text: Our Company faces a number of cybersecurity risks in connection with the operation of our business which could have a material adverse effect on our business financial condition, results of operations, cash flows, or reputation. As part of the operation of our business, the Company, and our service providers, use, store, and process data for our customers, employees, partners, and suppliers. A cybersecurity incident impacting any of these entities could materially and adversely affect our operations, performance, or results of operations. In addition, as a financial services company we are subject to extensive regulatory compliance requirements, including those established by the FRB, FDIC and the DFR. To address these risks and regulatory requirements, the Company established a robust cybersecurity risk management program. This program safeguards sensitive customer data, financial transactions, and our information systems, serving as a vital component of our broader enterprise risk management strategy.

companyName: UNION BANKSHARES INC

ticker: UNB


text: We evaluate cybersecurity risk as part of our broader enterprise risk framework. Our Board of Directors oversees Haemonetics' enterprise-wide approach to risk management while our management team is responsible for managing risk on a day-to-day basis and for bringing to the Board's attention material risks facing the Company, including with respect to cybersecurity threats. The Board focuses on the quality and scope of the Company's risk management strategies and considers the most significant areas of risk inherent in the Company's business strategies and operations as well as the steps that management is taking to mitigate those risks. We conduct an annual enterprise risk assessment – including consideration of cybersecurity risks – that is reviewed with the Board and Audit Committee and informs strategic priorities throughout the Company. Additionally, certain Board committees consider discrete categories of cybersecurity risk relating to their respective areas of responsibility. O ur CISO reports at least annually on Haemonetics' threat landscape and security programs to our Governance and Compliance Committee, which oversees Haemonetics' compliance programs and policies regarding data privacy and cybersecurity risks associated with our information technology systems. Management also reports on these programs to the Audit Committee as needed and periodically reviews with our Technology Committee certain aspects of new and existing products as they relate to quality, safety and cybersecurity.

companyName: HAEMONETICS CORP

ticker: HAE

secItem: Item 1C


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our COO, Mr. Chris Williams. Mr. Williams has experience in the security of both corporate and technical systems as well as business continuity planning in previous security operations roles at public pharmaceutical companies.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: As a global organization, the Company's information systems are subject to various risks, including, but not limited to risks associated with ransomware, system disruption, data theft, unauthorized access to information, and misuse of data. To identify, address, and mitigate these risks, the Company has developed and maintains a cybersecurity program. The Company's cybersecurity program is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Company's Enterprise Risk Management (ERM) process and relies on internal and external expertise.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats, or incidents or that we will be successful in mitigating the consequences of any such incidents. A cybersecurity incident could materially and adversely affect our business strategy, results of operations, or financial condition due to a loss, or loss of access to, our funds, reputational damage, a loss of customers and related revenues, and/or the institution of governmental enforcement actions or civil litigation against us. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this report under the heading "Risks Related to Our Business," which should be read in conjunction with the foregoing information.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: incidents. All Company employees are required to participate in scheduled training and are obligated to certify the completion of each training session. Additionally, all third parties retained by the Company, including vendors, that are granted access to the Company's IA are required to certify compliance with all relevant Company policies relating to such access and re-certify compliance as deemed necessary. This certification includes the completion of questionnaires that are reviewed by the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO").

companyName: MBIA INC

ticker: MBI


text: Our Vice President of Information Technology and our cybersecurity team are experienced information systems security professionals. These individuals, working with cybersecurity vendors, including managed IT service providers and training partners, monitor for vulnerabilities and threats, which are reported to other members of management, where appropriate.

companyName: Karuna Therapeutics, Inc.


text: The continued growth in the frequency, complexity and sophistication of cyberattacks presents both a threat and an opportunity for FIS. Using expertise we have gained from our ongoing focus and investment, we have developed and we offer fraud, security, risk management and compliance solutions to target this growth opportunity in the financial services industry. We also use certain of these solutions to manage our own risks.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: IHM, in coordination with our General Counsel, is responsible for testing the Incident Response Plan on a periodic basis. In addition, our Audit Committee and General Counsel will review on at least an annual basis the Incident Response Plan and update the Incident Response Plan, as appropriate, to address applicable legal requirements and the Company's policies, procedures and information security and business objectives. Periodically, the Audit Committee will review (i) the Cybersecurity Policies and (ii) the Company's cybersecurity risk exposure and discusses steps management has taken to monitor or mitigate such risk exposure.

companyName: Chatham Lodging Trust

ticker: CLDT


text: General and Other Risk Factors • the adequacy and availability of, and ability to obtain, insurance coverage, customer indemnifications or other liability protections • the future investment performance of plan assets, gains or losses associated with changes in valuation of marketable securities related to our non-qualified benefit plans, changes in actuarial assumptions associated with our pension and other postretirement benefit plans and legislative or other regulatory actions impacting our pension and postretirement benefit obligations • changes in business conditions that could impact business investments and/or recorded goodwill or the value of other long-lived assets, and other potential future liabilities We urge you to consider the limitations on, and risks associated with, forward-looking statements and not unduly rely on the accuracy of forward-looking statements. These forward-looking statements speak only as of the date this report is first filed or, in the case of any document incorporated by reference, the date of that document. We undertake no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise, except as required by applicable law.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: As part of our overall risk management program, we provide required training to employees in high-risk areas on cybersecurity and will distribute standard operating procedures to all employees. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: We also provide our employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. We conduct regular phishing tests and provide additional training as appropriate.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: As part of its overall risk oversight activities, with respect to cybersecurity risk management, the audit committee: • oversees the quality and effectiveness of our policies and procedures with respect to our information technology and network systems; • provides oversight on our policies and procedures in preparation for responding to any material data security incidents; and • oversees management of internal and external risks related to our information technology systems and processes.

companyName: Invitation Homes Inc.

ticker: INVH


text: As indicated above, supporting our operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.

companyName: BV Financial, Inc.

ticker: BVFL


text: The Board of Directors of the Company (the "Board") is presented with a cybersecurity update quarterly and is integrated within our TriMas Incident Response Plan. The Board reviews the Company's ERM process, including the design of the program, the key risks identified and the actions identified to manage and reduce those risks. Consistent with this undertaking, the Board regularly reviews the Company's cybersecurity strategy and activities in support of the strategy. As part of its compliance oversight responsibilities, the Audit Committee of the Board (the "Audit Committee") is responsible for the review of compliance with laws, regulations and internal policies and procedures of our information and cybersecurity programs. The Board and the Audit Committee receive updates from management quarterly on information and cybersecurity status and enhancements. Additionally, prompt notification of the Board is integrated into the Incident Response Plan.

