While we have not experienced a cybersecurity incident that has had a material impact to date, the threat of potential incidents remains high. We continually evaluate our exposure to risks such as: Operational disruption from ransomware or other cyberattacks. Data breaches that could compromise customer or proprietary information. Regulatory and legal exposure arising from cybersecurity failures.

companyName: cbdMD, Inc.

ticker: YCBD


text: As SandRidge has increasingly relied on information technology systems and networks in connection with our business activities, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: IBM's Enterprise & Technology Security ("E&TS") organization has oversight responsibility for the security of both IBM's internal systems and external offerings and works across all of the organizations within the company to protect IBM, its brand, and its clients against cybersecurity risks. E&TS also addresses cybersecurity risks associated with third party suppliers. For these purposes, E&TS includes a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes for IBM's internal systems. The CISO manages the CSIRT. The CISO also manages the Product Security Incident Response Team ("PSIRT"), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers. IBM also has Business Information Security Officers ("BISO") who are coordinated by the Office of the CISO on security issues specific to particular business segments.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Our Director of Information Security has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Operations Officer provides monthly reports to our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually.

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: We have established controls and procedures to escalate enterprise-level issues, including cybersecurity matters, to the appropriate management levels within our organization and our Board of Directors, or members or committees thereof, as appropriate. Our Board of Directors provides oversight of our enterprise risk management, including our approach to managing cybersecurity risk, and has delegated responsibility for review of information security risks to its Audit Committee. The Audit Committee regularly reviews information security risks and receives reports from our Chief Information Officer and other members of the Company's management regarding those risks. Our cybersecurity program is managed by a dedicated Chief Information Officer whose global team, including the Vice President, Information Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our Chief Information Officer has over 29 years of relevant industry experience, including 18 years with Merit. Our Vice President, Information Security, functions as our senior information security officer and has over 18 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as Certified Information Systems Security Professional.

companyName: MERIT MEDICAL SYSTEMS INC

ticker: MMSI


text: Our CEO and CFO, along with our Legal, Quality Assurance (QA), and IT (Information Technology) departments help identify, assess and manage the Company's cybersecurity threats and risks. The IT department works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, internal and external audits, and utilizing trusted third parties to conduct vulnerability assessments to identify vulnerabilities.

companyName: CHIMERIX INC


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board has been delegated specific risk oversight responsibilities related to cybersecurity and data protection. The Audit Committee receives regular updates from the CIO or CISO regarding the Company's material risks from cybersecurity threats, cybersecurity defense and detection capabilities, incident response plans and employee training activities.

companyName: AVIENT CORP

ticker: AVNT


text: For data and information that is maintained for us outside our network, we conduct security and privacy assessments of vendors who hold sensitive data and manage critical platforms. We maintain written agreements that govern third-party access to our network and protection of our information, and we conduct annual reviews of appropriate access. We require our suppliers to agree to our Supplier Code of Conduct which includes cybersecurity requirements. We include the assessment of cybersecurity risk as part of our overall enterprise risk management strategy.

companyName: STEELCASE INC


text: The Program is evaluated on an ongoing basis to address the evolving cyber threat landscape and to comply with applicable legal and regulatory obligations. See "Business—Regulation—U.S. Regulation—Privacy, Data Protection and Cybersecurity" for further discussion. Control adequacy and design are reviewed periodically, and periodic audits assist in identifying areas for continued focus, improvement and/or inclusion, and are designed to provide assurance that controls are appropriately designed and operating effectively. Additionally, our Internal Audit group performs testing of Corebridge's control environment, including the Program.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: We maintain a cybersecurity and information protection program that is supported by policies and procedures designed to protect our systems and assets and the Company's sensitive or confidential business information, including that entrusted to us by our clients and business partners. Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management ("ERM") processes. Our ERM processes consider cybersecurity threat risks alongside other company risks as part of our overall management activities. Cybersecurity risks related to our business are identified and managed though a multi-faceted approach utilizing various systems, controls, and processes.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: User access controls are used to limit unauthorized access to sensitive information and critical systems. In addition, we require multi-factor authentication for some, but not all, accounts. Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: As an HCM company, we face a multitude of cybersecurity threats from threat actors seeking to access, compromise access, or leverage the data we possess for malicious ends. Review of our information security program, including our cybersecurity policies, standards, and processes, is integrated into our Enterprise Risk Management ("ERM") program which is based on the COSO Enterprise Risk Management Framework and International Organization for Standardization ("ISO") 31000, the two most widely used global standards for ERM.

companyName: Dayforce, Inc.

ticker: DAY


text: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from our head of Global Cybersecurity and Compliance (Head of Cybersecurity), who oversees a global team responsible for our cybersecurity infrastructure. These reports cover various cybersecurity and information technology matters, including material risks and threat trends, mitigation strategies, security incidents, the status of information technology and cybersecurity priorities and initiatives and other related matters of importance. The Audit Committee provides periodic updates on these topics to the full Board as necessary. In addition to the above, the Audit Committee, typically in the presence of the full Board, will review the results of the independent cyber-maturity evaluations described above, and from time to time participates in table top exercises or other cybersecurity training programs.

