text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Fund and the Advisers. Cyber risk management is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Fund relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Fund and other affiliates of TIAA.

companyName: Nuveen Churchill Private Capital Income Fund


text: Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. The results of this testing are included in the Company's SOC report. Further, we also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.

companyName: CANTALOUPE, INC.

ticker: CTLP

secItem: Item 1C


text: We have implemented and maintain various information security processes designed to assess, identify and manage material risks from cybersecurity threats to our critical systems and information. Such processes are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and has historically been included as part of compliance reports provided to our audit committee.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: The Information Security Officer ("ISO") oversees the Bank's Information Security and Cybersecurity Program and leads the Information Security team. Reporting to the Chief Risk Officer ("CRO") and Chief Information Officer ("CIO"), the ISO and his team are responsible for identifying, assessing and managing information security and cybersecurity risks, and for implementing and maintaining controls to prevent, detect and respond to cybersecurity threats and incidents, safeguarding the confidentiality, integrity and availability of the Bank's information systems and data.

companyName: RBB Bancorp

ticker: RBB


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Cybersecurity and Privacy—If we or our third-party providers sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."

companyName: Vroom, Inc.

ticker: VRM


text: Use of Consultants and Advisors We engage with a range of external experts, including cybersecurity assessors, consultants, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.

companyName: Century Communities, Inc.

ticker: CCS


text: We have made cybersecurity and the protection of our customers' data a top priority. The critical areas that we consider for our evolving cybersecurity program include access control; data encryption; SSDLC/change management; BCP/DRP; endpoint security; patch management; vulnerability assessments; compliance management; data privacy; incident response; monitoring, alerting, and logging; employee training (ingrained in our onboarding process, and mandatory online and in person training annually); and cyber insurance (coverage areas include ransomware, and business interruption which are critical to our clients and availability of business operations).

companyName: Fluent, Inc.

ticker: FLNT


text: We maintain an Information Systems Security Program to safeguard all Summit and Summit Community's information assets against unauthorized use, disclosure, modification, damage, or loss. This is achieved through a collaborative effort involving Operations, Technology, Compliance, Risk, and Senior Management. The Program is designed to: Uphold the security and confidentiality of customer and bank records as mandated by law. Proactively guard against potential threats or hazards to the integrity of these records. Prevent unauthorized access or use of records or information that could significantly harm our Company, Customers, and Employees. Develop and maintain guidelines for Information Technology compliance with external and regulatory demands. Implement and regularly test effective Business Continuity and Disaster Recovery strategies. The Company's Chief Operating Officer (COO) is designated as the program coordinator responsible for coordinating and overseeing the program.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to better manage and respond to cybersecurity risks in protecting our infrastructure and sensitive data. We have mapped and base-lined our people, processes, and technology in alignment with the categories defined in the NIST industry standard framework: Identify, Protect, Detect, Respond, and Recover. Additionally, Insulet's information security management system is ISO 27001 and 27701 certified. For the seventh consecutive year, Insulet received re-certification from the ISO, which is the recognized standard for information security management and privacy best practices that adheres to the highest international data security standards. In 2024, we also added ISO certifications specific to Cloud Computing and Health Informatics, which pairs with and supports other applicable medical device and international certification requirements.

companyName: INSULET CORP

ticker: PODD


text: We depend on the functioning, availability and security of our information systems, including financial, data processing, communications and operating systems. Several information systems, such as software applications and cloud platforms, are provided by third parties. Our cybersecurirty risk framework is designed to allow us to identify, assess and manage the cybersecurity risks we face in relation to, our systems and the information we process.

companyName: Outlook Therapeutics, Inc.

ticker: OTLK


text: As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our critical third-party service providers. These cyber-attackers can attempt to gain unauthorized access to our digital systems for malicious purposes including, but not limited to: misappropriation of company assets, accessing Company confidential or sensitive customer non-public information, corrupting data, causing operational disruptions, or as part of a ransom demand for payment. As described below, we believe we have appropriate risk management processes, governance policies, standards, and procedures, a system of internal controls designed to address and mitigate these risks, and experienced internal resources to execute our information security and cybersecurity risk management programs.

companyName: Capital Bancorp Inc

ticker: CBNK


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in Item 1A- Risk Factors.

companyName: FATE THERAPEUTICS INC

ticker: FATE


text: We also use a Security Information and Event Management (SIEM) platform, providing real-time analysis of security alerts generated by applications and network hardware. This platform helps the Global Security Operations Center in monitoring and responding to security events.

companyName: HERBALIFE LTD.

ticker: HLF


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the board of directors. The Incident Response Plan is coordinated through the [Information Technology Officer] and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: In addition, all employees regularly undergo mandatory continuing cybersecurity training. Employees in higher-risk functions receive additional training and cybersecurity awareness education. Audits, cybersecurity simulations and employee testing results indicate that our program is effective in protecting our information. The effectiveness of these programs is evaluated regularly through both internal and third-party audits.

companyName: Brookfield Asset Management Ltd.

ticker: BAM


text: In addition, we undergo an annual IT risk assessment reviewed by a third-party IT vendor, with significant or actionable findings reported to the Technology Business Review Committee. The annual IT risk assessment identifies our risk status on various IT security metrics and prioritizes remediation, external vulnerability scan results, patching reports, dark web status, and personnel IT security training reports. This annual third-party review helps further monitor and inform our Technology Business Review Committee's work and our cybersecurity risk management and strategy.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, managed cybersecurity service providers, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

companyName: biote Corp.

ticker: BTMD


text: Please refer to the "Risk Factors" section of this Annual Report for additional information related to the cybersecurity risks that could potentially impact our business.

companyName: Compass, Inc.

ticker: COMP


text: The Company has an Enterprise Risk Management (ERM) process, with an annual risk assessment performed. A universe of key risks is updated annually, with key risks rated by and discussed with corporate and site-level executives, as well as our Board of Directors, which oversees the Company's ERM process. As a result of the annual risk assessment, the enterprise's top risks are identified, with action plans developed to address each risk. Results of the annual enterprise risk assessment are presented to and discussed with the Board of Directors at least annually. One of the key risks evaluated annually is cybersecurity. Our cybersecurity risk evaluation assesses whether, or to what extent, information assets (hardware, software, systems, laptops, data, intellectual property) might be compromised in an attack by a malicious actor, resulting in potential data leakage, data destruction, malware infiltration, or a ransomware attack. With the increasing sophistication of cyber-criminals and constantly evolving threat vectors, the Company continues to identify cybersecurity as a top risk, prompting numerous actions and measures across the Company that endeavor to mitigate and, where possible, minimize such risks.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our President. Such individual completed a certificate program with Stanford University on Foundations of Information Security in the first quarter of 2024. In addition, he has over 20 years of executive responsibility for managing public company IT operations, including managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and deployment of internal training and company technology standards. This member of management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: KINETA, INC./DE


