text: The Board of Directors is responsible for overseeing and monitoring the material risks facing the Company. The Audit and Risk Committee of the Board is charged with overseeing our risk management framework, including cybersecurity risks. The CISO reports directly to the Audit and Risk Committee on cybersecurity risks on a quarterly basis.

companyName: EZCORP INC

ticker: EZPW


text: In the event of a cybersecurity incident, the Company maintains incident response plans to investigate, classify, respond to, and manage cybersecurity incidents that may compromise the availability or integrity of our information systems, network resources, or data. In accordance with the incident response plans, cross-functional management teams assess and assign a threat level to each cybersecurity incident. A cybersecurity incident (or incidents, if aggregated together) assigned a critical threat level is escalated to a committee consisting of the Company's executive and certain other officers (for such purpose, the "Critical Threat Committee") for review.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC

secItem: Item 1C


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, CFO, and CISO, and CTO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO, CTO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: Our cybersecurity risk management program is integrated into our Quality Management system, our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Owlet, Inc.

ticker: OWLT


text: We have taken proactive measures intended to minimize the likelihood of successful cyberattacks, including the establishment of incident response procedures designed to address potential cyber threats that may arise. These response procedures are structured with the aim to identify, analyze, contain, and remediate any cyber incidents that occur. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party providers. The Company's cybersecurity risk management processes are an integrated and key component of the Company's overall risk management strategy.

companyName: FTAI Infrastructure Inc.

ticker: FIP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our CISO, Chief Compliance Officer and General Counsel. Our CISO, who reports to our General Counsel and has the primary responsibility for our cybersecurity risk assessment and management processes, has over a decade of experience as CISO for public companies, as well as in U.S. government security compliance, architecture and design, and systems and standards development.

companyName: Sprinklr, Inc.

ticker: CXM


text: Ongoing Evaluation and Assessment of Systems and Processes We take steps to monitor evolving regulatory, industry and legal requirements and best practices relating to cyber risk mitigation, and we employ standards and frameworks that we deem appropriate to address identified risks. In addition to periodic in-depth evaluations of our applicable systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures, and policies as we deem necessary and in response to identified threats and risks. For example, ITSS has implemented improvements to our protective measures that have included, but have not been limited to: endpoint intrusion detection and response software, vulnerability scans, regular patching of vulnerabilities, evaluating and reviewing log monitors, event correlation tools, network segmentation, system audits, data partitioning, privileged account segregation and monitoring, and tabletop exercises.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: Direct oversight of information and cybersecurity risks is delegated to the Risk and Technology Committee of the Board. The Risk and Technology Committee meets at least quarterly and receives reports detailing current risks, maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats. Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board following each quarterly meeting, and as needed on an interim basis to address developing risk. All Risk and Technology Committee reports are available to the full Board for review. In the event critical matters arise between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: The Company seeks to ensure every employee understands their role in keeping ONE Gas safe from cyber incidents. As part of this commitment, we provide our employees cybersecurity awareness training on a regular basis as well as regular security -focused announcements and seminars. We augment these educational trainings with live phishing exercises that simulate the current threat landscape. These exercises provide immediate feedback and, if necessary, additional training or remedial action. The Company also includes cybersecurity training as part of the on-boarding process of every employee.

companyName: ONE Gas, Inc.

ticker: OGS


text: We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. Certain of these systems are managed, hosted, provided or used by third parties to assist in conducting our business and which have their own cyber security measures in place. We are currently working to ensure that we satisfy generally applicable industry standards and best practice methods for the assessment, identification, and management of risks from cybersecurity threats that may jeopardize our line of business or may pose a risk to our information technology systems, including from third parties with whom we work. We have appointed an Information Security Coordinator who oversees our information security policies and procedures. The background and experience of our Information Security Coordinator includes managing the development of cyber security products for corporate and oversee security analysis process on multiple products and companies. Our Information Security Coordinator will maintain a cyber incident reporting and response process and will provide management notifications based on the seriousness of any incident. Our information security policies and procedures are required to be reviewed on a regular basis.

companyName: Odysight.ai Inc.

ticker: ODYS


text: Our cybersecurity strategy prioritizes protection, detection, analysis, and response to known, anticipated or unexpected cyber threats, effective management of cyber risks and resilience against cyber incidents. We maintain a formal cybersecurity program structured around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), a voluntary framework created by industry and the U.S. government to promote the protection of our infrastructure from cybersecurity risks. We contract with an external auditing firm to assess our cybersecurity controls relative to industry peers using the NIST CSF, which has five functions: identify, protect, detect, respond and recover. We consistently evaluate the threat landscape, adopting a multifaceted approach to cybersecurity risks through a zero-trust strategy focusing on prevention, detection, and mitigation, which includes the following programs and practices: • Our cybersecurity team conducts an annual review of cybersecurity risks at the ERM level, integrating significant cybersecurity risks into our overall ERM program. We remain committed to increasing investments in cybersecurity, which includes providing additional training for end-users, adopting a zero-trust methodology, identifying and safeguarding critical assets, and reinforcing monitoring and alerting capabilities. Our proactive approach involves regular testing of defenses through simulations and penetration tests, both technically and through a comprehensive review of operational policies and procedures. At the managerial level, our cybersecurity team consistently monitors alerts and holds regular meetings to discuss threat levels, trends, and remediation strategies. Additionally, we conduct periodic external penetration tests and maturity testing to assess the effectiveness of our security controls, including processes, procedures, and our readiness to face the evolving threat landscape. • We consider and assess the cybersecurity risks associated with the utilization of third-party service providers under our third-party risk management program. Pursuant to the program, we evaluate security and data privacy controls prior to sharing or authorizing the hosting of sensitive data in computing environments managed by third parties. In addition, our standard terms and conditions with third-party service providers feature contractual provisions mandating specific security protections. • Our cybersecurity incident response plan is designed to detect and address potential threats that may impact the confidentiality, integrity, and availability of our technology systems. The response plan includes coordinated processes for handling security and data privacy incidents, encompassing communication and effective response. • Our global business continuity program includes information technology disaster recovery, supporting resilience in both our business and information technology.

companyName: CF Industries Holdings, Inc.

ticker: CF


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer and Adviser's Director of IT regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and any cybersecurity incidents impacting the Company.

companyName: Stone Point Credit Corp


text: Company continues to implement policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We employ a variety of tools designed to identify, assess and maintain security measures to meet regulatory requirements, and possess technical personnel to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Our risk factors, which can be found in Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. There can be no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Core information technology systems supporting our business operations are backed up and stored outside of our network infrastructure. Our cloud-based systems, including products we sell, utilize configurations for backup designed to prevent data from being destroyed as a result of a cyber event.