companyName: TRIMAS CORP

ticker: TRS


text: Members of the audit committee and the board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management programs. Material cybersecurity threat risks are also considered during audit committee and/or board discussions of important matters such as enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions and other relevant matters.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Our cybersecurity program and policies establish the responsibilities of individuals and committees tasked with oversight of security risk management and provide broad directives that support implementation for identifying, assessing and managing risks from cybersecurity threats. We conduct an annual information security risk assessment which includes a review of the organization's performance of administrative, technical and physical safeguards protecting personal and confidential information. Information security related policies are reviewed on an annual basis and approved by the owners of each functional area.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, which includes our management of information and cybersecurity risk. The full Board receives an update on our cyber risk management process and trends related to cybersecurity at least annually. The Audit Committee of the Board assists the full Board in its oversight of cybersecurity risks and as part of its oversight, the Audit Committee receives reports from management on information systems and security at each meeting, including metrics and controls, and other items from time to time such as risk assessments, security software, and incident response plans.

companyName: SMITH A O CORP

ticker: AOS


text: The Board of Directors and Executive Management are responsible for ensuring that the Information Security Program within Enterprise Risk Management identifies, measures, monitors, controls, and reports risk according to significance. If risks are determined to be undesired and beyond stated and aggregated Risk Appetites, the Board of Directors and Executive Management take appropriate action to ensure that excessive risk is mitigated or eliminated, which may include reducing risk exposure. The Board of Directors has final responsibility, after consultation with management, for ensuring the Information Security Program aligns with the overall business strategy and provides oversight to protect the Company from ongoing and emerging threats, including those related to cybersecurity.

companyName: Beacon Financial Corp

ticker: BBT


text: Oversight and Governance Our Head of Information Technology serves as our Information Security Officer (ISO) and has primary responsibility for managing our information technology team and external service providers and for generally assessing and managing our cybersecurity risk management program. Currently, the ISO role is held by an individual who has more than 20 years of experience in leading information security teams and who has implemented and managed cybersecurity programs for other publicly-traded biotechnology companies. Our ISO's experience includes developing and maintaining tools and processes designed to protect internal computer and telecommunications networks used to store, process, and transmit personal and confidential data.

companyName: Vigil Neuroscience, Inc.


text: Our Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board of Directors has oversight responsibilities for risk management with a focus on the most significant risks facing us, including strategic, operational, financial and legal compliance risks. The Board's risk oversight process builds upon management's risk assessment and mitigation processes, which include an enterprise risk management program of which our cybersecurity processes are an integral component.

companyName: SelectQuote, Inc.

ticker: SLQT


text: Our Information Security Management team, among other things, is responsible for conducting risk assessments, designing the Information Security Program to manage identified risks based on information sensitivity and the Company's operational complexity, overseeing service provider arrangements, and managing risks associated with third-party service providers by conducting due diligence prior to engagement and ongoing monitoring of vendors' security practices, including their ability to prevent, detect, and respond to cybersecurity threats. They also establish risk-based response programs for incidents of unauthorized access, providing staff training, conducting testing of key controls, systems, and procedures, and adjusting the program in response to changes in people, processes, technology, sensitive information, threats, and the business environment (e.g., mergers, acquisitions, alliances, joint ventures, or outsourcing arrangements).

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the MITRE ATT&CK framework. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF and MITRE ATT&CK as guides to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: CALIX, INC

ticker: CALX


text: Our enterprise risk management framework assesses cybersecurity threats alongside other company risks as part of our overall risk assessment process. This approach involves collaboration between enterprise risk professionals and subject matter experts to identify and assess material cybersecurity threat risks, their severity, and potential mitigations. We leverage various tools and services, including network monitoring, vulnerability assessments, penetration testing, and tabletop exercises, to enhance our risk identification and assessment capabilities.

companyName: ARTIVION, INC.

ticker: AORT


text: The Vice President of Information Technology works together with our board of directors, audit committee, and members of executive management ("Cybersecurity Team") to set the strategic digital landscape. The Cybersecurity Team provides strategic guidance and oversight to ensure our cybersecurity posture is robust and aligned with our overall objectives. The Cybersecurity Team does this by establishing cybersecurity policies and setting risk tolerance levels, approving budgets for security initiatives, and ensuring compliance with relevant regulations and standards. The Cybersecurity Team engages in regular discussions regarding incident response strategies to assess the preparedness for cyber threats and continually evaluates our incident response plans. The Incident Response Team ("IRT") is led by the Vice President of Information Technology, who is the overall incident response coordinator. The IRT works together with our President to assess risk and materiality of an incident and engage members of Cybersecurity Team as needed.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Our information and cybersecurity program utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and our security controls are mapped to the NIST Cybersecurity Framework to ensure alignment with recognized industry best practices. Annually, we engage a third-party consultant to conduct an assessment of the effectiveness of our information and cybersecurity program against the NIST Cybersecurity Framework. This assessment is reviewed with the audit committee, and opportunities for further maturation are incorporated into our information and cybersecurity roadmap.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: We maintain a team, tools, policies, and processes for identifying, assessing, and managing material risks from cybersecurity threats. Threats like malware attacks, system vulnerabilities, and data breaches are actively identified, monitored, evaluated, and mitigated along with other Company risks. Our security team maintains centralized documentation regarding known security risks and mitigation. Consideration of material risks from cyber threats is integrated into our enterprise risk management processes and is a standing agenda item for discussion at our Audit Committee meetings. An Information Security Executive Committee representing multiple areas of the Company is responsible for assessing material risks from cybersecurity threats and represents multiple functions of the business including Finance, Human Resources, Legal, and the Information Technology ("IT") departments. We have certain employee cybersecurity awareness campaigns and training designed to help promote a culture of cybersecurity awareness throughout the organization. Cybersecurity tools, processes, policies, and controls are periodically reviewed and updated in response to changes in the business environment and evolving threats, as well as to align with broader risk management objectives.