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board of Directors for further actions, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board of Directors deems appropriate to take.

companyName: China Foods Holdings Ltd.

ticker: CFOO


text: We employ a comprehensive, cross-functional approach to our cybersecurity strategy across our technology, legal, compliance, risk, finance, and other teams to assess, identify, and manage cybersecurity threats and respond to cybersecurity incidents when they occur. This integration helps ensure that the breadth of potential impacts from cybersecurity risks are considered and that our approach to managing these risks is consistent and coordinated across teams within our business. Through our digital risk and security program, our cybersecurity risk is regularly evaluated, and we regularly report this assessment of our cybersecurity risk to our executive management team and to the Audit and Compliance Committee and the Board of Directors.

companyName: Premier, Inc.


text: The Board Enterprise Risk Management ("ERM") Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls. The Chief Information Officer ("CIO") manages the IT Department and reports to the ERM and Chief Risk Officer ("CRO") on these matters. The CIO also supervises the Information Security Officer ("ISO") who is responsible for implementing and maintaining the Company's Information Security Program. The Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. Additional cybersecurity training to the ERM Committee is provided and overseen by the CRO and CIO. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company's Risk Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company. The Risk Committee is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank's corporate strategies, and ensuring compliance with applicable laws and regulations. The Bank's Information Technology ("IT") Steering Committee in conjunction with the Bank's Project Management Office oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Management is responsible for designing and implementing our governance framework and controls for managing our material risks from cybersecurity threats, under the oversight of our Board of Directors. Our Chief Information Security Officer is responsible for assessing and managing identified cybersecurity risks, and evaluating and remediating cybersecurity incidents, and sharing information directly with the Audit Committee and Technology Committee, or full Board of Directors, when appropriate. Our Chief Information Security Officer reports to our Chief Information Officer, who is in turn responsible for the management of Humana's data and information technology risks more generally. Our Chief Information Officer is a senior executive and industry leader in risk management practices in highly regulated fields. Our Chief Information Security Officer is an experienced cybersecurity executive and leader in the field, with many years of relevant experience working in highly regulated industries.

companyName: HUMANA INC

ticker: HUM


text: The Company has a formal process in place for identifying, handling and disclosing of material cybersecurity incidents. The Company's Security Oversight Committee includes our Chief Financial Officer, General Counsel, Vice President of Information Security and representatives from our Internal Audit, Legal, Compliance and Information Systems departments. The purpose of the SOC is to develop and review the Information Security policies, standards and guidelines for the Company that manage Cyber Risk. Furthermore, the Company's Code of Ethics and Conduct explicitly prohibits officers, directors, team members or other insiders who are subject to the Code from transacting in the Company's stock during a time when such individuals have knowledge of any material undisclosed cybersecurity incident or breach.

companyName: PROASSURANCE CORP

ticker: PRA


text: We rely on industry-standard software applications, IT systems, computing infrastructure, and cloud service providers (collectively referred to as "Information Systems") to perform essential operations. Many of these systems are managed, hosted, provided, or utilized by third parties, including BD, to support our business activities.

companyName: Embecta Corp.

ticker: EMBC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our legal team along with third-party service providers in coordination with the CTO. The CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for potential cybersecurity incidents, approving technical cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: We maintain a comprehensive cybersecurity program that includes policies and procedures designed to protect our systems, operations and data from unauthorized access, theft and destruction. We utilize a variety of protective measures as part of our cybersecurity program, including: • reviews of our network access rights and controls; • penetration testing; • patch management; • annual security awareness trainings and assessments for all employees and contingent workers; • security information and event management software to identify anomalies; • periodic security review meetings designed to identify vulnerabilities and review remediation efforts; • a vendor risk management program; and • cybersecurity tabletop exercises.

companyName: Hamilton Lane INC

ticker: HLNE


text: The Company's Kimball Electronics Support Center ("KESC") serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or our information systems and incidents originating from third parties. The KESC monitors, detects, alerts and responds to cybersecurity incidents, evaluating each incident pursuant to our Cybersecurity Incident Response Plan. The KESC escalates incidents with significant impact and pervasiveness to the Company's Cybersecurity Incident Response Team ("CIRT") for further action. Depending on the nature of the attack or indicator, our MSSP will collaborate with us in response to incidents to contain, mitigate, respond to, investigate and eliminate threats. Where appropriate, the CIRT will escalate incidents to the Audit Committee and the Board for additional consideration, action, and potential disclosure.

companyName: Kimball Electronics, Inc.

ticker: KE


text: • Internally conducted environment and vulnerability assessments. These include regular assessments performed by Uber's security engineering teams. The findings from these assessments are reported to Uber's senior management, including the CISO, and the Board or Audit Committee. In addition, our internal audit function periodically conducts additional reviews and assessments, which are reported to the Audit Committee. We also conduct table-top exercises to simulate the response to cybersecurity incidents; participants may include, among others, the CISO, the CPO, and representatives from communications, investor relations, finance and legal. • Independent third-party audits and assessments by industry-leading firms. As a global organization, Uber undergoes annual audits to maintain its certification as a Payment Card Industry Data Security Standard (PCI DSS 4.0) Level 1 Merchant and Service provider. Uber also undergoes annual audits to maintain its ISO 27001 certification for its core mobility, delivery, and enterprise businesses, and SOC 2 attestations that vary depending on the Uber product. • Cyber incident management. This includes efforts by Uber's security engineering team, at the direction of the CISO, to review potential incidents identified by Uber's internal teams, Uber's third-party service providers or external researchers through Uber's Bug Bounty program; identify those which represent potential or actual threats to Uber's systems, data or users; investigate and mitigate the cause and impact of such incidents; and implement safeguards to help prevent recurrence. Uber's CPO and legal team support such efforts, including in connection with legal or disclosure obligations triggered in connection with any such incidents. • Third Party Risk Management. Uber performs due diligence regarding its third-party suppliers, service providers and business partners. This includes requiring submission of evidence demonstrating third parties' ability to meet Uber's cybersecurity and data handling requirements. In addition, Uber's third-party suppliers and service providers who process Uber personal data are contractually obligated to notify Uber if they experience certain incidents impacting Uber personal data.