companyName: Capri Holdings Ltd

ticker: CPRI


text: Our processes around cybersecurity risk management and strategy are led by our Chief Information Officer ("CIO"), who reports directly to our Chief Executive Officer. Our CIO meets with the Audit Committee of our Board as part of the governance process described above. This individual has prior work experience in various roles involving managing information security and risk management, developing cybersecurity strategy, and implementing cybersecurity programs. The IT subject matter experts meet quarterly to review the cybersecurity framework provided by National Institute of Standards and Technology and evaluate current cybersecurity processes and procedures.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Within our own operations, we uphold a culture of uncompromising security standards. To enhance access controls, we have implemented robust multifactor authentication methods for all personnel accessing our SharePoint and Outlook software. This additional layer of authentication not only bolsters our defenses but also ensures that only authorized individuals can gain entry to sensitive information. Moreover, our stringent email sign-in blocking policy exemplifies our proactive stance towards security. This policy is particularly pivotal during employee transitions, where the potential for security lapses is heightened. Upon an employee's departure, our Outlook administrators promptly deactivate their email sign-in functionalities, mitigating any risks associated with unauthorized access. These measures collectively form a cohesive and dynamic security framework, safeguarding our assets and ensuring the integrity of our operations in an increasingly digital landscape.

companyName: BeyondSpring Inc.

ticker: BYSI


text: Duke Energy is not currently aware of any potential cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, however, Duke Energy cannot provide assurance that it will not be materially affected in the future by cybersecurity risks or any future material incidents.

companyName: PROGRESS ENERGY INC


text: The Committee is chaired by the CISO, who works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. The CISO attends regular meetings with representatives from the legal, ERM and security teams to review newly identified cybersecurity risks and re-review previously identified risks. The Committee then determines how identified risks should be treated. The results of these risk review processes are included in periodic presentations to our executive leadership team and the audit committee.

companyName: HUBSPOT INC

ticker: HUBS


text: We employ a risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems. Our cybersecurity risk management program includes: Risk assessments designed to help identify material cybersecurity risks to our critical systems, and our IT environment; The use of external service providers to assess, test or otherwise assist with aspects of our security controls; Cybersecurity awareness training of our employees and senior management including consultation with third parties as deemed necessary;

companyName: Power REIT

ticker: PW


text: We have developed a Cybersecurity Council that reports directly to our Chief Financial Officer. The Cybersecurity Council is led by the Managing Director, Information Technology, and is comprised of select members of the IT team. The Cybersecurity Council meets monthly to review current cybersecurity threats as well as our potential exposure. The Cybersecurity Council also engages periodically with external and internal auditors, as well as the Cybersecurity and Infrastructure Security Agency, the American Exploration and Production Council and the Federal Bureau of Investigation to stay informed on cybersecurity risk management.

companyName: Chord Energy Corp

ticker: CHRD


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our AVPIT along with management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: We have in place an incident response plan to identify, respond to, and recover from cybersecurity threats and cybersecurity incidents. In the event of a potentially material cybersecurity incident, as determined by the VPoC with support from legal, as needed, the IRT is notified through an established escalation protocol. The Chair of the Audit Committee is also notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held as appropriate. We maintain a relationship with a third-party forensic vendor available for incident response and investigation. Additionally, we maintain cybersecurity insurance.

companyName: TransDigm Group INC

ticker: TDG


text: The structure of our information security program is generally designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. To prepare and respond to incidents, the Corporation has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. The Corporation engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Impact of Cybersecurity Risks We are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Our business and operations could suffer in the event of system failures or cybersecurity breaches."

companyName: Fortress Net Lease REIT


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. We have in place and continuously monitor and improve cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We continue to make investments in people, processes and technology to enhance our cybersecurity risk assessment, identification and management capabilities and to strengthen our cybersecurity risk response posture. Additionally, as part of the Company's Information Technology controls framework, management has established a suite of preventative and detective controls which enhance and strengthen the Company's cybersecurity program.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: e. Our cybersecurity team conducts routine cyber awareness training for professional associates using an independent third-party security training provider to educate best practices, policies and responsibilities pertaining to cybersecurity. We also conduct periodic simulated phishing tests to generate awareness and run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our practices, procedures and technologies.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: To date, we have not identified any cybersecurity threats or past incidents that have had, or are likely to have, a material impact on our Company's operations, business strategy, financial performance, or results of operations.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: We maintain a security operations center, supported by external providers and our employees, which provides threat detection and incident response capabilities. We maintain cyber incident response plans and related playbooks in coordination with stakeholders (including legal counsel). Significant incidents will be escalated to a Cybersecurity Materiality Committee to assess materiality based on qualitative and quantitative factors. The Committee is composed of a cross-divisional group of executives representing the core business functions of Information Technology and Security, Operations, Administration, Finance and Accounting, and Legal. We conduct periodic tabletop exercises, including at the executive level, to review our response processes and incident management procedures.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: Despite the efforts outlined above, we cannot ensure that we will not be subject to any cybersecurity incidents or threats. See "Risk Factors Risks Related to Information Technology" for additional information. To date, management has not determined that any cybersecurity incidents the Company has experienced would have resulted in, or are reasonably likely to result in, a material impact to its financial condition, results of operations, or business strategy.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: The team is responsible for assessing and managing cybersecurity incident response processes, response times, and communication plans in the event corrective actions and mitigation procedures are required to isolate and eradicate an incident.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: The Cybersecurity Governance Committee has the responsibility for determining if a cybersecurity incident is considered to have a material impact on the Company requiring public reporting in accordance with the rules and regulations of the U.S. Securities and Exchange Commission.