companyName: TRIMBLE INC.

ticker: TRMB


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure, or the systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. As a company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We may not have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss. However, risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition.

companyName: Aeluma, Inc.

ticker: ALMU


text: Our cybersecurity program is led by our Vice President of Information Security and overseen by our Chief Information Officer ("CIO"). Our Vice President of Information Security, who is responsible for assessing and managing our information technology risks, including cybersecurity, joined Winnebago Industries in July 2021 and has over 25 years of experience in heavily regulated industries such as finance and healthcare. She has held multiple roles in Information Security and IT, demonstrating expertise and versatility in navigating the threat landscape of cybersecurity. Our CIO reports to our Senior Vice President – Chief Financial Officer, Investor Relations, Information Technology and Business Development, a member of our senior leadership team who reports to our President and Chief Executive Officer.

companyName: WINNEBAGO INDUSTRIES INC

ticker: WGO


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by, and incorporates, elements of recognized industry standards. We leverage the support of third-party information technology and security providers, including for cybersecurity audits and risk assessments. We implement technical controls, such as multi-factor authentication and we deploy cybersecurity tools through a leading third-party cybersecurity firm to protect our systems from cybersecurity related risks. We have an enterprise risk management program and we maintain written information security policies, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents. We test this incident response plan on an annual basis. Finally, we have implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see Item 1A - Risk Factors.

companyName: Cerence Inc.

ticker: CRNC


text: Education and awareness training on information security and data protection is conducted regularly for Associates. Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.

companyName: STERIS plc

ticker: STE


text: Management is responsible for implementing our cybersecurity program. Our Chief Financial Officer works with our Vice President of Global Information & Technology ("IT") and regional IT members to lead our enterprise-wide information security program and manage our Cybersecurity Incident Response Plan. With over 30 years of experience in technology and information systems leadership our Vice President, Global Information & Technology oversees a global network of cybersecurity experts with an average of 25 years of experience. These teams work closely with internal stakeholders to develop, implement, and maintain a comprehensive security strategy that protects our enterprise and supports our business objectives. They also coordinate incident response efforts and proactively address emerging security threats. The recommendations of the management team are considered when updating our information security policies, procedures, and standards.

companyName: WD 40 CO

ticker: WDFC


text: As part of our processes for assessing, identifying and managing material risks from cybersecurity threats, we maintain an ongoing process to enhance security and optimize our IT systems, and regularly conduct security assessments and testing of our systems to verify our systems' integrity to protect them against being compromised from both internal and external sources. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner. These efforts include using monitoring tools and services to address the confidentiality, integrity, and availability of our assets and data. Regular internal and third-party reviews are performed on our processes and technologies to help validate the effectiveness of our privacy and data security controls. These safeguards include employing firewalls, intrusion prevention and detection systems, and access controls, which are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: Perella Weinberg Partners

ticker: PWP


text: Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company's business, financial condition, and results of operations. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cybersecurity breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Our IT Security Team is informed about and monitors the prevention, management, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. Our managed security service provider is also tasked with testing, auditing, and monitoring the performance of our cybersecurity processes. We also maintain processes for reviewing and assessing vendor security before new engagements as part of our Vendor Advisory Board's function, which includes the administration of questionnaires and interviews.

companyName: Markforged Holding Corp


text: Protection Mechanisms. We currently follow the ISO 27001 cybersecurity framework and are progressing toward program certification. We continuously monitor our enterprise network and have deployed detective and preventative controls. In-depth third-party security assessments are conducted annually.

companyName: Ingevity Corp

ticker: NGVT


text: The Audit Committee regularly briefs our board of directors on the matters communicated to the Audit Committee by our cybersecurity management team and the CDC, and our board of directors also receives periodic briefings from our cybersecurity management team on our cybersecurity risk management program and on cybersecurity threats in order to enhance our directors' literacy on cybersecurity issues.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: Our cybersecurity program is managed by our Chief Information Security Officer, who has more than 40 years of experience in information security, both in private industry and as an active-duty member of the United States Air Force. Such experience includes developing security practices, processes, and standards, leading security teams, managing incident response and implementing technologies to enhance security and compliance.

companyName: EMCOR Group, Inc.

ticker: EME


text: The Company's Chief Information Officer leads the IT and cybersecurity functions and has primary responsibility for leading the Company's overall cybersecurity risk management program, supervising both internal cybersecurity personnel and external cybersecurity service providers. The Company's cybersecurity function is responsible for assessing and managing material risks from cybersecurity threats, as well as informing management about and monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers and alerts and reports produced by security tools deployed in the IT environment.

companyName: RCM TECHNOLOGIES, INC.

ticker: RCMT


text: While Wesbanco and its third-party providers have in the past experienced cybersecurity incidents, Wesbanco is not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect Wesbanco, including its business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors – Interruption to Our Information Systems or Breaches in Security Could Adversely Affect Wesbanco's Operations." for additional detail.

companyName: WESBANCO INC

ticker: WSBC


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan with formalized workflows and playbooks. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems and test our IT infrastructure. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Security team identifies and addresses known cybersecurity threats and incidents at third-party service providers on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.

companyName: Edwards Lifesciences Corp

ticker: EW


text: We rely on third party service providers to deliver our products and services to our customers, including many of our technology initiatives. A cybersecurity incident at a supplier, subcontractor, or joint venture partner could materially adversely impact us. We evaluate third party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire and include security and privacy addenda to our contracts where applicable. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: To accomplish this purpose, the information technology and security committee has four primary responsibilities: • to understand the security controls and assessments conducted on major card platforms and concur that such controls are comparable to industry best practices and standards as appropriate; • to assess technology modernization plans and processing platform strategies to validate proper investment in multi- year initiatives that maintain effective and efficient use of Company resources; • to review progress on significant IT projects against milestones and quality indicators and evaluate actions intended to drive quality and timeliness; and • to evaluate the prioritization of strategies for intellectual property protection.

companyName: CORPAY, INC.