companyName: Uber Technologies, Inc

ticker: UBER


text: Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management. The Board also receives annual reports on information security matters from members of our security team.

companyName: Blaize Holdings, Inc.

ticker: BZAI


text: We have experienced cybersecurity incidents in the past and expect to continue to experience them in the future. We do not believe that any past cybersecurity incidents have had a material adverse effect on our business, operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program will prevent or mitigate a cybersecurity threat or incident, and it is possible that such events could occur, and could have a material adverse effect on our business, operations, or financial condition in the future. See the "Risk Factors" in Part I, Item 1A of this report for further discussion of the cybersecurity and related risks we face.

companyName: VERINT SYSTEMS INC


text: We maintain a comprehensive cybersecurity risk management program that aligns to the National Institute of Standards and Technology (NIST) Cyber Security Framework and adopts a variety of cybersecurity best practices across the enterprise. We leverage industry-leading cybersecurity vendors that provide the following capabilities: Managed Detection and Response (MDR); a Security Operations Center (SOC) that monitors the Company's IT assets on a 24x7x365 basis; tools to interdict emails with phishing links and malware payloads; data leak protection tools that provide real-time interdiction of data transfers outside of normal business usage; vulnerability detection and automated patching tools; firewalls and instruction detection systems; multi-factor authentication mechanisms; mobile device management systems; penetration testing; and various third-party assessments. Our critical IP data is maintained on segmented, access-controlled data stores. We utilize a variety of backup mechanisms for its data including both warm and cold storage solutions. Lastly, we utilize token-based technologies to support Payment Card Industry Data Security Standard (PCI DSS) compliant safe handling and protection of credit card data.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: Our information security program undergoes periodic external assessments aligned with the National Institute of Standards and Technology Cybersecurity Framework and the Payment Card Industry Data Security Standard. This alignment helps us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Outdoor Holding Co

ticker: POWW


text: Chief Administrative Officer is responsible for developing and implementing the cybersecurity risk management program and reporting on cybersecurity matters to the Board. Additionally, members of the third-party service providers have cybersecurity experience and/or certifications.

companyName: Streamex Corp.

ticker: STEX


text: Our cybersecurity risk management program includes a third-party risk management process for evaluating risks posed by critical service providers, suppliers, and vendors.

companyName: Erasca, Inc.

ticker: ERAS


text: Cybersecurity is an integral part of our overall enterprise risk analysis and discussions. We recognize the critical importance of assessing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the integrity, confidentiality, and availability of our company, customer, and employee data.

companyName: DAVEY TREE EXPERT CO


text: We believe cybersecurity is critical to advancing our business securely. We face a multitude of cybersecurity threats, and may experience cyber incidents in the normal course of business. Such cybersecurity threats could have a material adverse effect on our business, financial condition, operations, results of operations, performance, cash flows or reputation. Our service providers (including the transfer agent), and other business contacts may face similar cybersecurity threats, and a cybersecurity incident impacting these persons or entities could materially adversely affect our operations, performance and results of operations.

companyName: Broad Capital Acquisition Corp


text: Risk Management and Strategy Identifying, assessing, and managing cybersecurity risks is an important component of our overall enterprise risk management program. Our cybersecurity programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect the Company against cybersecurity risks. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, business continuity planning, incident response planning and data security assessments of third-party service providers as a part of vendor management.

companyName: Nine Energy Service, Inc.


text: Our CIO has more than 30 years of experience, including from his prior business and technology leadership roles at Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company. Our CISO has more than 20 years of cybersecurity experience. Prior to joining us, he was Senior Vice President, Chief Information Security Officer at Brighthouse Financial. Before then, he served as Technology Vice President & Chief Information Security Officer for GE Healthcare. He started his career at Allstate Insurance Company. He also holds security, privacy and risk certifications, including Certified Information Systems Auditor, Certified Information Security Manager and Certified Information Systems Security Professional.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: elements of our cybersecurity risk management program include: assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise our external service providers, where appropriate, to assess, test, monitor or otherwise assist with aspects of our security controls; training and awareness programs for employees to drive adoption and awareness of cybersecurity processes and controls; cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Biofrontera Inc.

ticker: BFRI


text: As part of the Company's overall risk management, the Company has adopted processes designed to assess, identify and manage material risks from cybersecurity threats. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. The cybersecurity risk management program includes, among other things, processes to manage risks associated with third party service providers, regular review and testing of the Company's cybersecurity practices through audits, internal assessments and tabletop exercises, and mandatory annual cybersecurity awareness training for all employees. In addition, the Company has adopted an incident response plan establishing the processes for responding to any cybersecurity incident. The Company has engaged third party cybersecurity firms to perform maturity assessments of our cybersecurity risk management program, the results of which are reported to the Board.

companyName: IES Holdings, Inc.

ticker: IESC


text: We maintain a comprehensive cybersecurity program and continuously assess our approach against industry best practices. Our focus on cybersecurity risk management, including risk identification, analysis, and response, centers on the following areas: • Enterprise security: We reference industry-accepted control frameworks, compliance regulations, privacy requirements and best practices. • Product security: Our development teams participate in regular training and adopt industry best practices to enhance the security of our product portfolio. • Threat landscape analysis: We continuously assess emerging threat vectors and the evolving data privacy regulatory environment. • Incident response: We continuously monitor the threat landscape and our systems in coordination with an external monitoring firm and regularly test our incident response preparedness.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: The Company's employees are required to sign confidentiality agreements in an effort to, among other things, help to ensure cybersecurity. The Company has taken measures to better ensure that key employees are aware of data security threats (including cybersecurity threats), and Company security policies and procedures, as appropriate. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures may result in disciplinary action.

companyName: Longduoduo Co Ltd

ticker: LDDD


text: A continuous cybersecurity risk monitoring and response process, which involves daily review and real-time alerts of security incidents, a multi-disciplinary escalation and review process, and a reporting and filing protocol for material incidents within four business days of materiality determination.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: In connection with our use of third-party services providers, we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business. For more information, please refer to Part I, Item 1A. "Risk Factors" in this Annual Report on Form 10-K.

companyName: Birchtech Corp.

ticker: BCHT


text: One of our board members is CEO of a technology company and another has been employed with a cyber security company.

companyName: INTELLINETICS, INC.