companyName: FTC Solar, Inc.

ticker: FTCI


text: –risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: a. Incident Response Preparedness: Our incident response plan outlines our approach to addressing and responding to cybersecurity incidents and to findings, vulnerabilities and incidents that could lead to or allegedly be suspected as cybersecurity incidents.

companyName: KALTURA INC

ticker: KLTR


text: The team within the Information Security function (referred hereinto as the "cybersecurity team") possesses a robust blend of technical knowledge, practical skills, and strategic insight, gained through years of experience in the field of cybersecurity. Our cybersecurity team includes professionals certified in a wide array of cybersecurity disciplines. Their qualifications include, but are not limited to, Certified Information Systems Security Professional ("CISSP") for general security practices, Certified Ethical Hacker ("CEH") for penetration testing capabilities, Certified Information Systems Auditor ("CISA") for information systems auditing, Certified Information Security Manager ("CISM") for overseeing enterprise security, Certified Risk and Information Systems Control ("CRISC") for risk management, and Certified Cloud Security Professional ("CCSP") for cloud security expertise. Additionally, they possess various other certifications in specific technologies and cloud security from providers like AWS and Microsoft, along with numerous other industry-relevant security certifications. This diverse expertise underscores their comprehensive understanding of the cybersecurity landscape. The cybersecurity team attends training programs to update their skills and knowledge.

companyName: TERADATA CORP /DE/

ticker: TDC


text: The Board of Directors' Risk Committee has the responsibility for oversight of our cybersecurity program. This committee's membership includes subject matter experts in both cybersecurity and national security. Spirit's CISO reports to the Risk Committee quarterly or as needed on the state of our cybersecurity program.

companyName: Spirit AeroSystems Holdings, Inc.


text: We maintain an information security program that includes physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and timely and effectively respond to cybersecurity incidents. Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of cybersecurity risk countermeasures made to defend against such threats. This process has been integrated into our Enterprise Risk Management program and our Compliance Risk Management program, both of which are overseen by our Board of Directors. In addition, we engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs, including conducting penetration testing, phishing campaigns, and vulnerability assessments, and responding to any incidents.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Federal Financial Institutions Examination Council (the "FFIEC"), and other applicable industry standards and regulations, including regulations promulgated by the NYDFS. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the data and information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company's strategy is informed by determinations of inherent risk and risk maturity level that are made in connection with an independent cybersecurity awareness assessment prepared for the FFIEC.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: The Audit Committee receives reports from management on our cybersecurity risks at least semi-annually. In addition, management updates the Audit Committee regarding cybersecurity matters, as necessary, including any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities and the full Board periodically receives briefings from management on our cybersecurity risk management program.

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: To assist the Company in assessing, preventing, identifying, mitigating and responding to material risks resulting from cybersecurity threats, the Company has developed a comprehensive cybersecurity risk management program led by our CISO. Our CISO is a Certified Information Systems Security Professional by the International Information System Security Certification Consortium who joined the Company in March 2018 after spending 15 years with other organizations as a cybersecurity and information technology ("IT") professional. Our CISO leads our management-level IT Risk Management Committee composed of IT functional leaders that meet quarterly to review the trending cybersecurity environment, risks and threats to the Company, the progress of cybersecurity mitigation and remediation projects and overall progress against the Company's cybersecurity strategy. The Company's senior IT leadership shares progress, findings or concerns reported by the IT Risk Management Committee with senior management to assess the impact of cybersecurity risks and threats to the Company, to assist with driving overall operational awareness, ownership and alignment broadly across the Company for a more effective cybersecurity risk management program.

companyName: MASONITE INTERNATIONAL CORP


text: The Company's Board of Directors receives regular reports from the Information Security Officer regarding the Company's cybersecurity program. The Board ensures that the Company has the necessary resources and authority to implement and maintain a sufficient cybersecurity program. The Information Security Officer reports directly to the Chief Executive Officer and is responsible for working with internal and third-party resources to develop and implement the Company's cybersecurity strategy, manage cybersecurity risks, and oversee the Company's cybersecurity operations.

companyName: ESCALON MEDICAL CORP

ticker: ESMC


text: Management oversees the Company's cybersecurity risk management process. Management has adopted a charter that provides to periodically review and discuss with the Board the guidelines and policies with respect to risk assessment and risk management of cybersecurity and other risk exposures relevant to the Company's computerized information system controls and security. Management may receive additional training in cybersecurity and data privacy matters to enable its oversight of such risks. Management will report to the Board on the substance of such reviews and discussions and, as necessary, recommend to the Board such actions as management deems appropriate.

