text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the risk entitled "Our computer systems or data, or those of our collaborators or other contractors or consultants, maybe compromised, which could result in adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; significant disruption of our product development programs and our ability to operate our business effectively; reputational harm; and other adverse consequences."

companyName: PMGC Holdings Inc.

ticker: ELAB


text: To date, no cybersecurity threats or incidents have materially affected, or are reasonably likely to affect, the Company including its business strategy, results of operations, or financial condition.

companyName: BOK FINANCIAL CORP

ticker: BOKF

secItem: Item 1C


text: Our Chief Information Officer has been with the Company for more than 25 years, developing and overseeing our information systems and cybersecurity risk management program. Our Chief Information Officer and his team, which includes a cybersecurity professional, are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board and Audit Committee on any appropriate items.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: To meet our business objectives, we rely on both internal information technology (IT) systems and networks, and those of third parties and their vendors, to process and store sensitive data, including confidential research, business plans, financial information, intellectual property, and personal data of ours and our customers that may be subject to legal protection, and promote the continuity of our Company's business operations.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: As part of our overall risk management system, we assess, identify and provide oversight over cybersecurity risks to our information technology systems and our business continuity. We have identified key risk drivers and characteristics, and have incorporated these into our risk assessment matrix, which we use for day-to-day risk mitigation. Our risk assessment matrix provides us with a means to assess the probability and impact of material risks from cybersecurity threats. As a result of this process, we have identified and implemented controls and mitigation methods to manage these risks.

companyName: AMERISAFE INC

ticker: AMSF


text: Third parties also play a role in the Company's comprehensive approach to cybersecurity and its associated risk management framework. CNX leverages substantial technological tools and partners to augment and enable the efforts of its internal cybersecurity team. Separately, management and oversight of the risks from cybersecurity threats associated with our engagement of third-party service providers is currently included in our internal auditing procedures, however, we have plans to further mature these procedures in the current fiscal year.

companyName: CNX Resources Corp

ticker: CNX


text: As part of our overall cybersecurity strategy, we also engage third-party service providers to: (i) assist in our cybersecurity risk assessment procedures; (ii) perform penetration testing on external facing IT systems; (iii) perform security assessments on our IT and OT systems; (iv) assist in our incident response procedures; and (v) share information on industry-specific cybersecurity threats. With respect to our use of third-party systems, we oversee our risks from cybersecurity threats by working with our third-party vendors to evaluate their cybersecurity program for alignment with our own policies and procedures, including notification of and coordination during any incidents that might affect us.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: The Information Technology Department conducts on-going meetings and reviews with the IT Managed Service Provider to ensure the latest threats and vulnerabilities are addressed. This includes patch management. Quarterly external penetration and vulnerability testing is conducted by a third-party IT audit firm. Business continuity/ disaster recovery testing and incident response plan testing is conducted annually by the Board appointed Disaster Recovery Committee. In addition, the company participates in annual disaster recover exercises with its core IT system provider. The Board appointed Technology Committee provides oversight of policies and receives updates including cybersecurity, systems, IT assets and control policies. The COO is a member of the Technology Committee and the Disaster Recovery Committee and information from committee meetings and testing is reported to the Board.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: We partner with and build relationships with third parties who have access to our IT systems to support an overall ecosystem around cybersecurity that we believe helps reduce third party cybersecurity risk affecting our level of cybersecurity risk. We assess cybersecurity risk from our suppliers and service providers and have in place oversight processes to identify and manage such risks, including that we have systems that constantly monitor each third party with access to our systems and that allow such third parties to see and resolve their risks while we continue to monitor. Our processes to protect against third party cybersecurity risk are cross-functional and form part of our enterprise risk management program, and they are supported by our security, compliance and sourcing organizations. We require suppliers and service providers identified as potential cybersecurity risks to adopt security-control principles based on NIST or similar global standards, and our form contracts for them include provisions drafted to reduce the cybersecurity risk that they may pose for us. We obtain various Service Organization Control 1 and 2 reports from third parties relating to physical security, information security, account administration, transactional processing and reconciliation, client reporting and layers of electronic security controls. Notwithstanding our cybersecurity controls that cover third parties, because it is more difficult to control and mitigate risk associated with third parties than risk internal to our own organization, we believe that these relationships with third parties create additional exposure to cyber risk.

companyName: Sylvamo Corp

ticker: SLVM


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and its business impact. This committee provides oversight and governance of the technology program and the information security program. This committee includes the Information Security Officer (Senior VP of Operations), the Computer Systems Operation Manager, the virtual Chief Information Officer and other members of senior management. This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Computer Systems Operations Manager and Virtual Chief Information Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the board of directors on an annual basis (or more frequently as may be required by the Incident Response Plan).

companyName: Fifth District Bancorp, Inc.

ticker: FDSB


text: As of February 3, 2024, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, cash flow or financial condition.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: The Company maintains robust and comprehensive policies, processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company's cybersecurity program is led by its Senior Director of Cybersecurity, who functions as the chief information security officer ("CISO"). The Company's cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company's business segments and information technology ("IT"), legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its policies, processes, procedures and controls in light of ongoing cybersecurity developments.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: The foundation of risk oversight at Equinix is our Governance, Risk and Compliance Committee ("GRCC"), led by our Chief Compliance Officer, and overseen by the Nominating and Governance Committee of our Board. The GRCC is a global, cross-functional group currently comprised of our most senior leaders, across functions such as Legal, Compliance and Risk Management. The GRCC considers enterprise and emerging risks via Equinix's Enterprise Risk Management Program (the "ERM Program"). Our ERM Program focuses on the identification, assessment, management, monitoring and reporting of key business risks. Risk identification involves periodic risk surveys and/or risk interviews with key business process owners and executives to identify key strategic, operational, financial, regulatory, compliance and external risks at the enterprise level. We completed a global risk assessment in 2023 to identify enterprise risks. In addition, the ERM Program also includes an Emerging Risks Team of business leaders at Equinix, representing a majority of business functions, that meets monthly to identify fast-moving, potentially impactful risks.