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: Our Senior Director, IT who has over 20 years' experience with cybersecurity at public companies, in coordination with senior management including our Chief Executive Officer, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, a cross-functional team throughout our company addresses cybersecurity threats and responds to cybersecurity incidents. Through ongoing communications with this team, the Senior Director, IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: Zymeworks Inc.

ticker: ZYME


text: The CSO is responsible for implementing and overseeing the controls and processes employed to identify, assess and manage the Company's risks from cybersecurity threats. We also maintain a Privacy and Security Steering Committee that regularly meets to review and discuss cybersecurity issues and review our cybersecurity-related metrics. The Privacy and Security Steering Committee is comprised of the CSO and other representatives from our cybersecurity, IT, legal, and privacy teams. The CSO, cybersecurity team, and members of the Privacy and Security Steering Committee combined have decades of experience in managing relevant information technology and cybersecurity matters. The CSO also provides regular briefings to our executive leadership team, including the CEO and CFO, and our Audit Committee on cybersecurity matters, such as threats, events, and the state of the program, and at least annually as part of our ERM process. Our security program also includes a yearly audit of our controls towards cybersecurity certifications, including ISO 27001, SOC 2 Type 2, PCI DSS, UK Cyber Essentials, and others.

companyName: GRAIL, Inc.

ticker: GRAL


text: As part of its overall risk management efforts, 26North has developed and implemented a cybersecurity risk management program (the "RMP") that applies to our business and operations. The RMP is designed to protect the confidentiality, integrity and availability of the critical systems involved in our business and the information stored in those systems. The RMP leverages a combination of standards and best practices from the National Institute of Standards and Technology Cybersecurity Framework, the International Organization for Standardization, and the Center for Internet Security, among others.

companyName: 26North BDC, Inc.


text: These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Our reactive processes are captured primarily by a cyber incident response plan (the "IRP"), which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All of these procedures and practices are tailored to our technology environment and are refined iteratively. Further, we have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to its use of third-party service providers.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: Policies and processes are also in place to ensure review and identification of risks from cybersecurity threats associated with third-party service providers and vendors. Cybersecurity reviews are required prior to initiating any engagements with third-party service providers and vendors who receive access to IAS systems and infrastructure. Additionally, recurring annual audits of such critical third-party service providers and vendors are completed by our Information Security team.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: Our cybersecurity leadership team is responsible for assessing and managing cybersecurity risks and is made up of experienced professionals with an extensive background in information security, risk management, and incident response. This team is led by our Head of Information Technology. The Head of Information Technology is a senior technology strategist and thought leader with over two decades of experience in the bio pharma, life sciences, and high-tech sectors.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: Our CISO, who has over 25 years of information security experience and is licensed as a Certified Information Systems Security Professional, is principally responsible for assessing and managing all aspects of the Program, including the Company's Regional Information Security Officers (RISOs), third-party consultants, development of industry trends and control testing and tracking by risk level. Our CISO meets periodically with senior executives, including the Company's President and CEO, to discuss the Company's cybersecurity strategy, and its monitoring, prevention, detection, mitigation, and remediation of cybersecurity risks. Regular reporting on the Program is also provided to the Company's Enterprise Risk Management Committee, which is comprised of the President and CEO, Senior Vice President – Enterprise Risk Management, Executive Vice President – Investments, Executive Vice President – Chief Financial Officer, and Executive Vice President – Secretary. Collectively, the CISO and RISOs, along with their teams, in collaboration with the technology and business owners, implement the Program. Legal, Compliance, and Internal Audit functions also assess the Program's adherence to regulatory requirements and internal controls.

companyName: BERKLEY W R CORP

ticker: WRB


text: We, our clients and our vendors are regularly the target of attempted cyber-attacks, and we must continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. Such cybersecurity incidents could lead to disruptions in our systems; the unauthorized release or destruction of our or our clients' or other parties' confidential or otherwise protected information; and corruption of data. We regularly re-evaluate, modify and enhance our information security processes as new technologies emerge or new risks are identified. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk factors - Risks Relating to Our Business - Our software-enabled services may be subject to disruptions, attacks or failures that could adversely affect our reputation and our business." for more information about these risks.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: The Company has a team of cybersecurity professionals reporting to the VP of IT, the head of the Company's cybersecurity team, dedicated to managing threats and incidents in real time and the reporting of any such incidents. The VP of IT reports to the Chief Financial and Strategy Officer. Through regular and ongoing communications, the VP of IT and the Executive Leadership Team, which includes our Chief Executive Officer, Chief Financial and Strategy Officer, and Chief Administrative and Legal Officer, manage the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and escalate any such threats and incidents to the Audit Committee when appropriate.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: Our VP of IT meets with the audit committee quarterly to review our information technology systems and discuss key cybersecurity risks. In addition, our chief financial officer reviews with the audit committee, at least annually, our global enterprise risk management program, which includes cybersecurity risks, and is also reported to the board of directors.

companyName: Adeia Inc.

ticker: ADEA


text: Our cybersecurity and privacy policies encompass information security, incident response procedures, and vendor management. Our risk management team works closely with our information technology, privacy, product, and operations departments to continuously evaluate emerging cyber risk. We monitor existing or proposed cybersecurity and privacy laws, regulations and guidance that are or may be applicable to us in the regions where we operate, including in the European Union and the United Kingdom where we are subject to the General Data Protections Regulations ("GDPR"), as well as various other laws governing privacy rights, data protection and cybersecurity in other regions. As a U.S. government contractor we are required to comply with extensive governmental regulations and standards regarding cyber security.

companyName: Level 3 Parent, LLC


text: The Company's Internal Audit Department further assists the Company to ensure that the proper safeguards are in place to protect the Company's information by conducting internal audits on certain aspects of the information security program. Internal Audit engages professionals that specialize in information security to review and provide an annual examination and report on the sufficiency of the Company's cybersecurity process and information security program. The Company's independent public accounting firm also performs audit procedures regarding the information security program. In addition, the Company's and the Bank's regulators review and assess the Company's information security program on an annual basis.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Members of our senior management have specific and relevant cybersecurity expertise and experience, including the following: • The Company's CISO holds a B.S. degree in Computer Science, an M.S. degree in Administration, an M.S. degree in Electrical Engineering, and a Graduate Certificate in Cybersecurity. In addition to the CISO's more than 30 years of experience in technology and cybersecurity, he also holds multiple professional certifications in security, privacy, governance, audit, and technology. • The Company's CIO holds a Master of Liberal Arts (ALM) degree in Information Technology Management and a Graduate Certificate in Project Management. In addition to the CIO's more than 16 years of experience in technology, she has directly managed global privacy, compliance, ethics, and records retention technology, been responsible for addressing global cybersecurity risks, and has also attended multiple training programs in cybersecurity, privacy, governance, and technology. • The Company's VP, Enterprise Risk Management holds a Certificate in Risk and Information Systems Controls (CRISC) certification along with 25 years of experience in managing technology delivery, vendor management, privacy, and governance.