companyName: SHF Holdings, Inc.

ticker: SHFS


text: Third party software providers that facilitate Linde's business activities are also sources of cybersecurity risk for the company. Linde performs risk assessment procedures including evaluation of the overall health of the control environment for certain third-party providers.

companyName: LINDE PLC

ticker: LIN


text: While we have experienced cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows. Even with the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: MANHATTAN BRIDGE CAPITAL, INC

ticker: LOAN


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation. We maintain a cybersecurity risk register, and cybersecurity team leaders hold monthly meetings to discuss and prioritize risks as well as the status of any remediation activity. Key facets of our cybersecurity program include:

companyName: INSULET CORP

ticker: PODD


text: The Board of Directors is responsible for the oversight of our cybersecurity risk management program. On a quarterly basis, our C hief Information Officer (CIO) provides a cybersecurity status report and update to the Board of Directors, which includes a scorecard of cybersecurity threats, updates on key initiatives, and any changes in trends that may impact the Company. The CIO reports directly to the President and Chief Executive Officer (CEO) and meets regularly with him, the Chief Financial Officer, and other members of the Executive Leadership Team. The CIO has over 25 years of experience in IT Operations and is supported by an internal Director of IT Security and a virtual Chief Information Security Officer (vCISO) service to ensure comprehensive focus on the program.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: Management's Role Managing Risk The CIO and the CLO are responsible for updating the Nominating and Corporate Governance Committee on cybersecurity risks and the Company's mitigation strategies. They provide quarterly updates to the Nominating and Corporate Governance Committee, as well as comprehensive briefings at least once per year and appropriate briefings during any potentially material cybersecurity incident. These briefings encompass a broad range of topics, including: • results of internal assessments and audits by third parties; • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • incident reports and lessons learned from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to regular scheduled meetings, the Nominating and Corporate Governance Committee, CIO and Chief Executive Officer ("CEO") maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive periodic updates on significant developments in the cybersecurity landscape to support proactive and responsive Board oversight. The Nominating and Corporate Governance Committee actively participates in strategic decisions related to cybersecurity, reviewing and offering guidance on major initiatives and any potentially material cybersecurity incident. This involvement ensures that cybersecurity considerations are integrated into the Company's broader strategic objectives.

companyName: Array Technologies, Inc.

ticker: ARRY


text: The Board and the Audit Committee oversee risk for us and are generally responsible for the oversight of risks from cybersecurity threats. Our management will promptly report to the Board and the Audit Committee any cybersecurity incidents impacting us and the measures that may be taken to mitigate such incidents.

companyName: Cantor Equity Partners I, Inc.

ticker: CEPO


text: Our cybersecurity risk management strategy is informed by a recent cyber risk assessment conducted in consultation with our third party managed security service provider. The assessment was informed by industry standards and included an evaluation of our cybersecurity controls. We also leverage our managed security services provider and other third-party consultants, providers, and technologies to support our efforts to monitor, identify, and address cybersecurity risks, including managing our monitoring and alerting tools and conducting periodic assessments of certain system applications. Our efforts to address cybersecurity risks and also include training employees, both from programs provided by our third-party managed security service provider and internal policies and training, which are designed to increase awareness of cybersecurity threats.

companyName: MYOMO, INC.

ticker: MYO


text: Under our Cyber Risk Program, our SVP, and the cybersecurity staff, along with the Cyber Response Team, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in our various policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Risk Committee and board of directors informed. Pertinent policy and practice documents include, among others, our Crisis Response Plan, which describes the detailed processes and procedures that should be followed in the event of a cybersecurity incident.

companyName: E2open Parent Holdings, Inc.


text: Our Board has oversight of all material risks relevant to Enterprise, including those related to cybersecurity threats. To help keep our Board informed about such risks, senior representatives from our IT and OT department provide quarterly updates to our Board regarding significant developments in: (i) cyberattacks and other cybersecurity threats targeting critical infrastructure; (ii) governmental enforcement actions and investigations against cyber criminals; (iii) the regulatory landscape impacting the midstream energy industry; (iv) improvements to our cybersecurity programs, including our CIRP and related response procedures, and the progress of ongoing cybersecurity projects.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: All of the Company's office-based associates and certain distribution and fulfillment center associates undergo mandatory security awareness training at the time of hiring and on an annual basis thereafter. The Company's store-based associates receive ad hoc awareness communications and are provided with cybersecurity awareness materials as part of the store operating manual.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: We maintain a robust system of data protection and cybersecurity resources, technology and processes. In addition to performing an annual risk assessment and developing a mitigation plan, along with a comprehensive review and update of our cybersecurity policies and procedures, we continuously evaluate new and emerging risks and ever-changing legal and compliance requirements. We also monitor risks relating to sensitive information at our business partners, where relevant, and reevaluate the risks at these partners periodically. We make strategic investments to address these risks and compliance requirements to keep Company, guest and team member data secure, including maintaining a network privacy and security insurance policy. Although we have purchased cyber liability insurance to provide a level of financial protection should a data breach occur, such insurance may not cover us against all claims or costs associated with such a breach. Our comprehensive cybersecurity program includes agreements with third-party cybersecurity partners for continuous monitoring, alerting, and response. We perform annual and ongoing cybersecurity awareness training for our management and Restaurant Support Center team members as well as specialized training for our users with privileged access. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards.

