text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams, in coordination with third parties, conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. The results of these tests are reviewed with the Nominating and Corporate Governance Committee. Leaders from each team regularly meet with Cybersecurity Leadership to provide visibility into major issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board, as appropriate. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates with external legal advisors, communication specialists, government agencies, regulators, law enforcement, and other key stakeholders. KNIGHT-SWIFT TRANSPORTATION HOLDINGS INC.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: The Company's Board of Directors oversees the processes for risk management, including cybersecurity risks, to help align risk exposure with strategic objectives. Senior management, including our CISO, periodically briefs the Board of Directors on our cybersecurity framework and assessments of the information security program, key and emerging threats and risks, the status of projects to strengthen our information security systems, and any cybersecurity incidents that could potentially have a material business impact. In the event of an incident, the Company would follow a detailed incident response plan, which outlines the steps to be followed, including notification of senior management and the Board of Directors, as appropriate.

companyName: INVESTORS TITLE CO

ticker: ITIC

secItem: Item 1C


text: As of the date of this report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, for more information on risks posed by cybersecurity threats to the Company.

companyName: Global Interactive Technologies, Inc.

ticker: GITS


text: Cyber risk management is a core component of the Company's governance structure. We utilize the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guide in cyber risk management to identify, assess, and assist the CSO in managing cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cyber governance, prevention, detection, and remediation activities within the Company's cybersecurity environment. As part of our cyber risk management efforts, we conduct periodic reviews and collaborate with enterprise-wide risk assessments to assess and manage cybersecurity risks. Our cybersecurity team also provides enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Information Technology Team will notify our Chief Executive Officer, Chief Financial Officer, General Counsel and other relevant business executives. Our Chief Information Officer will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps.

companyName: Ventas, Inc.

ticker: VTR


text: We maintain a cybersecurity program aligned with NIST CSF standards designed to identify critical assets and vulnerabilities, protect them with appropriate safeguards, promptly detect cybersecurity events, respond effectively to mitigate their impact and recover from incidents to restore services. Our cybersecurity program is designed to safeguard the confidentiality, integrity and availability of information. Our cybersecurity risk management strategy includes: Governance: The Audit Committee of our Board of Directors oversees our cybersecurity risk management.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Willdan Group, Inc.

ticker: WLDN


text: Reporting to the Board The Senior Vice President of Information Technology regularly informs the Chief Executive Officer and COO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Matador Resources Co

ticker: MTDR


text: Cyber Governance Cybersecurity is a key element of the Company's enterprise risk management ("ERM"). Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis. Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Chief Information Officer. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from employees in the information technology team and through the use of technological tools and software and results from third-party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.

companyName: CITIZENS, INC.

ticker: CIA


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks, and the Company may not be able to implement effective preventive measures against cyber security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Part I, Item 1A, "Risk Factors" in this report.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis.

companyName: Gaucho Group Holdings, Inc.


text: We have adopted a Written Information Security Program (WISP) designed to align with the guidelines recommended by the National Institute of Standards and Technology (NIST). We make ongoing continuous improvements to our information security program; specifically in the implementation of secure remote access solutions with multifactor authentication, next-generation endpoint detection and remediation, cloud-based security controls, automated scanning and outside validation of security controls. Additionally, we require all employees to complete cybersecurity training at least annually, with additional training targeted for employees with greater data access. When a specific cyber threat is identified, we may create additional trainings with targeted content for our employees. As part of our efforts to manage our cybersecurity risks, we have engaged an independent firm to assist with conducting penetration tests and provide advice on our information security program. We also carry insurance to mitigate losses from cyber events.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets including for example (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management assessment processes; (2) the information security function works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors on at least a quarterly basis, which evaluates our overall enterprise risk, (4) policies and procedures to manage how Information Systems and Data are collected, maintained and stored, (5) communicating with and training personnel on cybersecurity risks and trends.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: In the past, the Partnership has experienced actual and attempted cybersecurity events and incidents. While prior incidents have not materially affected the General Partner's or the Partnership's business strategy, results of operations or financial condition, and although the General Partner's processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect the General Partner's or the Partnership's business strategy, results of operations or financial condition. To date, the General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner, the Partnership, the General Partner's business strategy, the Partnership's results of operation or the Partnership's financial conditions.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: The Chief Information Security and Privacy Officer (CISPO) is the risk manager overseeing the organization's information security risk management function. As the Risk Manager, the CISPO is responsible for the administration of the information security risk management program, policy, and procedures. This includes ensuring that risks are properly identified, assessed, managed, and reported as prescribed by the organization. The Risk Manager also has the responsibility of promoting an effective risk management culture through regular training across the organization. The CISPO has direct communication with senior executives regarding cybersecurity risks and works collaboratively with our leadership to respond to and manage the response to cybersecurity incidents. The CISPO has nearly 20 years of legal and data protection experience with a focus on Information Security, Privacy, and Abuse Prevention.

companyName: Live Nation Entertainment, Inc.

ticker: LYV


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party cybersecurity firm to assist with aspects of our cybersecurity program including, but not limited to, network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.

companyName: Ocugen, Inc.

ticker: OCGN


text: Cybersecurity risk is assessed at the enterprise level as part of our overall enterprise risk management program. We maintain a dedicated cybersecurity function and program that is led by the Chief Information Security Officer ("CISO").

companyName: FIVE BELOW, INC

ticker: FIVE


text: Our Director of Information Technology, who has extensive cybersecurity knowledge and skills gained from over twenty years of work experience at the Company and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Executive Vice President — Chief Financial Officer. The Director of Information Technology receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with management, regularly reviews risk management measures implements by the Company to identify and mitigate data protection and cybersecurity risks. Our Director of Information Technology works with Legal to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: Calumet Specialty Products Partners, L.P.