ticker: CPAY


text: Our cyber risk management program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services. The risk management program is focused on safeguarding the organization's digital assets, ensuring continuous business operations, and minimizing the potential impact of cyber threats. Regular assessments, including penetration tests, are performed. These inputs form the basis of a risk register that is integrated into the overall enterprise risk management program to further inform the Company's strategy assessing the likelihood, impact, and velocity of these risks on a forward-looking basis.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: We implement enterprise-wide information security policies and security awareness training to promote compliance and enhance security awareness and vigilance among our workforce. This training is distributed to all employees and includes interactive training on the acceptable use of technology, secure software development practices and phishing simulations.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: These processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. Our information technology team is responsible for assessing our cybersecurity risk management program, and we currently do not engage third parties for such assessment.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: Our Board of Directors oversees our company's cybersecurity and information technology strategies. Annually, the CIO briefs the Board of Directors on the company's cybersecurity posture and the effectiveness of its risk management strategies.

companyName: BALL Corp

ticker: BALL


text: Management provides comprehensive briefings to the Audit Committee on a regular basis. These briefings may include topics such as the current cybersecurity landscape and emerging threats, reports on significant incidents and breaches, and compliance with new regulatory requirements.

companyName: V2X, Inc.

ticker: VVX


text: Our risks from cybersecurity threats have not affected or are reasonably not likely to materially affect our business strategy, results of operations, or financial condition.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: As of the date of this Annual Report on Form 10-K, PMI is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect PMI, its business strategy, results of operations or financial condition. For additional information concerning PMI's risks related to cybersecurity, see Item 1.A. Risk Factors.

companyName: Philip Morris International Inc.

ticker: PM


text: We employ business continuity, backup and disaster recovery procedures for systems that are used for storing, processing and transferring customer information, and we periodically test and validate our disaster recovery plans to validate our resilience capabilities. Additionally, we maintain insurance coverage that, subject to applicable terms and conditions, may cover certain aspects of cybersecurity and information risks. However, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: Audits are an important part of our layers of defense; they can help us to identify areas in which we have incomplete coverage or ineffective placement of controls. The Company has an independent internal audit team that conducts audits based on their own methodology and assessment and we utilize external cybersecurity auditors, where applicable. In addition, certain lines of business utilize other third-party cybersecurity auditors for PCI DSS assessments and PCI ASV scans; and we are routinely audited by our customers.

companyName: NELNET INC

ticker: NNI


text: Our executive team including our Chief Executive Officer, Chief Financial Officer and Chief Business and Legal Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: PlayAGS, Inc.


text: The Company is charged for storage fees, staking fees and transaction fees for services specifically requested by the Company or the Asset Management Company. Except as set forth above, the contract terms of the agreements are typically for one to three years and can be terminated upon 30 day notice and payment of all fees due and one month of additional fees.

companyName: UPEXI, INC.

ticker: UPXI


text: Our cybersecurity program is managed by our interim Chief Information Security Officer ("CISO"), who reports to our Chief Information Officer ("CIO"). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the Company's information security team, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and results from third-party audits. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position since March 2025 and has over 20 years of experience in information security. His background includes technical experience, strategy and architecture focused roles, governance, risk, and compliance roles, secure application development and implementation roles, cyber and threat experience, and various leadership roles in several areas of information technology. Our CIO joined the Company in May 2025 with 35 years of experience in information technology roles, including implementing new information security teams on a global scale and overseeing information technology teams in multiple industries, including wholesale distribution, retail, manufacturing, finance, and information technology services, leading new global software development, and establishing global information security standards for his previous company.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: Our cybersecurity framework is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: CG Oncology, Inc.

ticker: CGON


text: We monitor potential risks associated with the use of third-party service providers and vendors. Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident. Service providers and vendors must adhere to security requirements such as security incident or data breach notification and response protocols, appropriate data encryption requirements, and data disposal. In addition, we engage with third party consultants to perform penetration (PEN) studies. These independent third party assessments provide valuable insight to enhance our cybersecurity posture.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: The Corporation recognizes the significance of cybersecurity in the financial industry and the potential risks associated, such as the the loss of confidentiality, information systems. ("ERM") ("CISP"). Officer. Chief Information Security Officer ("CISO"). Cybersecurity Framework. implementation of security safeguards across the its subsidiaries.

companyName: FIRST BANCORP /PR/

ticker: FBP


text: We face continuing and ongoing material risks from cybersecurity threats, which the U.S. Securities and Exchange Commission defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—A failure or breach of our IT infrastructure or that of our subcontractors, suppliers, or joint venture partners, including as a result of cyber-attacks, could adversely impact our business and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: TechnipFMC plc

ticker: FTI


text: As part of our cybersecurity policies, we conduct risk assessments designed to identify and prioritize potential cybersecurity threats, assess the likelihood and impact of those threats, and develop strategies for mitigating or managing cybersecurity risks. This involves assessing, evaluating and monitoring our vulnerabilities, as well as conducting impact analysis. Additionally, we provide ongoing cybersecurity awareness training to educate employees about the potential cybersecurity threats and how employees can identify potential threats and protect our data.

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: Currently, the only cybersecurity risk is from the use of websites associated with the Company. All hosting and hosting related services of these websites are engaged via reputable companies such as Namecheap, Godaddy and Cloudflare.

companyName: Medicale Corp.

ticker: MCLE


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.

companyName: Metallus Inc.

ticker: MTUS


text: Our Operational Risk Oversight ("ORO") department provides second line defense oversight of the Information Security Program in support of senior management and the Board of Directors' responsibility to provide appropriate risk oversight. Owned by the VP, Information Security and Technology Risk ("VP-ISTR") in ORO, the Information Security Policy provides a framework for the security of information assets and computer resources and is consistent with our ERM framework, which incorporates certain components that guide the Company's approach to risk management: Governance and Oversight, Business Strategy, Risk Infrastructure and Risk Culture. The Information Security Policy is designed to comply with applicable laws and regulations, such as the GLBA and the Sarbanes-Oxley Act.

companyName: Discover Financial Services


text: Our CISO meets regularly with members of our senior management, including our executive officers. Executives also frequently attend meetings of our Audit Committee and our Board and are therefore able to hear the cybersecurity updates presented at those meetings.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: We also engage other consultants, and other third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: Our comprehensive data security strategy includes: • Regular critical security assessments such as advanced attack simulations and vulnerability scans. • A System Development Life Cycle (SDLC) framework to assess applications and related infrastructure before implementation to ensure our security standards are met. • Use of a Role Based Access Control (RBAC) methodology, which defines the access a user receives to eHealth's information systems based on job function. • Requirements that third-party vendors that host, transmit, or have access to eHealth data comply with our policies and undergo reviews. • Monitoring of security event data and the security industry to flag anomalies and be aware of potential threats. • Dedicated domestic and international liaisons who help ensure that business and functional area employees have easy access to experts for guidance and assistance mitigating privacy and information protection risks. • Encryption of customer data both in transit and at rest. • A broad spectrum of technical controls, including data loss prevention, role-based access, application/desktop logging, and data encryption as well as multi-factor authentication and enhanced web application firewall controls.