companyName: BJs RESTAURANTS INC

ticker: BJRI


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of the Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer is responsible for leading the assessment and management of cybersecurity risks and reports at least quarterly or more frequently as needed to the Audit Committee on cybersecurity strategy and risks.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: The Company's Cybersecurity Program The Company's cybersecurity program is an integral part of the long-term sustainability and effectiveness of the Company's operational and technology environment. To protect the integrity of its data and operational and technology systems, the Company employs a "defense-in-depth" strategy that uses multiple security measures. This strategy aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. The Company periodically reviews and modifies the implementation of its cybersecurity strategy based on threat trends, program maturity, the results of assessments, and the advice of third-party security consultants.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Security Officer ("CSO"), who receives reports from our information security team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CSO and dedicated personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications. Management, including the CSO and our information security tea m, regularly update the Audit Committee o n the Company's cybersecurity program, including cybersecurity vulnerabilities, risk, threats and incidents, and developments in the cybersecurity risk landscape.

companyName: Rapid7, Inc.

ticker: RPD


text: Management of cybersecurity risks is an integral part of our overall risk management framework. We have developed an information security program designed to assess, identify and manage material risks from cybersecurity threats, which is integrated into our overall risk management program and governance structure. The program includes policies and procedures that identify how security measures and controls drawn from relevant frameworks are developed, implemented and maintained. Our cybersecurity risk management program works to balance critical infrastructure, network, application, cloud and information security objectives with overall business objectives and risk tolerance. Specific controls that are used include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls, and intrusion detection and prevention, and vulnerability and patch management.

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with the aim of modeling our cybersecurity strategies and processes after industry best practices. Our collaboration with these third parties includes managed services, team augmentation, independent audits, vulnerability management, threat and attack and consultation on security risks enhancements. Some engagements involve point in time activities with end products or reporting while others involve ongoing monitoring and management of risk across the Company.

companyName: Cornerstone Building Brands, Inc.


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, products and our critical data (including intellectual property and confidential information that is proprietary, strategic or competitive in nature, and clinical trial data) (collectively, "Information Systems and Data").

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.

companyName: CalEthos, Inc.

ticker: GEDC


text: The Board provides oversight of Chevron's cybersecurity program, receives reports from management on cybersecurity risks in connection with Chevron's operations and projects, and also reviews cybersecurity risks as part of the company's broader annual ERM process. In support of the Board's oversight of the company's policies and processes with respect to risk management and the company's major financial risk exposures, including cybersecurity, the Audit Committee meets with Chevron's CISO and CIO at least twice a year to review cybersecurity risks and implications, including the results of independent third-party assessments. The CISO and CIO present cybersecurity matters to the Board of Directors at least annually. The CISO and CIO also provide new Board members with a cybersecurity briefing as part of the onboarding process. In 2023, the Audit Committee hosted an external expert to discuss cybersecurity and digital risk management topics.

companyName: CHEVRON CORP

ticker: CVX


text: TEP employs and regularly exercises UNS Energy's Cybersecurity Incident Response and Reporting Plan. This plan identifies key roles and responsibilities applicable during a cybersecurity incident and classifies incidents according to qualitative and quantitative factors that are continuously reviewed as information evolves over the course of an incident. The plan also identifies certain reporting obligations and may trigger additional response processes such as activation of UNS Energy's Data Breach Response Plan.

companyName: TUCSON ELECTRIC POWER CO


text: As noted above, we have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Our SVP of IT leads a team that is responsible for assessing and managing our cybersecurity risks. The SVP of IT has a B.S. in Management Information Systems, spent more than a decade with Microsoft before joining the Company, and is an active member of North Dakota State and Local Intelligence Center (NDSLIC), an affiliate of National Fusion Center Association (NFCA) and United States Homeland Security (DHS). Senior management, including the SVP of IT, conducts regular meetings to discuss technology initiatives and cybersecurity risks and strategies.

companyName: CENTERSPACE

ticker: CSR


text: The Company's corporate information technology, communication networks, and accounting and financial reporting platforms are necessary for the operation of its business. The Company uses these systems, along with others, to manage its tenant and vendor relationships, for internal and external communications and for accounting to operate recordkeeping and reporting functions. The Company has implemented and maintains various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information.