companyName: EQUINIX INC

ticker: EQIX


text: An integral part of our cybersecurity readiness is an annual external IT audit that evaluates various aspects of our cybersecurity framework. This measure ensures that our defenses align with industry best practices and facilitates continuous improvement. The results of this audit are reviewed by the audit committee of the Board of Directors, allowing such committee to assist in and make recommendations on our management's cybersecurity controls.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level committee designated by our Board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Bank's cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board receives an Annual Report from the Director of Information Technology on the Bank's Information Technology Systems, including cybersecurity risk.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: Depending on the environment and system, we implement and maintain several technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our systems and data. These include, for example, IT policies and procedures; a network security policy; an information and asset management policy; an information security policy; incident planning, detection and response plans, including backup systems; vulnerability management, including of third parties; risk assessments; establishment of network security controls, including physical security; annual employee training; systems monitoring; and penetration testing.

companyName: Iridium Communications Inc.

ticker: IRDM


text: Enterprise Risk is primarily responsible for reporting risks from cybersecurity threats to executive leadership and our Enterprise Risk Management Committee (ERMC). The ERMC supports the efforts of the CRO in providing corporate-wide oversight of our firm's risk management efforts and provides a path for risk escalation. This committee monitors risk management activities, including cybersecurity matters, and reports periodically and more frequently, as necessary, to our Board of Directors and Audit Committee. For example, at each quarterly meeting the Audit Committee receives an update concerning the company's cybersecurity metrics. In addition, at least annually the Board receives a technology and cybersecurity update led by the senior management from the company's technology and information security teams. Cybersecurity risk management practices operate enterprise-wide, across T. Rowe Price legal entities, including Oak Hill Advisors (OHA). In addition, OHA has established an independent risk committee, which includes responsibilities for prompt escalation of key risks and incidents such as cybersecurity to the T. Rowe Price CRO.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: To protect our IT systems and information from cybersecurity risks, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified cybersecurity vulnerabilities and incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools. We also utilize a third-party security operations center connected to a networks operation center to identify, investigate, and resolve any cybersecurity threats and incidents.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: Third parties are also incorporated into our approach to cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, cybersecurity maturity assessments or consulting on best practices to address current and new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: The Company's cybersecurity risk management policies and procedures include internal notification procedures which, depending on the level of severity assigned to the event, may include direct notice to, among others, the Company's General Counsel and Chief Privacy Officer. Members of the Company's legal department support efforts to evaluate the materiality of any incidents, determine whether notice to third parties such as regulators, customers or vendors is required, determine whether any prohibition on insider trading is appropriate, and assess whether disclosure to stockholders or governmental filings, including with the SEC, are required. Our internal notification procedures also include notifying various Company Information Technology Services managers, subject matter experts in the Company's software department and other senior executives, depending on the level of severity assigned to the event.

companyName: NCR Voyix Corp

ticker: VYX


text: The Board of Trustees of the Fund periodically receives reports from BlackRock and from the Advisers regarding BlackRock's cybersecurity program. Team members who support the Fund's information security program have relevant educational and industry experience.

companyName: BlackRock Private Credit Fund


text: Cybersecurity threats are monitored and prevented by the head of the Information Systems Department, and the training plan is reported to the CEO and other executives, who implement the following: are planning to conduct annual training for the entire company on cybersecurity response. are conducting recovery simulation training in the event of a system failure. are conducting email training that simulates malicious attacks.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: The Company has established an information security program to address and mitigate material risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. These policies and procedures undergo an annual audit to ensure compliance with ISO 27001 controls. A risk assessment, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We have aligned our cybersecurity program with recognized security frameworks, such as NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: Governance and Oversight of Cybersecurity Risks Fortress has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Fortress's Enterprise Security Steering Committee (the "ESSC"), a cross-functional management committee that includes its General Counsel, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Chief Human Resources Officer and Fortress IT Management. The ESSC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: In addition, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: SES AI Corp

ticker: SES


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also utilize a managed security provider (the "Security Provider") to identify and assess vulnerabilities. Our Security Provider monitors our network, conducts vulnerability scanning, provides event logging services, and raises potential and actual threats with the Company's security operations center when appropriate.

companyName: FARO TECHNOLOGIES INC


text: The audit committee of the Board (the " Audit Committee ") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for overseeing these risks. Senior IT leadership regularly informs the Audit Committee, the Chief Financial Officer and other members of the Company's senior leadership of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Our cybersecurity risk management initiative is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Vertex, Inc.

ticker: VERX


text: We are regularly the target of attempted cyber and other security threats and must continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. While to date the Company has not detected a significant compromise of its information and operating systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "We are increasingly dependent on technology, including through the use of Artificial Intelligence (AI), in our operations and a failure of our technology could impact our ability to service our customers and adversely affect our financial results, damage our reputation, and expose us to litigation risk."

companyName: Waste Connections, Inc.

ticker: WCN


text: The Board of Directors is responsible for reviewing the overall policies and practices for risk management, including delegation of oversight for particular areas of risk to the appropriate subcommittees. Collectively, the Board of Directors and its subcommittees are responsible for discussing with management major financial risk exposures as well as significant operational, compliance, reputational, strategic and cybersecurity risks, and the steps management has taken to monitor and manage such exposures to be within the Company's risk tolerance.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we endeavor to undertake the below listed activities: Monitor emerging data protection laws in conjunction with our advisors and implement changes to our processes to comply; firewall and virus protection software, and 2FA logins to servers; and to obtain a cybersecurity insurance policy where necessary.

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB


text: On the management side, our ERM committee oversees the firm's risk management process, which includes oversight of cybersecurity. In addition, we have a cybersecurity committee that directly oversees the firm's cybersecurity program and is responsible for cybersecurity strategy, risk assessment and management, and incident response management. Our CTO is a member of the cybersecurity committee, along with other of the most senior professionals at the firm, including our chief operating officer (who is also our chief risk officer) and chief compliance officer. Our CTO also updates our ERM committee on cybersecurity matters on a quarterly and as-needed basis.

companyName: Hamilton Lane INC

ticker: HLNE


text: Our Program includes: periodic risk assessments and penetration tests, which are integrated within our enterprise risk management framework processes, designed to identify cybersecurity and technology risks, as well as to formulate management actions to respond to, mitigate and remediate material issues (if any); annual management reporting to the Board;

companyName: AMPHENOL CORP /DE/

ticker: APH


text: On January 31, 2022, certain computer systems related to the Aurora acquisition that had not yet been integrated into our main systems were the victim of a cybersecurity attack. We immediately took steps to isolate those systems and implemented measures to prevent the spread of the attack, including taking systems offline in an abundance of caution. Together with an outside cybersecurity forensics firm, we investigated the attack to determine its nature, scope, duration, and impacts, as well as our vulnerability to another such attack and whether there was any exfiltration or misappropriation of data. There was no evidence that the attack extended beyond the Aurora acquisition's systems, and it was determined that no critical data was accessed. We have subsequently integrated the acquisition's systems with our main systems, which we completed in 2024.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Our incident response and crisis communications plans are designed to escalate certain cybersecurity incidents to members of the crisis management team depending on the circumstances, which includes the following roles: CISO, CCO, GC, and the corporate communications team and executive leadership as needed. This group works with our incident response team to help triage, contain, remediate, and recover from cybersecurity incidents of which they are notified. In addition, our incident response and crisis management plans include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Sprinklr, Inc.

