text: The Board of Directors has overall responsibility for the oversight of risk management, and has delegated oversight of cybersecurity risk management to the Audit Committee. The Company's CIO and CISO regularly report to the Audit Committee on cybersecurity risks, updates on key initiatives and progress toward the Company's objectives. In addition, the CIO provides updates to the Board of Directors, at least annually, on the Company's broader IT strategy and key initiatives.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: Members of the Information Technology Leadership Team have experience managing risks arising from cybersecurity threats and hold security certifications including Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM). The Company's Vice President of Infrastructure and Information Technology Operations has served in various information technology security, infrastructure, and application roles for over 27 years and is supported by a team of information technology and cyber security professionals with decades of relevant experience. The Vice President of Risk Management has served in various roles in information technology and information security for over 18 years, holds an undergraduate degree in Accounting and a Master of Business Administration degree, and is a Certified Public Accountant.

companyName: WillScot Holdings Corp

ticker: WSC

secItem: Item 1C


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is assessed as a component of our enterprise risk management program. In addition, we have developed a process whereby our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports certain cybersecurity incidents to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: The DITSC is the Company's management position with primary responsibility for the development, operation, and maintenance of our information security program. The DITSC has over 20 years of experience in cybersecurity, including over 15 years of experience in the Cyber Defense and Electronic Warfare section of the U.S. Army. The DITSC has obtained multiple subject matter certifications, including the Global Information Assurance Certification. The DITSC briefs the Technology Committee of the Board regularly and oversees regular cybersecurity training and education opportunities for the Board, which covers topics ranging from the current threat landscape to our cybersecurity program metrics, risks, and roadmap. Management receives regular updates on cybersecurity risks from the DITSC. In the event of a security incident, the DITSC will follow the escalation process in our incident response plan to notify the Company's Crisis Committee, which is composed of a cross-functional group of Company leaders. The Crisis Committee will work with the DITSC to respond to and remediate any actual cybersecurity incidents. Depending on the severity of the security incident, the DITSC and the Crisis Committee are to escalate the security incident to the Chief Legal Officer and the Principal Accounting Officer, who will assess materiality in consultation with outside counsel. The Chief Legal Officer will notify the Technology Committee and the Board of any potential material incident.

companyName: Designer Brands Inc.

ticker: DBI


text: We also conduct a periodic assessment of cybersecurity risk as part of broader enterprise risk management (ERM). This assessment includes an evaluation of the Company's processes to identify and respond to cyber risks and the effectiveness of the Company's lines of defense. Given the complexity and evolving nature of cybersecurity threats, we leverage both internal cyber analytics and external sources of threat intelligence (including assessors, consultants, and other third parties) to evaluate our cyber risks and to properly adjust our risk mitigation approach. We also maintain controls and procedures that are designed to evaluate cyber risks on an ongoing basis. These processes include prompt communication of certain cybersecurity incidents to the Company's executives, internal committees and the Board as needed, so that any needed external reporting can be made by management and the Board in a timely manner.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: Cybersecurity risk management is incorporated into our overall enterprise risk management program. As part of its enterprise risk management efforts, critical enterprise risks are assessed by senior management annually and discussed with the Company's Board of Directors. Our Board of Directors has ultimate oversight for risks relating to our cybersecurity program and practices and receives regular updates from management on cybersecurity risks and threats.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: The Company's Information Technology Manager oversees the Company's incident response plan and related processes designed to assess and manage material risks, if any, from cybersecurity threats. The Information Technology Manager also coordinates with any consultants, auditors and other third parties to assess and manage material risks, if any, from cybersecurity threats.

companyName: Sow Good Inc.

ticker: SOWG


text: Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Risk Factors— Risks Related to our Business—If our efforts to protect the privacy and security of information related to our customers, us, our associates, our suppliers and other third parties are not successful, we could become subject to litigation, investigations, liability and negative publicity that could significantly harm our reputation and relationships with our customers and adversely affect our business, financial condition, and operating results." and "Risk Factors— Risks Related to our Business—A material disruption in our information systems, including our website or call center, could adversely affect our business or operating results and lead to reduced net sales and reputational damage." in Part 1 of this Annual Report.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: Our Manager of Information Technology is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for leading our overall cybersecurity risk management program. Our Manager of Information Technology has over 20 years of experience in the cybersecurity field.

companyName: TXO Partners, L.P.

ticker: TXO


text: Our Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the audit committee, which reviews our cybersecurity program with management and reports to the Board.

companyName: MetaVia Inc.

ticker: MTVA


text: The CISO manages a team of employees, which has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CISO brings over 30 years of technology, cybersecurity, and risk management experience from the finance and healthcare industries. His work experience includes the design, implementation, and oversight of control and governance frameworks in complex, hybrid-cloud, and data intensive environments operating in highly regulated entities in the financial services and healthcare insurance industries.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Emerson maintains a centralized 24x7x365 global incident response operation, managed by the global enterprise security team, supported by leading cybersecurity tools that detect and respond to threats as they occur. Every detected cyber incident is reviewed and assessed by Emerson's Computer Incident Response Team in accordance with our incident response plan, which contains documented escalation paths and is regularly tested.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: AWARE INC /MA/