ticker: INLX


text: management and strategy are an R&D stage pharmaceutical company, with no commercial operations or revenue streams. Since our IPO, our sole business activity has been ongoing research into our drug therapies. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently.

companyName: Pelthos Therapeutics Inc.

ticker: PTHS


text: We engage third-party vendors in connection with our cybersecurity risk monitoring and processes. These service providers assist in our design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: Our cybersecurity risk management and strategy processes are overseen by the Response Team, including our Chief Operating Officer ("COO"). The individuals on the Response Team and our COO have prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed by our information security and engineering teams about, and monitor, the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response and breach management processes. The Response Team and COO report to the Audit and Risk Committee on any appropriate items. The Board retains broad oversight of all risk management of the Company.

companyName: Sezzle Inc.

ticker: SEZL


text: • Our Senior Vice President, CIO leads our information technology department and oversees our cybersecurity division. Our CIO holds a Bachelor of Engineering in Computer Science and Engineering from Maharshi Dayanand University and a Master of Science in Computer Science from the University of Texas at Arlington. Our CIO has served in various roles in information technology for over 20 years, including as vice president of the Canadian division of a major home improvement retailer, where he directly oversaw the cybersecurity function, and in various vice president and IT director roles at a large U.S. based retailer and aircraft operator, as well as in the energy and online ticket distribution industries. • Our Director of Cybersecurity heads the division and is responsible for aspects of cybersecurity across our infrastructure, which includes cybersecurity architecture and engineering, cybersecurity operations and IT governance risk and compliance. Our Director of Cybersecurity has served in various cybersecurity roles for over 20 years at numerous organizations and consulting firms. Our Director of Cybersecurity earned a Bachelor of Business Administration in Management Information Systems (MIS) from Florida International University and a Master of Business Administration (MBA) in Management from Nova Southeastern University and also holds active cybersecurity certifications including the GIAC Certified Incident Handler (GCIH), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP).

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: Risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors— Risks Related to Our Company and Our Business— Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruption in service, which could harm our business.

companyName: SHOREPOWER TECHNOLOGIES INC.

ticker: SPEV


text: Our management and Board of Directors (the "Board") recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, dealers, business partners, employees and investors. The Board oversees our risk management practices, including our overall enterprise risk management ("ERM") program, in which cybersecurity risk is included. Our cybersecurity program is aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and leverages the International Organization for Standardization and other applicable industry standards. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our connected products. This is supported by our security operating framework, roadmap and governance.

companyName: PENTAIR plc

ticker: PNR


text: We have developed and implemented cybersecurity risk management procedures ("CRMP") intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our CRMP consists of procedures designed for Graham Corporation and certain subsidiaries and separate procedures designed specifically for BN. Our CRMP includes cybersecurity incident response plans ("IRPs") for Graham Corporation and BN. The purpose of the IRPs are to provide a structured and systematic incident response process for all Information Security Incidents that affect any of our or our subsidiaries' information technology systems, network, or data, including data of ours and our subsidiaries held, or IT services provided by, third-party vendors or other service providers.

companyName: GRAHAM CORP

ticker: GHM


text: A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management. An internal information security audit program is in place to ensure controls remain operational and effective.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: Board Oversight and Management ' s Role. The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. In particular, the Audit Committee assists the Board of Directors in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.

companyName: TRANSCAT INC

ticker: TRNS


text: The cybersecurity program is supported by other members of Uber's senior management team as well, including the Chief Legal Officer, Chief Architect Officer, and Global Data Protection Officer. Uber's Board of Directors oversees the cybersecurity program through regular updates.

companyName: Uber Technologies, Inc

ticker: UBER


text: Securing Bunge's business information, customer, supplier, and employee data and information technology systems is an important part of our overall risk management framework. We rely on certain key information technology systems, some of which are dependent on services provided by third parties, to provide critical data and services for internal and external users, including procurement and inventory management, transaction processing, financial, commercial and operational data, human resources management, legal and tax compliance, and other information and processes necessary to operate and manage our business.

companyName: Bunge Global SA

ticker: BG


text: The Audit Committee of the Board of Directors, which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the HGTO and Operational Risk Management throughout the year. At least annually, the Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential's annual external integrated audit.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: We understand the critical importance of assessing, identifying, and managing material risks associated with cybersecurity threats. To address this, we have established a cybersecurity risk management process that aligns with industry standards and is integrated into the Company's overall risk management systems.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: In order to mitigate risks of cybersecurity incidents, critical business and operational data are backed up at night and stored offsite for security purposes and to restore data in the event of a breach. Additionally, we provide cybersecurity awareness training of our employees, incident response personnel, and senior management.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: (1)Our Director of Information Technology has more than 25 years of IT experience. He joined the company in 2000 as an application developer and has held multiple positions of authority including project management and IT operations management. He holds a bachelor's degree and MBA from the University of South Carolina.

companyName: Rayonier, L.P.


text: Risk Management and Governance response to the increasing threat of continuously evolving cybersecurity risks, we continue to invest in our information technology and operational technology cybersecurity processes. W e maintain a data protection and cybersecurity risk management program based upon the National Institute of Standards and Technology ("NIST") Cybersecurity framework to assess, identify and manage cybersecurity risks. As part of this program, we maintain defensive network perimeter safeguards, internal mitigation and control features, continuous system and network monitoring, and contingency data protection. The Company ensures regular data and system backups through planned schedules. We utilize local backups for quick recovery and off-site, off-line and physical backups to safeguard against disasters. Our cybersecurity program includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity testing, detection, response, prevention and mitigation strategies. We also have a notification process for real-time escalation of material cyber incidents by members of our internal cybersecurity team to senior management, including our Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Corporate Controller, General Counsel and the Audit Committee of the Board of Directors. The Company's information security team also engages third-party security consultants for penetration testing, training and system enhancements. Our Director of Information Technology is responsible for leading global cybersecurity risk reduction efforts and compliance.

companyName: RBC Bearings INC

ticker: RBC


text: The Audit Committee reports to our board of directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies, and ongoing developments, on a quarterly basis or more frequently as needed. The board of directors also receives updates from management on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework. Members of our board of directors receive presentations that include cybersecurity topics and the management of key cybersecurity risks as part of the continuing education of our board of directors on topics that impact public companies.

companyName: Fold Holdings, Inc.

ticker: FLD


text: Ongoing cybersecurity training for employees; and Periodic testing of incident response procedures. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our cybersecurity risk management program.

companyName: TopBuild Corp

ticker: BLD


text: Our CISO has been at Williams for over 25 years. During that time, he has held a variety of IT positions at multiple levels in the organization ranging from network engineering to application development, project management as well as several IT Manager and Director roles. He has had oversight of our cybersecurity and risk management programs since 2017. Active in government and private sector partnerships, he is currently serving as the outgoing Chair of the Oil & Natural Gas Subsector Coordinating Council and recently acted as the Chair of the Interstate Natural Gas Association of America security committee. Our CISO holds degrees in Business Administration and MIS from the University of Oklahoma and is certified in Leadership from Harvard Business School's executive education. In 2018, he obtained his Chief Information Security Officer certification from Carnegie Mellon University.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information, see "Item 1A. Risk Factors, Our operations have been and will continue to be subject to cyber-attacks and other disruptions to our information systems that could have a material adverse impact on our business, consolidated results of operations, and consolidated financial condition ".