companyName: eHealth, Inc.

ticker: EHTH


text: We conduct third party assessments of potential new vendors who process, store or transmit our data, which include a formal security review. This can include the review of documentation related to a vendor's security attestations, such as SOC 2 Type 2 or HITRUST certifications.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Our cybersecurity efforts involve regular engagement with external assessors, consultants, and auditors, including periodic reviews by an independent qualified security assessor to identify areas for improvement and ensure compliance, as well as assessments and audits by our insurer and our external auditing firm.

companyName: ARTIVION, INC.

ticker: AORT


text: As a regulated financial institution, the Company is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see Item 1A – Risk Factors.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: • Education and Awareness: The Company provides annual mandatory global information security training and certification for personnel regarding cybersecurity threats. This training is offered in 20 languages to maximize associate accessibility and comprehension. The Company administers monthly targeted trainings and phishing simulations for our associates. Training sessions and additional phishing simulations are automatically deployed based on success and failure rates. In October 2024, the Company observed Cybersecurity Awareness Month with additional opportunities for engagement, interactive training and education. These activities are designed to develop a mature and vigilant, risk-aware culture among our associates.

companyName: REGAL REXNORD CORP

ticker: RRX


text: Our cybersecurity program, which is discussed in greater detail above, is led by our Chief Financial Officer with the help of our legal and human resources teams. Such individual has prior work experience in various roles involving managing information security and developing cybersecurity strategy and is responsible for supervising both our internal personnel and our retained third-party cybersecurity vendors. As discussed above, this management team member reports to the Audit Committee of our Board of Directors about cybersecurity related matters, periodically.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: We assess, identify and manage risks from cybersecurity threats through CNH's Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of CNH's larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors for CNH (the "CNH Audit Committee") and is managed by CNH's Chief Information and Digital Officer (the "CNH CIO") and a dedicated CNH Chief Information Security Officer (the "CNH CISO"). The CNH CISO has over 10 years of experience in cybersecurity and has held numerous positions in the cybersecurity sector, including serving as a Global Director of Information Security at another global high-tech manufacturing company. The CNH CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network and, information assets. The CNH CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial Capital LLC


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the Board has primary oversight of cybersecurity risk and cybersecurity risk management and receives reporting from management about material risks from cybersecurity threats. All members of the Board of Directors receive regular updates on cybersecurity risks and incidents from the Information Security Officer ("ISO") and Chief Information Officer ("CIO") and annual security awareness training. The Information Security department consists of cybersecurity professionals who assess, identify, and manage cybersecurity risks and are responsible for implementing and maintaining the Company's cybersecurity risk management program.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. Our VP of Technology, Director of IT, General Counsel, and MSP, along with relevant department heads, work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.

companyName: Origin Materials, Inc.

ticker: ORGN


text: We maintain a Corporate Incident Response Plan ("CIRP") that provides a documented set of protocols for responding to actual or potential cybersecurity incidents, including timely detection and analysis, containment and elimination, and recovery and improvement following an incident. The CIRP provides for notification of appropriate information breach or cybersecurity incidents and escalation to the Company's appointed Incident Management Team, which would be composed of an Incident Response Lead and team members from information technology, information security, enterprise risk management, corporate security, compliance, and legal teams, among others. The Incident Management Team would leverage the expertise of team members to work together to respond to the incident and take appropriate measures. The Senior Risk Committee would oversee the team and receive quarterly reporting on the incident and any relevant updates. The CIRP is coordinated through Incident Management Teams that involve the Bank's Incident Management Lead, Chief Digital & Innovation Officer, Chief Information Security Officer, and other key departments. The CIRP facilitates coordination across multiple parts of our organization and is evaluated by the Chief Risk Officer and legal department at least annually.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring, mitigating and managing our cybersecurity risks rests with our information security organization, led by our CISO and supported by our CTIO. The CISO, who has over 20 years of cybersecurity and technology expertise, supports a skilled information security organization that brings expertise in vulnerability management, incident response, penetration testing, regulatory compliance and other critical information security domains. Our information security team maintains certifications from recognized external security authorities such as ISC2, CompTIA, ISACA, GIAC, SANS, PCI and OffSec. The security program is assessed annually by a reputable third party to provide guidance for continuous improvement.

companyName: NORDSTROM INC


text: We prioritize risk management as a core component of our overall cybersecurity program. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. These efforts include: • an internal governance structure to identify, assess, and manage cybersecurity risks across the company in an integrated manner.; • cybersecurity incident management procedures designed to address the monitoring of systems for anomalous activity; identification of threats; assessment, prioritization, and escalation of incidents; response and recovery of systems; and continuous improvement; • technical controls to help ensure systems are protected from security threats and unauthorized or inappropriate access; • a vulnerability management and threat intelligence program that is designed to provide threat intelligence information to leadership and impacted business units; • monitoring and tracking key cybersecurity metrics; • a third-party risk management program designed to assess and mitigate risks associated with vendors, and other service provider organizations; and • cybersecurity awareness training for all employees, including additional training for specialized functions.

companyName: Aspen Technology, Inc.


text: The Materiality Committee is responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company's business strategy, results of operations or financial condition. The Materiality Committee considers both quantitative and qualitative factors. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the Materiality Committee is required to immediately report the incident to the Disclosure Committee and Audit and Risk Committee (the "Audit Committee") of the Board of Directors (the "Board").

companyName: Bausch & Lomb Corp

ticker: BLCO


text: Our Chief Executive Officer and Chief Financial Officer are primarily responsible for timely updating the Board of Directors and the Audit Committee of the Board of Directors (the "Audit Committee") about any material cybersecurity incidents or threats or any cybersecurity related issues worthy of their attention.

companyName: Cytosorbents Corp

ticker: CTSO


text: Our Security Program is managed by our Executive Security Steering Committee ("ESSC"), comprised of selected members of leadership, including our CISO, which assesses and manages any material risks from cybersecurity threats. The CISO and security team provide regular updates to the ESSC on our Security Program and, in accordance with our security incident response plan, escalate applicable cybersecurity threats or incidents to the ESSC for review and management. SPS COMMERCE, INC.