ticker: AWRE


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Dominion Energy's current security posture and regulatory compliance efforts are intended to address the evolving and changing cyber threats. During the past three years, DESC has not experienced any cybersecurity incidents resulting in a material impact to their business strategy, results of operations or financial condition. DESC has identified the risk that a hostile cyber intrusion could severely impair DESC's operations, lead to disclosure of confidential information, damage Dominion Energy's reputation or otherwise have an adverse effect on DESC's business as disclosed under the Operational Risks header within Item 1A. Risk Factors.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: As one of the elements of the Company's overall enterprise-wide risk management approach, the Enterprise Risk Management Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the section titled "Governance," the Board Risk Oversight Committee has delegated to senior management responsibility for managing the Enterprise Risk Management Program. Senior management carries out this mandate through the Strategic Initiatives and Board Risk Oversight Committees. To maintain alignment and appropriate insight regarding information security activities, a bi-weekly operational committee provides general program insight. • Collaborative Approach: The Company has implemented a cross-functional approach to identifying, assessing, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management. • Security Competencies: The organization oversees a program of security competencies and tools designed to evaluate security risks and to protect the confidentiality, integrity and availability of our information systems and data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense and Incident Response Plan: The Company utilizes sophisticated security monitoring and detection tools for continuous monitoring of our information systems 24 hours per day, seven days per week. The Company utilizes third-party tools and solutions to actively deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. We also receive the latest cybersecurity alerts and threat intelligence from government agencies and information sharing and analysis centers. The Company's Incident Response Plan helps reduce the risks related to security incidents by providing guidance on our response to incidents by focusing on the coordination of personnel, policies, and procedures to ensure incidents are detected, analyzed and managed. • Third-Party Risk Management: Management of the Company's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven by risk factors established by the Vendor Management Program. The process provides awareness and collaboration across all internal teams including Information Technology and Risk Management. A review process is conducted on new or significantly changed key third parties, to ensure certain cybersecurity baseline requirements are met and cybersecurity incidents are appropriately disclosed. This process is aimed at advocating for appropriate standards and controls, based on risk factors, to secure the third parties' information systems, and to ensure the third parties have recovery plans in place. • Security Awareness and Education: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company's information security policies, standards, processes and practices.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: Management and Board Oversight of Cybersecurity Risks Our cybersecurity program is managed by the Information Security Officer who leads our IS team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Officer provides periodic reports to the IT Committee and Board of Directors. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operations Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: We have not experienced any material cybersecurity incidents. As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, we are aware that changes in our IT systems, including those provided by third parties, could expose us to risk in the future. These threats pose a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Cybersecurity attacks could also include attacks targeting patient, employee, or customer data or the security, integrity, and/or reliability of the hardware and software we utilize in our business operations. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing will be sufficient to protect and mitigate associated risks to our systems, information, or other property. For more information, see the risk factors included in Item 1A of this Annual Report.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: When necessary, the Company's Vice President of Information Technology and his staff collaborate with external third -party subject matter specialists. The Company has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of these providers. All third parties engaged for such matters are subjected to scrutiny to ensure they satisfy the Company's security standards. The Company periodically reviews its third -party engagements to ensure that the providers maintain the necessary levels of protection and competency, as well as to oversee and identify potential cybersecurity risks and threats from such engagements.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. Novel cybersecurity threats to the Company that are identified by our CIO are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber attacks.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: Our information security program includes the following key elements to help identify, manage, mitigate, and respond to cybersecurity threats: • Risk assessments—We conduct risk assessments designed to help identify material cybersecurity risks, quantify the impact and probability of each risk, develop mitigating controls, and periodically reassess previously identified risks. • Testing—We conduct regular testing of our systems and controls to help identify and address potential vulnerabilities. • Technical safeguards—We utilize various technical safeguards to help protect our information systems from cybersecurity threats. We regularly review our technical safeguards and update them in accordance with recognized best practices and standards. • Business continuity and disaster recovery planning—We maintain business continuity and disaster recovery plans and periodically test those plans. • A cybersecurity incident response plan—We maintain a policy governing actions required for reporting and managing cybersecurity incidents. We have designated an Incident Response Team with clearly defined roles and responsibilities for managing all material aspects of our reporting and response plan. • Employee training and awareness programs—We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in annual training, including insider threat awareness, simulated phishing exercises, and other awareness training. • Third-party risk management —We maintain a third-party risk management program that is designed to help identify, assess, manage, mitigate, and respond to risks associated with the Company's suppliers and other third parties.

companyName: Red Violet, Inc.

ticker: RDVT


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. We describe how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations and financial condition, in the risk factor entitled " A significant disruption to our information technology systems or those of our third-party service providers could adversely affect our business and operating results" under Item 1A, Risk Factors, of this report.

companyName: ROYAL GOLD INC

ticker: RGLD


text: See "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of the risks related to cybersecurity threats.

companyName: Health In Tech, Inc.

ticker: HIT


text: Protocols and Practices AIBotics employs a multi-layered cybersecurity strategy that encompasses various protocols and best practices, designed to defend against a wide array of cyber threats:

companyName: AIBOTICS, INC.

ticker: AIBT


text: Our global cybersecurity team ensures that the cybersecurity risks identified through the ERM program are incorporated into our overall cybersecurity program. We have put into place programs to address key cybersecurity risks including layered coverage with focus areas and practices designed to address network and endpoint security, application security, and security operations. We have processes in place to oversee and identify risks from cybersecurity threats associated with the use of third-party technology including third-party risk management, process and partner intake risk assessments, and dedicated procurement functions. These processes help mitigate the risks associated with utilizing external technology platforms and help prevent disruptions to our business operations. consistently involve our external cybersecurity experts to assess our cybersecurity program, risk management, and relevant internal controls. Although we have not experienced a material cyber-attack, we maintain insurance coverage to specifically address cybersecurity risks.

companyName: Unique Logistics International, Inc.


text: Cybersecurity incidents may occur at, or be reported to, any of the Company's facilities worldwide. The Company has an IT Service Desk which acts as the single point of contact for cybersecurity incident reporting. Employees can notify the IT Service Desk of any event that they observe or is reported to them that may constitute a cybersecurity incident. Once notified, the IT Service Desk team conducts an initial classification and escalates, when needed, to the CISO and other members of ISIRT as per the Company's IRP. Financial Ops, in consultation with the General Counsel, CPO and CISO, decide whether to activate the ISIRT in connection with any escalated incident. When activated, the ISIRT coordinates and directs all aspects of the response, including, as applicable, investigation, containment, business continuity and recovery, remediation, notifications, communications, and post-incident activities with executive leadership, including the CIO, and the Audit Committee and/or Board of Directors, as appropriate in the circumstances. As of December 31, 2024, no identified risk has required activation of the ISIRT.