ticker: CXM


text: Although risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.

companyName: Knife River Corp

ticker: KNF


text: The Board is also regularly briefed by our director of information technology (IT) on the Company's cybersecurity policies, risk assessments, and mitigation strategies. This reporting structure allows the board to remain engaged with the company's efforts to address and manage evolving cyber threats, ensuring that cybersecurity is aligned with our overall risk management framework.

companyName: Luvu Brands, Inc.

ticker: LUVU


text: The Security and Compliance Team, within our IT department, takes the lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. The Security and Compliance Team is led by the Security and Compliance Program Manager and consists of a Lead Security Engineer and a Security Analyst. The Security and Compliance Team works very closely with our team across the IT department and with several different third parties who provide expertise in different areas such as threat hunting and penetration testing.

companyName: Zumiez Inc

ticker: ZUMZ


text: The Company engages a third party to perform an annual cybersecurity audit, which attests compliance with our Cybersecurity Program and industry best practices. The results of the third-party audit and internal vulnerability reviews are used by the CISO to guide investments in cybersecurity capabilities, solutions, and services to reduce the Company's exposure to cybersecurity risks. To aid managing, prioritizing and remediating any identified cybersecurity, software engineering, and IT infrastructure risks, the Company has implemented a risk register. The risk register is maintained by the IT Department and the status of remediation efforts is communicated to management during the quarterly meetings of the IT Steering Committee. Any significant, control failure, weakness or cybersecurity incident is reported by the CISO to the Company's incident response team and prioritized for remediation in accordance with our cybersecurity incident response plan. In addition to the third-party audit, we perform ongoing vulnerability reviews and conduct annual penetration testing of certain external and internal systems based on selected criteria as determined by Management in conjunction with external consultants. These tests are conducted by qualified external consultants and all findings are reported to the CISO and any deficiency is tracked until it has been fully remediated. A risk assessment is conducted regularly based on NIST and CIS frameworks to determine gaps in controls that exposes the Company to a risk level that requires mitigation efforts. The Company requires in depth security monitoring continuous and real-time, detection of, and responses to cybersecurity threats and has partnered with industry leading managed service providers to accomplish this objective. Our cybersecurity partners maintain continuous security operations centers, threat intelligence, response capabilities, and incident response services. These services are tested for effectiveness annually as part of the internal penetration testing process. As mentioned above, the Company has implemented an incident response plan and incident response team that meets at least annually to assess breach scenarios and improve our response capabilities. All findings from testing, vulnerability analysis, breach scenarios, and event detection are reported quarterly by the CISO to the IT Steering Committee and Audit Committee.

companyName: International Money Express, Inc.

ticker: IMXI


text: As part of our overall enterprise risk management function, we have implemented and currently maintain various information security processes designed to identify, assess and manage material risks related to information technology, including cybersecurity threats to our critical computer networks, third-party hosted services, and our critical data, ("Information Systems"). Our Information Systems risk management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: We have developed and implemented a cybersecurity risk management program that leverages the Center for Internet Security Critical Security Controls framework (CIS CSC). As part of our cybersecurity risk management program, we use multiple internal and external systems and tools to help monitor, identify, assess and manage material risks from cybersecurity threats and protect the Company's data and systems. We also monitor various sources to identify risks including, but not limited to, data from government entities, security vendors, and industry sources.

companyName: CARROLS RESTAURANT GROUP, INC.


text: The Company's Board of Directors as a whole supervises the Company's cybersecurity strategy and regularly reviews cybersecurity risks, incident reports, and risk mitigation initiatives.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: A formal incident response plan is maintained by the Information Security Department and approved by the Board of Directors or designated Committee thereof at least annually. The response plan sets forth the Bank's information/cybersecurity incident response framework, which has been designed to ensure a consistent, repeatable response to any actual or threatened cybersecurity incident. The framework sets forth the team structure utilized for the coordination, monitoring, oversight, and internal and external reporting in connection with any identified incident; and delineates responsibilities for all team members involved in response activities, as well as guidance for all employees in connection with defining, discovering, reporting, investigating, containing, and recovering from an incident. During the reporting period, we did not experience any cybersecurity risks or incidents that have materially or are reasonably likely to materially affect the Bank; including its business strategy, result of operations, or financial condition.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: Our Chief Information Officer is primarily responsible for assessing and managing material risks from cybersecurity threats on a day-to-day basis.

companyName: CRYO CELL INTERNATIONAL INC

ticker: CCEL


text: Access control policies have been implemented to limit unauthorized access to sensitive information and we seek to maintain and monitor critical systems. Multi-factor authentication is used for remote access, use of privileged accounts and access to critical systems.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: We, including our third-party vendors, have experienced cybersecurity incidents and threats and may continue to experience them in the future. Based on the information available as of the date of this Annual Report on Form 10-K, we believe that during the last three fiscal years risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. Due to evolving cybersecurity threats, we may not be able to protect all information systems and, as an acquisitive organization, integrating information systems as we acquire new businesses may expose us to unexpected liabilities or increase our vulnerability. There can be no guarantee that our policies, programs and controls, and those of our third-party vendors, including those described in this section, will be sufficient to protect our information, information systems or other property. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: To safeguard our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner at a network and user end point level. These include, but are not limited to, internal reporting, monitoring and detection tools. We engage various third-party vendors to provide these security services, including providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. In addition, we engage a third-party vendor to perform penetration testing at least annually and our IT team also performs simulations and response readiness tests on an annual basis. Our incident response plan sets forth our response protocol to coordinate the activities that we take to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We utilize certain vendor management processes to help manage cybersecurity risks associated with our use of certain these providers, including, for example, risk assessments and reviews of the provider's written security program documentation. Our vendor management processes may vary depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.

companyName: IN8BIO, INC.