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remain. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. See "Risk Factors" in Part I—Item 1A of this Annual

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: DATASEA INC.

ticker: DTSS


text: Members of our Audit Committee and Board of Directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Members of our Audit Committee and Board of Directors continue to receive updates around the cybersecurity threat landscape and ongoing best practices as a means of continuing education in the area. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning and disaster recovery, product management, and other relevant matters.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: The Corporation has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Corporation. There can be no assurance that this will continue to be the case. Notwithstanding the Corporation's investment in cybersecurity, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, results of operations or financial condition. For a discussion of cybersecurity risks affecting the Corporation's business, see "Item 1A. Risk Factors - Strategic and Operational Risks - The Corporation's information technology systems, processes, and sites may suffer interruptions, security incidents, or failures that may affects its ability to conduct its business and cause significant damage to its reputation." which is incorporated by reference into this Item 1C.

companyName: HNI CORP

ticker: HNI


text: We continuously assess technology risks and threats and monitor our information systems for potential vulnerabilities based on industry trends and evolving threats. We use our IRP to identify, evaluate, respond to and resolve information security incidents. We conduct regular reviews of our information security program and also validate our information security program by conducting tabletop exercises, penetration and vulnerability testing, red team campaigns to identify potential vulnerabilities, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our IRP. Our auditors perform independent audits on aspects of our information security program for assurance purposes. We occasionally engage third-party assessors to assess different aspects of our information security program. We conduct regular training for employees on different cybersecurity topics and best practices. We also conduct a risk-based analysis on third-party vendors that we engage to process personal data and confidential information for us and provide them with our information security requirements prior to their engagement.

companyName: Chewy, Inc.

ticker: CHWY


text: We regularly assess our adherence to these standards and maintain programs designed to support our compliance with these requirements. External firms audit our compliance with NIST 800-171 CMMC and DFARS every three years. In addition, our cybersecurity processes have been integrated into our overall enterprise risk management system and specific cybersecurity-focused disclosure controls and procedures have been developed. Management continues to support a variety of practices that are intended to align with recognized frameworks and reflect our approach to assess, identify, and manage material risks from cybersecurity threats: • Incident response: We have adopted a Cybersecurity Incident Response Plan (IRP) that applies in the event of a cybersecurity threat or incident to provide a standardized framework for investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel and third-party contractors, vendors, and partners that perform functions or services that require access to secure information, and to all devices and network services that are owned or managed by the Company. • Regular testing: We engage a third-party cybersecurity firm to conduct an annual network penetration test on our corporate and supervisory control and data acquisition networks. The annual penetration test enables us to assess our existing security controls to identify weaknesses and eliminate vulnerabilities to defend against cybersecurity threats proactively. Our IT team also conducts rehearsals of our IRP to test and enhance our ability to respond to cybersecurity incidents. • Monitoring for risks: We engage a third-party cybersecurity firm to manage our Security Operations Center (SOC), which is responsible for monitoring our network traffic 24/7. Our SOC helps to identify and respond to cybersecurity issues in real time by assessing the level of threats and making recommendations on appropriate actions. • Security controls: We incorporate physical- and software-based preventive, detective, and corrective security controls to prevent or detect unauthorized activities and proactively alert us should an unauthorized activity occur within the organization. Early detection can enable the security team to quickly contain and eradicate the unauthorized activity to reduce the time exposure window and the impact of the incident. Our Security Incident Event Management tool monitors security logs, includes detective controls, and helps to identify irregular activities. • Detection and preventative technology: We have implemented multiple technologies designed to help protect our systems from cybersecurity threats, including an intrusion prevention system, next-generation antivirus program, end point protection system, and a data loss prevention security tool. • Regular improvements: We regularly work to enhance our systems and integrate new information and technology to upgrade our systems. We review and approve software and hardware acquisitions to enhance our ability to detect and manage cybersecurity threats. We also engage the FBI, DHS, and fusion centers for incident response support and collaborate to share critical information.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: On a periodic basis, but not less than annually, the Information Security Officer (ISO), in conjunction with the Information Technology department, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or customer records. Risks are identified and mitigations are documented by the ISO, IT staff and business lines responsible for the assessed area. Risks related to the engagement of third-party providers are identified and reviewed by the Risk & Compliance Department, in coordination with Vendors and Business lines that engaged the vendor relationship.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: Our Board of Directors ("Board") has responsibility for oversight of risk management and, pursuant to the Audit Committee Charter, has delegated to our Audit Committee oversight of our cybersecurity risk management program. The VP of IT provides reports to the Audit Committee at least annually as well as the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external security professionals with the results of those reviews reported to senior management and the Board.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: Our Chief Financial Officer and Chief Operating Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to identify, protect against, detect, respond to, and recover from current and emerging cybersecurity risks, and plans and strategies to address those risks and mitigate harm caused by cyber incidents.

companyName: Axonics, Inc.


text: The Bank's information security program is designed to protect sensitive, confidential, and non-public personal information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public personal information, financial data, and internal operational information. Our Chief Information Officer ("CIO") manages our information security strategy and development as overseen by our overarching Enterprise Risk Management ("ERM") program.

companyName: Primis Financial Corp.

ticker: FRST


text: To implement our cybersecurity strategy, we maintain various safeguards to secure the data we hold, including encrypting sensitive data, utilizing a robust 24/7/365 security monitoring system, regularly assessing product features for security vulnerabilities, conducting continuous internal penetration tests, and leveraging multi-factor authentication to help effectively protect sensitive information and appropriate access rights. We also have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to preserve the availability of critical data and systems. We have processes in place to assess and manage vendor cybersecurity risks, which include initial and periodic security program reviews through the use of third-party vendors who specialize in this subject matter. We have engaged our independent, internal audit team that reports directly to the Chair of the Audit Committee of our board of directors to audit our adherence to our cybersecurity policies. These audits help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: Containment, Eradication, Recovery, and Reporting With every cybersecurity incident, the highest priority of the incident response team is to contain the cybersecurity incident as quickly as possible. A cybersecurity incident is considered contained when no additional harm can be caused and the focus shifts to remediation. The incident response team executes our incident response plan to respond to the cybersecurity incident and coordinate resources and communication protocols.

companyName: American Homes 4 Rent

ticker: AMH


text: Our key cybersecurity processes include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer information, personal information, intellectual property and proprietary information. • Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have a strategic partner (a Managed Security Service Provider ("MSSP")) that is responsible for leading the initial assessment of priority and severity. Our cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise level. • Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at the Company. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations, and industry risks. • Supplier risk assessments: We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for us to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems. • Third-party assessments of the Company: We have engaged third-party cybersecurity companies to periodically assess our cybersecurity posture and to assist in identifying and remediating risks from cybersecurity threats.

companyName: SONIDA SENIOR LIVING, INC.