companyName: BRUKER CORP

ticker: BRKR


text: We partner with leading cybersecurity companies and organizations to enhance our cybersecurity infrastructure, leveraging third-party technology and expertise to monitor and optimize the performance of our deployed cybersecurity products and services. We also engage with third party firms to help identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards and best practices. We use a third-party provider to supplement the continuous monitoring of our cybersecurity environment and to help coordinate the investigation and remediation of events. The Company evaluates third-party risk for critical suppliers through ongoing security reviews, provided that for third-party providers that are part of the Company's financial reporting system, security controls are assessed through a more detailed review of events.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: The Company has a dedicated cybersecurity incident response team, overseen by Cybersecurity Leadership, which is responsible for managing and coordinating the Company's cybersecurity incident response plans and efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks potentially material cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, government agencies, regulators, law enforcement, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board as appropriate. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide training for the participants and to help the Company assess its processes and capabilities in addressing major cybersecurity incidents.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Members of the Audit Committee receive scheduled quarterly updates from senior management.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of AMG assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security and have increased scrutiny of third-party service providers with access to sensitive AMG data, including through security risk assessments at the time of initial contract, periodically as part of our third-party risk management process, and upon detection of an increase in the vendor's risk profile. In addition, we require key providers to meet appropriate security requirements and controls, and we investigate security incidents that have impacted our third-party providers, as appropriate. We also have our own fully documented proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place designed to protect employee, business, Affiliate, and Affiliate client data in the event of an emergency or natural disaster.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: As part of our risk management process, our cybersecurity team conducts routine vulnerability and application security assessments, penetration testing, security and compliance audits, and ongoing risk assessments. We also engage third-party independent auditors to attest to the implementation and operational effectiveness of security controls implemented within our product and service environments in scope for Payment Card Industry Data Security Standard ("PCI DSS") and American Institute of Certified Public Accountants ("AICPA") System and Organization Controls ("SOC") as well as financial systems in scope for Sarbanes-Oxley information technology general controls. Additionally, our internal audit team conducts regularly scheduled audits of our IT and business systems. The results of these reviews are reported to senior management and the audit committee as part of the quarterly reporting process discussed above.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: To date, there have been no risks from cybersecurity threats because of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Management has implemented specific mitigation strategies for each of these factors, such as (i) user training to avoid fraud and other scams, (ii) utilizing multi-factor authentication processes for system access, (iii) engaging in vulnerability scanning applications, (iv) upgrading software and hardware to those with the greatest security protections, and (v) ensuring third parties to whom sensitive information is provided have appropriate security. Management has also developed a vendor assessment form to evaluate potential "Software as a Service" providers, which is incorporated in the Company's RFP processes. The Company routinely obtains and reviews SOC 2 reports from third parties who have access to the Company's information, some of which are part of management's internal controls over financial reporting. The Company accesses cybersecurity consultants and legal counsel to assist in the identification of vulnerabilities and advise on appropriate mitigation and preparedness actions.

companyName: AXCELIS TECHNOLOGIES INC

ticker: ACLS


text: We have established and maintain incident response and recovery plans to address our response to a cybersecurity incident. We use a manage, detection, and response (MDR) partner to provide threat detection and response capabilities. We also utilize security consultants including a vCISO to assess and continuously improve our cybersecurity program.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: For a description of the risks from cybersecurity threats that may materially affect the Company, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we or Cohen & Steers fail to implement effective information security policies and procedures."

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: For additional information on the risks we face related to cyber and information security threats, please see our related risk factor in Item 1A. Risk Factors.

companyName: URBAN ONE, INC.

ticker: UONE


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, customer data, and the personal information of our employees (collectively, "Information Systems and Data").

companyName: PagerDuty, Inc.

ticker: PD


text: A key element of the Company's strategy is fostering training and awareness through annual cybersecurity training and role-based phishing tests for employees and certain third parties having access to the Company's information systems. The Company also utilizes a third-party cybersecurity operations monitoring center to help identify threats and incidents to the Company's servers and computers. The Company's cybersecurity program includes specific requirements and guidelines for the information security team relating to the Company's computer emergency response preparedness, intrusion response preparedness, and incident response preparedness.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The Corporation uses multiple assessors, consultants, auditors and other third parties in the fulfillment of the information security program. These third parties participate in testing and validation processes, as well as the execution of certain program-related controls. The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board's Risk and Credit Policy Committee of the Board on a quarterly basis. At the Information Security Committee, security-related policies and standards are reviewed and recommended for approval, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, and relevant cyber risks and trends are presented.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: Under the direction of the CIO, the CSO is responsible for global cybersecurity and business continuity, which includes security architecture, security operations, incident response, IT risk and compliance, and security awareness and training. The CSO has over 25 years of security experience and maintains certifications in risk, information security, and audit, among other disciplines. The other members of the company's security organization also have extensive cybersecurity, business, and technology experience and hold certifications in their area of expertise.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: Both EQT and our Adviser remain committed to adopting the highest cybersecurity standards and practices, continuously enhancing their cybersecurity capabilities, and prioritizing the safeguarding of company and customer data from potential threats. In the last fiscal year, EQT and EQRT have not experienced any cybersecurity incidents that have materially affected us or are reasonably likely to have materially affected our operations, strategy, performance, cash flows or financial health. See Part I, Item 1A, "Risk Factors—Risks Related to Our Organization Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results."

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Monitoring Cybersecurity Incidents The CISO is informed about the developments in cybersecurity, including potential threats and risk management techniques. This ongoing knowledge acquisition is crucial for the prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, the CISO is equipped with a cyber incident response plan ("CIRP") supported by a cross-functional cyber incident response team ("CIRT"). The CIRT oversees and responds to cybersecurity incidents. Its core objectives encompass detection and response, conducting incident analysis and investigation, implementing containment and eradication measures, and facilitating recovery processes. It also entails coordinating and communicating with the Company's management, regulators, affected parties, and external security experts. The CIRT determines the materiality of the incident, maintains documentation and reporting practices, and fosters a culture of improvement.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Management and Strategy to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third-party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our Board of Directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: NextTrip, Inc.

ticker: NTRP


text: Our management, led by our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer, is responsible for assessing cybersecurity risks and for overseeing our cybersecurity strategy to assess and manage those risks, including responding to attacks or breaches. Our Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer each have experience in senior leadership roles in which they have been responsible for an entity's enterprise risk management, including management of cybersecurity risks. The Chief Executive Officer and the Senior Vice President, Finance and Chief Financial Officer regularly communicate with those responsible for daily IT operations and infrastructure to assess potential cybersecurity threats and determine whether updates to the cybersecurity strategy are necessary.

companyName: XOMA Royalty Corp

ticker: XOMA


text: CLEAR's information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading the Company's Enterprise Risk Management Program ("ERM Program"), which includes cybersecurity strategy, policy, standards, architecture, and processes. Our current CISO, together with his team, continues to implement, monitor, and maintain our cybersecurity program while we search for his successor. Cybersecurity risks are identified, discussed and assessed regularly as part of CLEAR's ERM Program. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We utilize a range of external experts, such as cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity systems. In addition, the Company has established the CLEAR Security Advisory Board, which provides guidance and advice on security risk and privacy to our Board and our CISO.

companyName: Clear Secure, Inc.

ticker: YOU


text: At the management level, Montrose's Enterprise Cybersecurity Council, consisting of our CIO, CISO, Director of Information Security, Director of Infrastructure, and senior security architects and engineers, meets monthly to review and assess cybersecurity risks and evaluate performance metrics to identify areas for continual improvement and system strengthening. Furthermore, the Council reviews project implementation status for targeted cybersecurity measures and tracks employee cybersecurity training completion and phishing email response rates. Council members have extensive cybersecurity experience and hold certifications including CISM, Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH) and Cisco Certified Network Associate (CCNA).