ticker: INAB


text: We utilize on-premises and cloud-based security solutions, with real-time monitoring provided by specialized managed security services providers. These external managed security service providers collect events generated by critical systems in real-time, filters non-security events, and then correlates the information using security data analytical engines so that personnel can identify and analyze threats.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: As a financial institution, we believe that the risk of cybersecurity incidents is a significant, increasing, and always evolving risk for our business. Federal law and regulations require us to maintain a comprehensive written information security program, and federal banking regulators regularly issue guidance regarding cybersecurity threats intended to enhance our cybersecurity risk management. Accordingly, we have developed and implemented processes for assessing, identifying and managing material risks from cybersecurity threats designed to comply with federal law and regulations and protect against cybersecurity threats to our business. Our program is supported by management and the Board. The Company maintains an active cyber insurance policy to enhance protections against material data intrusions or loss of privacy. For an overview of the federal banking laws and regulations that govern our management and oversight of cybersecurity risks, refer to Item 1. Business – Supervision and Regulation – "Financial Privacy and Cybersecurity Requirements," incorporated by reference into this Item 1C.

companyName: Investar Holding Corp

ticker: ISTR


text: As detailed above, Voya Financial's CISO and the information security team regularly assess and manage cybersecurity risks. Voya Financial's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. Additional management of cybersecurity risks is conducted by Voya Financial's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya Financial's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya Financial.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: Cybersecurity Risk Management Program Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence ("AI") technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CCO of the Advisor, manage the Company's cybersecurity program. The CCO is responsible for monitoring and reporting to the board about the Advisor's compliance with its responsibilities for the Advisor's and the Company's cybersecurity program. The CCO has been responsible for this oversight function as CCO to the Company since inception and has worked in the financial services industry for more than 30 years, during which time the CCO has gained experience in assessing and managing risk applicable to the Company.

companyName: Kennedy Lewis Capital Co


text: Cybersecurity is considered a critical risk area at DXC and is integrated into the Company's overall ERM program, which includes maintaining the ERM framework, evaluating risk appetite, and monitoring evolving risks and the effectiveness of mitigations. Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Nominating/Corporate Governance Committee oversight of cybersecurity and other information security risks. The Nominating/Corporate Governance Committee oversees management's efforts to identify, assess, mitigate, and remediate material information security risks. Similarly, the Audit Committee oversees our disclosure controls and procedures, which include cybersecurity reporting disclosure controls.

companyName: DXC Technology Co

ticker: DXC


text: At PetIQ, cybersecurity is an overall company risk that is managed as a part of the Enterprise Risk Management Program which is updated and reviewed quarterly and is overseen by both senior management and the Board of Directors. For a description of the risks from cybersecurity threats that may materially affect PetIQ and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: PetIQ, Inc.


text: Our cybersecurity risk management program incorporates multiple components, including, but not limited to, ongoing monitoring of critical risks from cybersecurity threats using automated tools.

companyName: HealthLynked Corp

ticker: HLYK


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats. For a discussion of potential cybersecurity risks affecting us, please refer to the " Risk Factors " section.

companyName: EON Resources Inc.

ticker: EONR


text: Board Oversight and Governance Our Board of Directors (the "Board"), in conjunction with management, is responsible for assessing which risks are warranted and acceptable, based on management's ability to: • identify and understand such risks; • measure the degree of exposure to such risks; • monitor the changing nature of the risk and related exposure; and • develop and implement processes and procedures to control such risks.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: As part of our cybersecurity risk management program, we regularly perform a comprehensive risk assessment to help identify material cybersecurity risks, including vulnerability analysis, industry-specific risks, and required regulatory adherence. We also use external third-party service providers, where appropriate, to assess, test or otherwise assist us with aspects of our cybersecurity program. We manage material risk from cybersecurity threats by implementing a three-year strategic plan addressing the design, implementation, monitoring, and maintenance of preventative technologies and controls related to cybersecurity. This plan is reviewed and tailored annually for any relevant changes in business operations or new initiatives. In addition, our cybersecurity risk management program includes (1) a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, our response to cybersecurity incidents, and the performance of our managed security service provider; (2) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (3) a third-party risk management process for service providers, suppliers and vendors. State privacy laws are continually evaluated and applied as required. In addition, the Nevada Gaming Control Board issues information technology internal control standards, which we use to evaluate our internal and external audit procedures on an annual basis.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Our information security leadership inventories and prioritizes information security risks and evaluates material risks from cybersecurity threats, and reports those quarterly to the audit committee of our board of directors (Audit Committee), which evaluates our overall enterprise risk.

companyName: Freshworks Inc.

ticker: FRSH


text: We assess the cybersecurity practices of our third-party vendors and service providers, including conducting due diligence on vendors before engaging their services and monitoring their compliance with our security requirements.

companyName: GT Biopharma, Inc.

ticker: GTBP


text: For the fiscal year ending June 30, 2024, the Company had no cyber events requiring disclosure on Form 8-K, Item 1.05 as required under the Securities Exchange Act, Regulation S-K, Item 106.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Our Chief Financial Officer and Chief Operating Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Oruka Therapeutics, Inc.

ticker: ORKA


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") 800-53, including derivatives such as NIST Cybersecurity Framework ("CSF") and HITRUST, as well as NIST 800-66 and the Center for Internet Security ("CIS"). Recently we have obtained HITRUST certification for one of our core clinical applications, however this does not mean that overall we meet any particular technical standards, specifications, or requirements, but only that we use these standards as a guide to help us design and assess our program.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: We have a mandatory employee education program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions. Security training is required upon hire for new employees, and on an annual basis for the rest of the workforce.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: We believe cybersecurity is critical to advancing our business securely. We face a multitude of cybersecurity threats, have experienced, and will continue to experience, cyber incidents in the normal course of business. Such cybersecurity threats could have a material adverse effect on our business, financial condition, operations, results of operations, performance, cash flows or reputation. Our service providers (including the transfer agent), and other business contacts may face similar cybersecurity threats, and a cybersecurity incident impacting these persons or entities could materially adversely affect our operations, performance and results of operations.

companyName: TLGY ACQUISITION CORP

ticker: TLGYF


text: While our full board of directors has overall responsibility for risk oversight, it has delegated oversight of certain risks to its committees, including the oversight of risks from cybersecurity threats. The board of directors delegated the oversight of cybersecurity risks to the Audit, Risk and Finance Committee, which oversees controls for the Company's major financial and security risk exposures. The board of directors, through the Audit, Risk and Finance Committee, oversees the design and implementation of the Information Security Program. The board of directors and the Audit, Risk and Finance Committee are informed about these risks through regular reports from the Chief Information Security Officer, or CISO, about the Information Security Program.