ticker: SNDA


text: During the fiscal year ended June 30, 2025, the Company did not identify any cybersecurity incidents that had a material impact on our business strategy, results of operations, or financial condition.

companyName: PORTSMOUTH SQUARE INC

ticker: PRSI


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A under the heading "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," which disclosures are incorporated by reference herein.

companyName: GRI Bio, Inc.

ticker: GRI


text: As discussed in more detail under the heading "Governance" below, our cybersecurity program is overseen by our Chief Information Officer (CIO), who reports to our Chief Executive Officer (CEO), and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our CIO regularly reports to our Audit Committee on the status of the cybersecurity program.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.

companyName: HilleVax, Inc.


text: The Company relies heavily on sensitive information to run daily operations and deliver products and services. To protect the availability, integrity, and confidentiality of sensitive information and sensitive infrastructure, the Board of Directors requires the Company develop and implement a comprehensive Information Security Program, which focuses on the confidentiality, availability and security of information and systems. The Information Security Program defines the strategy that the Company uses to protect and secure its systems and media that process and maintain sensitive information. The program details the governance, management, operations, and assurance of the program, and seeks to identify, prevent and mitigate cyber threats and to respond effectively to cyber threats when they occur.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: The Fund depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, administrative agents, fund administrators and other third parties to source, make and manage its investments. Accordingly, the Fund's business is dependent on the communications and information technology ("IT") systems that it shares with the Advisers and their ultimate parent company, TIAA, which further relies upon the systems of third-party IT service providers to TIAA. TIAA has established a cybersecurity program across its enterprise, which applies to certain of its affiliates, including the Advisers and the Fund. When identifying and overseeing risks from cybersecurity threats associated with its use of third-party service providers, the Fund further relies upon the expertise of risk management, legal, information technology, and compliance personnel of TIAA. TIAA conducts onboarding and ongoing due diligence of certain of the Fund's key third-party service providers to identify and oversee risks from cybersecurity threats associated with the Fund's use of such entities.

companyName: Nuveen Churchill Private Capital Income Fund


text: As of May 31, 2024, the Company has not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition. The Company has further disclosed how risks from cybersecurity threats could potentially have a material impact on the Company, including its business strategy, results of operations, or financial condition, in Part I, Item 1A, "Risk Factors" of this Annual Report.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: The Company has established comprehensive incident response plans that set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified, and elevated to an executive team which includes the CISO and executives on the Crisis Response Team. Once elevated, these executives are ultimately responsible for the management, mitigation, and remediation of incidents.

companyName: Alcoa Corp

ticker: AA


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight, mitigation, and disclosure of risks from cybersecurity threats.

companyName: Sweetgreen, Inc.

ticker: SG


text: Our approach to cybersecurity begins with our responsibility for strong governance and controls. Security begins at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. We use a risk-based and layered approach to prevent, detect, and respond to cyberattacks, and leverage external partnerships for threat intelligence.

companyName: SUPERNUS PHARMACEUTICALS, INC.

ticker: SUPN


text: The Company has an information security policy, and it provides cybersecurity training to employees on a recurring basis. As part of our processes, employees are trained on how to identify and report potential cybersecurity threats. The Company also engages in an ongoing process of risk assessments to identify and mitigate cybersecurity threats. This includes a vulnerability management program where such risks are identified, classified, and addressed. The Company conducts cybersecurity tabletop exercises to enhance mitigating controls and incident response preparedness. The Company also has incident response plans in place to address contingencies in the event of a cybersecurity incident.

companyName: MSA Safety Inc

ticker: MSA


text: We have certain vendor management processes designed to help to manage cybersecurity risks associated with our use of these providers.

companyName: Streamex Corp.

ticker: STEX


text: Our Board has ultimate oversight of our strategic and business risk management and, as such, has oversight responsibilities for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The Board has delegated to the Audit Committee oversight risks of cybersecurity risk policies, practices and procedures. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing and updating processes to ensure such potential risks are monitored, putting in place appropriate mitigation measures, and providing regular reports on cybersecurity trends and risks, and should they arise, any material incidents with our Board.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Integrated Risk Management Management is responsible for the day-to-day management of the Company's risk exposure, subject to the direction and objectives established by our Board of Directors (the "Board"). As an important component of the Company's risk management process, management reviews risks from cybersecurity threats and the Company's programs for evaluating, mitigating and educating its employees regarding cybersecurity risks. We employ a range of tools and services, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessments and penetration testing, to update our ongoing cybersecurity risk identification and mitigation efforts.

companyName: Liquidia Corp

ticker: LQDA


text: The CTO and Chief Legal Officer ("CLO") are key members of management responsible for strategic cybersecurity leadership. They lead tactical threat assessment, keep an updated risk register and develop and maintain governance and procedures. The CTO reports to the CFO and presents at least annually to the Audit Committee and the full board of directors on cybersecurity processes. The CLO reports to the CEO, and to the Audit Committee and the full board of directors, with regard to significant cybersecurity incidents, as further described below. Our CLO has specific training in cybersecurity awareness and holds a certificate of Cybersecurity Governance for the Board of Directors from the Massachusetts Institute of Technology Sloan School of Management.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: Aside from more immediate reporting of material incidents to our Board of Directors as described above, our VP of Technology provides our Board of Directors an update on cybersecurity during each of its quarterly meetings regarding the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.

companyName: Smart Sand, Inc.

ticker: SND


text: Our security incident response plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting and providing relevant information to senior management and the Board of Directors. The security incident response plan also requires management to assess materiality of the threat or incident for the purposes of public disclosure.

companyName: Federal Home Loan Bank of Cincinnati


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our organizational strategy, results of operations, or financial condition as part of our risk factor disclosures in Part I, Item 1A of this report.