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Our cybersecurity program has also focused on company-wide training on phishing and other social engineering attacks. Management takes the position cybersecurity is owned company wide as a collective team, not just by the organizations of the Chief Information Officer and Chief Information Security Officer. Our newest security awareness platform was deployed in the first quarter of 2024 to improve awareness through assessments, training, realistic phishing campaigns, and immediate feedback. All-hands briefings, updates on metrics, and "tips and tricks" supplement our platform and address gaps in awareness. Key areas of focus in 2024 will include challenging employee-teammates with real-world social engineering techniques and encouraging the reporting of phishing to improve resiliency.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: In addition, while we take various measures to comply with all applicable data privacy and protection laws and regulations, there is no guarantee that our current security measures and those of our third-party service providers may always be adequate for the protection of our customer, employee or company data; and like all companies, we have experienced data incidents from time to time. In addition, given the size of our customer base and the types and volume of personal data on our system, we may be a particularly attractive target for computer hackers, foreign governments or cyber terrorists. Unauthorized access to our proprietary internal and customer data may be obtained through break-ins, sabotage, breach of our secure network by an unauthorized party, computer viruses, computer denial-of-service attacks, employee theft or misuse, breach of the security of the networks of our third-party service providers, or other misconduct. Because the techniques used by computer programmers who may attempt to penetrate and sabotage our proprietary internal and customer data change frequently and may not be recognized until launched against a target, we may be unable to anticipate these techniques. Unauthorized access to our proprietary internal and customer data may also be obtained through inadequate use of security controls. Any of such incidents may harm our reputation and adversely affect our business and results of operations. In addition, we may be subject to negative publicity about our security and privacy policies, systems, or measurements from time to time.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") are primarily responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. Our CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations and our COO has over 5 years of experience overseeing cybersecurity and IT functions. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, where it deems appropriate, regarding any significant cybersecurity incidents.

companyName: Owlet, Inc.

ticker: OWLT


text: We view managing cybersecurity risk as imperative to protecting the confidentiality, integrity, availability, and resiliency of the information and systems we use to achieve our strategic business goals and satisfy our customers and partners. To that end, we have developed a formal cybersecurity risk management program that is integrated into our broader enterprise risk processes in an effort to protect our applications, networks, and systems from risks from cybersecurity threats. We use elements of the NIST Cybersecurity Framework and other recognized industry standards to inform and guide the design of this program, though we do not purport to meet any particular technical standards, specifications, or requirements of NIST.

companyName: SailPoint, Inc.

ticker: SAIL


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Third parties might attempt to gain unauthorized access to our network or seek to compromise our products and services."

companyName: ESS Tech, Inc.

ticker: GWH


text: Responsibility and Communication The Company promotes a culture where cybersecurity awareness is recognized as everyone's responsibility. Regular communications about cybersecurity risk mitigation and intrusion prevention measures are shared with senior management and the Board of Directors.

companyName: i-80 Gold Corp.

ticker: IAUX


text: Third-Party Risks. The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: We require our associates to receive annual training on our cybersecurity policies and practices. This may include, but is not limited to, training regarding information classification and handling, data privacy, physical security, phishing, malware and ransomware, social engineering, identifying and reporting information security incidents, and secure credit card handling, as well as additional topics based on job roles and responsibilities. We also maintain written cybersecurity policies and procedures that apply to the entire Company and third parties who handle our data or have access to our information technology systems. These policies and procedures establish the framework for our cybersecurity program and cover topics such as acceptable use of information systems, cybersecurity risk management, access management, audit and logging, patching, and cybersecurity requirements for numerous technologies. These policies and procedures are reviewed at least annually, updated as necessary, and integrated into employee training programs and our technology procurement process. We are also subject to the Payment Card Industry Data Security Standard and perform an annual self-assessment according to the requirements set forth by the Payment Card Industry Security Standards Council.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: The Company employs a multi-layered, risk-based approach to cyber and information security, incorporating a variety of tools and processes to aid in risk identification, assessment and management. In addition to periodic risk assessments, we rely on continuous monitoring of systems and environments, regular vulnerability scanning, external auditing and penetration testing and active participation in industry intelligence sharing partnerships.

companyName: TFS Financial CORP

ticker: TFSL


text: The general objectives for our cybersecurity program are to protect our information systems from cyber threats and to protect the confidentiality, integrity and availability of systems and information used, owned, or managed by Tradeweb and our customers. This involves a comprehensive and ongoing effort to protect against, detect, and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • conducting regular risk assessments to identify potential vulnerabilities and threats; • implementing strong cybersecurity frameworks by adopting policies, standards and guidelines derived from a combination of ISO/IEC 27001 principles, the National Institute of Standards and Technology Cybersecurity Framework and industry best practices; • enforcing strict access control policies as appropriate; • implementing strong encryption protocols; • utilizing advanced threat detection systems; • conducting regular security audits and penetration testing; • conducting thorough security assessment of third-party vendors and service providers on an ongoing basis; and • continuous monitoring of our and third-party systems.

companyName: Tradeweb Markets Inc.

ticker: TW


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions, however, there can be no assurance in that regard.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: certifications where relevant from key third party partners and other service providers with access to information assets at least annually.

companyName: Anixa Biosciences Inc

ticker: ANIX


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, Delek conducts mandatory security awareness programs, including required training and phishing campaigns for our employees. Delek also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. Delek is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the drill conducted in 2024 and previous years, we remain committed to continuous improvement and proactive preparedness in addressing potential challenges and effectively managing incidents.

companyName: Delek US Holdings, Inc.