companyName: Employers Holdings, Inc.

ticker: EIG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, incoming (external) physical infrastructure with enhanced firmware, continuous employee training, internal reporting, and monitoring and detection tools. We also engage top third-party security providers for applications and infrastructure to identify, prioritize, assess, mitigate, and remediate risks.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: Our CISO leads a dedicated Information Security team in charge of cybersecurity matters. Collectively, the members of our Information Security team have over 35 years of relevant experience in various roles involving information technology, information security, compliance and systems. Also, our Information Security team oversees compliance with our cybersecurity framework, facilitates cybersecurity risk management activities, assists with the review and approval of policies, and oversees the security awareness program. At least annually, our Information Security team and CISO update the members of the Risk Committee and the Board of Directors on compliance and risk matters. The Information Security team also reports to the IS Steering Committee on a quarterly basis. We invest in ongoing cybersecurity training for our Information Security team.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: The cybersecurity risk management program, processes and strategy outlined in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), the Company's critical third-party systems and services supporting or used by the Company (collectively, "Critical Systems"), and service providers.

companyName: Hour Loop, Inc

ticker: HOUR


text: Our cybersecurity risk management is intricately integrated into our broader enterprise risk management strategy. Our aim is to effectively identify, prioritize, and manage risks under robust governance, ensuring a secure and resilient organizational environment.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CISO is responsible for overseeing our Information Security budget, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Freshworks Inc.

ticker: FRSH


text: Our Board considers cybersecurity risk as a critical part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management.

companyName: Lemonade, Inc.

ticker: LMND


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. See " ITEM 1A. RISK FACTORS " for additional information regarding the Company's cybersecurity risks and which should be read in conjunction with this Item 1C.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: Disclosure of Risk Management, Strategy, and Governance Regarding Cybersecurity Risks Our Board of Directors engages in regular discussions to address our Company's principal risks, including those related to cybersecurity, ensuring comprehensive management and oversight. In alignment with this commitment, our cybersecurity leadership, comprising the Chief Operating Officer, Senior Systems Architect, DevOps Engineer, and Senior Technical Project Manager, forms a core committee dedicated to the review and strategic planning of our cybersecurity initiatives. This team's collaborative efforts are instrumental in steering our Company's approach to identifying, evaluating, and mitigating cybersecurity risks.

companyName: PAID INC

ticker: PAYD


text: Our CIO and GISO provide regular updates on cybersecurity risk and our information security program to the Risk Committee. These reports typically occur on a quarterly basis and include updates on current cyber risks, cybersecurity strategies and initiatives, event preparedness, the status of projects to strengthen our information security program, and the emerging cybersecurity threat landscape.

companyName: Enstar Group LTD


text: The Company's cybersecurity program is integrated within its overall risk management function. The Company engages third parties, including an outsourced cybersecurity team and additional vendors that conduct cybersecurity testing. All critical vendors of the Company, including its cybersecurity vendors, are subject to the requirements of its vendor management policy and processes. The Company is a regulated entity and undergoes regulatory reviews to ensure the Bank remains in compliance with all appropriate standards, including related to its management of third-party vendors.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: Our business and industry has become increasingly dependent upon digital technologies, including information and operational systems and related infrastructure as well as cloud applications and services, to process and record financial and operating data; analyze seismic, drilling, completion and production information; manage production equipment; conduct reservoir modeling and reserves estimation; communicate with employees and business associates; perform compliance reporting and many other activities. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has an Insider Threat and Data Loss Prevention program that is designed to protect the confidentiality, integrity and availability of such data, and we maintain processes designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: CONTINENTAL RESOURCES, INC


text: Our cybersecurity risk management and strategy are integral components of our comprehensive information security program. They guide our continuous efforts to evaluate and improve the confidentiality, integrity, and availability of our critical systems, data, and operations.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: We operate in a highly regulated industry that requires the continued operation of advanced information technology systems and network infrastructure and we recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We manage these risks from cybersecurity threats through our enterprise risk management process which is overseen by our board of directors through an enterprise risk management policy. This policy requires a risk management committee, which is chaired by our President and CEO and also includes our other executive officers, and which is responsible for managing our risks including cybersecurity. The risk management committee meets on a monthly basis, and can be convened as needed to address any time-sensitive matters arising between scheduled meeting dates.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: Our Vice President of Global Technology Solutions head our Global Technology Solutions Team along with our CISO are responsible for leading the individuals tasked with maintaining our enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. Our CISO has over eighteen years of information technology and cybersecurity experience in multiple industries, including building and leading governance, risk, and compliance functions that cover ISO 27001 certified compliance, NIST Cybersecurity Framework assessments, Sarbanes-Oxley ("SOX") information technology compliance, regional compliances, policy management, information technology risk management, vendor risk management, and security awareness. Our Vice President of Global Technology Solutions has over twenty years of experience leading technology organization and managing information security across multiple industries, including SOX 404 compliance, GxP audit and compliance, NIST Cybersecurity Framework assessments, managing incident response and communication with executives and board of directors.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: See "Risk Factors – General Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.

companyName: Metallus Inc.

ticker: MTUS


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of data protection and cybersecurity risks as part of the Audit Committee's oversight of the Company's enterprise risk management framework. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: LANDS' END, INC.