companyName: Science Applications International Corp

ticker: SAIC


text: In fiscal 2025 the Audit Committee and the NCG Committee received reports on our cybersecurity risk management initiatives. In addition, our management team updates the Board with respect to the Company's overall cybersecurity risk posture and initiatives in order to improve our cybersecurity risk controls. As necessary, the Audit Committee will oversee management's responses to any significant cybersecurity incidents including any disclosures required by law. The full Board also receives a briefing from management on our cyber risk management program at least annually.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: The cybersecurity risks identified as part of our information security program are integrated into our enterprise risk management program. The audit committee reviews the integration of our cybersecurity controls and procedures with our overall risk management systems and processes, and reviews and discusses with management First Solar's major information security risks (including cybersecurity) and the steps management has taken to monitor, control, and limit such exposures and risks. An Information Security Steering Committee, which is comprised of senior management from various departments, serves in an advisory capacity regarding the implementation, support, and management of the information security program and compliance with applicable state and federal laws and regulations. This committee aligns business initiatives, material digital risks, risk tolerance levels, and security requirements with the information security roadmap.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: While in depth processes and technological solutions are in place to help minimize the potential for a successful cyberattack, ASB maintains a cybersecurity incident response plan to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents. The Response Plan includes (1) detection, (2) analysis, which may include timely notice to the Board if deemed material or appropriate, (3) containment, (4) eradication, (5) recovery and (6) post-incident review.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Management and Strategy many of our peer companies, we recognize the significance of cybersecurity threats to our clients and operations. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors.

companyName: Cingulate Inc.

ticker: CING


text: Board Oversight of Cybersecurity Matters The cybersecurity dashboard with roadmap progress is shared with the board of directors regularly, which includes actions completed and any topics that need board awareness / sponsorship such as approval of budgets which include cyber security project initiatives.

companyName: Drilling Tools International Corp

ticker: DTI


text: We recognize the critical importance of maintaining the trust and confidence of customers, suppliers, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) the International Organization for Standardization and other applicable industry standards. Our customers' requirements for their suppliers to have certain cybersecurity policies, standards and processes in place also drives and guides some of our policies and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Our board of directors does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Trevi Therapeutics, Inc.

ticker: TRVI


text: As further described in Item 1A. "Risk Factors – Risks Related to Cybersecurity, Data Security, and Privacy, Information Technology and Intellectual Property," the Department of Homeland Security's Transportation Safety Administration has issued a series of security directives that require us to take a number of actions, including among other things, to appoint personnel, report confirmed and potential cybersecurity incidents to the DHS Cybersecurity and Infrastructure Security Agency and provide vulnerability assessments. We have adopted a cybersecurity program, which uses technology and processes designed to help mitigate cybersecurity risks, with our information technology ("IT") and operational technology ("OT") teams working together to protect, identify, detect, mitigate and respond to potential cybersecurity incidents that threaten our Company.

companyName: HF Sinclair Corp

ticker: DINO


text: We recognize the critical role of developing, implementing, and maintaining cybersecurity measures to protect our information technology networks and systems and the sensitive data of our partners, clients, and members. To manage cybersecurity risks, we use a multi-layered security approach, involving data privacy, application security, physical and environmental security, network access controls, monitoring and incident reporting, administrative and service availability controls, and regulatory compliance. As part of this multi-layered approach, Sharecare utilizes a managed service for its Security Operations Center that monitors all security related events collected in our Security Information and Event Management (SIEM) system 24x7. The SIEM application correlates events from the various systems and applications looking for indicators of compromise, and if found, initiates our incident response protocols. Through data protection, high availability, and built-in redundancy, Sharecare mitigates risks to application availability and minimizes accidental data loss or destruction during a cybersecurity incident, business interruption, or other event.

companyName: Sharecare, Inc.


text: Our information technology team, led by our Vice President of Engineering and Operations, helps identify, assess, and manage our cybersecurity threats and risks. Our information technology team assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example analyzing threat reports, conducting audits, and using intelligence feeds.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Risks from cybersecurity threats, incidents or intrusions have not thus far materially affected, and are not currently anticipated to materially affect, our Company, including our business strategy, results of operations or financial condition. See, however, Item 1.A, Risk Factors—"We are subject to cyber security risks. Cyber incidents or intrusions may result in information theft, data corruption, operational disruption and/or financial loss" for additional information regarding cybersecurity risks we face and their potential impact on our business strategy, results of operations and financial condition.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: The Advisor partners with several third-party technology providers to monitor and protect internal IT infrastructure and data. The Advisor has hired Marco Technologies, as the organization's Managed IT provider with tools that systematically update hardware and software while also monitoring uptime to ensure seamless business operations. Marco Technologies also provides cyber security trainings, which all Advisor personnel are required to complete on a monthly basis. The Advisor utilizes Red Canary to provide 24/7 monitoring on all end points with triggers to isolate and mitigate any suspicious cyber activity. Finally, High Point Networks provides physical and cloud-based network data backup solutions for the Advisor. In collaboration with the Advisor, an extensive data back-up plan is in place with Return to Operations objectives of less than 24 hours. Although our CTO does not come from an information technology background, she relies on her extensive organization and project management experience to coordinate and manage the third-party providers who perform our cybersecurity function and to implement our cybersecurity incident response plan described below.

companyName: Sterling Real Estate Trust


text: The Company maintains a robust Third-Party Risk Management program to manage risks related to third-party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments to ensure sensitive information is safeguarded appropriately.

companyName: Beacon Financial Corp

ticker: BBT


text: Both the CIO and CISO regularly report to the Audit Committee, Board and Governance and Compliance Committee, on the company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2024, the Board reviewed the company's cybersecurity program and maturity assessment, while the Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks at five committee meetings during the course of the year. With respect to specific incidents, the company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CISO, along with the company's senior leadership, including the finance and legal functions. In the event of a potentially material cybersecurity incident, the Audit Committee would be immediately notified and briefed.

companyName: Corteva, Inc.

ticker: CTVA


text: Governance. Regions' system of internal controls also incorporates an organization-wide protocol for the reporting and escalation of cybersecurity matters, including to management and the Board. The Board also receives updates on the Company's enterprise services, which includes resilience, information technology, and cybersecurity. The Board considers both business and technical resilience, cybersecurity and technological innovation, and privacy considerations, along with related risk considerations and mitigation efforts, within the Company's strategic plan. The Board is actively engaged in the oversight of Regions' continuous efforts to reinforce and enhance its operational resilience and receives education on the cybersecurity landscape. The Board oversees the management of cybersecurity and related risks primarily through its Risk Committee, which is supported at the management level by the ERMC, ORC, and TOROC which fall under the Risk Committee's purview. The Board's Risk Committee annually reviews and approves Regions' Information Security Policy; reviews information and regular reports on the topic from members of management on at least a quarterly basis; and recommends actions and other steps to be taken, as it deems appropriate. Additionally, the Board's Audit Committee periodically receives reports on the IS Program prepared by the Chief Information Security Officer and the Company's Risk Management and Internal Audit functions. The Board's Technology Committee is charged with oversight of the overall role of technology in executing Regions' business strategy and coordinates with the Risk Committee on risk assessment and management associated with technology-related strategic investments, major technology vendor relationships, and risks associated with information technology and security activities. The Board annually reviews the IS Program and, through its various committees, is briefed at least quarterly on cybersecurity matters. In addition, our management follows a risk-based escalation process to notify the Audit Committee and Risk Committee outside of the regular reporting cycle when they identify an emerging or risk or material issue.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Some of the steps we have taken and processes we have implemented to assess, identify, and manage material risks from cybersecurity threats include the following:

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: To further our commitment to data privacy and cybersecurity: • Atleos maintains the ISO 27001 certification for certain locations throughout the United States, Europe, Australia, and India; • Third-party audits for PCI-DSS, PA-DSS and SSAE-18 SOC2 are conducted for certain service offerings; • Atleos engages third party experts to perform penetration tests to attempt to infiltrate our information systems, as such term is defined in Item 106(a) of Regulation S-K; • Atleos maintains a robust information security awareness and training program. Employees and contingent workers are required to complete training within 30 days of hire, as well as an annual refresher course; • Atleos performs regular testing to help ensure employees can identify email "phishing" attacks; and • Atleos' corporate insurance policies include certain information security risk policies that cover network security, privacy and cyber events.

companyName: NCR Atleos Corp

ticker: NATL


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence, other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Ceribell, Inc.

ticker: CBLL


text: The Bank maintains a three lines of defense structure with the Cybersecurity Division as the primary security control owner, Enterprise Information Security providing review, assessment and challenge of risk management policies and processes, and an Internal Audit team providing independent review of the first and second lines of defense. The CISO facilitates communication across business lines to support effective and consistent information security risk identification and control infrastructure, maintaining an ongoing dialogue regarding emerging or potential cybersecurity risks, receiving updates on significant developments in the cybersecurity domain and ensuring that the Board's oversight is proactive and responsive.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Additionally, as a public company, we are subject to Sarbanes-Oxley Act ("SOX") requirements and must undergo independent audits of information technology general controls in support of internal control over financial reporting.

companyName: Terreno Realty Corp

ticker: TRNO


text: Our cybersecurity risk is managed as part of our broader enterprise risk management program. Specifically, a risk management workstream focused on our information technology function (including cybersecurity) is designed to assess, identify and manage cybersecurity-related risks and mitigation measures. Our cybersecurity risk program also includes a documented incident response plan to be used in the event of a cybersecurity incident. The incident response plan provides for certain responses based on various factors of a cybersecurity incident.

companyName: FULLER H B CO

ticker: FUL


text: 2022, we have been primarily focused on launching our real estate management and hospitality business. We have 21 employees and currently use a third-party sub-contractor to manage all Information Technology (IT) issues, including protection against, detection, and response to cyberattacks.

companyName: Awaysis Capital, Inc.

ticker: AWCA


text: The Chief Information Security Officer (CISO) leads our global information security organization responsible for overseeing the Company's information security program. Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at various technology companies. The global information security organization provides regular reports to senior management on various cybersecurity threats, assessments and findings.

companyName: ManpowerGroup Inc.

ticker: MAN


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established a robust oversight mechanism to ensure effective governance in managing risks associated by cybersecurity threats because we recognize the significant of these threats to our operations integrity and stakeholder confidence.

companyName: Via Renewables, Inc.

ticker: VIASP


text: In connection with our November 2024 portfolio prioritization, our Vice President, Information Technology assumed from our former Head of Information Security responsibility for assessing and managing our material risks from cybersecurity threats. He has worked in various roles pertaining to Information Technology for more than fifteen years. The processes by which he is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: vulnerability management, third party risk management, data security management, security awareness training, systems management, operations security, security incident and event management, and incident response management. We use third parties for managed detection and active response to cybersecurity incidents.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: The Company manages cybersecurity and data protection through a continuously evolving framework. The framework is intended to allow us to identify, assess and mitigate the various risks we face, and assists us in establishing policies and safeguards, which are modified as new cybersecurity risks and incidents occur, to protect our systems and the information of those we serve. Our cybersecurity program is managed by our Chief Information Security Officer. The Audit Committee of the Board of Directors has oversight of our cybersecurity policy and is responsible for reviewing and assessing the Company's cybersecurity risk management, procedures and resource commitment, including key risk areas and mitigation strategies.

companyName: Value Exchange International, Inc.

ticker: VEII


text: The CISO has over 17 years of banking experience, is a Certified Information Systems Security Professional, and has been involved with the management of information and cybersecurity for over ten years. The CISO regularly reports to the Board Technology & Information Security Committee on information and cybersecurity strategy, testing, training, policies, procedures, cybersecurity insurance, and overall effectiveness of the Information Security Program and would report and discuss material incidents, and ongoing mitigation status, if any should occur. The CISO is the chair of Management's Information Security Committee that meets on a monthly basis to evaluate threats, incidents, defense system effectiveness, accepted risks, results of third-party cyber assessments and engagements, and the overall adequacy of the cybersecurity program. In addition, the Chief Information Officer has over 15 years of experience in managing bank technologies, information security, and risk management, and collaborates in supporting the Information Security Program. The CISO reports directly to the Chief Risk Officer and meets on a monthly basis with the Executive Management team to discuss cybersecurity risk management matters.

companyName: ENTERPRISE BANCORP INC /MA/


text: As of December 31, 2023, we have not encountered any cybersecurity threats that have had a material impact on our operations, business strategy, financial results, or overall financial health.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves. As a backstop to our strong information security programs, policies, and procedures, we purchase a cybersecurity risk insurance policy that would defray the costs of an information security breach, if we were to experience one.

companyName: Invitation Homes Inc.

ticker: INVH


text: The CISO, in coordination with management level committees, along with Infosec, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.

companyName: Thoughtworks Holding, Inc.


text: Cybersecurity has been identified as a top risk, as attacks against participants in our industry have continued to increase in sophistication and frequency over the years. Although we devote significant resources and security measures to prevent unwanted intrusions and to protect our systems and data, we (and our third-party vendors) have experienced, and expect to continue to experience, cyber attacks of varying degrees in the conduct of our business, including, for example, denial of service attacks. Cybersecurity risk is described in Item 1A. Risk Factors.