companyName: SPS COMMERCE INC

ticker: SPSC


text: For companies that we acquire, our integration efforts include, where appropriate, workable timelines for alignment on information security, data privacy, cybersecurity and employee education.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: To assist in detecting cybersecurity events, we deploy security logging and monitoring, malicious code detection, and data loss protection tools. If the company is the target of a cybersecurity attack, we have established processes for incident response and crisis management to triage potential incidents, determine severity, contain, and eradicate a threat. These processes require notifications to regulatory and other governmental authorities of cybersecurity events as required by law, including providing notice to investors for material cybersecurity events. To recover our systems and information, we utilize established system recovery plans and business continuity plans.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: We actively educate our employees about potential cybersecurity threats and actions. Our executive officers and global workforce receive ongoing trainings in response to cyber threats and cybersecurity incidents. We mandate annual completion of our information security training and compliance program, which includes reviewing and acknowledging the Company's information security policy. All employees also participate in regular security awareness training, which includes data protection principles, general end-user security hygiene, and internal phishing simulations. Additional annual training covers information security topics related to our Code of Conduct and Records Management Policies.

companyName: J M SMUCKER Co

ticker: SJM


text: One of the key functions of our board of directors is informed oversight of our compliance program, including the processes used to mitigate risks associated with cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure generally, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its enterprise-level oversight of risks associated with cybersecurity threats directly as a whole, as well as through delegation of responsibility to our Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risk. The Audit Committee receives periodic reports from management personnel responsible for enterprise risk management, which also evaluates cybersecurity among other enterprise level risks on an annual basis. It also assesses the experience of management personnel responsible for preventing, mitigating, detecting, and remediating any cyber incidents, including applicable third-party providers. The Audit Committee also oversees the Company's disclosure of any cybersecurity incident deemed material as required by the SEC or any other governmental authority, as applicable.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: Training Initiatives: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at FEI. We also provide additional role-based training to employees based on customer requirements, regulatory obligations and industry risks as needed.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: The Governance and Sustainability Committee of our Board of Directors (the "Governance Committee") is responsible for providing oversight and policy direction on our risk management policies and programs, including those relating to cybersecurity. The Charter of the Governance Committee specifically requires the committee to periodically review the Company's enterprise cybersecurity strategy and framework, including the Company's assessment and management of cybersecurity threats and risks, data security programs, applicable laws and regulations, and the Company's management and mitigation of cybersecurity and information technology risks and potential breach incidents, including our incident response plan. The Governance Committee is also tasked with reviewing any significant cybersecurity incident that occurs.

companyName: NEOGEN CORP

ticker: NEOG


text: Loss of or damage to our data, intellectual property, or other proprietary or confidential information Interruption or degradation of our operations, services, or systems availability Compromise or corruption of our data or systems integrity Reputational harm or loss of customer trust or confidence Legal liability, regulatory fines, penalties, or sanctions Remediation or mitigation costs, such as increased security expenditures, investigation expenses, or litigation fees insurance coverage or Other negative consequences. of these outcomes could have a material adverse effect on our business, financial condition, or results of operations.

companyName: Superior Drilling Products, Inc.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration testing, adoption of an incident response plan, employee email phishing campaigns, email security monitoring, real-time vulnerability scanning and intrusion detection, employee cyber security awareness program, real-time (offsite) backups of production systems, regular audits and progress reports, and continuous improvement of the information security management system. The Company engages third parties, which it believes is the top of the market, to perform assessments on the Company's cybersecurity measures, including audits and independent reviews of the Company's information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Our Board oversees Bunge's approach to risk management. Our Board has established a dedicated Board committee, the Enterprise Risk Management Committee, which enables greater focus at the Board level on risk oversight tailored to our business and industries. Additionally, each of our other Board committees is responsible for considering risks within its area of responsibility. The Board has delegated oversight and review of risks related to cybersecurity and information technology systems to the Audit Committee.

companyName: Bunge Global SA

ticker: BG


text: Processes for Identifying, Assessing and Managing Material Risks from Cybersecurity Threats PPL's Chief Security Officer (CSO) is responsible for establishing, implementing and executing PPL's cyber-risk management strategy for PPL and the other Registrants and reports to PPL's Executive Vice President and Chief Technology and Innovation Officer. The CSO has over 25 years of experience leading technology and security organizations, has a degree in computer science, and holds professional certifications in information security, IT auditing, and privacy. He is also a member of nationally and internationally recognized industry and security organizations, including the Information Systems Audit and Control Association, International Association of Privacy Professionals, and the Domestic Security Alliance Council. The teams managed by the CSO are comprised of seasoned experts in cyber and IT security and possess appropriate experience to safeguard the company's data, networks and systems, mitigate cyber risks and help prevent and combat cyber threats.

companyName: PPL ELECTRIC UTILITIES CORP


text: Like every major financial services institution, Wintrust faces significant and persistent cybersecurity risks. Whether in the form of data theft, ransomware, phishing, denial of service, or third-party vendor incidents, threat actors continue to become more sophisticated and escalate their efforts against financial institutions. At Wintrust, the Board of Directors and executive management are committed to devoting the necessary resources into monitoring, detecting, preventing and mitigating cyber risk. As a regulated financial institution, we are required to comply with various regulations applicable to cybersecurity, as well as guidance issued by our regulators, and our cybersecurity program closely tracks to those requirements. Additionally, Wintrust leverages global cybersecurity standards as general guides, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: AUDACY, INC.


text: Our cybersecurity risk program is a comprehensive framework designed to safeguard our organization and stakeholders from evolving threats. Central to this approach is our commitment to threat and vulnerability management, where we proactively identify, prioritize, and address potential cybersecurity gaps to strengthen our overall security posture. We emphasize identity and access management by implementing access controls and robust authentication methods to protect user identities and secure information technology systems. Data protection and privacy is in place to ensure sensitive information is protected from exfiltration. Our cybersecurity defenses leverage systems and technologies, including firewalls, network access, endpoint protection, privileged access management, user behavior analytics, multi-factor authentication, intrusion detection systems and continuous monitoring. The purpose of these systems and technologies is to stay ahead of potential threats. To prepare for and respond to potential cybersecurity events, we conduct regular incident response exercises, ensuring our readiness and resilience. Additionally, we invest in employee training and awareness programs to promote a culture of security mindfulness and reduce risks associated with human error. Recognizing the importance of third-party relationships, we maintain a vendor risk management program that includes monitoring the cybersecurity practices of our vendors, and if applicable, performing user access reviews and evaluating System and Organization Controls reports at both inception and on an ongoing basis. Together, these efforts reflect our dedication to building a secure and compliant environment that protects our operations, data, and the trust of our stakeholders.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Our bank faces various cybersecurity threats, including unauthorized access, malware, and phishing attacks. These threats could compromise the security of our information systems and the data we store and process. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the three year period ended December 31, 2023. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory criticism or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factors entitled "Our business could be negatively affected by cyberattacks or a deficiency in our cybersecurity system and infrastructure" and "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in Item 1A- Risk Factors.