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks from the Sr. Director, IT. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with members of management.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to employees, based on their role.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: The audit committee of our board of directors oversees management's cybersecurity program and ensures timely reporting and management of cyber incidents.

companyName: ARGAN INC

ticker: AGX


text: The CISO and CIO provide monthly updates to the Executive IT Council on security incidents, compliance and patching metrics, as well as security related industry updates that might affect the Company's business. The Executive IT Council approves all security related project expenditures and all members are a part of the Company's incident response team.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: Our Director of Security has extensive experience implementing and managing cybersecurity policies including oversight of investments in tools, resources, and processes that allows for the continued maturity of our cybersecurity program. Team members who support our information security program have relevant educational and industry experience. Our CEO, Chief Financial Officer, and Audit Committee receive regular reports provided by our Director of Security on the Company's risk and compliance with respect to cybersecurity matters including data privacy, incidents, and industry trends, along with prevention, detection, mitigation, and remediation of cyber incidents.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: Equinix relies on its internal InfoSec team, and does not generally engage any consultants, auditors, or other third parties in connection with processes for assessing, identifying and managing risks from cybersecurity threats. However, Equinix does regularly engage with law enforcement communities with the intent to continuously improve and enhance its cybersecurity program.

companyName: EQUINIX INC

ticker: EQIX


text: We have established a dedicated team to manage and execute the ISP. A Chief Information Security Officer ("CISO") has been appointed as a Senior Vice President of the Company. The CISO leads the strategy and execution of the program while ensuring clear lines of communication with executive management, committees, the Board of Directors, and external stakeholders such as regulators and insurance carriers. The CISO was appointed in August 2023 after serving the Company as a senior officer and technology leader for over 15 years and leads a team of Information Security professionals with diverse security backgrounds including relevant certifications (e.g., CISSP, GSEC, GCTI). As a member of our risk organization, the CISO reports to the CRO, a member of the Executive Management Committee. The CRO joined the Company in February 2023 with over 30 years of progressive risk management experience.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: We review all technology third party vendors and technology service providers for the following: access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, incident response procedures, and periodic independent testing of the vendor capabilities. In addition, we review annually the System and Organization Controls ("SOC") Type 1 and SOC Type 2 reports of all of our third-party vendors hosting our data to ensure they conform to those requirements.

companyName: Meritage Homes CORP

ticker: MTH


text: Our management is responsible for risk identification, risk management and risk mitigation strategies associated to cybersecurity related information technology risks, including fully documenting our cybersecurity policies and procedures and cybersecurity risk management program as well as implementing a cybersecurity risk management program and ensuring compliance with our cybersecurity policies and procedures. Our Senior Vice President of Quality, GMP Operations, and Information Technology leads our Information Technology team, which includes experienced and information security professionals and has expertise in various aspects of cybersecurity, such as network security, data protection, incident response, threat intelligence, and security awareness. Our Information Technology Team's expertise is supplemented by external consultants who provide specialized services and independent assessments of our cybersecurity posture and capabilities.

companyName: SUPERNUS PHARMACEUTICALS, INC.

ticker: SUPN


text: Additionally, working group and committee meetings report up issues to Operational Risk Management, which may decide to open a formal Risk Management Issue (RMI) based on the severity of the issue or other factors and which are subject to specific governance processes. All security-related RMI remediation activities are reviewed with the Chief Risk Officer and Chief Information and Technology Officer on a bi-weekly basis.

companyName: US BANCORP \DE\

ticker: USB


text: Various security standards provide guidance to telecommunications companies in order to help identify and mitigate cybersecurity risks, including the voluntary framework released by the National Institute for Standards and Technology ("NIST") in 2014 and updated in 2018, in cooperation with other federal agencies and owners and operators of U.S. critical infrastructure. The NIST cybersecurity framework provides a prioritized and flexible model for organizations to identify and manage cyber risks inherent to their business. Our security infrastructure is comprised of multiple security capabilities designed with a defense-in-depth model informed by the NIST cybersecurity framework, as well as a variety of other industry standards and best practices. The risk-based approach of the NIST cybersecurity framework has enabled us to implement cybersecurity programs tailored to our particular network architectures, customer environments and institutional resources.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Cyber Risk Management and Strategy We have developed, implemented, and continue to maintain processes and procedures to identify and mitigate cybersecurity risks across our company (including our offices in Europe). Because we rely on various information technology systems and software programs to operate our business, we have an extensive cybersecurity program designed to protect our properties and confidential data. Our cybersecurity risk management and strategy program includes the following: • implementing the latest software releases and tools (including multi-factor authentication) in a timely manner; • seek to minimize the amount of personal information collected and stored about our employees and seek to avoid any collection and storage of non-financial or contact information from our tenants/borrowers; • constant security monitoring of computers, networks, and cloud-based information assets to detect and respond to cybersecurity risks and threats; • third party internal and external vulnerability assessments and penetration testing; • annual review and audit of cyber controls and procedures; • periodic review of cybersecurity procedures and implementation of new procedures as necessary to adhere to cybersecurity standards set forth by the National Institute of Standards and Technology; • periodic evaluation and review of cybersecurity risks associated with our use of key third-party business partners, vendors, and service providers. Because we do not control the systems or cybersecurity plans put in place by such third parties, and we may have limited contractual protections with such parties, we may be negatively impacted as a result of threats or incidents experienced by such third parties; • security awareness training provided during employee onboarding process and successful completion required at least annually for all employees with passing requirements; • employee anti-phishing campaigns performed at least quarterly; • a cybersecurity incident response plan, which is reviewed annually, but generally consists of a coordinated approach to investigating, containing, documenting, and reporting findings and keeping management and others informed and involved as appropriate; and • a cybersecurity risk insurance policy.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: Impact of Risks from Cybersecurity Threats We are regularly subject to cybersecurity attacks. None of the risks from cybersecurity threats we've faced to date have materially affected, and we do not believe are reasonably likely to materially affect the Company, our business strategy, results of operations or financial condition. For further information about risks we face from cybersecurity threats, see the risk factor entitled "Our size, scale and role in the global markets increases our risk for cyber attacks and other cyber-security risks. Our information systems and networks and those of our third-party service providers are exposed to risks related to cybersecurity and protection of confidential information, including material non-public information, which could have a material adverse effect on our business, financial condition or results of operations" in Item 1A, Risk Factors in this Annual Report on Form 10-K. Governance.