companyName: CAPITAL PROPERTIES INC /RI/

ticker: CPTP


text: Internal and third-party risks are reviewed, monitored, and managed by our Cybersecurity and Privacy teams, audited by an Internal Audit team and various external experts, and tracked within an Enterprise Risk Management framework. We regularly engage third-party experts to assess the effectiveness of our cybersecurity programs. Biennially, an external independent consultancy team conducts an assessment of our cybersecurity program using the inputs from accepted Cybersecurity Frameworks. Targeted assessments are conducted regularly by internal and third-party experts to ensure compliance with specific federal and state laws and regulations. We continue to participate in the VISA TIP program and AMEX STEP program around our PCI DSS compliance.

companyName: GENESCO INC

ticker: GCO


text: The Risk Committee is comprised of members of our senior management, who have managed and overseen cybersecurity risk at numerous public companies. Our Vice President and Head of IT leads our operational oversight of cybersecurity and IT strategy, policy, standards and processes. He has served in this role since our inception in November 2021 and has more than 16 years of experience overseeing cybersecurity strategy, cybersecurity and technology risk management, engineering of security technology, overseeing managed security service providers and IT governance at other publicly traded companies and holds industry-standard certifications with respect to cybersecurity risk management.

companyName: Orion Properties Inc.

ticker: ONL


text: Board Oversight of Cybersecurity Risks Our Board is responsible for the oversight of our risk management program and regularly reviews information regarding our most significant strategic, operational, financial, legal and compliance risks, including cybersecurity risks. The Board reviews mitigation plans through discussions with management, which includes regular Board reports and findings from management's monthly discussions with our outside IT group. Our Board of Directors also reviews and approves our cybersecurity policies, strategies, and budgets on an annual basis.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT


text: Cybersecurity threats are identified, assessed, and monitored by our security operations center, which is staffed with cybersecurity professionals who report to the Company's Chief Information Security Officer (CISO), and includes resources provided by external vendors. When a cybersecurity threat or incident meets certain categorized thresholds as determined by our Cybersecurity Incident Response Plan, we follow an escalation review process which can result in our CISO forwarding the threat or incident to our cybersecurity crisis response team consisting of our Chief Executive Officer (CEO), Chief Financial Officer, Chief Human Resources Officer, Chief Information Officer, and General Counsel (the "Crisis Response Team"). Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess and manage our response to cybersecurity threats and incidents. Our CISO follows a risk-based escalation process to notify our General Counsel of certain cybersecurity threats and incidents, and our General Counsel analyzes our obligation to report any incident publicly. If the General Counsel determines disclosure is warranted, she reports this conclusion to the CISO, the Crisis Response Team, and the Company's Public Disclosure Committee for consideration and disclosure.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: With respect to management, our CTO, who reports directly to our chief executive officer, has over 12 years of experience with our company, including more than 6 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CTO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CTO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Our management team oversees our cybersecurity policies and processes, including those described in the "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: Cybersecurity is one of the top operational risks facing TMCC. We and other financial institutions continue to be targets of ever evolving cybersecurity threats and cyberattacks. As a result, we devote significant resources to a cybersecurity program designed to minimize such risks and protect TMCC, along with data from our customers and clients.

companyName: TOYOTA MOTOR CREDIT CORP


text: As of the date of this Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, Cars Commerce, including our business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity prevention and mitigation efforts have been or will continue to prevent possible cybersecurity threats or whether a cybersecurity threat could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risks Related to Technology" in "Risk Factors" of this Report.

companyName: Cars.com Inc.

ticker: CARS


text: Our Board of Directors, in coordination with each of our Board Committees, is responsible for oversight of our enterprise risk management activities. The Nominating and Governance committee receives an update on the Company's risk management process quarterly, including interaction of cybersecurity with our overall risks. The Board of Directors oversees risks from cybersecurity threats through report out from the Audit Committee, which monitors cybersecurity incidents and management's response to such incidents.

companyName: Sensata Technologies Holding plc

ticker: ST


text: Although the aggregate impact on our operations and financial condition has not been material to date, the Company has been the target of cybersecurity attacks and expects them to continue as such attacks are becoming more sophisticated and frequent, and the techniques used in such attacks change rapidly. Any such future incidents could have a material impact on our business.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: The Management Company's third-party advisor has performed cybersecurity risk assessments of its information technology security processes and implemented technologies to lessen risk. Using third party services, the Management Company monitors, scans, assesses, audits, and remediates identified vulnerabilities across its networks, as appropriate. Furthermore, recognizing that the Management Company's employees are an essential line of defense in cybersecurity, it requires employees to participate in training and testing programs through which it provides education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. The Management Company's policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.

companyName: AEI INCOME & GROWTH FUND XXI LTD PARTNERSHIP

ticker: XXAAU


text: Our board of directors does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.

companyName: Syros Pharmaceuticals, Inc.

ticker: SYRS


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our Audit Committee receives prompt and timely information regarding any known or suspected cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. In addition, our Audit Committee has established a Cybersecurity Subcommittee, comprised of four Audit Committee members and members of management, including the Director of Information Security, Chief Financial Officer, and Chief Legal Officer, which meets quarterly to review materials concerning the ongoing maturation of the Company's cybersecurity program, the effectiveness of its information security controls, and current and emerging material cybersecurity threat risks. Our Audit Committee, and its Cybersecurity Subcommittee receive materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Real-Time Monitoring. We engage a third-party security operations center that actively monitors our environment and detects and remediates security threats in real-time.