companyName: FATE THERAPEUTICS INC

ticker: FATE


text: We work with third parties from time to time that assist us to identify, assess and manage cybersecurity risks, including professional services firms to conduct SOC 2, Type II assessments, incident response consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.

companyName: Cardlytics, Inc.

ticker: CDLX


text: We believe cybersecurity is critical to advancing our technological advancements. As a pharmaceutical and biotechnology services company, we face a multitude of cybersecurity threats that include attacks common in most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: The Senior Director of IT monitors cybersecurity incidents and does so by working closely with expert technology and security partners. The Company and its partners deploy a variety of technologies and processes, including but not limited to intrusion monitoring, detection and response, patch management, threat hunting, identity and access management, assessments, audits and tests.

companyName: Third Harmonic Bio, Inc.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. To this end, we maintain an information security program designed to protect our information, intellectual property, and systems, including the data we host and maintain for our learners, customers, and partners in accordance with industry standards and best practices.

companyName: Coursera, Inc.

ticker: COUR


text: We have made efforts to implement the National Institute of Standards and Technology (NIST) Cybersecurity Framework as well as supplemental guidance for information and operational technologies. We seek to follow federal and state statutory and regulatory guidance and have adopted internal policies and standards designed to align with these requirements.

companyName: HF Sinclair Corp

ticker: DINO


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, Software-as-a-Service, or SaaS, platforms, managed services, cloud-based infrastructure, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.

companyName: Equillium, Inc.

ticker: EQ


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. We have an enterprise-wide cybersecurity program designed to protect against, detect, respond to and remediate cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that are designed to prevent, identify, escalate, investigate and remediate identified cybersecurity threats and incidents, including threats and incidents associated with third-party service providers, in a timely manner. These tools include, among others, internal detection tools to support the identification, monitoring and reporting of threats, vulnerabilities and incidents, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our platform and products before they are exploited by malicious threat actors. We maintain a variety of incident response plans that are utilized when cybersecurity incidents are detected. We require employees with access to information systems, including specified corporate and engineering employees, to undertake data protection and cybersecurity training. Further, we use various processes to identify, monitor, assess and manage material risks from cybersecurity threats associated with the use of third-party service providers, including engaging in security reviews of third-party service providers who may have access to, or integrate with, our information systems; however, we rely on these third parties to implement cybersecurity programs commensurate with their risk profile and our expectations, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Braze, Inc.

ticker: BRZE


text: Cohen & Steers' cybersecurity incident response plan is a key component of its cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with Cohen & Steers' incident response team to help control, mitigate and remediate cybersecurity incidents. In addition, the response plan includes prompt reporting to our Board (or the audit committee) of certain cybersecurity incidents and related materiality and disclosure determinations.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee previously utilized an IT Cybersecurity Subcommittee, comprised of members of the Audit Committee, to assist in carrying out a portion of these responsibilities. In December 2023, the Audit Committee transitioned away from use of the subcommittee structure. At all times, the full Audit Committee has maintained and continues to maintain oversight responsibility for cybersecurity risk management.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: We follow a formal, documented process to assess the data protection practices of certain third-party vendors that handle sensitive information on our behalf.

companyName: Amesite Inc.

ticker: AMST


text: Our cybersecurity policies and procedures are designed to vet key third-party providers and provide for oversight and cooperation regarding cybersecurity incidents. In addition, our cybersecurity policies and procedures require our third-party providers to meet appropriate security requirements and we investigate security incidents that have impacted our third-party providers, as appropriate; however, our ability to monitor our third-party service providers' data security is limited.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: Our board of directors and our audit committee oversee risk for our company and are generally responsible for the oversight of risks from cybersecurity threats. Our management will promptly report to the board of directors and our audit committee on incidents of material cybersecurity risks facing us and any third parties and the measures that may be taken to mitigate such risks. In the event of a cybersecurity incident, we intend to follow an incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the board of directors and our audit committee. have not encountered any cybersecurity incidents since our IPO.

companyName: VISION SENSING ACQUISITION CORP.


text: Information and cybersecurity risk management fall under the oversight of the Audit Committee. The Audit Committee receives an annual review, followed by quarterly updates, of the Company's cybersecurity systems, enhancements, strategies and risk management efforts, and the Chair of the Audit Committee will be promptly notified of any material cybersecurity breach incident. In addition, the full Board reviews cybersecurity as part of its regular risk reviews. Linde has appointed a Global Chief Information Officer (CIO) reporting to the Chief Financial Officer (CFO). A Chief Information Security Officer reports to the CIO and is supported by a global IT security team.

companyName: LINDE PLC

ticker: LIN


text: AGM's CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM's CISO for nearly eight years. AGM's CISO holds a master's degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: Our security teams work with management to prioritize our risk management processes and mitigate cybersecurity threats, including those that may materially impact our business. Our assessment and management of material risks from cybersecurity threats is a key risk area within our enterprise risk management program. Our Chief Information Security Officer and SVP, Engineering and Support are responsible for management of cybersecurity risk under our enterprise risk management program, and senior management and the audit committee of our board of directors receive reports on the key risks and the effectiveness of our management of such enterprise risks. In addition, key cybersecurity risks are assessed as part of our internal audit program. We have completed various security audits and certifications, including SOC 2 Type II, SOC 1 Type II, PCI-DSS, HITRUST, FedRAMP High, and ISO/IEC 27001. We also employ a shared responsibility cybersecurity model where our customers are responsible for using and configuring our platform in a manner that meets applicable cybersecurity standards and requirements. As part of this shared responsibility cybersecurity model, customers have sole responsibility for creating and securing their access credentials for our platform.

companyName: Snowflake Inc.

ticker: SNOW


text: Internal and external Penetration Testing is performed annually. Tests are conducted or reviewed by independent third parties or qualified Associates independent of those that develop or maintain the security program. Testing is performed annually by third party auditors contracted through the Company's Risk Management Department. Management reviews test results promptly and ensures that appropriate steps are taken to address adverse test results. Remediation efforts are organized and made available to the Risk committee of the Board of Directors (Risk Committee) as well as for review by third party auditors and examiners.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: The cybersecurity team implements, monitors and maintains controls that are aligned with the guidance defined by the National Institute of Standards and Technology ("NIST") CyberSecurity Framework. These controls are designed to protect the confidentiality, availability and integrity of information systems. Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team. We view cybersecurity as a responsibility shared by all of our associates. As an organization committed to continuous improvement, we periodically conduct incident response tabletop exercises with key members of our leadership team, including our Chief Executive Officer, perform internal and external assessments and engage consultants to help assess the design and effectiveness of our program. In addition, we expect all of our associates as well as our third-party vendors to help protect against cybersecurity risks, and we conduct periodic awareness campaigns, emerging threats communications and specific trainings.