companyName: ENBRIDGE INC

ticker: ENB


text: The IT Steering Committee focuses on technology and business impact and is responsible for overseeing the Company's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The ISO and SVP/IT Manager provide quarterly reports to the IT Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes. The IT Steering Committee reviews and approves the information security and technology budgets and strategies annually.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Maintaining people's trust is of paramount importance for Logitech. Logitech's security capability is designed to protect the confidentiality, integrity, availability and accessibility of Logitech's information, digital assets, products and services. Our security capability includes: (i) cybersecurity, which protects information and digital assets used at Logitech to conduct business and (ii) product security, which protects Logitech products and services provided to our customers.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: We may engage consultants and other third parties as needed in connection with our risk assessment policies and processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: Our board of directors has oversight responsibility for our overall enterprise risk management, and delegates cybersecurity risk management oversight to our audit and risk committee. As part of its enterprise risk management efforts, our board of directors also meets with management to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. Our audit and risk committee is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which the Company is exposed. Further, our audit and risk committee reports material cybersecurity risks to our full board of directors, based on the assessment of risk by our management, CISO, information security team, internal audit team, and legal team.

companyName: Remitly Global, Inc.

ticker: RELY


text: The Board of Directors ("Board") and management believe that cybersecurity is vital to protecting proprietary and confidential information, company operations and maintaining the trust of our customers, agents, franchisees, and employees. The Company has a cybersecurity risk management strategy and a governance framework to assess, identify and manage material risks from cybersecurity threats. As discussed below, the Company utilizes both internal and external resources as part of its cybersecurity program.

companyName: Anywhere Real Estate Group LLC


text: We have implemented a variety of measures to enhance our cybersecurity protections and minimize the impact of any future attack, including by (i) requiring that all external vendors who need to access any internal/cloud resources utilize secure encrypted tunnels or be physically internal and utilize authorized terminals with provided credentials, (ii) conducting security awareness training for our staff and (iii) requiring longer log retention for all tracking telemetry information. However, cybersecurity threats are constantly evolving, and there can be no guarantee that a future cybersecurity event will not occur. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including through the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as the use of artificial intelligence may further expose our computer systems to the risk of cybersecurity incidents.

companyName: Falcon's Beyond Global, Inc.

ticker: FBYD


text: The Audit Committee oversees, on behalf of the Board, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Our CDIO leads the Company's digital optimization and information technology initiatives. He is also responsible for driving the strategy, execution and integration of all banking and nonbanking technology, information and digital initiatives in alignment with the Company's corporate business strategy. Our CDIO assumed his current role in January 2022. Prior to that, he served as the Company's Senior Vice President of Technology and Operations, where he lead the Company's core processing and operations functions, and the development of technology-driven products and services. Our CDIO has over 20 years of technology and operations experience in the banking industry.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC


text: We have not experienced a significant compromise, significant data loss, or any material financial losses related to cybersecurity attacks, and no risks from cybersecurity threats that are known to us are believed to be reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Risks and exposures related to cybersecurity attacks, however, are expected to remain high for the foreseeable future, due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of third-party service providers, internet banking, mobile banking, and other technology-based products and services.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: We seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services;

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC


text: Board of Trustees' and Management Oversight Our Board of Trustees oversees our cybersecurity program and initiatives through its Audit Committee. The Audit Committee, in consultation with management, actively oversees and manages the Company's cybersecurity risk, including periodically reviewing our policies and procedures with respect to risk assessment and risk management.

companyName: EQC Liquidating Trust


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our President has overall oversight and with our Chief Financial Officer oversees our external information security professionals who have primary responsibility for our overall cybersecurity risk management program and supervises our internal personnel on these matters.

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: Processes for identifying and assessing cybersecurity risks The CISO, with the support of the outside consultant's cybersecurity team and the owners of information technology across the business, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations. There are several processes in place to monitor and review our systems, including third-party solutions, to identify potential risks. Third-party service providers are required to notify us in the event of a cybersecurity incident within their systems, and annual reviews are conducted on our critical third-party vendors. Cybersecurity risks, threats, and incidents, including those from third-party service providers, are tracked and regularly provided to the CISO.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: Review of Third Parties There are risks associated with sharing information with third parties, and with allowing third parties to access our systems. Therefore, prior to integrating any third-party provider's information into our systems, we assess their security maturity against our standards, assess business risks associated with integration and request changes as we deem necessary.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: We have a comprehensive third party cybersecurity risk review process, which prioritizes, monitors and assesses the risks associated with our third party service provider interactions. The third party service provider assessment framework follows industry standard practices and allows us to properly understand the risk associated with the services provided which are key to our company's daily operations.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, as well as performing intrusion detection and prevention. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: a.monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: EXAGEN INC.

ticker: XGN


text: Our Board of Directors considers cybersecurity risk to be a critical part of its risk oversight function and has delegated to the Risk & Technology Committee primary oversight of cybersecurity and other information technology risks. The Audit Committee also reviews cybersecurity matters as part of its oversight of major financial risk exposures. The Risk & Technology Committee oversees management's implementation of our cybersecurity risk management program, and receives regular reports from management on our cybersecurity risks. In addition, management updates the Risk & Technology Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: The Technology Risk Management Director is responsible for maintaining the Company's information and cyber security risk management framework. This framework establishes standards and processes for the continuous assessment of material cybersecurity risks, covering identification, measurement, mitigation activities, monitoring and reporting of the risk posture at any given time. Additionally, the Director ensures oversight and compliance with the Security Incident Response Plan, providing guidance during security incidents, whether within the Company or involving service provider/vendor engagements.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Our executive team, including our Senior Vice President, Chief Operating Officer and Chief Financial Officer and our Senior Vice President, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The executive team has primary responsibility for our overall cybersecurity risk management program. Our Senior Vice President, Chief Operating Officer and Chief Financial Officer supervises our Vice President, Chief Accounting Officer, who leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare our company and our internal cybersecurity personnel and retained external cybersecurity advisors to address cybersecurity risks. Our Vice President, Chief Accounting Officer and the internal cybersecurity personnel under his supervision collectively have experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within complex and international business verticals, such as pharmaceuticals/biotechnology, technology, telecommunications and financial services, and hold several related third-party certifications related to information systems management and security.