companyName: S&P Global Inc.

ticker: SPGI


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: • our external IT service provider; • professional services firms, including legal counsel; • cybersecurity consultants; • managed cybersecurity service providers; and • penetration testing firms.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Cybersecurity Committee meets at least twice annually with management to review our cybersecurity risks and cyber risk management program, and periodically reports to the Board on its activity. In addition, management updates the Cybersecurity Committee and Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: Amplitude, Inc.

ticker: AMPL


text: Our CISO attends quarterly meetings of our Disclosure Committee and provides input on disclosures in our Quarterly Reports on Form 10-Q and Annual Reports on Form 10-K, including the relevant risk factors set forth therein. Our CISO, along with the Information Security Team, also leads our Security Incident Response Team, which is responsible for investigating suspected cybersecurity threats and incidents. In the event of a possibly material cybersecurity incident, the Information Security Team also includes the following executive team members: Corporate General Counsel, Chief Legal Officer, Chief Accounting Officer, Chief Operating Officer & Chief Financial Officer and, to the extent practicable or relevant, other senior executives.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. The Company's Senior Manager, IT, has 24 years of experience in enterprise IT and has primary responsibility for managing our cybersecurity program and efforts, and our finance and IT teams are responsible for the testing and audit of our information-technology related internal controls.

companyName: CorMedix Inc.

ticker: CRMD


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled "If our information technology systems or those of our third-party partners or service providers or our data are or were compromised, we may experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruption to our business, harm to our reputation and brand, and exposure to liability."

companyName: Xometry, Inc.

ticker: XMTR


text: Cybersecurity risk management is a critical component of the Company's overall risk management. The Company proactively addresses cybersecurity risk through a comprehensive cybersecurity program to identify, protect, respond to, and manage any reasonably foreseeable cybersecurity risks, threats and incidents. The Company's cybersecurity risk management program is aligned with the International Standards Organization (ISO 27001:2022) and mapped to National Institute of Standards Special Publication 800-53 Revision 5 (NIST 800-53). The Company's cybersecurity program is integrated into the Company's overarching enterprise risk management program.

companyName: Vestis Corp

ticker: VSTS


text: Processes and controls we have implemented with the assistance of our third-part IT and cybersecurity team to assess, identify, manage and protect against material risks from cybersecurity threats include the following: • perform 24/7 security monitoring through an automated detection software managed by our third-party IT and cybersecurity firm; • conduct regular phishing email training for all employees with access to corporate email and other systems to enhance awareness and responsiveness to such possible threats; and • requiring employees, as well as third parties who provide services on our behalf, to treat information and data with care.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks, including cybersecurity. The Audit Committee of the Board of Directors is responsible for regularly reviewing with management our cybersecurity practices and policies. The Audit Committee regularly reports risks and compliance actions to the Board. As part of its oversight role, the Audit Committee receives regular reporting about our strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through quarterly updates from the Chief Information Officer ("CIO") who is also our Chief Information Security Officer. In addition, on at least an annual basis, the full Board of Directors receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from our CIO.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Our CISO reports to our Chief Information Officer and leads our overall cybersecurity function. Our CISO has over 20 years of experience in various security roles, which include managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. Our CISO collaborates with senior leaders and other members of our organization to identify and analyze cybersecurity risks and implement controls as appropriate and feasible to mitigate these risks. The CISO also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including by collaborating with internal and external stakeholders. Our CISO is supported by a management-led Security Council, which consists of our Chief Executive Officer, Chief Financial Officer and other senior leaders throughout our organization, and which reviews and discusses our cybersecurity program as well as emerging cyber risks, threats, and industry trends, among other topics.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Our operations include the creation, collection and maintenance of sensitive information, including proprietary and confidential business information, intellectual property, third-party information and employee information. To protect this information, we use external and internal services to managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats on a constant basis. In addition, we use multi-factor authentication (MFA) for external use, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impacts. We establish incident response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - The Company is dependent on computer and communications systems, and a systems failure, cyber-attack or data breach could cause a significant disruption to its business and cause financial losses."

companyName: Daseke, Inc.


text: Management oversight of cybersecurity risks is provided primarily through the Company's Technology Committee, which is chaired by the Company's CIO and comprised of members of senior management. The Technology Committee's responsibilities include general oversight of cybersecurity-related matters, maintenance of the cybersecurity and data privacy programs and oversight of the Company's cybersecurity incident response plan. Technology risk, including cybersecurity risk, is also integrated into the Company's enterprise risk management process. The Company's Risk Committee, chaired by the CEO and comprised of members of executive management, identifies the Company's material risks and reviews the strategies, processes and controls in place to facilitate the understanding, identification, prevention, measurement, reporting and mitigation of those risks. The Risk Committee meets quarterly and reviews the Technology Committee's current assessment of cybersecurity risks.

companyName: RLI CORP

ticker: RLI


text: The Board of Directors is responsible for oversight of risks from cybersecurity threats. Oversight of cybersecurity risk management is performed primarily by the Board of Directors and the IT Committee. The IT Committee consists of members of the Board of Directors and key members of management. The IT Committee's primary purpose is to assist the Board of Directors in its oversight of technology and innovation strategies, plans and operations related to cybersecurity, data privacy, and third-party technology risk management. The Chief Information Security Officer ("CISO") provides monthly information security reports on cybersecurity programs, policies and controls, key risk indicators and trends including responses to any cybersecurity events, and efforts to improve security. Annually, the CISO provides security training to the Board of Directors. The CISO also provides the Board of Directors with an annual Information Security Program Summary Report in compliance with federal banking guidelines.