companyName: ESAB Corp

ticker: ESAB


text: Our Chief Financial Officer is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.

companyName: Inmune Bio, Inc.

ticker: INMB


text: The Company's information security is managed by the Executive Vice President, Finance, Operations and Technology, whose team leads enterprise-wide cybersecurity strategy, policy, education and training, standards, architecture, processes, monitoring and implementation. The status of the Company's cyber risk and threat profile and any proposed plans to strengthen the Company's information security systems or assessments thereof are reported to senior management and the audit committee of our board of directors.

companyName: Townsquare Media, Inc.

ticker: TSQ


text: Cybersecurity risks are overseen by the full Board of Directors and the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: STRYKER CORP

ticker: SYK


text: In addition, the Board will oversee any cybersecurity risk management framework and a dedicated committee of the Board or an officer appointed by the Board will review and approve any cybersecurity policies, strategies and risk management practices.

companyName: Wenyuan Group Corp.

ticker: WYGC


text: Before purchasing third-party technology or other solutions and partnerships that involve exposure to the Company's assets and electronic information, our Information Security and Privacy team undertakes due diligence to assess any key data privacy or information security risks.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our CFO, leveraging the expertise of our third party service provider. Our CFO has two years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: The Company's Board of Directors provides ultimate oversight of the Company's cybersecurity risk management. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CIO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.

companyName: GMS Inc.


text: Murphy engages cybersecurity assessors, consultants, our internal auditors, and other third parties both periodically and as appropriate when cyber threats are identified. Murphy utilizes these consultants to perform forensic analysis of data published by threat actors, to monitor and scan Murphy's systems for threat vectors, and to consult on emerging cybersecurity environment topics. In addition to monitoring its own IT systems, Murphy also has processes in place to identify cybersecurity risks and threats associated with third party service providers and partners. These processes include conducting vendor due diligence and risk assessments, participating in industry information sharing groups, subscribing to cybersecurity notification services, and maintaining ongoing collaboration with federal agencies.

companyName: MURPHY OIL CORP

ticker: MUR


text: Cybersecurity risks are communicated and discussed with our Board of Directors at least annually in conjunction with our overall ERM program. As part of its oversight responsibilities, our Board of Directors also receives frequent updates from executive management on our company's physical and cybersecurity efforts.

companyName: ONEOK INC /NEW/

ticker: OKE


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks we face, including those related to cybersecurity. We believe it is important to work cross functionally within the Company to manage cybersecurity risks and threats. Therefore, our cybersecurity team is made up of individuals from multiple different departments throughout the Company, including but not limited to our security, IT, R&D and legal teams. The cybersecurity team as a whole has academic degrees related to cybersecurity, technical know-how, and real-world experience managing cybersecurity incidents and risks. Material issues identified by our cybersecurity team are brought to the attention of our Chief Executive Officer and/or our Executive Vice President of Operations and Legal Affairs who in turn will update the Board, as necessary.

companyName: Ubiquiti Inc.

ticker: UI


text: The Company's CISO is primarily responsible for assessing and managing cybersecurity risks and threats and is responsible for developing and implementing our information security program, working closely with the ISO Committee. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity governance, cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has been with the Company for 14 years in various information security leadership roles and has over 20 years of experience in the cybersecurity field. The CISO provides regular reports to the ISO Committee that are shared with the Company's Board of Directors.

companyName: First American Financial Corp

ticker: FAF


text: Depending on the environment, system, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; vulnerability management policy; disaster recovery plans; risk assessments; implementation of security standards and certifications; encryption of data; network security protocols; data segregation; access controls; physical security; asset management, tracking and disposal; systems monitoring, vendor risk management program; employee training; penetration testing; cybersecurity insurance; and a dedicated CISO and security organization.

companyName: Fastly, Inc.

ticker: FSLY


text: We have an enterprise-wide approach to addressing cybersecurity risk, including input and participation from management and support from our Information Technology ("IT") Steering Committee that is comprised of our Senior Vice President Electronic and Structural Systems, Chief Financial Officer, General Counsel, Chief Human Resources Officer, Vice President Supply Chain Management, and Chief Information Security Officer (Head of IT and Cybersecurity or "CISO"). Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Framework which augmented with Cybersecurity Maturity Model Certification ("CMMC") components to meet our particular needs. We regularly assess the threat landscape and take a holistic view of the cybersecurity risks, with a layered cybersecurity strategy based on protection, detection, and mitigation. Our IT security team, which is comprised of internal resources, reviews enterprise risk management-level cybersecurity risks at least annually.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: We evaluate cybersecurity incidents individually and in the aggregate to assess materiality. Like any other technology company operating in today's environment, we have experienced incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please see Item 1A. Risk Factors, "Risks Related to Our Business, Operations, and Industry—Breaches of our security systems or products, systems failures, interruptions, delays in service, catastrophic events, and resulting interruptions in the availability of our systems or those of our customers, suppliers, or business partners, could expose us to losses. "

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: The Company prioritizes the security of our banking operations to protect our customers and our reputation, and to preserve our value. While eliminating all risk is unrealistic, we invest heavily in our Information Security program to mitigate cybersecurity risks. Our controls focus on safeguarding information systems, networks, and assets from unauthorized access, ransomware threats, and service disruptions. Third-party vendors are also held to similar standards, with reviews conducted annually.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: The Company's cybersecurity strategy is guided by prioritized risk, the National Institute for Standards and Technology (NIST) Cybersecurity Framework, and emerging business needs. The Company maintains a cybersecurity incident response plan, as well as a monitoring program, to support senior leadership and the Board.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: In the ordinary course of our business, we collect, process, store, and transmit players' data, including confidential, sensitive, proprietary, and personal information. Maintaining the confidentiality, integrity and availability of our information technology systems and data, as well as appropriate limitations on access to such information, is important to our operations and business strategy. To this end, we have implemented various Information Security programs aligned to ISO and NIST cyber security frameworks with functions incorporating the "Identify", "Protect", "Detect", "Respond", and "Recover"

companyName: GAN Ltd


text: The Board of Directors of Alaska Air Group is responsible for overseeing management's processes to identify and mitigate risks, including cybersecurity risks. The Board's Audit Committee leads the review and discussion of cybersecurity threats with management and receives updates from the CISO each quarter. Senior management, including the CISO, are available to address questions or concerns from the Audit Committee related to our risk management plan.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: Our Audit Committee is ultimately responsible for assessing and managing the Partnership's material risks from cybersecurity threats. Our IT leadership provides periodic cybersecurity program updates to senior management and to the Audit Committee. Management also updates the Audit Committee as new risks are identified and the steps taken to mitigate such risk s.