companyName: Root, Inc.

ticker: ROOT


text: The responsibility for day-to-day management of cybersecurity risks lies with the Chief Financial Officer and Chief Executive Officer, with assistance from other members of management and contracted information technology consultants. The Company's contracted information technology consultants consist of highly experienced professionals in the areas of network security and disaster recovery. This team will be at the forefront of our cybersecurity initiatives, coordinating both internal and external resources to anticipate, identify, and mitigate cyber threats. Our approach will include regular updates from our third-party security expert consultant, leveraging intelligence from various sources, and utilizing advanced security tools to protect our digital environment.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Our cybersecurity program aligns to internationally recognized standards and best practices for cybersecurity and data protection. We perform, internal and externally sourced, security testing, 3rd party attack simulations, application scanning, and IT Security Controls Assessments, to identify vulnerabilities and evaluate cyber defense capabilities in the enterprise and in our vehicle product systems. We also perform phishing and social engineering simulations and provide cybersecurity training to Company personnel with access to Company information and/or digital assets. We disseminate security awareness newsletters to employees to highlight emerging or urgent cybersecurity threats and best practices. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT"), Automotive Information Sharing and Analysis Center ("Auto ISAC"), FBI InfraGard; and review customer, media, and third-party, cybersecurity reports; and respond to third-parties or security researchers who notify us of vulnerabilities they can detect in our cyber defenses.

companyName: Fisker Inc./DE


text: Our Chief Financial Officer and our Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Global IT Director has 20 years of experience in the design, implementation, and support of information technology infrastructures.

companyName: Pangaea Logistics Solutions Ltd.

ticker: PANL


text: We also have a dedicated team of employees overseeing its data security plan and initiatives, led by our Director of IT, and works directly in consultation with internal and external advisors in connection with these efforts. With over fifteen years of experience in the field of cybersecurity, our Director of IT brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: Shimmick Corp

ticker: SHIM


text: We utilize a range of external experts, including cybersecurity consultants to assist in evaluating and testing our risk management systems, particularly where advanced or specialized expertise may be required.

companyName: BrightView Holdings, Inc.

ticker: BV


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST and Center for Internet Security (or "CIS") as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle confidential information, personal data and other sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage incident handling frameworks to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; • use a third-party risk management platform to continually assess and manage risk, using CIS and NIST benchmarks, HIPAA security rules and guidance and overall information technology risk; • use a third-party service providers to continuously monitor, perform vulnerability scanning, and penetration testing of our internal and/or external online presence, including wireless networks, cloud-based servers, business website, and electronic communications; • utilize defined onboarding and monitoring procedures with third-party contractors, including risk- based surveys as part of the vendor management and selection process; and • establish a cross-functional governance working group or committee led by the Information Security Officer to oversee and make recommendations as to data classification, management and access.

companyName: DermTech, Inc.


text: Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. Our management will promptly report to the board of directors on incidents of material cybersecurity risks facing us and any third parties and the measures that may be taken to mitigate such risks. As of the date of this Annual Report, we have not encountered any cybersecurity incidents that have materially affected, or that we believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. We do, however, face risks from cybersecurity threats.

companyName: Aimei Health Technology Co., Ltd.

ticker: AFJK


text: We employ a variety of measures to prepare for and protect against, detect, and contain and eradicate cybersecurity incidents and threats. The preparatory and protective measures we have in place include, without limitation, password protection, multi-factor authentication, internal and external penetration testing, maturity assessments, industry benchmarking, and annual cybersecurity awareness trainings for our employees as well as social engineering awareness simulations. The security operations program includes an outsourced managed security detection and response service, augmenting the internal security staff with additional third-party dedicated staff and an expert security advisor. Our IRP sets forth the process we follow to investigate a potential or confirmed cybersecurity incident and contain it as well as to assess disclosure obligations and address remediation, eradication, and recovery, with such efforts dependent upon on the nature of the cybersecurity incident. We have relationships with a number of well-established third-party service providers to assist with cybersecurity incident response, containment and remediation efforts. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity incidents that impact our own systems, networks, and technology. While we maintain a robust cybersecurity program, the techniques used to attack or impact information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: 2. Third Party Support – In addition to the internal tests and recurring audits our Information Security team performs on our systems, the Company also engages external consultants and auditors. For example, the Company engages third party auditors to obtain SOC 2 Type II Certification. Furthermore, the Company regularly works with third party consultants to perform penetration tests. These third-party engagements supplement internal tests and audits as detailed in our Information Security policies.

companyName: QUINSTREET, INC

ticker: QNST


text: The rapid emergence of AI technologies has had a notable impact on our operational and strategic environment. These technologies quickly entered our ecosystem, and we responded by implementing necessary user awareness programs and governance mechanisms. Responsible adoption of AI technologies remains a key focus area. Our efforts encompass raising organizational awareness, deploying suitable monitoring tools, and fostering innovation while ensuring compliance with privacy regulations and industry standards. Our program continues to evolve to ensure the safe, ethical, and compliant use of AI across the enterprise.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Cyber Governance On a quarterly basis, the CISO presents key security metrics to the Company's IT Advisory Council, which is composed of functional leaders across the Company and is responsible for IT governance oversight in the Company. Specifically, this IT Advisory Council is responsible for establishing program strategies in alignment with LivaNova's business objectives, as well as providing guidance on the implementation of appropriate and necessary security controls in alignment with the Information Security Policy. Among other things, the IT Advisory Council reviews summaries of information security incidents, audit findings, or other test reports, and ensures appropriate root-cause analyses are performed and corrective actions are taken. It also establishes year-over-year goals, security objectives, and priorities for the information security program.

companyName: LivaNova PLC

ticker: LIVN


text: Cybersecurity incidents are inevitable in the current threat environment. We believe that it is a question of "when" not "if" a cybersecurity incident will occur. As a result, we commit resources to prevention, detection, and mitigation to limit the adverse effects of cybersecurity incidents, including the amount of information that can be extracted from our systems by threat actors, whether internal or external.