companyName: Mersana Therapeutics, Inc.


text: The IT Director meets periodically with members of the Relay Information Security Council, or RISC, which is comprised of the VP of IT and senior leaders from various functions, including finance, legal, human resources, corporate development, and research and development. The RISC provides input to the IT Director in connection with proposed cyber strategies as it relates to potential business impacts from new or proposed technologies and security solutions across the organization, including implementation strategies designed to address potential risks and disruptions to the business. In the event we or one of our business partners experiences a cybersecurity incident, the RISC is responsible for assisting in evaluating the incident, including whether any disclosure of the incident is required. The VP of IT reports to the Audit Committee on cyber initiatives and implementation resulting from RISC discussions.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: Management is responsible for the Company's day-to-day risk management and the Board serves in an oversight role. The Board has empowered the Audit Committee with formal oversight of enterprise risk matters, including with respect to cybersecurity. The Audit Committee and management periodically review the Company's policies with respect to risk identification, assessment, and management, including cybersecurity risk exposures and the internal controls and procedures in place to manage such risks, as well as the steps that management takes to monitor and control such exposures. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues.

companyName: Collective Audience, Inc.


text: The Audit Committee receives at least quarterly reports from our Chief Digital & Technology Officer and internal security staff on developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, and how management is managing risks. In addition, the Chief Digital & Technology Officer updates the Audit Committee, as necessary, regarding any material cybersecurity incidents per our established severity and response framework, as well as any incidents with lesser impact potential.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: Our cybersecurity risk management program incorporates multiple components, including, but not limited to, ongoing monitoring of critical risks from cybersecurity threats using automated tools. Additionally, we have implemented an employee education and training program, which we provide on an annual basis, that is designed to raise awareness of cybersecurity threats. To support our cybersecurity risk management program, we leverage managed service providers and other third-party information technology and cybersecurity providers and consultants, including to perform regular system scans and threat intelligence analysis. Additionally, we require certain third-party providers and consultants to adhere to contractual requirements relating to privacy and cybersecurity standards. We do not have a board of directors committee or subcommittee responsible for the oversight of risks from cybersecurity threats.

companyName: HealthLynked Corp

ticker: HLYK


text: The Company's Board of Directors does not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, financial condition, results of operations, or cash flows.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: We have an information security training program that includes: monthly awareness articles, a phishing training program (with reports reviewed by the Executive Team), and required and optional training modules in our Learning Management System.

companyName: Zoetis Inc.

ticker: ZTS


text: The Company has not experienced any material cybersecurity incidents, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to the Company, including potentially to the Company's results of operations and financial condition. The Company relies extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that the Company may expend greater resources to continue to modify and enhance protective measures against such security risks.

companyName: TWIN DISC INC

ticker: TWIN


text: Members of the Committee will present the results of the periodic performance and effectiveness review to our Board of Directors, who oversee our risk management processes directly and through its committees. These results, along with other cybersecurity topics including updates on previously identified material cybersecurity threats or incidents, are presented at regularly scheduled meetings. Members of the Committee will also notify our Board of Directors between such meetings regarding significant new or updates to ongoing cybersecurity threats or incidents.

companyName: PC CONNECTION INC

ticker: CNXN


text: Our VP of Information Security has over 15 years of experience in technology and information security, serves on the board of directors of the Retail & Hospitality Information Sharing and Analysis Center ("RH-ISAC") and holds several cybersecurity and risk management certifications. Our SVP of Information Technology has over 30 years of information technology management and cybersecurity experience and has held leadership roles overseeing all aspects of information technology operations for multiple Fortune 500 and Fortune 50 global companies, particularly in the retail and media & entertainment sectors.

companyName: SKECHERS USA INC


text: Our Board of Directors (the "Board") has oversight responsibility for cybersecurity risk management. The Board oversees management's ongoing activities related to our cybersecurity risk management program. The management team is responsible for the implementation and execution of our cybersecurity program. In addition, the management team provides guidance and direction on cybersecurity priorities, resource allocation and risk tolerance levels. The Board receives quarterly updates from the management team on cybersecurity matters.

companyName: DIXIE GROUP INC

ticker: DXYN


text: The Information Security Department is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats and overseeing cybersecurity third-party relationships. The Information Security Department is led by our CISO, who has over 15 years of experience in the cybersecurity space and has obtained professional security certifications and advanced training in the field of cybersecurity and technology. Our CISO and our Chief Information Officer, along with key members of their departments, regularly collaborate with peer institutions, industry groups, policymakers and third-party relationships to discuss cybersecurity trends and issues and identify best practices. The cybersecurity risk management program is periodically reviewed to address changing threats and conditions. Our internal audit team, led by our Chief Internal Auditor, provides independent assurance and evaluation of processes, controls and cybersecurity risk management practices to ensure they are adequate and functioning as intended.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: In 2023, we implemented a Third-Party Risk Management Program to perform IT security controls assessments for our third-party suppliers and vendors and measure the IT security rating of Celestica and these entities through an external security rating solution platform. Through this program, our IT Risk and Compliance team assesses, monitors, and mitigates potential cybersecurity risks from our third-party suppliers and vendors. In addition, an external service is used to assess the cybersecurity risk rating of third party suppliers and vendors.

companyName: CELESTICA INC

ticker: CLS


text: The Company has established and maintains comprehensive incident response and recovery plans intended to fully and timely address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: EASTERN CO

ticker: EML


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board of Directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Audit Committee also oversees our internal audit department and management's internal controls over financial reporting, including with respect to cybersecurity.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Our Cybersecurity team, comprised of seasoned IT and cybersecurity members, has decades of experience across multiple technical and compliance disciplines including cyber incident response, forensics, IT compliance, incident recovery, threat investigation and information technology. Our cybersecurity team includes several individuals who hold industry recognized certifications and advanced degrees in cybersecurity. Cybersecurity oversees the implementation and compliance of our information security standards, information technology compliance, and mitigation of information security related risks. The Chief Technology Officer and Chief Information Officer have direct oversight of the cybersecurity function. We also have management level committees, leaders, and a cybersecurity incident team who support our processes to assess and manage cybersecurity risk as follows: • The head of privacy, in conjunction with the cybersecurity leadership assists on identification and mitigation of privacy related risks across the enterprise. This combination brings together legal, compliance and other function leads as required. • The Cybersecurity Disclosure Steering Committee, comprised of leadership from IT, cybersecurity, operations, risk, finance, legal and compliance across business segments, contributes to the assessment of cybersecurity breach, planned response, and required disclosures and filings. • The Rapid Response Team, which includes senior executives across the Company and its global operations, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. The Rapid Response Team performs tabletop exercises on a yearly basis with inclusion across functions.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: Our cybersecurity policies and procedures include the controls and technology we use to identify, assess and respond to cybersecurity threats and incidents. These policies and procedures also focus on identifying vulnerabilities in our internal and external environments and remediating those vulnerabilities. To combat cybersecurity risk, we focus on proactive procedures such as patch management and quarterly cybersecurity training of our employees. In an effort to mitigate cyber risks for customer-facing software, we incorporate the protocols described above along with software specific programs such as a bug bounty system and partnerships with external experts.