ticker: LE


text: The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer, who then notifies the Chief Operating Officer and General Counsel of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. Our CTO, who has more than 25 years of information security and cybersecurity experience, manages cybersecurity at the corporate segment and oversees a team of dedicated cybersecurity personnel employed in our real estate brokerage segment. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: At the management level, our Director of Information Technology who is experienced in cybersecurity matters, leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our Director of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our Director of Information Technology reports to our Chief Financial Officer/Chief Operating Officer and to our Chief Executive Officer.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: We have experienced attempted cybersecurity attacks, but have not suffered any material adverse impacts to our business and operations as a result of such unsuccessful attempts. However, we acknowledge that cybersecurity attacks are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See Item 1A – "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: Enviva, LLC


text: We rely on our information technology systems and networks in connection with many of our business activities. Some of these networks and systems are managed by third-party service providers and are not under our direct control. The Company has implemented a third-party risk management program to manage the cybersecurity risks associated with its use of third-party service providers.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: The Company's Information Security Awareness Program, a component of the Information Security Program, is designed to ensure that all employees and contingent workers are aware of relevant cyber-related policies, principles, standards and practices, as well as new and current regulatory requirements related to safeguarding customer and corporate information assets. Cybersecurity awareness initiatives and resources are regularly provided to employees and contingent workers, including through mandatory annual cybersecurity awareness training, ongoing simulated phishing email exercises and communications from the Company's Cybersecurity Division on the Company's internal communication channels.

companyName: M&T BANK CORP

ticker: MTB


text: TPG's Corporate IT footprint and systems are not used to process guest transactions. Corporate systems do not have connectivity to any hotels.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: While we believe that our current cybersecurity measures are robust, we recognize that the cybersecurity landscape is constantly evolving, and we remain vigilant in monitoring and adapting our practices to address emerging threats. We are committed to maintaining the confidentiality, integrity, and availability of our systems and data and to protecting the interests of our clients and stakeholders.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: Index to Financial Statements Our cybersecurity leadership team is made up of highly experienced professionals with an extensive background in information security, risk management, and incident response. This background includes more than 50 years of collective experience in infrastructure, cybersecurity and telecommunications. In addition to having the requisite training, knowledge, skills and abilities required for their respective positions, the cybersecurity leadership team collectively holds various relevant U.S. and Canadian information security certifications. The cybersecurity leadership team is supported by a dedicated team of skilled cybersecurity professionals, each bringing diverse expertise in areas such as network security, data protection, and threat intelligence.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: Our Board has overall oversight responsibility for our risk management and delegated cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our CISO is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee on a regular basis and briefing the full Board on cybersecurity risk oversight activities and preparedness efforts on an annual basis, as well as on an ad hoc basis upon request. Our Security teams have a wealth of cross-industry, government, and national defense experience. We employ qualified and certified security practitioners with specialized skill sets in security engineering, incident response, forensics, and threat management. Our CISO has more than a decade leading highly technical security teams that evolve with the technology and threat landscape.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: The Company's cybersecurity partners, including, consultants, and other third-party service providers are a key part of Elite Pharmaceutical's cybersecurity risk management strategy and infrastructure. Elite partners with industry recognized cybersecurity providers leveraging third-party technology and expertise and engages with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in the Company's environment. The cybersecurity partners provide services including, but not limited to systems inventory monitoring, user management, network protection and monitoring, IPS/IDS management, remote access monitoring and management, user activity monitoring, data backups management, cybersecurity strategy, and cyber risk advisory, including assessment and remediation.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: The Audit Committee of the Board of Directors oversees our cybersecurity and data privacy programs and practices and consults with management regarding cybersecurity initiatives. This committee is also responsible for reviewing cyber and data security matters, including cybersecurity threats to us and our risk mitigation initiatives. At least twice a year, the Audit Committee receives updates on our cybersecurity and data privacy programs and practices from our Senior Vice President of

companyName: Mueller Water Products, Inc.

ticker: MWA


text: We recognize that cyber threats are a permanent part of the risk landscape and that new threats are constantly evolving. For these and other reasons, we have made it a priority to ensure the risk of cybersecurity threats is integrated into our risk assessment and risk management processes.

companyName: BOISE CASCADE Co

ticker: BCC


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.

companyName: CURIS INC

ticker: CRIS


text: Communicating awareness and education of security risks, social engineering and scams affecting our customers through targeted marketing and social media messaging strategies and campaigns; Monitoring electronic mail and other network intrusion attempts with various tools to identify and stop intrusion and malware threats;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Valvoline employs a risk-based approach to secure access to networks, systems, and applications for business partners and vendors receiving access to the environments and data. Business partners and vendors with whom information is shared to conduct business are required to safeguard it by appropriate means, including elevated contractual commitments when appropriate. The Company provides cybersecurity training to team members during onboarding and regularly thereafter and deploy technologies to automate and enhance operational security capabilities. In addition, Valvoline also uses third-party managed security services to augment the cybersecurity team's capabilities.

companyName: VALVOLINE INC

ticker: VVV


text: Governance & Board Oversight The cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"). The CISO plays a pivotal role in informing the Board on cybersecurity risks.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We aim to promote a company-wide culture of cybersecurity risk management.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: Board of Directors The audit committee of the Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer and Vice President of Information Technology. Updates on cybersecurity matters, including material risks and threats, are provided to the Company's audit committee, and the audit committee provides updates to the Company's board of directors at regular board meetings. The Vice President of Information Technology also provides updates annually or more frequently as appropriate to the Company's board of directors.

companyName: MARIMED INC.

ticker: MRMD


text: The Board is composed of members who have diverse expertise including, risk and financial management, technology, cybersecurity and finance, equipping the Board to oversee cybersecurity risks effectively.

companyName: WORKIVA INC

ticker: WK


text: Management plays a pivotal role in identifying, assessing, and managing material risks from cybersecurity threats. This involves continuous monitoring, analyzing emerging threats, and the development and implementation of risk mitigation strategies. Led by our Senior Vice President and Chief Technology Officer with over 20 years of cyber and risk management experience, the Company actively implements and enforces cybersecurity policies, procedures, and strategies, including employee training programs, security assessments, and updates to ensure alignment with our evolving threat landscape.

companyName: AGNC Investment Corp.

ticker: AGNC


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under General Risk Factors in this Annual Report on Form 10-K, including the risk factor titled "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; a material disruption of our product candidates' development programs; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Poseida Therapeutics, Inc.


text: Our management team, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. Our CCO, in managing such risks relating to cybersecurity threats, relies on the assistance provided by the Adviser.

companyName: Willow Tree Capital Corp


text: The Company is not aware of any risks from cybersecurity threats, including any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the Company, including its business, results of operations or financial condition. Refer to Item 1A. Risk Factors in this annual report on Form 10-K, specifically "The Company faces risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, as well as other significant disruptions of its information technology ("IT") networks and related systems," for additional discussion about cybersecurity-related risks.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: Reporting to the Board of Directors The Director of Infrastructure, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Operating Officer (COO) of all aspects related to cybersecurity risks and incidents. The CFO and COO regularly inform the Chief Executive Officer (CEO) of such risk and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Via Renewables, Inc. Furthermore, significant cybersecurity mattes, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Via Renewables, Inc.