companyName: U-Haul Holding Co /NV/

ticker: UHAL


text: One of our organization's top priorities is protecting Cooper Standard's digital assets, and we increasingly rely on data and digital transactions to operate efficiently and effectively. We take action to prevent potential impacts related to system outages, data breaches, cyber-attacks and other threats to avoid disruption to our daily operations. Cooper Standard prioritizes increasing efficiency and efficacy as we design and refresh prescriptive incident response procedures to minimize impacts of potential cyber-attacks or outages. From time to time, the Company engages in table-top exercises, which involve cross-functional business leaders. Our information technology ("IT") professionals focus on improving existing controls as outlined by ISO/IEC 27001:2022 (an internationally recognized information security framework), which is the foundation of our cybersecurity program. In recent years, we made advancements in this space by conducting a risk assessment carried out by an independent third-party and adding new cyber advisory services as described further below.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: The Board of Directors, as a whole and at the committee level, oversees our enterprise risk management program, the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regularly scheduled and as needed updates on cybersecurity and information technology matters and related risk exposures from our CISO and Chief Information Officer. The Board also receives regular updates from our CISO and Chief Information Officer on cybersecurity risks. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee and the Board of Directors.

companyName: loanDepot, Inc.

ticker: LDI


text: Technical safeguards We deploy technical safeguards designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls. Ongoing enhancements are integrated into our security roadmap, as informed by our security audits and assessments.

companyName: PENTAIR plc

ticker: PNR


text: Ansys also has an established Third-Party Risk Management Program and Policy that is designed to identify and manage cybersecurity risks associated with third-party service providers. The program includes processes designed to identify, assess and mitigate and/or manage third-party service provider risks. Under the Third-Party Risk Management Program and Policy, we evaluate third-party service providers through five stages: planning, due diligence, contracting/onboarding, ongoing monitoring and termination/off-boarding.

companyName: ANSYS INC


text: Although we expend significant resources to protect against security breaches, our existing security measures may not be successful in preventing all attacks on our systems. We have experienced cybersecurity incidents and threats, including malware, phishing, partner and customer account takeover attacks, and denial-of-service attacks on our systems. We do not believe these cybersecurity incidents have had a materially adverse effect on our Company, including our business strategy, results of operations, or financial condition. For further discussion, see Part I, Item 1A, Risk Factors - "Information Security, Cybersecurity, and Data Privacy Risks."

companyName: Booking Holdings Inc.

ticker: BKNG


text: The cybersecurity committee receives periodic notices (written and verbal) from the Cybersecurity Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The cybersecurity committee also receives quarterly reports, summaries or presentations related to the Company's cybersecurity program as it relates to both our corporate systems and products.

companyName: NETGEAR, INC.

ticker: NTGR


text: Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. As part of that educational process, we periodically simulate cybersecurity threats to the Company and review/assess employee responses. In this regard, the Company has implemented policies and procedures for all employees including: (i) information security/cybersecurity policies, which are internally available for all employees, (ii) information security/cybersecurity awareness training; (iii) a clear escalation process which employees can follow in the event an employee notices something suspicious; and (iv) ensuring that information security/cybersecurity is part of the employee performance evaluation and/or disciplinary process.

companyName: GRESHAM WORLDWIDE, INC.


text: We retain Techneto, Inc. d/b/a CyberTeam ("CyberTeam"), a third party vendor that reports directly to our Chief Operating Officer, to be responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. CyberTeam has been with the Company since its inception and has over 25 years of experience in cybersecurity.

companyName: PAVmed Inc.

ticker: PAVM


text: As discussed in more detail above under the heading, "Governance," our board of directors' oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with executives with responsibility for cybersecurity, our Chief Executive Officer, Chief Technology Officer and President, Chief Financial Officer, Chief Operating Officer/General Counsel and other members of management. Management is promptly updated regarding any significant security events and the Audit Committee regularly reviews updates from our information security and product security leaders about cyber threat response preparedness, security controls and procedures, security program maturity milestones, risk and approaches to risk mitigation and the current and emerging threat landscape. In addition, all members of our board of directors receive management's cybersecurity updates to the Audit Committee as part of their regular attendance at meetings of our board of directors.

companyName: Fortinet, Inc.

ticker: FTNT


text: The Company's information risk management program is designed to protect the confidentiality of nonpublic, sensitive information and the integrity and availability of our information systems. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. We have designed our enterprise-wide information security program consistent with industry standards using the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: Incyte is committed to maintaining robust oversight and governance of potential cybersecurity risks and to implementing processes and controls that help us identify, assess and manage such risks. To date, we have not experienced a cybersecurity threat or incident that has resulted in a material adverse impact to our business or operations. However, we cannot guarantee that we will not experience such a threat or incident in the future, given the increasing sophistication of those responsible for cybersecurity incidents. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable through our internal processes and tools, we remain potentially vulnerable to known or unknown threats. In some instances, we can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" for more information on our cybersecurity risks.

companyName: INCYTE CORP

ticker: INCY


text: We rely on information technology systems and data processing so that we or our service providers, collaborators, consultants, contractors or partners can operate to collect, process, transmit and store electronic information in our day-to-day operations. Our internal computer systems and data processing along with those of our third-party vendors, consultants, collaborators, contractors or partners may be vulnerable to risks from cybersecurity threats. To help manage these risks, we engage and rely on external experts, including an Information Technology MSP. We are also in the process of developing additional cybersecurity policies and procedures, as we continually work to enhance and evolve our program in light of the constantly evolving threats to our environment.

companyName: Vivani Medical, Inc.

ticker: VANI


text: We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. To help manage these risks, we engage and rely on external experts and an information technology managed services provider. Our managed services provider's information security analysts and IT security specialists offer us advice on technology, infrastructure, management, and productivity in relation to our information technology capabilities.

companyName: SWK Holdings Corp

ticker: SWKH


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of certain third-party service providers. These providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in the risk assessments, including information supplied by providers and third parties. In addition, we require these providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers.

companyName: Elastic N.V.

ticker: ESTC


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Adicet Bio, Inc.

ticker: ACET


text: We have also employed a chief information security officer who reports to the chief risk officer. The chief information security officer is responsible for information security, information technology risk management, vendor management and business continuity programs. The chief information security officer holds a graduate degree in cybersecurity and numerous information security certifications, including certified information systems security professional, certified information security manager, certified cloud security professional and qualified technology expert. Additionally, the chief information security officer has worked in the information security field for over 20 years within several financial institutions, implementing cybersecurity strategies, programs, policies and procedures.

companyName: Sterling Bancorp, Inc.