ticker: DK


text: Enterprise Risk Management (ERM) Program Our cyber risks are included in our ERM program. Our ERM program is led by our Senior Director of Compliance and Internal Audit and has oversight from our Audit Committee. This program includes a cross functional team including our senior leadership team and other key members of management. Risk reduction plans are developed and updates are regularly assessed by the team. Our Audit Committee provides oversight and is briefed quarterly, at a minimum. In the event a cyber incident should occur, there are additional steps taken to mitigate cybersecurity risks and incidents.

companyName: J.Jill, Inc.

ticker: JILL


text: Cybersecurity threats continue to evolve as the threat landscape evolves. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Bank's security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

companyName: RBB Bancorp

ticker: RBB


text: Cybersecurity incident response plan and testing – We have a global incident response process and dedicated teams responsible for monitoring, detecting and responding to cybersecurity threats and attacks, whether external or internal, periodically testing our processes and protocols, and regularly communicating and providing reports to our CISO, Security & Resiliency global practice leader and senior executive leadership.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: As part of its cybersecurity program, the Company utilizes firewalls, identity and access management programs, email security, anti-malware, and a detection and response program. The Company periodically assesses and tests its policies, standards, processes and practices that are designed to address cybersecurity threats and incidents by performing internal and external vulnerability scans, penetration testing, and phishing exercises. The Company utilizes a combination of internal employees and third parties to perform security monitoring and 24/7 response, penetration testing, phishing campaigns, and provide security awareness training to our employees. We recently updated our onboarding process for certain third-party vendors and service providers to include a review and assessment of their information security practices. The Company also conducts information security and awareness training to ensure that employees are aware of information security risks and to enable them to take steps to mitigate those risks.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: Our CISO has over 25 years of information security experience and is licensed as a Certified Information Systems Security Professional.

companyName: BERKLEY W R CORP

ticker: WRB


text: The CISO has over 38 years of experience working in cybersecurity, risk management, and infrastructure technology and network architecture. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification. The CIO has over 32 years of experience focused on corporate strategy formulation and implementation, IT management including cybersecurity, and business and process transformation.

companyName: JABIL INC

ticker: JBL


text: The Chief Executive Officer, with assistance from other members of management, is responsible for managing our cybersecurity program, policies and strategy. Our Board of Directors is responsible for overseeing the management of cybersecurity risks, including the review of, as required, our processes around the management and monitoring of such risks.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: The Company's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CTIO and our Vice President IT Risk Management. The Company's CTIO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. To facilitate the success of the Company's cybersecurity risk management program, we have a unified and centrally coordinated team, led by our Vice President IT Risk Management, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with senior leadership and other teams across Ulta Beauty. Reporting to our Vice President IT Risk Management are a number of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: The Company engages independent cybersecurity consultants, auditors, and compliance specialists to validate internal controls, including penetration testing, PCI-DSS and SOC 2 assessments, and KYC/AML compliance audits. Findings are documented, tracked, and reviewed with the Board of Directors.

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: Board Level Governance The Audit Committee has primary Board-level responsibility for oversight of our cybersecurity and data protection risks. and serves as a liaison between management and the full Board. The Audit Committee receives regular reports from our CTO and CISO regarding the primary cybersecurity risks facing HGV, and the steps management is taking to mitigate such risks. The CISO and the CTO provide comprehensive briefings to the Audit Committee on a regular basis, generally at least once per quarter. These briefings include: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity incidents, if applicable; and • Compliance with regulatory requirements and industry standards.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: Our assessment and management of material risks from cybersecurity threats are taken into account in our overall risk management processes. For example, we evaluate certain identified material risks from cybersecurity threats against our overall business objectives and will report material risks, if identified, to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: We have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a detailed discussion on the Company's cybersecurity related risks, see "Risk Factors" relating to information technology contained in Part 1, Item 1A of this Annual Report on Form 10-K.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: The Program is subject to MetLife's risk management framework and operates under the "Three Lines of Defense" model MetLife uses. The CISO regularly reports about information security risk to the Enterprise Risk Committee ("ERC"), including the Chief Risk Officer ("CRO"), and other members of the senior management team. See "Management's Discussion and Analysis of Financial Condition and Results of Operations — Risk Management."

companyName: METROPOLITAN LIFE INSURANCE CO


text: In the last fiscal year, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incidents are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. The Company's Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is composed solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Board receives updates from the Company's management on cybersecurity risks on at least an annual basis.

companyName: BIOVIE INC.

ticker: BIVI


text: We provide regular training for our employees regarding cybersecurity threats and our security policies to equip our employees with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. In addition to our internal exercises to test aspects of our cybersecurity program, we periodically engage independent third parties to assess the risks associated with our information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of our information technology resources, including our employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes.

companyName: MARKETWISE, INC.

ticker: MKTW


text: Management is responsible for day-to-day cybersecurity risk management activities, including proactively identifying, assessing, prioritizing, managing and mitigating enterprise cybersecurity risks. Our Chief Financial Officer ("CFO") is the accountable leader in executive management for Zebra's IT and cybersecurity programs.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Primary responsibility for assessing and providing strategic direction to our cybersecurity program resides with our IT Manager, whose over eleven years of information technology experience in the financial services industry has provided him with in-depth knowledge and experience which are instrumental in developing and executing our cybersecurity strategies.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Our cybersecurity management teams supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by information security tools deployed in the information technology environment. Cybersecurity management also supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Sempra's director of cybersecurity governance & chief information security officer provides additional oversight and support for the operational cybersecurity activities at our consolidated entities.

companyName: SEMPRA

ticker: SREA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors" above for additional information on risks related to, for example risks related to cyber-attacks, information and system breaches, and technology disruptions and failures; our reliance on using and protecting certain intellectual property rights; keeping pace with technological developments; legal and regulatory developments; and obtaining hardware, software and operational support from third-party vendors.

companyName: Funko, Inc.

ticker: FNKO


text: Plumas Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Chief Information Officer. In addition, the Internal Auditor and Risk Management Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: PLUMAS BANCORP

ticker: PLBC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Manager of IT Infrastructure, who has over 20 years of experience in various IT administration roles, five of which have been in cybersecurity.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: The Board of Directors (the "Board") is acutely aware of the critical nature of managing risks associated with cybersecurity threats.

companyName: Energy Recovery, Inc.