ticker: VIASP


text: Logical access security reviews for applications and data protection; and Awareness training for employees on cybersecurity threats and safe practices.

companyName: Ramaco Resources, Inc.

ticker: METC


text: At each quarterly board meeting, the full board receives the quarterly cybersecurity board update that is prepared by our CISO. The report provides a comprehensive cybersecurity update for the past quarter, including topics such as details on threat landscape, incident response, security metrics and performance, compliance and regulatory updates, cybersecurity investments and budget, employee security awareness and trainings, vendor risk management updates, business continuity and disaster recovery updates, and an update on cybersecurity strategy, projects and roadmap.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Our assessment and management of material risks from cybersecurity threats are taken into account in our overall risk management processes. For example, we evaluate identified material risks from cybersecurity threats against our overall business objectives and will report material risks, if identified, to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: The Company's Chief Financial Officer, with assistance from our third-party cybersecurity vendors, is responsible for identifying, assessing, and managing our cybersecurity threats and risks. Together, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, evaluating our and our industry's risk profile, conducting real-time monitoring of certain systems, and implementing escalation protocols with our third-party cybersecurity vendors.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see the Item 1A. Risk Factors—Information Technology and Security section in this Form 10-K.

companyName: PFIZER INC

ticker: PFE


text: We have a documented incident monitoring, escalation and reporting process and procedure that we believe to be effective in detecting and analyzing cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: a.continual monitoring of our systems and logs by both dedicated cybersecurity internal and outsourced staff;

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network.

companyName: Aimco OP L.P.


text: Cyber Risk Management and Strategy LivaNova's enterprise risk management process consists of risk identification, evaluation, control and monitoring, and documentation. The LivaNova Board oversees risk management within the Company, and the CRO provides the framework to identify and reduce risks that may materially impact the Company's business. As part of the CRO's enterprise risk management process, regular inquiries and discussions are held with the CISO, Chief Information Officer, Chief Privacy Officer, and their respective teams to review the cybersecurity risk landscape.

companyName: LivaNova PLC

ticker: LIVN


text: We have not identified any cybersecurity incident that had or may have a material impact on our business whatsoever, in particular, no unauthorized access to our information technology systems that either occurred or is reasonably likely to have occurred, including of reports submitted to us by third parties (including regulatory agencies, law enforcement agencies and security consultants), to the extent that such unauthorized access to our information technology systems is reasonably likely to have a material effect on the (consolidated) financial statements, in each case or in the aggregate, and no ransomware attacks when we had been asked, paid or are contemplating paying a ransom, regardless of the amount. However, conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology are assumed to be vulnerable to cybersecurity attacks and other data security threats. These types of attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target.

companyName: Satellogic Inc.

ticker: SATL


text: Our Cybersecurity department is staffed with professionals holding a variety of IT, cybersecurity and audit best practice certifications, including, among others, Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), International Organization for Standardization 27001 Lead Auditor Certification (ISO 27001 LA), Certified Information Privacy Professional (IAPP CIPP/CIPM), Alibaba Cloud's Cloud Security Certification (Ali-ACP), and Certified in Risk and Information Systems Control (CRSC). Our Cybersecurity department also has a training and development program in place so that appropriate skillsets are maintained and/or acquired, and professional certifications remain current.

companyName: HERBALIFE LTD.

ticker: HLF


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in our IT environment.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: Before purchasing third party technology or other solutions that involve exposure to our assets and electronic information, our Information Technology Team performs a review on vendors (evaluating suitability, risk, and impact) before they are approved to work with us.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We face significant and persistent cybersecurity risks due to: the scope of geographies, networks and systems we must defend against cybersecurity attacks; the complexity, technical sophistication, value, and widespread use of our systems, products and processes; the attractiveness of our systems, products and processes to threat actors (including state-sponsored organizations) seeking to inflict harm on us or our Clients; and our use of third-party products, services and components.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: The management team is responsible for identifying, assessing and managing cybersecurity risks by monitoring and evaluating potential threats using various methods including, for example, manual and automated tools such as vulnerability scans, penetration tests and system configuration reviews; conducting risk assessments and internal and external audits; and conducting tabletop incident response exercises. We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage risks from cybersecurity threats to our systems, including, for example: (1) having an information security incident response plan; (2) maintaining a disaster recovery plan, business continuity program, vulnerability management process and vendor risk management process; (3) conducting periodic risk assessments and employee training on cybersecurity; (4) maintaining security controls in alignment with industry standard security frameworks like National Institute of Standards and Technology ("NIST") and Center for Internet Security ("CIS"); (5) encrypting and segregating data, having network security controls, access controls, monitoring systems, managing assets and conducting penetration testing; and (6) maintaining cybersecurity insurance.

companyName: AAON, INC.

ticker: AAON


text: Our Cybersecurity Management Team is responsible for assessing and managing our material risks from cybersecurity threats. The Head of IT has a primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. Our Head of IT has served in various roles in information technology and information security for over 17 years. Our Deputy General Counsel has over 20 years of experience as an attorney and holds various certifications related to privacy and data protection.

companyName: Arteris, Inc.

ticker: AIP


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cybersecurity risks applicable to us. The cybersecurity risk management program involves, among other things, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including through briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Fold Holdings, Inc.

ticker: FLD


text: Third-party Risk we are aware of the risks associated with third-party service providers, Bioxytran implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Financial Officer ("CFO"). This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, software, and our critical data including confidential, personal, proprietary, and sensitive data. Accordingly, we maintain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess any potential material impact to our business. Based on our assessment, we implement and maintain risk management processes to our information assets and mitigate harm to our business. In addition to internal systems and concerns, we manage risks from third parties that are a part of business operations. This includes assessing cybersecurity risks during the vetting process and recurring assessments during the life of the engagements. Relative levels of assessment are considered with regard to business criticality of the relevant third parties. We rely heavily on our third party CROs and CDMOs to manage our clinical trials and manufacture our investigational products, and a cybersecurity incident at a CRO, CMDO or other third party upon which we rely could materially adversely impact us. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report on Form 10-K for additional information on cybersecurity risks we face.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's our risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: Our CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.

companyName: PBF Energy Inc.