text: As of the date of this Report, we are no t aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: Spectral maintains a comprehensive cybersecurity risk management program designed to identify, protect against, detect, respond to, and mitigate reasonably foreseeable cybersecurity threats to the Company's operations. This program incorporates internal controls and safeguards aligned with industry standards – including access controls, data encryption, network monitoring, and employee cybersecurity training – to protect the confidentiality, integrity, and availability of the Company's information assets. We utilize a range of security tools and procedures to continuously monitor our systems and prevent unauthorized access or data loss. In addition, the Company has implemented a formal incident response plan that outlines procedures for promptly addressing and containing cybersecurity incidents. This incident response plan is tested and updated periodically (e.g., through tabletop simulations and third-party penetration testing) to ensure preparedness and effective remediation of any identified security events.

companyName: SPECTRAL CAPITAL Corp

ticker: FCCN


text: We believe that our cybersecurity program provides effective protection of client information and of our operating systems from known and reasonably expected risks, while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we maintain up-to-date information security and monitoring controls, which we believe mitigates cybersecurity risks and threats while optimizing the utility of our systems. At the same time, cyberattacks are increasingly common, sophisticated and destructive, and several large, highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. These events also have carried significant reputational risk for the successfully targeted institutions. In order to mitigate these risks, our Information Security Officer ("ISO") is responsible for our cybersecurity programs and for the detection of and response to any identified threats and incidents. That individual also reports regularly to our Board of Directors, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. Although the SEC's new cybersecurity reporting requirements do not require us to file a Form 8-K announcing the occurrence of material cybersecurity incidents, that obligation will apply to the Company with respect to material incidents discovered after June 15, 2024, and we are adapting our disclosure procedures to assure the timely compliance with the Company's obligations under Item 1.05 of Form 8-K once that requirement becomes applicable to the Company. In the meantime, we continue to evaluate and monitor cybersecurity risks to assess whether any detected incident would be material to investors and, in such an event, we would make a timely report of a material incident under Item 7.01 or Item 8.01 of Form 8-K.

companyName: OP Bancorp

ticker: OPBK


text: The Company has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Company's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions. Refer to Part I, Item 1A, "Risk Factors—We are subject to cybersecurity risks and may experience cyber incidents resulting in disruption or harm to our businesses" of this Report for further discussion of our processes for managing cybersecurity risks.

companyName: CVR ENERGY INC

ticker: CVI


text: Board Committee Oversight The Company's Board Enterprise Risk Committee provides oversight of the cyber program. The Committee consists of Board members, chaired by an independent director. Committee members have extensive experience in various disciplines including risk management, communications, litigation, banking and transactional matters, and regulatory compliance. The Board Committee receives regular reports informing on the effectiveness of the overall cybersecurity program and the detection, response, and recovery from significant cyber incidents. Cybersecurity metrics are reported quarterly to the Committee and Key Risk Indicators are reported.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For a discussion of cybersecurity risks applicable to us, see Part I, Item 1A, Risk Factors, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs" in this Annual Report on Form 10-K.

companyName: uniQure N.V.

ticker: QURE


text: The Audit Committee of our Board of Directors, or the Audit Committee, provides direct oversight over cybersecurity risk. Our Audit Committee and Board of Directors receive periodic updates from our Chief Legal Officer and Chief Compliance Officer, together with our outside information technology management/cybersecurity consultant, and the Audit Committee and Board of Directors is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: KALA BIO, Inc.

ticker: KALA


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Aquaron Acquisition Corp.

ticker: AQUC


text: We face many cybersecurity threats including ransomware, denial-of-service attacks, business email compromise, and persistent threats from state-affiliated groups. We have experienced cyber-attacks in the past and may experience cybersecurity incidents in the future. While prior incidents have not materially affected our business, results of operations or financial condition, there is no guarantee that a future cyber threat or cyber incident would not affect our business strategy, results of operations or financial condition. See Item 1A. Risk Factors for more information on our cybersecurity risks.

companyName: AAR CORP

ticker: AIR


text: Our cybersecurity framework is overseen its Information Technology ("IT") Team. The IT team is geared towards developing and refining a risk-informed decision-making process, emphasizing the early identification and mitigation of cybersecurity risks. The IT Leader leads the charge in implementing a cybersecurity risk management program, employing a mix of technological tools, rigorous processes, and external assessments to safeguard our assets. Regular training programs, including those focused on phishing and secure data handling, are mandatory for all employees, reinforcing the culture of cybersecurity awareness.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. All employees who have access to our systems are required to undergo annual cybersecurity training and, each year, our employees must review and acknowledge our cybersecurity policies. Further, our Information Systems team is trained to understand how to manage, use and protect personally identifiable information. User access controls have been implemented to limit unauthorized access to sensitive information and critical systems. Employees are required to use multifactor authentication and keep their passwords confidential, among other measures.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyber-attacks, data breaches, and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs, and negatively impact our reputation among customers and partners.

companyName: Toughbuilt Industries, Inc


text: Response to cyber incidents is guided by the Bank's Incident Response Policy. The Bank's plan is based on the National Infrastructure Protection Center ("NIPC") guidelines, with the addition of specific reporting and notification requirements required by regulation. The Incident Response Policy prescribes points of escalation and mechanisms for collaboration should the need arise to engage outside partnerships such as external counsel, cybersecurity forensic examiners, cyber insurance vendors, government agencies and regulatory bodies. The Incident Response Policy also specifies that material incidents are promptly reported to the Board and considered for disclosure under applicable SEC rules.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Under the ultimate direction of our CFO, with oversight from the Board, we maintain a security governance structure to evaluate and address cyber risk.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: National Security Administration ("NSA")'s Cybersecurity Collaboration Center U.S. Cybersecurity and Infrastructure Security Agency's Critical Partnership Federal Bureau of Investigation ("FBI") InfraGard U.S. Coast Guard Area Maritime Security Committees and Cybersecurity Subcommittees Cyber-Hawaii Maritime Transportation System Information Sharing and Analysis Center ("MTS-ISAC")

companyName: Matson, Inc.

ticker: MATX


text: We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.

companyName: Transit Pro Tech Inc.


text: Our management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. In managing cybersecurity risks, we adhere to a structured framework that outlines the roles and responsibilities of management positions and committees.

companyName: Powerfleet, Inc.

ticker: AIOT


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. We use people, process, and technology controls to manage and mitigate cybersecurity risk. The Company's Board of Directors delegates oversight of the Bank's processes for identifying, assessing, and mitigating material risks, including cybersecurity risks, to the Board Audit and Risk Management Committee. Senior Leadership, including the CTO and CRO, managed third-party service providers and advisors to maintain and continuously enhance the Bank's Information Security Program. The CTO, CRO, and the Bank's third-party virtual ISO regularly present to the Board Audit and Risk Management Committee on the state of cybersecurity at the Bank, including any business-impacting incidents and emerging industry risks. The virtual ISO has over 30 years of experience in IT, Information Security, Business Continuity, and Technology Risk in the Financial Services sector and maintains several industry-recognized security, audit, privacy and governance certifications.