companyName: Clene Inc.

ticker: CLNN


text: We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations, or financial condition based on information known to us as of the date of this Annual Report on Form 10-K. Although we cannot eliminate all potential threats, our cybersecurity program is operated in a manner to minimize the likelihood of any threat becoming material and to keep pace with a constantly evolving cybersecurity landscape. For additional description of cybersecurity risks and potential related impacts on the Company, refer to the risk factor captioned "Any cybersecurity attack or other security breach of our technology systems, or those of third-party vendors we rely on, could subject us to significant liability and harm our business operations and reputation" in "Item 1A. Risk Factors."

companyName: Beneficient

ticker: BENF


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The Incident Response Team ('IRT") members include senior management and other relevant personnel with defined roles and responsibilities. The IRP addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. The IRT is notified of all incidents, and incidents are elevated to the Board of Directors when warranted.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: Third-Party Risk we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: CleanCore Solutions, Inc.

ticker: ZONE


text: FMC has established a process to assess the nature, scope and timing of a cyber incident and communicate the facts of the incident to management and the board of directors and, if needed, investors. In the event of a cybersecurity incident, the incident response team, which is managed by IT personnel, is responsible for ensuring the Chief Executive Officer and other members of the Executive Committee and Leadership Team are notified in a timely manner. For any cybersecurity incident, there will be a cross-functional review, including the IT, legal, and finance teams, to evaluate qualitative and quantitative factors related to the incident to determine if the impact of the event is material. Individuals from other departments may be involved in this review depending on the facts and circumstances of the incident. These individuals will be responsible for responding to the event and monitoring the impacts on the Company's operations, financial position, and results of operations. This team will also evaluate cyber incidents in the aggregate if related events occur. During the response and recovery related to a cyber incident, this team will meet daily or weekly depending on the severity of the event and continuously evaluate the nature, scope, and timing of the event. Members of the senior management, including the Chief Financial Officer, Chief Accounting Officer, and General Counsel, as well as the Senior Director - Core IT will be briefed as to the facts and circumstances of a cyber incident and determine if the event is considered material to the business. If such determination is made, the matter will be escalated to Board of Directors. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations. Throughout this process and the recovery following an incident, the Company is focused on considering the ever-changing facts and circumstances of the event and remaining as transparent with the investment community as possible.

companyName: FMC CORP

ticker: FMC


text: Cybersecurity is among the most critical risks to the Company. For many activities important to its business, the Company depends on the confidentiality, integrity, and availability of information systems and data, some of which are provided or managed by third parties.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: In response to such risks, the Company plans to implement initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Breeze Holdings Acquisition Corp.


text: Our Chief Information Officer has more than 20 years of cybersecurity and information technology experience and she has served as the Chief Information Officer for multiple technology companies. Our vCISO and their third-party IT security firm includes a global team of cybersecurity professionals with significant industry experience. Similarly, the members of the ERM Committee possess significant risk management experience obtained by their collective years of experience at Bloom and other companies of similar or greater complexity.

companyName: Bloom Energy Corp

ticker: BE


text: The objective in managing cybersecurity risk is to avoid or minimize the impact of efforts to penetrate, disrupt or misuse Company systems or information. Cybersecurity helps to maintain an environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, and privacy. IT Management is charged with cybersecurity and uses a layered approach to protect systems with ESET and Cylance.

companyName: ATEL 14, LLC


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from our vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data.

companyName: Cavitation Technologies, Inc.

ticker: CVAT


text: Information Systems Acquired from Teads As disclosed above in Item 1 under "Acquisition of Teads," on February 3, 2025, we completed our acquisition of Teads. Teads' legacy information systems are currently maintained separately from Outbrain's preexisting information system infrastructure. After we are able to fully evaluate Teads' legacy information systems, protocols and practices, we plan to operationally integrate either the legacy Teads system or the legacy Outbrain system, and these integrated systems will then be subject to Outbrain's cybersecurity risk management structure and strategy. While we integrate these systems, our GRC and CISO are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Teads information systems are assessed, managed and reported in accordance with the governance processes detailed above.

companyName: Teads Holding Co.

ticker: TEAD


text: Third-Party Vendors We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, suppliers, and other vendors. We use a variety of inputs in such risk assessments, including information supplied by vendors and in some cases attestations from objective, reputable, and licensed assessors. Where appropriate, our contracts with vendors require agreement and adherence to commercially reasonable security, confidentiality, and privacy contractual terms. Vendors are subject to security risk assessments at the time of onboarding, and are thereafter periodically monitored and reassessed depending on risk level, our cybersecurity practices, and consideration of evolving cybersecurity standards and legal and regulatory requirements.

companyName: Premier, Inc.


text: Our process to monitor, report, and respond to identified or suspected security incidents includes (i) collection of relevant information about an incident, including (a) impacted systems, (b) impacted entities, (c) protection mechanisms that were in place and active at the time of the security incident, (d) audit logs, and (e) the risk classification of the Information Assets that were potentially impacted; (ii) reporting to a centralized ticketing system; (iii) reporting to management and other authorities, such as legal, human resources, IT, and local and/or state law enforcement, etc.; (iv) escalation, if the incident is considered to be critical based upon our assessment of its potential impact, to appropriate management and directors and other authorities; and (v) documentation of the incident and our response actions taken.