companyName: USA Compression Partners, LP

ticker: USAC


text: The members of management that lead our Information Security Program and strategy have extensive experience in technology, cybersecurity, and information security. Our CRO previously served as our interim CIO and has more than 20 years of banking experience spanning a variety of roles in both the commercial and consumer segments, including credit risk, portfolio risk management, model management, acquisition integrations, technology, and vertically integrated operations for revenue producing businesses, including leading operational services across Truist for deposits, payments, credit card, capital markets, consumer and wholesale lending, fraud, and care centers across all products. Our CIO has over 25 years of experience leading technology teams at financial institutions, including in the areas of application development, infrastructure, information technology strategy, risk management, and information security. Following the departure of our CISO in November 2024, the CIO is serving as our interim CISO while our search for a permanent CISO continues. The CIO's direct reports have on average over 20 years of experience with technology management and information security at financial institutions, including in the areas of governance, operations, application and data protection, access management, and business information security.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: The Technology Committee of the Board of Directors oversees our use of technology in business strategy as well as the major risks arising from our technology, digital and data strategies, legacy information systems, technology investments, data privacy, operational performance, cybersecurity programs, and technology-related business continuity and disaster recovery programs. The Technology Committee, which includes directors with technology experience, also oversees management's effort to mitigate these risks. Technology Committee meetings typically occur five times a year. Generally, at these meetings, our CSO briefs the committee on cybersecurity-related matters.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: Cybersecurity is a key component of our enterprise risk oversight framework, with our Board of Directors actively engaged in overseeing cybersecurity risk management. While management is responsible for day-to-day cybersecurity operations, the Board ensures that our cybersecurity risk management strategies are effectively implemented. The Board is briefed on material cybersecurity incidents as necessary to maintain transparency and informed decision-making.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: Risk Management and Strategy Managing Material Risks & Integrated Risk Management We have a comprehensive and systematic cybersecurity risk assessment program, which covers the identification, analysis, evaluation, and management of cybersecurity risks. The program follows a risk-based approach, which prioritizes the cybersecurity risks according to their likelihood and impact and allocates the appropriate resources and actions to mitigate these risks and leverages the National Institute of Standards and Technology (NIST) framework.

companyName: AGREE REALTY CORP

ticker: ADC


text: These processes include analyzing potential risks from the use of IT components and our use of third-party service providers, engaging third-party service providers to identify potential cybersecurity threats, conducting penetration tests to detect vulnerabilities, conducting employee trainings, monitoring network activities, ensuring patches are applied timely, analyzing and reacting to threat intelligence, and layering controls to prevent unauthorized access to IT assets. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition.

companyName: Excelerate Energy, Inc.

ticker: EE


text: We maintain relationships with law enforcement, government agencies, forensic investigators, and legal counsel to inform our cybersecurity and data privacy programs.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: Impact of Cybersecurity Threats There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.

companyName: FASTENAL CO

ticker: FAST


text: The Company increasingly leverages and relies upon digital technologies and services to conduct our business and support our customers. These technologies and services are a blend of organic and third-party supplied solutions that encompass data storage, processing and transmissions. Our digital technologies support business processes for financial management, human capital management, customer engagement, and manufacturing services. Examples of such technologies include Enterprise Resource Planning (ERP) systems, shop floor controls, test equipment, general business applications, and our global infrastructure and networks, as well as external systems, analytics, automation and cloud services. Such digital technologies and services are subject to numerous risks including, but not limited to, ransomware or cyber-extortion, denial of service to systems, malicious code introduced through third party software products or software updates or theft of company, customer, vendor and employee data. As discussed further below, our operations have been, and may in the future be, subject to ransomware or cyber-extortion attacks, which could significantly disrupt our operations. Generally, such attacks involve restricting access to electronic and computer systems or the restriction or theft of vital data including customer supplied data.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our overall risk management system. We obtain input, as appropriate, for our cybersecurity risk management program from threat intelligence services, cybersecurity consultants, and multiple external sources. Our cybersecurity program is managed by our Head of Cyber Security, whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment, and management policies, standards, architecture, and processes. The Head of Cyber Security has a master's degree in cybersecurity, maintains industry certifications, and has over 20 years of prior work experience in various roles involving information technology, cybersecurity, and compliance. We augment our cybersecurity team with consultants, contract resources, and managed security service providers when needed. Our executive leadership team is responsible for our overall enterprise risk management system and processes and, along with the Head of Cyber Security, regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: OXFORD INDUSTRIES INC

ticker: OXM


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. This integration is designed to ensure that cybersecurity considerations are part of our decision-making processes. Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Cybersecurity Risk Management Committee, or Cybersecurity Committee, of the Board of Directors, or Board.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: NEE, including FPL, conducts periodic desktop exercises and an annual cybersecurity drill with the participation from time to time of local, state and U.S. federal agencies to test its capability of dealing with a simulated cyberattack. NEE, including FPL, also participates in industry forums and various trade groups, as well as in NERC activities, to learn and apply these incident preparedness learnings to its cybersecurity policies and procedures.

companyName: FLORIDA POWER & LIGHT CO


text: The Global Information Services team has relevant educational and industry experience. The Director of Cybersecurity has served in various roles in information technology and security at Manitowoc for over 29 years, including the last five years overseeing cybersecurity. The Senior Vice President Global Information Systems has been with Manitowoc for over 23 years, leading the Global IS team since 2022.

companyName: MANITOWOC CO INC

ticker: MTW


text: Our ECS team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The ECS team oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ECS team also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk register and oversees the security awareness program.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: 3.Monitoring and Testing: Management is required to evaluate the effectiveness of risk management practices and controls through monitoring of key risk indicator metrics, testing and other activities. Identified issues are remediated, addressed via mitigation plans, or escalated, in line with our risk appetite.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Periodical Viruses Analysis: We conduct regular scans and analyses for viruses and malware across our network. This proactive approach enables us to detect and neutralize potential threats before they can inflict harm.

companyName: AIBOTICS, INC.

ticker: AIBT