companyName: POOL CORP

ticker: POOL


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is responsible for assessing and managing risks from cybersecurity threats. Specifically, our CIO, supported by our Global Information Security Team, is responsible for the overall management of our information security program, which includes assessing, identifying and managing cybersecurity risks and material risks from cybersecurity threats. The Company's CIO was promoted to the position in January 2024 after serving as Senior Vice President – Enterprise Applications since July 2022. The CIO has more than 25 years of manufacturing experience, mostly in IT leadership roles in the semiconductor industry, and holds electrical and computer engineering degrees from the University of Missouri and an MBA from The Ohio State University.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: As part of our overall risk management approach, we seek to prioritize the identification and management of cybersecurity risk at several levels in our organization, including through oversight by our Board of Directors and management team. Our Board of Directors oversees risk from cybersecurity threats and our procedures for protecting our cybersecurity infrastructure, and members of management responsible for our cybersecurity risk management program are expected to periodically report to the Board of Directors regarding cybersecurity risk.

companyName: Falcon's Beyond Global, Inc.

ticker: FBYD


text: Quarterly, the Chief Information Officer presents detailed cybersecurity reports to the Enterprise Risk Committee, focusing on strategic initiatives and evolving threats. The Enterprise Risk Committee, meeting quarterly, evaluates cybersecurity within the broader organizational risk context, ensuring consistent assessment and management.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: At NIKE, cybersecurity risk management is an important part of our overall risk management efforts. We have cybersecurity processes, technologies and controls in place to aid in our efforts to assess, identify and manage material risks associated with cybersecurity threats. We assess cybersecurity risk at both the board and management levels.

companyName: NIKE, Inc.

ticker: NKE


text: The Company's cybersecurity risk management program and strategy are designed to ensure the Company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.

companyName: Veritex Holdings, Inc.


text: The Company has a designated IT Security Team to maintain its cybersecurity program and oversee third-party service providers that provide cybersecurity protection. The IT Security Team is tasked with the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and reports to our DevOPS/Security Manager. The team is comprised of personnel with a broad range of experience across the business and information technology industries, including our DevOPS/Security Manager, a DevOPS Security Administrator, and employees in senior legal and administrative roles. The IT Security Team relies on the advice of the Manager DevOPS/Security related to the security of our data and any mitigation steps necessary.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: February 2024, the Company engaged HUB International as its national insurance broker and risk services consultant. HUB brings industry expertise specifically regarding cybersecurity. (iii)

companyName: BOXABL Inc.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Any actual or perceived security or privacy breach or incident could interrupt our operations, harm our brand and adversely affect our reputation, brand, business, financial condition and results of operations."

companyName: Lyft, Inc.

ticker: LYFT


text: We maintain and continually enhance a comprehensive, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the Board of Directors. Our Chief Technology & Data Officer holds overall responsibility for IT, OT, and cybersecurity. Delek follows recognized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.

companyName: Delek US Holdings, Inc.

ticker: DK


text: Davey Tree also uses third-party service providers to support its business operations and many of its technology platforms and is aware of risks associated with using such services. We periodically monitor and assess third-party service providers from a cybersecurity risk perspective and continuously seek to enhance our third-party risk management program.

companyName: DAVEY TREE EXPERT CO


text: Risks from Cybersecurity Threats Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: TIC Solutions, Inc.

ticker: TIC


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, financial, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. Our cybersecurity program is informed in part by industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This program is managed and monitored by a dedicated information technology team, including a Senior Director of Information Security, and is led by our Senior Vice President, Chief Information Officer, or CIO. Our processes include mechanisms, controls, technologies, and systems designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Our program includes, for example: • Regular penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments; • Engagement of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model; • Cybersecurity awareness training for our employees, contactors, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and annual tabletop exercises with participants from cross functional teams; • A third-party risk management process for service providers, suppliers, and vendors including due diligence prior to engagement and ongoing periodic review of our key technology vendors, and other contractors and suppliers.

companyName: Ultragenyx Pharmaceutical Inc.

ticker: RARE


text: Oversight and Governance BNY Mellon's management is responsible for assessing and managing BNY Mellon's material risks from cybersecurity threats with oversight provided by its Board of Directors (the "Board") and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon's risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon's cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit Committee of the Board monitors and oversees the performance of Internal Audit, including with respect to its cybersecurity risk management responsibilities.

companyName: VOC Energy Trust

ticker: VOC


text: Our cybersecurity program utilizes the International Organization for Standardization Information Security Management Systems (" ISO 27001") framework, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness. Our approach to protecting our systems uses the concept of defense in depth, providing multiple layers of defense, monitoring, and controls. It is a mutually supported environment of fit-for-purpose technology, established processes, trained security and operations personnel, and supporting external services.

companyName: KORN FERRY

ticker: KFY


text: Technical Safeguards: Together with the MSP, we deploy technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention systems, endpoint detection and response systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Through December 31, 2023, the date on which our CIO retired, our CIO, who had extensive cybersecurity knowledge and skills gained from over 25 years of experience in the construction industry, including four years as our CIO, led the team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business and reported directly to our Chief Financial Officer. This team, during our search for a new CIO, continues to implement, monitor, and maintain our cybersecurity program and provides reports on cybersecurity threats to management on an ongoing basis. In conjunction with management, this team regularly reviews our risk management measures to identify and mitigate data protection and cybersecurity risks and also works closely with our legal team to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: Tri Pointe Homes, Inc.

ticker: TPH