ticker: PBF


text: The ERM process is incorporated into our disclosure controls and procedures. Representatives of each of our ERM, Legal, Internal Audit and Compliance Audit teams sit on the Company's management Disclosure Committee, which is responsible for, among other things, the design and establishment of disclosure controls and procedures to help ensure the timeliness, accuracy and completeness of corporate disclosure. Our IT Security and Privacy teams, who are responsible for assessing cybersecurity threats and risks, in turn maintain policies and procedures designed to ensure appropriate escalation of cybersecurity incidents to meet external disclosure requirements. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) regularly meet and coordinate with our Chief Privacy Officer (CPO). Each of the CIO, CISO and CPO also advise members of the Disclosure Committee, including our Chief Legal and Public Affairs Officer (CLO), on disclosure matters on an as-needed basis.

companyName: DAVITA INC.

ticker: DVA


text: Employee training: Providing ongoing cybersecurity awareness training to all employees to ensure they understand their role in protecting company assets.

companyName: HG Holdings, Inc.

ticker: STLY


text: Our CIO and CISO are responsible for providing information regarding our cybersecurity risk management program, as well as cybersecurity risks and incidents, to a senior management-level cybersecurity steering committee. Within our cybersecurity risk governance model, the steering committee, which includes our CIO, CISO, General Counsel, Chief Compliance Officer, Chief Audit Executive, Chief Human Resources Officer and other senior functional and business leaders, meets quarterly, and more frequently as warranted, to review and discuss, among other things, cybersecurity risk assessments, prioritization of initiatives, training plans and incident response plan, protocols and testing. This committee regularly provides updates on its discussions and decisions to our Chief Executive Officer.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Our Chief Financial Officer, also acting as our Compliance Officer, is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from our IT staff, who oversee our cybersecurity processes on a day-to-day basis. Our Board is responsible for the oversight of management's efforts to address cybersecurity risks. Management updates the Board on an ongoing basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats.

companyName: S&W Seed Co

ticker: SANW


text: Our information security organization is led by the CISO, who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Vice President of Product Security (VP of Product Security) provides additional expertise and focus attempting to ensure the integrity and resiliency of the products and services we provide to our customers. Combined, the CISO and VP of Product Security possess over 50 years of deep information technology, cyber security, program management, and risk experience. The information security organization manages and continually enhances a robust enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our cybersecurity program attempts to follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles. We have adopted a risk-based management process used to define, manage, and prioritize controls required to maintain the integrity and availability of our digital assets. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture and periodic training, supportive of security, which we believe improves our overall cybersecurity posture.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. Based on media reports and other surveys, we believe there is a general increase in cyberattack volume, frequency, and sophistication. We have experienced the same in our own business. We seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our suppliers, and our customers can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Risk Factors" for more information on our cybersecurity risks.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: We have adopted an incident response plan that applies in the event of a cybersecurity incident involving a breach of our information technology systems and applications. Pursuant to this response plan, in the event of an incident, a multi-disciplinary team is assembled that is led by our CIO. The team in turn may leverage the expertise of third-party consultants, external legal counsel, and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident, and the breadth of the incident. The plan also establishes procedures for escalating incidents depending on severity and for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors, and insurance providers. Our CIO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process. In addition to internal resources, we utilize third-party service providers to supplement and maintain our cybersecurity and our information technology systems.

companyName: Ryerson Holding Corp

ticker: RYZ


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Based on the context and details of the potential cybersecurity incident, the incident response plan includes prompt review by one or more members of the IT Team, with appropriate responses deployed as promptly as is practicable under the circumstances. Additionally, the CIO receives reports on potential cybersecurity incidents. As part of overall enterprise risk management, additional reporting of potential cybersecurity incidents is also provided to our General Counsel, Chief Accounting Officer, and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: Our comprehensive data security strategy includes: • Regular critical security assessments such as advanced attack simulations and vulnerability scans. • A Software Development Life Cycle (SDLC) framework to assess applications and related infrastructure before implementation to ensure our security standards are met. • Use of a Role Based Access Control (RBAC) methodology, which defines the access a user receives to eHealth's information systems based on job function. • Requirements that third-party vendors that host, transmit, or have access to eHealth data comply with our policies and undergo reviews. • Monitoring of security event data and the security industry to flag anomalies and be aware of potential threats. • Dedicated domestic and international liaisons who help ensure that business and functional area employees have easy access to experts for guidance and assistance in mitigating privacy and information protection risks. • Encryption of consumer data both in transit and at rest. • A broad spectrum of technical controls, including data loss prevention, role-based access, application/desktop logging, and data encryption as well as multi-factor authentication and enhanced web application firewall controls.

companyName: eHealth, Inc.

ticker: EHTH


text: To learn more about the risk and potential impact of cybersecurity threats on our business strategy, operations, and financial condition, including with respect to the Cybersecurity Incident, See Part I, Item 1A, "Risk Factors," "Significant disruptions of information technology systems or breaches of information security systems could adversely affect our business".

companyName: ARTIVION, INC.

ticker: AORT


text: Our Board of Directors maintains oversight of risks from cybersecurity threats. Our Chief Financial Officer is assigned oversight of cybersecurity risks. Our Chief Financial Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: Nu-Med Plus, Inc.

ticker: NUMD


text: Cybersecurity Risk Management We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: We use the following controls, among others, to mitigate the material cyber risks that we face: endpoint threat detection and response (EDR), identity and access management (IAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, a vendor management program (VMP) and vulnerability and patch management.

companyName: NuStar Energy L.P.


text: Acknowledging the intricate and dynamic landscape of cybersecurity threats, the Company collaborates with external experts, such as cybersecurity assessors, consultants, and auditors, to assess and test its risk mitigation tools. The Company's engagement with these external entities encompasses routine reviews, threat assessments, and ongoing consultations to enhance the Company's security measures.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Concerning governance, oversight, and compliance, the Board of Directors plays an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. Management provides periodic reports to our Technology Committee and our Board of Directors, as well as to our senior management team as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: Our IT and related systems are critical to the efficient operation of our business and essential to our ability to perform day to day processes. We face persistent security threats, including threats to our IT infrastructure and unlawful attempts to gain access to our confidential, classified or otherwise proprietary information, or that of our employees or customers, via phishing/malware campaigns and other cyberattack methods.