companyName: BayFirst Financial Corp.

ticker: BAFN


text: Kelly Randis, Head of Global Information Technology. Ms. Randis is a seasoned information technology professional with substantial experience in handling cybersecurity matters who has worked at various pharmaceutical companies. Ms. Randis has previously served as the Director for Emerging Technology and Innovation at an international pharmaceutical company.

companyName: Gamida Cell Ltd.


text: Certain customer contracts require that we maintain a heightened level of information security and set out specific protocols to which we must adhere to safeguard covered data and other information. Our CEO, who has expertise in government contracting and related data and information controls, assesses these requirements on behalf of the company in consultation with our IT to determine the necessary network architecture and infrastructure for all of these requirements and ensures that proper protocols are implemented and that our personnel adhere to them. This includes special, additional training for personnel on handling of various levels of customer information.

companyName: APPLIED ENERGETICS, INC.

ticker: AERG


text: Our Director of Information Technology and our Manager of IT Security, having over 45 years of combined information technology experience1 take the lead in protecting the organization's digital assets and sensitive information from cyber threats and manage our partnerships with the external firm that specializes in around-the-clock threat monitoring, detection, and response services and other third-party providers. Our Director of Information Technology and Manager of IT Security also report material risks from threats to our information systems to the ERM Committee.

companyName: Rayonier, L.P.


text: Overview of the Cybersecurity Program Compass operates a cybersecurity program designed to identify, assess, and mitigate cybersecurity risks to protect our information assets, ensure business continuity, and maintain stakeholder trust. Guided by industry best practices, including the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") and the Center for Internet Security ("CIS") Critical Controls, we focus on continuous improvement to address emerging threats and vulnerabilities. We recognize the evolving nature of cybersecurity threats and regularly enhance our security controls, processes, and policies to adapt to these risks.

companyName: Compass, Inc.

ticker: COMP


text: As discussed in further detail in Item 1A – Risk Factors, the Company faces an increasingly challenging cybersecurity environment, and from time to time the persistent efforts of bad actors to gain unauthorized access to our and our service providers' information systems and our confidential and proprietary information are successful. In fiscal 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents or will not discover additional information about previously detected events.

companyName: Walt Disney Co

ticker: DIS


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Technology, Internal Audit, and Legal teams.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Vice President of IT and General Counsel. The Vice President of IT and General Counsel work with the Company's cross functional incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policies and procedures include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: We maintain standard procedures to help assess, identify and manage material risk posed by cybersecurity threats and regularly evaluate how we can integrate these procedures into our overall risk management processes. For example, we require that all of our employees who have access to our internal network complete formal cybersecurity training upon hire and on a periodic basis, including training on phishing, malware, and other cybersecurity risks. We also continuously evaluate our information technology systems and our practices that relate to our information technology systems. To date, we have not engaged any formal assessment or cyber security auditors or other third parties in connection with these efforts but may elect to do so in the future.

companyName: Decoy Therapeutics Inc.

ticker: DCOY


text: During 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected us, including our business strategy, results of operations or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, and if realized, these risks are reasonably likely to materially affect us. Additional information on the cybersecurity risks we face is discussed in "Item 1A. Risk Factors."

companyName: Penguin Solutions, Inc.

ticker: PENG


text: Proactively Managing Privacy Risks We also take several measures to proactively manage privacy risks. As part of our commercial contract review process, we require every third-party vendor ("vendor") engaged by the company to go through a separate privacy review. The privacy review includes, evaluating the personal data processed by the company and/or vendor, assessing the potential risks to such personal and applicable data subjects and identifying the specific measures that must be implemented to mitigate against such risks. One of these measures is to require vendors to agree to our standard Data Security and Privacy Addendum ("DPSA"), which was prepared with the assistance of outside consultants or revising the vendor's proposed Data Protection Agreement ("DPA") to provide the same protections as our DSPA. Wish's DSPA contains privacy preserving language and security controls to protect the Company in the event of a Security Incident.

companyName: ContextLogic Inc.


text: Our management, represented by our Chief Financial Officer and Vice President, Information Systems, lead our cybersecurity risk management processes and oversees their implementation and maintenance. Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters. As described above, we also have engaged a third-party IT and cybersecurity firm that works closely with our management to implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Our management and information systems teams, oversee the work of our third-party IT and cybersecurity firm and regularly communicates with members of the team. Members of this third-party IT and cybersecurity team have collectively over 54 years of prior work experience and are responsible for the implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer. In addition, our Vice President, Information Systems, has 38 years of prior work experience in information systems and technology, including with respect to cybersecurity issues and threats.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: Our Audit Committee oversees the Company's policies and monitoring programs relating to data privacy and security, including cyber or technology related attacks or malfunctions and reviews and discusses with management the Company's risk exposures pertaining to data privacy and security, and management's risk management policies. Our cybersecurity management team provides periodic updates to the Audit Committee, which occur no less than annually. Such updates include information related to threat landscape, risks, initiatives, and security incidents. In the event that any matter requires escalation, such matter would be brought to the Board; however, no matter has required such escalation since the Business Combination.

companyName: Sharecare, Inc.


text: Reporting to Board The VP of Technology, in his capacity, regularly informs the Executive Chairman and Chief Executive Officer and President and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. In addition to regular briefings, any significant cybersecurity matters and strategic risk management decisions would be escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. For further discussion of cybersecurity risks, see "Part I. Item 1A. Risk Factors – Risks Related to Our Business – Various events could disrupt or result in unauthorized access to our networks, information systems or properties and could impair our operating activities and negatively impact our reputation and financial results."

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: The firm's Chief Risk Officer (CRO) leads the Enterprise Risk program, providing the framework and tools used by all business teams across the firm, including technology, to identify, assess, and manage risks from cybersecurity threats in coordination with the firm's Chief Information Security Officer (CISO). The Enterprise Risk team provides guidance and support in identifying, assessing, and monitoring all aspects of risks from cybersecurity threats. The Enterprise Risk function conducts risk assessments for technology and cybersecurity, and coordinates with Internal Audit and Global Compliance to provide risk assurance activities.

companyName: PRICE T ROWE GROUP INC

ticker: TROW