companyName: Investar Holding Corp

ticker: ISTR


text: The Company maintains a robust Information Security Program that sets forth the Company's commitment to the continual review and improvement of policies, processes, procedures, and standards for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, disposing, and protecting sensitive information including customer information under guidelines established as part of the Gramm Leach-Bliley Act (GLBA). The Company uses or adheres to relevant standards and frameworks from the Federal Financial Institutions Examination Council (FFIEC) and National Institute of Standards and Technology (NIST), among others, to assess information security risks and controls, as well as to assess the maturity and effectiveness of the Information Security Program.

companyName: Beacon Financial Corp

ticker: BBT


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, CEO and other members of our executive leadership team (ELT). Our CFO, CEO and ELT work with our Security Management Team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the Audit Committee for certain cybersecurity incidents.

companyName: aTYR PHARMA INC

ticker: ATYR


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, and notification from external parties (e.g., our third-party information technology provider). Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.

companyName: LXP Industrial Trust

ticker: LXP


text: Following the initial briefing, depending on the seriousness of the incident, a cadence for updates and escalation is established and the cross-functional team continues to investigate, mitigate and resolve the incident, retaining outside counsel, forensic investigators and other consultants as needed. Priority is given to critical business functions/tasks/processes. Progress and developments are reported to more senior leadership based on the severity of the incident, up to and including the Board.

companyName: Portillo's Inc.

ticker: PTLO


text: Our Board of Directors oversees the organization's preparedness for cyber threats as part of its risk oversight function. This involves working to understand our risk profile, reviewing our cybersecurity processes, and maintaining an incident response plan. The Board strives to engage in active participation in continuous cybersecurity strategy improvement. In March 2023, the Board enhanced its cybersecurity expertise with the addition of Joanna Burkey. Ms. Burkey has an extensive cybersecurity background and has served as Chief Information Security Officer (CISO) at both HP and Siemens.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: At the management level, our CIO, certain directors on our information technology team, and our director of risk management, in consultation with our senior management team, have broad oversight of our cyber risk management processes. Our information technology team regularly discusses the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management, which includes that of the Company. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.

companyName: Vertex Energy Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our information technology infrastructure could be subject to service interruptions, data corruption, cyber-based attacks, or network security breaches, which could result in the disruption of operations or the loss of data confidentiality."

companyName: Enovis CORP

ticker: ENOV


text: The Cyber Incident Policy sets forth a process to report cybersecurity incidents that is intended to enable a rapid organizational response to mitigate risks and also to ensure compliance with our public reporting obligations. This process includes incident identification, reporting channels to report any cybersecurity incidents, reporting procedures with respect to information to be included in any incident report, provision for confidentiality of information reported, the initiation of a response process to any reported incident, communication of a reported incident to the Cybersecurity Committee. In addition to our internal reviews we may from time to time engage external cybersecurity firms to assist with investigations and external cybersecurity experts to evaluate our processes, including conducting penetration tests, to report on our cybersecurity infrastructure and processes to our senior management and to the Enterprise Risk and Audit Committee (the "Audit Committee") of our Board. Our Cyber Incident Policy also establishes procedures for engaging law enforcement should the need arise and defines certain parameters with respect to drafting initial incident reports, technical assessment reports, and financial impact reports for review by the Cybersecurity Committee, management, the Audit Committee, and the full Board, as appropriate.

companyName: Celsius Holdings, Inc.

ticker: CELH


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's IP; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Axogen, Inc.

ticker: AXGN


text: To identify and assess material risks from cybersecurity threats, we engage in regular network and endpoint monitoring, vulnerability assessments, penetration testing, and periodic tabletop exercises. We have developed an incident response plan to manage identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. The incident response plan sets forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. In addition to our in-house capabilities, we engage with key security and technology vendors, industry participants and intelligence communities to assess our program and test our technical capabilities and enhance the effectiveness of our information and cybersecurity policies and procedures. We use a combination of tools and technologies to protect AMN Healthcare's assets and information. We maintain and operate a proactive threat intelligence program to identify and assess risk. We have implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party vendors, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: Our program is outlined within our IT Security Policy and includes but is not limited to: authentication and authorization procedures, employee security awareness training, logging and monitoring procedures, in transit and at rest encryption of certain data we deem sensitive, periodic vulnerability scanning, periodic phishing attack simulations. We also use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: Consistent with overall ERM policies and practices, our cybersecurity program focuses on the following areas: we maintain cybersecurity threat operations with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response plans;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Roles of our Board of Directors and Management Our Board has delegated both the Audit Committee and Technology & Operations Committee with responsibility for monitoring and oversight of the information technology and cybersecurity components of our risk assessment and risk management programs. The independent directors comprising our Audit Committee and our Technology & Operations Committee: • regularly review our cybersecurity and related information technology risks, controls and procedures, including data protection and privacy and our plans to mitigate cybersecurity risks and to respond to cybersecurity incidents; • oversee technology and operations processes that relate to or affect our internal control systems, information security, data protection and privacy, fraud and cybersecurity risks; and, • assist management in developing our risk management methodologies and the steps taken to identify, monitor and control such exposures.

companyName: WORLD KINECT CORP

ticker: WKC


text: During fiscal year 2025, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our Reputation and Business Could Be Materially Harmed as a Result of Data Breaches, Data Theft, Unauthorized Access or Hacking" in Part I, Item 1A of this report.

companyName: VIASAT INC

ticker: VSAT


text: Our Cybersecurity Incident Response Plan is overseen by our Cybersecurity Incident Response Team ("CSIRT"), which is led by our Chief Information Officer ("CIO"). Our CIO is an information technology executive with over 20 years of CIO and Chief Technology Officer experience at publicly traded and privately held companies. His experience has included cybersecurity leadership throughout his executive career. The CIO, the Vice President of Information Technology, the virtual Chief Information Security Officer, and other members of the CSIRT, are responsible for the Company's cybersecurity risk management processes described above, including maintaining systems that are designed to preempt, detect and monitor cybersecurity threats, as well as identifying and responding to cybersecurity incidents.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: Under the oversight of our Executive Security Council, which is chaired by our Senior Vice President of Technology (Certified Information Systems Security Professional), and is also comprised of our Chief Legal Officer, Chief Operating Officer, Chief Accounting Officer and Treasurer and Chief Financial Officer, we have developed and implemented a cybersecurity risk management governance, risk, and compliance ("GRC") program that applies to us as well as our advisor and its affiliates. The GRC program is used to identify, assess, and mitigate findings and risks to our operations from cybersecurity threats. Our GRC program employs qualitative and quantitative assessments of the cybersecurity risk landscape impacting our operations, as identified by our Information Technology ("IT") and Security team to determine likelihood and potential impact. The analysis is evaluated by our Executive Security Council, and subject to the oversight of our board of directors to assess and prioritize potential risk to our information security. We consider cybersecurity, along with other top risks, within our enterprise risk management and GRC framework.