companyName: TEXTRON INC

ticker: TXT


text: Our Board of Directors has overall oversight responsibility for the Company's risk management and receives updates from management throughout the year on cybersecurity matters and other material risks facing the Company. Additionally, the Audit Committee regularly reviews the Company's policies and practices with respect to risk assessment and risk management, including cybersecurity risks, and reports to the full Board of Directors on a regular basis. The Audit Committee is responsible for overseeing the Company's enterprise risk management policies and processes, including discussing with management the Company's major risk exposures and the steps that have been taken to monitor and control such exposures, including those arising from cybersecurity risks.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee. Our CIO provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: We maintain a Third Party Security and Privacy Policy and conduct security reviews of vendors, including for potential fourth-party risks, prior to and during their contracts with Robinhood and require all third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Any identified security or privacy risks of doing business with a vendor, including potential fourth-party risks, are highlighted to business owners to help make informed risk-based decisions.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: We are a shell company with no business operations. Since inception, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board of Directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our inception.

companyName: AG Acquisition Group III, Inc.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Our Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment and our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: As of the date of this Annual report on Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. In addition, while we have implemented a risk management process to mitigate cybersecurity risks that arise from utilizing third party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. For more information on our cybersecurity related risks, see Part I, Item 1A. Risk Factors of this Report.

companyName: OXFORD INDUSTRIES INC

ticker: OXM


text: Monitoring, Training and Incident Response We continuously monitor our information systems for potential cybersecurity threats. Our cybersecurity incident response plan outlines specific procedures for responding to incidents, minimizing damage, and recovering swiftly. We have implemented a comprehensive cybersecurity training program for all employees to ensure they are fully equipped to handle cybersecurity responsibilities. The training emphasizes making cybersecurity an integral part of our corporate culture. It covers a wide range of topics, including understanding the different types of malware and how to avoid them, recognizing social engineering tactics like phishing and pretexting, and the importance of creating strong passwords while using multi-factor authentication. Additionally, the program addresses the unique security risks associated with remote work, mobile device usage, and Wi-Fi connections, as well as best practices for securing email communications and ensuring physical security of devices. Employees also learn about the importance of information classification, securing sensitive data, and safeguarding mobile devices and USB drives from unauthorized access or attacks. The program highlights the risks associated with the dark web and emphasizes how employees can protect themselves and the organization from information exposure. Furthermore, the training ensures that employees understand how to effectively respond to cybersecurity incidents, including how to recognize, report, and address security threats in a timely manner. This training is regularly updated to reflect the latest security threats and trends, ensuring employees are always aware of evolving risks. Employee understanding is assessed through quizzes, and executive leadership plays a key role in reinforcing cybersecurity as a top priority by modeling strong security behaviors and emphasizing ongoing vigilance.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: We carry insurance that provides protection that may reduce the potential losses arising from a cybersecurity incident. Past cybersecurity incidents have not materially affected the Company, including our business strategy, results of operations or financial condition.

companyName: JBT MAREL Corp

ticker: JBTM


text: We maintain a dedicated team of cybersecurity professionals. The Director of Information Security, the Information Security team, the SPMC, the Vice President of Information Technology, and the Information Technology leadership team are principally responsible for assessing and managing cybersecurity risks for our company. These individuals possess relevant expertise in cybersecurity risk management and are equipped to address the evolving nature of cyber threats. Our Director of Information Security has over 20 years of cybersecurity experience, holds several professional certifications and is an adjunct faculty member teaching courses on information security management and governance. Our cybersecurity professionals have a proven track record of executing strategic security objectives across various sectors, including utility, government, healthcare, and consulting. They bring with them experience in designing, implementing, and managing information security programs focused on quality, performance, and compliance.

companyName: EXPONENT INC

ticker: EXPO


text: The President would also apprise the Board of Directors of any cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us, and would timely notify the public of any material cybersecurity incident.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: As part of our enterprise risk management function, we have implemented processes to assess, identify and manage the material risks facing our company, including risks from cybersecurity threats. Our enterprise risk management function represents our overall risk management system. Our cybersecurity program is built upon recognized security frameworks. We believe that our processes provide us with a comprehensive assessment of potential cybersecurity threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cybersecurity threats include the risks arising from threats associated with third-party service providers, including cloud-based platforms.

companyName: Construction Partners, Inc.

ticker: ROAD


text: We periodically engage third parties, which are subject to our standards, policies, and procedure, to conduct risk assessments. As a result of these assessments and testing, we have responded to all known risks and are constantly strengthening our environment as applicable. Additionally, our program includes role-based privacy and cybersecurity training for all employees. Training occurs prior to accessing the system or performing assigned duties, when required by system changes, and annually thereafter.

companyName: Inrad Optics, Inc.


text: ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network. We maintain processes and procedures to continuously assess third-party cybersecurity risk and include security and privacy addendums to our contracts where applicable. We seek to work directly with any suppliers to address potential deficiencies when identified.

companyName: Information Services Group Inc.

ticker: III


text: Our cybersecurity risk management program is integrated into our overall ERM program, and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: We developed our cybersecurity program by integrating proactive training, vulnerability management, and system design with active threat defense mechanisms. Our marketplace services are protected by multiple layers of security, employing a "defense in depth"

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Mark J. Costa, age 57, is Chair of the Eastman Chemical Company Board of Directors and Chief Executive Officer. Mr. Costa joined the Company in June 2006 as Chief Marketing Officer and leader of corporate strategy and business development; was appointed Executive Vice President, Specialty Plastics and Performance Polymers Head and Chief Marketing Officer in August 2008; was appointed Executive Vice President, Specialty Products and Chief Marketing Officer in May 2009; and became President and a member of the Board of Directors in May 2013. Prior to joining Eastman, Mr. Costa was a senior partner with Monitor Group, a global management consulting firm. He joined Monitor in 1988, and his experience included corporate and business unit strategies, asset portfolio strategies, innovation and marketing, and channel strategies across a wide range of industries. Mr. Costa was appointed Chief Executive Officer in January 2014 and named Board Chair effective July 2014. Mr. Costa also serves on the Board of Directors of International Flavors & Fragrances Inc.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Our Vice President of Trust Engineering is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management. Our Vice President of Trust Engineering has served in various roles in cybersecurity and information technology for over 30 years, including as Vice President and Chief Security Architect of Intertrust Technologies Corporation and Java Security Architect at Sun Microsystems, Inc.

companyName: ROKU, INC

ticker: ROKU