ticker: ERII


text: As part of its responsibility to oversee the management, business, and strategy of the Company, the Company's Board of Directors reviews and approves the Company's risk management framework annually through its Audit and Compliance Committee and oversees the Company's risk management processes by informing itself about the Company's key risks and evaluating whether management has reasonable risk management and control processes in place to address those risks.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: As of December 31, 2024, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition, although we may be materially affected in the future by such risks or future material incidents. See "Risk Factors—Risks Related to Our Business Operations—Disruption, failure or cyber security breaches affecting or targeting computers and infrastructure used by us or our business partners may adversely impact our business and operations" for additional information regarding cybersecurity risks.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: The chair of the Audit Committee is a Chief Financial Officer with existing cyber-security and risk management responsibilities at a similar public company.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Reporting and Governance The Board and regional and country leadership boards may receive periodic presentations and reports on cybersecurity risks. We have an established issue escalation protocol for technology incidents, including cyber related incidents. In the event of a material cybersecurity incident, the Board will receive prompt information and ongoing updates about the incident. Our technology incidents and risks are tracked and rated. Items that are rated as "critical" are discussed in the TRCC, and escalated to the GRC as appropriate. At least once each year, the Board discusses our approach to cybersecurity risk management with the CISO. The CISO and regional/country information security officers regularly present to the Company's regional and country leadership boards on material cyber risks and our information security posture and strategy.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: Our Risk Management Steering Committee, which includes the Company's Chief Risk and Operations Officer (Chair), CIO and ISO, assesses and monitors the effectiveness of the Company's cybersecurity risk management program. The Company's internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: We recognize that our cybersecurity risk profile extends beyond our organization. As such, we strive to manage cybersecurity risks associated with our third-party business partners and external users of our systems. Our third-party business partner risk management program is built upon, informed by, and responsive to industry best practices. This program is designed to conduct appropriate due diligence on the third-party business partners with whom we engage and conduct business, as well as on the systems and the cybersecurity controls of such third-party business partners. Specifically, to evaluate third-party cybersecurity controls, we utilize third-party cybersecurity monitoring and alerting tools, cybersecurity due diligence questionnaires, and request and review third-party audit reports and assurance certifications if they exist.

companyName: Cencora, Inc.

ticker: COR


text: We also have processes in place to stay informed of and monitor prevention, detection, mitigation, and remediation of cybersecurity risks, including: • Any cybersecurity breach, unauthorized access, data loss, or ransomware attack must be immediately escalated to the Disclosure Committee, General Counsel, Internal Audit, and Audit Committee. • On a quarterly basis, the Disclosure Committee, in coordination with the SVP of People and Technology, Internal Audit, and vCISO, shall assess the Company's cybersecurity risk exposure, including potential vulnerabilities in IT systems and data security.

companyName: HF Foods Group Inc.

ticker: HFFG


text: BNY Mellon's Technology Risk Committee is the most senior governance committee primarily focused on cybersecurity and technology risk issues and is a part of the second line of defense risk function. It is responsible for, among other things, overseeing and reviewing emerging cybersecurity risks, significant cybersecurity incidents and remediation plans. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is chaired by the interim Chief Technology Risk Officer. Members include key leaders from the first line of defense, including the CISO.

companyName: ECA Marcellus Trust I

ticker: ECTM


text: Notwithstanding Juniata's defensive measures and processes, the threat posed by cyber-attacks is severe. Juniata's internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while it has experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We have established a third-party risk management program that includes a formal vendor and cloud security policy and processes to conduct diligence on applicable vendors, including thorough questionnaires and additional documentation. Cybersecurity controls language may be included in third-party service provider contracts, and if applicable, this language is designed to be tailored to the use case and sensitivity of any data or business processes involved.

companyName: Keenova Therapeutics plc


text: Our CISO, who reports directly to the Company's Chief Information Officer ("CIO"), has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems, and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems Auditor.

companyName: CORPAY, INC.

ticker: CPAY


text: Abbott's cybersecurity program utilizes a variety of technical and process controls that are designed to identify, protect against, detect, respond to, and recover from cybersecurity threats, including: • dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity policy and requirements, implementing protections, and monitoring and responding to cybersecurity incidents; • periodic cybersecurity awareness training for relevant employees and contractors on Abbott policies and emerging cybersecurity threats, including phishing awareness training; • internal and third party cybersecurity testing, including penetration testing of Abbott's information systems and hardware; • cybersecurity risk assessments for Abbott's systems and applications; • cybersecurity monitoring and response processes intended to identify, assess, escalate, investigate, contain, and remediate incidents; and • disaster recovery plans.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: In order to monitor our information technology systems and data and to identify, assess and manage potential threats to such, we maintain cybersecurity risk assessment and management programs. As part of such programs, we endeavor to conduct annual security penetration tests both externally and internally, bi-annual security assessments against cybersecurity frameworks, continuous vulnerability scanning and monthly and annual security awareness and simulated phishing trainings for our employees. We have also implemented incident response processes and various system alert monitoring and screenings. Our cybersecurity risk management processes are integrated into our broader risk management program.

companyName: Permian Resources Corp

ticker: PR


text: Management's Role Managing Risk Quarterly briefings and formal updates are provided by members of management to the audit committee to maintain transparency and facilitate informed decision-making regarding cybersecurity investments and strategies. These reports encompass a broad range of cybersecurity topics, including: • Current Policies: Updates on the Company's cybersecurity policies, procedures, and incident response plans; • Threat Landscape Assessment: An overview of our current cybersecurity threat landscape, emerging trends, and potential risks; • Incident Reporting: Details on any cybersecurity incidents, breaches, or threats, including the nature of the incident, response actions taken, and remediation plans. • Investments and Initiatives: Updates on cybersecurity investments, initiatives, and projects to improve our overall cybersecurity posture; and • Compliance and Regulatory Landscape: Insights into changes in cybersecurity regulations, compliance status, and efforts to align with industry best practices.

companyName: Snap One Holdings Corp.


text: Our Chief Information Officer and IT consultants provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: There have been no previous cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including, but not limited to, exploitation of vulnerabilities, ransomware, denial of service, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.

companyName: Fathom Digital Manufacturing Corp


text: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems.

companyName: Eiger BioPharmaceuticals, Inc.


text: Our goal is to maintain an information technology infrastructure that implements physical, administrative, and technical controls. These controls are adjusted based on risk and designed to protect the confidentiality, integrity, and availability of our information systems, including the customer information, personal information and proprietary information stored on our networks.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Orient. Identify Information Systems and assets, regulatory requirements, and overall risk approach, identify threats to, and vulnerabilities of, those systems and assets. Risk assessment. Identify the likelihood of a cybersecurity event and the impact on the organization. Consider emerging risks. Target Profile. Create a Target Profile focusing on categories, subcategories, and desired cybersecurity outcomes.

companyName: ATEL 14, LLC


text: The cybersecurity practices and controls are derived from multiple recognized cybersecurity frameworks to meet the evolving needs of our organizations.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: Table top exercises are also held annually and are designed to practice and validate existing incident response plans, as well as to identify the plans' respective strengths and weaknesses. These exercises test the response capabilities of both technical and executive level resources, including key vice presidents, senior company leaders and cross-functional capabilities, such as with the Product Cybersecurity team as well as with the Legal, Privacy and Sales teams.

companyName: Aptiv PLC

ticker: APTV


text: At the management level, our Head of Information Technology is responsible for assessing and managing risks from cybersecurity threats through oversight of our information technology infrastructure and cybersecurity program. The individual occupying this role has over 20 years of experience in information technology and cybersecurity and has served in senior cybersecurity leadership positions for over 10 years. Thus, we believe our Head of Information Technology is well-qualified to serve in this role. Our Head of Information Technology conducts bi-weekly meetings with our information technology department to remain apprised of cybersecurity matters. If a cybersecurity incident were to occur, our Head of Information Technology may inform our Executive Vice President and Head of Technological Operations and/or Audit Committee, depending on the severity of the incident in accordance with the established severity and response matrix as defined in our incident response plan.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: The Company's cybersecurity program emphasizes defense, rapid detection, and remediation of cybersecurity threats and incidents, including the use of various security tools and systems based on defense-in-depth and zero-trust principles that are intended to meet control requirements. The cybersecurity program also encompasses crisis incident response guidelines that detail the processes for the detection, response, mitigation, and remediation of cybersecurity incidents, in order to support the effective management of, response to, communication during, and recovery from any such incidents.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Key elements of our corporate-level cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical corporate network systems and corporate information; • a security function principally responsible for managing at the corporate-level (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our corporate security controls; • a cybersecurity awareness training of our corporate employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents that impact Xenia's corporate systems and information; and • a third-party risk management process for key service providers, suppliers, and vendors that support our corporate functions based on our assessment of their respective risk profiles.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: Our CISO leads all aspects of our global cybersecurity program. Our CISO joined Workday in 2010 and has served as our CISO since April 2018. Our CISO has more than 20 years of experience in cybersecurity and information technology risk management, including at a large public company and a recognized consulting firm. He also has a degree in information systems management.

companyName: Workday, Inc.

ticker: WDAY


text: The Company's VP of Information Technology is the member of the Company's management who is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology works in coordination with senior leadership, which includes our Chief Executive Officer and President, Chief Financial Officer and General Counsel. The Company's VP of Information Technology has served in various roles in technology and is supported by a team of information technology and cyber security professionals with decades of relevant experience. Most notably, the Company's Enterprise Manager of Cybersecurity and Network holds a Certified Information Systems Security Professional (CISSP) certification and has over 15 years of experience with managing risks arising from cybersecurity threats.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Our management is responsible for the ongoing assessment of, and for developing and implementing our strategies and measures to address, material cybersecurity risks. Our board of directors through its audit and compliance committee oversees management's cybersecurity assessment activities and protective strategies and measures. This includes engaging in periodic reviews with management covering, among other things, our cybersecurity practices and risks. Our chief information officer ("CIO") periodically provides this review to the audit and compliance committee, with the most recent review conducted in January 2025. The CIO, who has more than 34 years of experience in IT and cybersecurity, is supported by a chief information security officer and various employees and dedicated contract personnel experienced with IT and cybersecurity matters who are responsible for procuring, using, maintaining, updating and evaluating the cybersecurity measures detailed above. These individuals also hold numerous cloud, security and privacy certifications.

companyName: KB HOME

ticker: KBH


text: Our management team, including our Chief Financial Officer, and members of the Audit Committee play a pivotal role in assessing and managing material risks stemming from cybersecurity threats. The management team is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts.

companyName: PARKS AMERICA, INC

ticker: PRKA


text: Cybersecurity is an important part of our risk management processes. Our Associate Vice President of IT & Facilities is responsible for overseeing the cybersecurity risk management program. He has over 20 years of IT management, cybersecurity, and information governance experience. In order to monitor and appropriately escalate cybersecurity risks, our Associate Vice President of IT & Facilities receives reports on a monthly basis, and more frequently as appropriate, from our third-party cybersecurity vendor.

companyName: Ocugen, Inc.

ticker: OCGN


text: Our chief information officer and chief information security officer provide regular reports (at least quarterly) to the Risk Committee of our Board and management committees on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, and more frequently if there was an ongoing cybersecurity incident. Our Board oversees our information security program through regular review of policies, including our information security policy designed to establish clear management direction and commitment to preserve the confidentiality, integrity, and availability of all information technology assets and data.

companyName: Federal Home Loan Bank of Cincinnati


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly reports from our CIO, FVPIS, and/or our SVPITSS regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The CIO, FVPIS, and SVPSS report quarterly to the Audit Committee and Board regarding cybersecurity risks and the status of our cyber risk management program. Our CIO, FVPIS, and/or our SVPITSS also periodically make presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company.

companyName: PRICESMART INC

ticker: PSMT


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, tests on our systems, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including a third party company, Mission Cloud, to enhance our cybersecurity oversight.

companyName: Freeze Tag, Inc.

ticker: FRZT


text: The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Former Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Former Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with officers and individuals at the Company to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks. The Former Manager's Chief Technology Officer and Chief Information Security Officer have extensive knowledge and skills, and collectively bring decades of experience in the cybersecurity industry.

companyName: FTAI Aviation Ltd.

ticker: FTAI


text: On January 6, 2025, Skip Potter, Executive Vice President, Chief Digital Information Officer, departed the Company. Jim Swanson, Executive Vice President and Chief Financial Officer, is overseeing the digital technology department at the Company in an interim capacity. Our Chief Information Security Officer ("CISO") reports to Mr. Swanson and is responsible for identifying, assessing and managing risks facing the Company from cybersecurity threats impacting our internal systems and/or systems supported by third-party providers. Our CISO has served in various information technology and information security roles for over 20 years, including management of information security programs in the Department of Defense, private and public companies, and holds multiple industry certifications in information security. We leverage certain third-party providers and our internal Incident Response Team to alert us when a cybersecurity event occurs. Cybersecurity events may include unauthorized access, attacks on our resources, compromised accounts, malware, or ransomware. Upon alert of an event, we estimate the level of severity, create a response plan, and communicate to management as needed. Based on the estimated level of severity, timing of incident communication to management may range from immediate to quarterly. Our risk assessment process related to cybersecurity threats is subject to change in the future as threats may evolve over time.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect the company, see the risk factor titled "Our business could be adversely affected by cyber threats or other interruptions to information technology, communications networks and operations." in Item 1A of this Annual Report on Form 10-K.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: The Company employs an IT Security Team that is responsible for assessing and managing cybersecurity risks.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Our Senior Director of Information Security and Data Privacy, who has more than 20 years of experience in information technology-related roles, including engineering, governance, and security, oversees our information security program and matters of risk relating to cybersecurity. Members of our Information Technology team periodically provide risk reports to the Board and its committees, including assessments of the Company's cybersecurity risks, their potential impact on our business operations, and management's strategies to monitor and mitigate those risks. The committee chairs, in turn, report to the full Board as part of our general risk management process.

companyName: Wingstop Inc.

ticker: WING


text: The IT Department's management responsible for developing and executing both OFS Advisor's and our cybersecurity policies, and is comprised of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.

companyName: OFS Capital Corp

ticker: OFS


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled: Cyber-attacks or other failures in telecommunications or information technology systems and deficiency in our, or those of third parties upon which we rely, cybersecurity could result in information theft, data corruption and significant disruption of our business operations.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: Notwithstanding the cybersecurity protections we have in place, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: Western Digital has implemented a governance framework related to cybersecurity that includes operational risk-mitigation practices and Board-level cybersecurity risk oversight.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our Incident Detection and Response ("IDR") processes and practices include the evaluation of each identified cybersecurity threat event to determine its authenticity and potential impact or whether our systems blocked or mitigated it. Our Incident Response Standard, governed by our Incident Response Policy comprises two separate workflows, both tracked in a ticket system. The first workflow encompasses all events requiring investigation. If an event is confirmed as positive and has caused an impact, a second workflow may be triggered, engaging the Materiality Determination Committee until the incident is reported to the SEC or otherwise determined that there is no material impact.

companyName: Satellogic Inc.

ticker: SATL


text: We recognize the importance of maintaining the safety and security of our critical systems, information, products, services, and broader information technology environment (collectively, our "Information Systems and Data"), and we have developed, implemented, and maintained a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability thereof.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Perform any other activities required by applicable law, rules or regulations (including the Securities Exchange Act of 1934 and The NYSE American Stock Exchange regarding reporting and disclosure obligations related to cybersecurity risks, costs, and incidents), and take such other actions and perform and carry out any other responsibilities and duties delegated to it by the Board or as the Cybersecurity Committee deems necessary or appropriate consistent with its purpose.

companyName: Cohen & Co Inc.

ticker: COHN


text: Our management team, including our Chief Legal Officer, our Chief Security Officer and our Chief Technology Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security team and our retained external cybersecurity consultants. Our management team has over 20 years of cybersecurity technology leadership experience.

companyName: Airbnb, Inc.

ticker: ABNB


text: The Board's Oversight and Management's Role Our Board has delegated the responsibility for overseeing cybersecurity risk. Our Audit Committee oversees management's assessment and management of cybersecurity risk. Our Senior IT Director, who reports to our Executive Vice President, Chief Administrative and Accounting Officer, leads the Information Technology team, is a member of our management-level Cybersecurity Governance Committee and management-level Cybersecurity Risk Committee and manages our information technology and cybersecurity function.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: We maintain a formal incident response plan (IRP) and business continuity/disaster recovery (BC/DR) procedures to ensure we can rapidly respond to and recover from cybersecurity incidents. These procedures, which include clear escalation paths and responsibilities in the event of a cybersecurity incident, are tested and updated annually to ensure their effectiveness.

companyName: Altus Power, Inc.


text: Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. We have a cybersecurity organization within our information technology department that focuses on current and emerging cybersecurity matters and leverages cybersecurity consultants and third-party cybersecurity firms. Our cybersecurity function is led by our Chief Financial Officer, who reports to our Chief Executive Officer. Our Chief Financial Officer and cybersecurity organization are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies.

companyName: VAPOTHERM INC


text: Strategy and Governance The Fund is externally managed by the Adviser and has no employees or internal information systems. Thus, the Fund relies on the Adviser as well as its administrator, custodian and other service providers to protect the Fund's information from cybersecurity threats. The Fund's Chief Compliance Officer (the "CCO"), in coordination with the Adviser's Compliance Department and Information Security Working Group (the "ISWG"), which includes the Adviser's Chief Technology Officer – Infrastructure and Cybersecurity (the "CTO"), Chief Compliance Officer, General Counsel and Chief Financial Officer or their respective designees and teams, oversees the Fund's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Trustees. The ISWG uses various security tools that help the Adviser identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Silver Point Specialty Lending Fund


text: Our IT networks and related systems are critical to the operations of our business and essential to our ability to successfully perform day-to-day operations. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a component of our internal control system. Cybersecurity awareness, including specific topics related to social engineering and email fraud, are included in our employee handbook. We have processes and controls, in particular with respect to our financial and reporting technology, to prevent and minimize cybersecurity risks and attacks. We rely on industry-standard third-party software and vendors for our core systems, including data storage, analysis and backup.

companyName: CV Sciences, Inc.

ticker: CVSI


text: We maintain comprehensive internal protocols to mitigate cybersecurity threats associated with our use of third party service providers. We are currently enhancing these protocols to further strengthen our defenses and reduce potential vulnerabilities.

companyName: FingerMotion, Inc.

ticker: FNGR


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include operational risks, intellectual property or trade secret theft, improper disclosure of confidential information, fraud, extortion, harm to employees or third parties with which we do business, and violation of data privacy or security laws.

companyName: Caribou Biosciences, Inc.

ticker: CRBU