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our CIO. The Board also receives updates from the Audit Committee on cybersecurity risks on a regular basis.

companyName: Ultragenyx Pharmaceutical Inc.

ticker: RARE


text: There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, we are not aware of any cybersecurity threats that have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: The Company is committed to ensuring the highest standards of cybersecurity to protect our systems, networks, and data from cyber threats. We recognize the critical importance of safeguarding sensitive information and maintaining the trust of our customers, partners, and stakeholders.

companyName: International Land Alliance Inc.

ticker: ILAL


text: The Company has implemented a comprehensive cybersecurity risk management program designed to protect confidentiality, integrity, and availability of critical systems and information.

companyName: TIC Solutions, Inc.

ticker: TIC


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibilities for enterprise cybersecurity risks. The Technology, Innovation, and Cyber Committee of the Board of Directors also reviews enterprise cybersecurity risks in connection with its oversight of cybersecurity and compliance risks. Our CISO leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks in coordination with the EVP of Systems and IT Controls.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: We have identified information technology and cybersecurity risk as some of the most significant risk types to our business. Related to these identified risk types, we have classified our top risks and report these risks to both senior management and the risk committee of Genworth Financial's Board of Directors. For additional information regarding the risks associated with these matters, see "Item 1A—Risk Factors."

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: We recognize the paramount importance of cybersecurity in preserving the integrity, confidentiality, and availability of our systems, data, and operations. Our cybersecurity program is designed to identify, assess, monitor, and manage material risks from cybersecurity threats. We have developed a comprehensive approach based on recognized frameworks including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and industry best practices.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Management and Strategy regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our board of directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the board of directors. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes and to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned " Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed " in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: Lipocine Inc.

ticker: LPCN


text: Governance and Responsibilities Our Board of Directors recognizes that cybersecurity represents an important component of the Company's overall enterprise risk management ("ERM"). Throughout the year, our Board of Directors and its Committees engage with management to discuss and mitigate a wide range of enterprise risks, including cybersecurity.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: We or our third-party manager currently maintain cybersecurity insurance policies that provide coverage for security incidents. Although the risks we face from cybersecurity threats are many and change daily, in the last three fiscal years, we have not experienced any cybersecurity incidents that have materially affected our operations, strategy, financial positions or operations. In addition, as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations and financial condition. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors-Risks Relating to Our Business- We are increasingly dependent on information technology, and potential cyber-attacks, security problems or other disruption and expanding social media vehicles present new risks."

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Managing Third Party Risk Arcosa recognizes the risks associated with the use of vendors, service providers, and other third parties that provide information system services, process information on its behalf, or have access to its information systems, and Arcosa has processes in place to oversee and manage these risks. In addition to the minimum security and control standards, these processes include other quality control measures, such as utilizing a third-party security scoring system to evaluate the security posture of current and potential parties. Arcosa also maintains ongoing monitoring to support continuous compliance with its cybersecurity standards.

companyName: Arcosa, Inc.

ticker: ACA


text: Cybersecurity Risk Management and Strategy Overview. Our cybersecurity programs and related processes generally consist of the following key elements: (i) risk assessment and management efforts, (ii) technical safeguards and incident response and recovery efforts, (iii) third-party risk management efforts, (iv) education, training and preparedness efforts and (v) governance efforts.

companyName: Angi Inc.

ticker: ANGI


text: We use third party security providers for specialized areas such as incident response, penetration testing, and on-demand cybersecurity services, including staff augmentation and consulting. We also leverage a managed security service provider to augment our cybersecurity organization and to provide additional monitoring and response capabilities.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us.

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity software, and darkweb monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, CROs and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, the access to be provided to such Information Systems and Data, and the identity of the provider, our vendor due diligence involves different levels of assessment of systems and controls designed to help identify cybersecurity risks associated with a provider. In addition, we may impose contractual obligations related to cybersecurity on the provider.

companyName: Kura Oncology, Inc.

ticker: KURA


text: While we have not experienced a material impact on our business strategy, results of operations or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws, which could have a material adverse effect on our business, results of operations and financial position.

companyName: AZEK Co Inc.


text: Gryphon subsequently wired the commensurate amount in USD to Sphere 3D to make them whole for the stolen BTC. Gryphon also engaged a nationally recognized third-party firm to perform a forensic analysis. The analysis revealed that the threat actor did not enter the email exchange via Gryphon's IT systems. The Company has also subsequently modified its control systems to protect against any future attempted incursions. During the quarter ended June 30, 2023, the Company made a payment to Sphere 3D for $560,000, which was classified as a general and administrative expense on Gryphon's consolidated statement of operations.

companyName: American Bitcoin Corp.

ticker: ABTC