companyName: Cottonwood Communities, Inc.


text: Our Vice President, Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above and, along with and informed by the Information Technology organization and our Incident Response Team, monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Depending on the severity of the security incident, the Incident Response Team will report the security incident to our Audit Committee, including the financial impact of the security incident and any regulatory violations. As our Information Technology organization monitors the security and effectiveness of our policies and procedures, they also work to keep the Vice President, Information Technology and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: Fat Brands, Inc

ticker: FATAQ


text: Although no cybersecurity incident during the year ended December 31, 2024 resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations, the scope of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.

companyName: Safehold Inc.

ticker: SAFE


text: We maintain a CSIRP that is designed to guide our incident response process for cybersecurity incidents that could affect our systems, network, or data. The CSIRP identifies the individuals responsible for developing, maintaining, and following appropriate procedures to identified cybersecurity incidents. We periodically test our CSIRP using tabletop exercises with the goal of improving our processes and preparedness.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Overseeing Third Party Risk The need to govern third party service providers and vendors poses significant challenges, and as a result we have implemented processes to oversee and manage these risks. Our procedures contemplate conducting security assessments of all third-party providers that are proportional to the risks present, ideally before or soon after engagement, and periodically thereafter, in order to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Array Technologies, Inc.

ticker: ARRY


text: As the third line of defense against cybersecurity risk, our Internal Audit Department, with the assistance of outside experts, annually reviews and tests the Company's processes, including its policies, procedures and controls, with respect to cybersecurity risk. The Internal Audit Department reports the results of its review, including the steps management intends to take to address any findings, to the Audit Committee of the Board of Directors.

companyName: RENASANT CORP

ticker: RNST


text: To help identify, assess, and manage risks from cybersecurity threats, we have integrated cybersecurity risk management into our broader, Company-wide enterprise risk management (ERM) evaluation and strategy process, which is led by our executive officers, overseen by the Audit Committee of the Board, and reviewed annually by the full Board. Our ERM process takes a top-down, enterprise view of material risks impacting our Company, including credit, liquidity, strategy, cybersecurity, and operational risks, and is an ongoing process consisting of risk identification, risk rating, analysis and action plans, and reporting and monitoring. Employees responsible for assessing identified risks deliver an update quarterly to our senior leadership team, which consists of our Chief Executive Officer, Chief Financial Officer, Chief Information Officer, General Counsel, Chief Human Resources Officer, Chief Growth Officer, and Vice President of Supply Chain. Status updates with respect to these risk areas are delivered quarterly by management to the Audit Committee of the Board, and full risk assessment results are presented by management annually to the full Board.

companyName: TopBuild Corp

ticker: BLD


text: Our Enterprise Risk Committee has delegated to our Senior Vice President and Chief Information Officer (CIO) primary responsibility for assessing and managing our material risks from cybersecurity threats. The CIO has served in various roles in information technology and information security for over 25 years, including serving as vice president of global infrastructure and operations, infrastructure security, access management, cloud security, disaster recovery and change management, and vice president of enterprise business applications, architecture and operations. The CIO holds a master's degree in technology policy management and a doctorate in information technology management, in addition to serving on multiple advisory boards within academia and industry. The other senior leaders who collaborate with the CIO on reviews of the Company's IT system and cybersecurity risk environment include a senior director of global IT cybersecurity and a senior director of global infrastructure, each of whom have over 20 years of experience managing risks in various roles, including risks arising from cybersecurity threats.

companyName: ChampionX Corp


text: We have strategically integrated cybersecurity risk management into our broader ERM program to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. Our strategy includes regular employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of table top exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: TENNANT CO

ticker: TNC


text: Board of Directors has oversight responsibility for cybersecurity risk as part of its broader enterprise risk oversight function. The Audit Committee receives periodic updates on cybersecurity threats, incidents, risk mitigation strategies, and program enhancements from senior management.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: We have not engaged third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.

companyName: Propanc Biopharma, Inc.

ticker: PPCB


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Part I. Item 1A. Risk Factors" in this Form 10-K, including "If we or the third parties upon which we rely experience a cybersecurity breach or other security incident, any vulnerabilities are identified, or unauthorized parties otherwise obtain access to our customers' data, our data or our Unified-CXM platform, our Unified-CXM platform may be perceived as not being secure, our reputation may be harmed, demand for our Unified-CXM platform may be reduced and we may incur significant liabilities."

companyName: Sprinklr, Inc.

ticker: CXM


text: We depend on information systems and technology in many aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, and inadvertent release of information. We have a risk-based cybersecurity program and a dedicated team of cybersecurity professionals focused on protecting our data and information systems. These cybersecurity threats and related risks make it necessary for us to stay apprised of developments in the information security field, and dedicate resources to cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.

companyName: Varex Imaging Corp

ticker: VREX


text: The Company may review SOC1 or SOC2 reports of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent potential cybersecurity incidents as appropriate on an annual basis. The Company has engaged a third party to provide cyber security and awareness training to our employees to help mitigate the risk of threats posed by bad actor requesting information. The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality, security information event management, automated update/patch-management and access controls which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party vendors, the Company has implemented several layers of physical security, digital security, and data backup.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: As of the date of this Annual Report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations, or financial condition. For a discussion of how material risks from cybersecurity threats could materially affect us, see "Risk Factors—Risks Related to Privacy, Cybersecurity, and Infrastructure—If sensitive information about our sellers and buyers or other third parties with whom we transact business is disclosed, or if we or our third-party providers are subject to cyber-attacks, use of our online marketplace could be curtailed, we may be exposed to liability, and our reputation would suffer."

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: Part I - Item 1C. Cybersecurity Both the CIO and the CISO have expertise assessing and managing cybersecurity risks. The CIO has served in her current role since 2019 and served in similar technology leadership roles before her current role. She has nineteen years of executive leadership experience in the financial services industry and twenty-nine years of overall technology experience, during which time she has led large scale business transformation, delivered innovative technology strategies and has overseen and modernized complex technology portfolios.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG