text: During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: Salesforce, Inc.

ticker: CRM


text: Following most Audit Committee meetings, the Chair of the Audit Committee provides an update to the full Board of Directors at the Board's next regularly scheduled meeting. It is through this update where the Board of Directors would be apprised of any material risks or threats, including those pertaining to cybersecurity matters.

companyName: NeueHealth, Inc.

ticker: NEUE

secItem: Item 1C


text: We also utilize third-party service providers to enhance our CSP, including engaging them annually to assess our CSP against the NIST CSF. We use one or more third-party managed security solution providers, who provide us with threat intelligence information and managed threat detection and response capabilities. We have also engaged a third party to assist with associate cybersecurity training. Additionally, we have engaged outside breach response legal counsel to assist the Company with cybersecurity counseling and incident response.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: Although we are not aware of having experienced any prior material data breaches, regulatory non-compliance incidents, or cyber security incidents, we may in the future be impacted by such an event, exposing our clients and us to the risk of someone obtaining access to our information, to the information of our clients or their customers, or to our intellectual property, disabling or degrading service, or sabotaging systems or information. Any such security breach could result in a loss of confidence in the security of our services, damage our reputation, disrupt our business, require us to incur significant costs of investigation, remediation, and/or payment of a ransom, lead to legal liability, negatively impact our future sales, and result in a substantial financial loss. For additional information, see "Item 1A. Risk Factors" of this Annual Report.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Risks from Cybersecurity Incidents The Partnership has not encountered a cybersecurity incident that has materially impaired our operations or financial condition.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems." Cybersecurity Governance.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: By conducting regular risk assessments, we believe we effectively manage both internal and external cybersecurity threats. Our cybersecurity strategy is specifically tailored to our organization's size, scope, and business needs, emphasizing the protection of customer and employee data. Our security infrastructure includes advanced tools and protocols, such as firewall protections, secure user authentication, and up-to-date antivirus and internet security software, which we believe are fundamental components of our operational protocols designed to mitigate vulnerabilities and efficiently address security incidents.

companyName: CuriosityStream Inc.

ticker: CURI


text: We have also integrated cybersecurity related risks into our enterprise risk management program, which is designed to identify, prioritize, assess, monitor and mitigate the various risks confronting ADP, including cybersecurity risks. Our enterprise risk management team conducts a range of activities, including an annual enterprise risk management assessment.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response standard and Crisis Management Policy that guide our response to cybersecurity incidents; and • a third-party risk identification and management process for service providers.

companyName: SLM Corp

ticker: SLM


text: The Company depends on the proper functioning, availability, and security of its information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties, grants limited access to the Company's systems to third parties providing specific outsourced functions or other services, and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the Company's critical information systems, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees, and others, could result in liability for the Company to third parties and have a significant impact on the Company's operations and reputation.

companyName: SITE Centers Corp.

ticker: SITC


text: Maintaining our information security systems, communication networks, IT systems and data centers utilized by our business, and any outsourced service providers that may hold any data utilized by our business is crucial to the successful operation of our business.

companyName: Microvast Holdings, Inc.

ticker: MVST


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. The Company engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and vulnerability assessments to identify weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions. This includes a managed security service provider to augment the Company's dedicated SOC team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: IRadimed employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third-party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis.

companyName: IRADIMED CORP

ticker: IRMD


text: Oversight of Third-Party Service Providers Security Assessment Process for IT Service Providers Our Security Assessment Process for IT Service Providers is based on the ISO 27001 Information security, cybersecurity, and privacy protection standard. This standard's guidelines ensure that service providers design and implement procedures and notification mechanisms for incident response management within their technological infrastructure. All contracts with IT service providers must stipulate the service levels required by the Company.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Cybersecurity Risk Oversight Our business unit managers with oversight and guidance from our risk management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our ISO, nonmember of the executive management team, oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on an annual basis and subject to oversight by our board of directors.

companyName: COMMUNITY WEST BANCSHARES /


text: Our cybersecurity risk management strategy process is led by our Chief Information Security Officer, and Chief Technology and Digital Officer, and leverages the expertise of our Chief Financial Officer, General Counsel, and Chief Accounting Officer. Our Chief Information Security Officer and Chief Technology and Digital Officer have extensive prior work experience in roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, and Certified Ethical Hacker.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Our management team is responsible for the day-to-day management of risks we face, including our current Chief Operating Officer and Chief Security Officer. The Chief Operating Officer is an experienced Certified Information Systems Security Professional (CISSP) with more than 10 years of relevant experience in technology, security, and risk management across multiple industries, including finance and banking.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Role: Day-to-day cybersecurity responsibilities are managed by our Chief Executive Officer ("CEO"), with the support of an external Managed Security Services Provider. The Company is evaluating options to enhance management's cybersecurity role through additional training or external expertise.

companyName: Genvor Inc

ticker: GNVR


text: Our cybersecurity team engages with applicable personnel across the enterprise and utilizes software tools to identify, categorize, and quantify material cybersecurity threat risks. The team meets regularly to consider new, known, and evolving risks and evaluate the measures in place to mitigate these risks.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Our risk management program also assesses third party risks, and we have a third-party risk management program designed to identify and mitigate risks from vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when selecting third-party service providers. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: TrueCar, Inc.


text: We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Assessments of our cybersecurity safeguards are conducted by independent cybersecurity vendors. Our internal Information Systems team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and cyber security software protection, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. • Incident Identification and Response: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. • Cybersecurity Training and Awareness: All employees and contractors are required to receive semi-annual cybersecurity awareness training. Employees also receive training in response to drills and simulated attacks. • Access Controls: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information. • Encryption and Data Protection: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.

companyName: OneWater Marine Inc.

ticker: ONEW


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Chief Information Officer. Our executive team, including our Chief Executive Officer and Chief Financial Officer, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, guest and team member data. The Company uses multiple layers of security controls and unique threat intelligence within the "Center for Internet Security v8 Cybersecurity Framework" across five core security functions: Identify risks and threats, Protect, Detect, Respond and Recover. In addition, the Company requires that its employees complete annual compliance training on cybersecurity and online habits.

companyName: Spirit Aviation Holdings, Inc.

ticker: FLYYQ


text: The company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the company dedicates significant resources in an effort to secure its confidential information as well as the data and any personal information the Company receives and stores about its customers and employees. The company has systems in place designed to securely receive and store that information and to detect, contain, and respond to data security incidents.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems and infrastructure from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: VirnetX Holding Corp

ticker: VHC


text: In addition, we perform quarterly incident response and data breach tabletop exercises, which are simulations of cybersecurity incidents that are designed to test the effectiveness of our incident and data breach response plans. These exercises identify potential process improvements, opportunities to enhance the incident and data breach response plans and help prepare for actual cybersecurity incidents.

companyName: BOISE CASCADE Co

ticker: BCC


text: Management Oversight Our Chief Operating Officer ("COO"), Chief Financial Officer ("CFO"), VP of IT, CPO, General Counsel ("GC") and various members of the Incident Response Team play an important role in managing the Company's cybersecurity-related risks and maintaining an ongoing dialogue with our Board, the Governance Committee and the Company's Disclosure Committee. Potential cybersecurity incidents come to the attention of the Incident Response Team, which then responds to such incidents in accordance with our incident response plan. Cybersecurity incidents are reported to the Company's Management Disclosure Committee to review and assess the materiality of the cybersecurity incident. The members of the Disclosure Committee, which is responsible for addressing the Company's public disclosures and internal controls, include the GC, VP of IT, CPO, CFO, COO, certain members of the Incident Response Team, and other members of senior management from legal, finance, risk management, internal audit and communications.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: We employ a variety of measures to prepare for and protect against, detect, and contain and eradicate cybersecurity incidents and threats. The preparatory and protective measures we have in place include, without limitation, password protection, multi-factor authentication, internal and external penetration testing, cybersecurity assessments, industry benchmarking, and annual cybersecurity awareness trainings for our employees as well as social engineering awareness simulations. To detect and analyze cybersecurity incidents, our cybersecurity program uses automated event-detection technology monitored by our cyber defense team, notifications from employees, vendors or service providers, and other tools. Once a potential cybersecurity incident is detected, our IRP sets forth the process we follow to investigate the potential incident and contain it. After the cybersecurity incident is contained, our focus shifts to remediation, eradication, and recovery, with such efforts dependent upon on the nature of the cybersecurity incident. We have relationships with a number of well-established third-party service providers to assist with cybersecurity incident response, containment and remediation efforts. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity incidents that impact our own systems, networks, and technology. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: The Company currently relies on third-party hosting and software providers for its core platform operations, email communications, and data storage. These vendors maintain their own cybersecurity programs, which include network protection, access controls, and incident response procedures. While Londax Corp. does not yet employ a dedicated IT security team, its directors are actively involved in overseeing operational and technological risk, including cybersecurity.

companyName: Londax Corp.

ticker: LDXC


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure of our information technology systems, including cybersecurity attacks or other data security incidents, could significantly disrupt the operation of our business", included as part of our risk factor disclosures at Item 1A of this Annual

companyName: FORUM MARKETS Inc

ticker: FRMM


text: We engage independent third parties to audit our adherence to our cybersecurity policies and conduct infrastructure and application security assessments and penetration testing. These third parties help us assess our internal preparedness, adherence to best practices and industry standards, and compliance with applicable laws and regulations as well as help us to identify areas for continued focus and improvement. We conduct annual information security awareness training for employees involved in the systems or processes connected to confidential and sensitive information. We also carry insurance that provides certain, limited protection against potential losses arising from a cybersecurity incident.

companyName: APPFOLIO INC

ticker: APPF


text: The Company employs third parties in certain aspects of its information security and cybersecurity risk management. For example, we engage third parties to assess the information security risks related to new products, and we utilize third parties to conduct certain security operations and maintain certain information security infrastructure. We have adopted a Contract and Vendor Management Policy, which addresses the identification, measurement, monitoring, and management of our third-party service provider relationships, including those related to information security. The CISO assesses and monitors information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third party service providers, the CISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to the CRO, ERMC, TOC, and, if applicable, the Board.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Our ICSPP is overseen by the SMT who is responsible for designating the CISO. The CISO is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The CISO is charged with all logical security related matters, which include but are not limited to, PC/server security, network security, internet security, and database and application security. Our ICSRP is based on applicable federal and state laws as well as cybersecurity incident response best practices. The purpose of the ICSRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident. These objectives include maximizing the effectiveness of our company's operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Our information technology (the "Information Technology Team") is responsible for monitoring our information systems for vulnerabilities and mitigating any issues. It works with others within our company to understand the severity of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We maintain a comprehensive incident response plan. Key components include regular updates to ensure effectiveness, employee training programs, and establishing communication channels and relevant systems for proper incident reporting and logging procedures. Communication and notification protocols are defined for notifying third parties such as regulatory bodies, customers, and partners. Recovery strategies are developed for restoring normal operations, and post-incident analysis is conducted to identify lessons learned and improvements for future incident response efforts. The incident response plan also outlines procedures for prompt detection, response, and remediation efforts to minimize the impact of incidents.

companyName: INNODATA INC

ticker: INOD


text: The aspects of the Company's risk management approach to cybersecurity include: • Annually reviewing and updating cybersecurity policies to ensure alignment with the latest industry standards and regulatory requirements. The specific aspects of the Company's program are informed by guidelines outlined in various accepted frameworks, including the Cybersecurity Framework ("CSF") issued by the National Institute of Standards and Technology Framework ("NIST"), an agency of the United States Department of Commerce. • Maintaining a dedicated cybersecurity team under the direction of the Company's Chief Information Officer ("CIO") that has expertise related to data and network security, data governance, and risk management. • Conducting vulnerability assessments to identify and mitigate potential security risks. These assessments include network scans, penetration testing, and security audits performed by internal resources or qualified third-party providers. • Requiring all employees to participate in cybersecurity training and awareness programs including annual cybersecurity training and monthly phishing campaigns. These programs educate employees on how to recognize and respond to cyber threats and develop best practices for maintaining a strong security culture. • Monitoring information channels from trusted security information sources to stay abreast of developing cybersecurity concerns that may affect the Company or its operations. • Reviewing the security protocols of new third-party service providers to ensure acceptable levels of security are documented and maintained. • Maintaining an incident response retainer with a respected cybersecurity firm to ensure timely response and forensic capabilities.

companyName: LINDSAY CORP

ticker: LNN


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are included in our overall risk management program and designed to protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Cybersecurity risks are also periodically reevaluated in additional detail based on our experience and on external information regarding emerging risks. To protect our information systems from cybersecurity threats, we use various security tools, tracking procedures and investigational procedures to identify, investigate, resolve potential security incidents in a timely manner. We also engage third-party vendors to assist with security management, incident detection and response.

companyName: Mural Oncology plc


text: Additionally, the Company engages third parties to aid in the identification of risks and controls related to technology and technology driven product delivery channels, allowing for an independent opinion. The risk assessment process identifies data sources, threats and vulnerabilities, and ensures awareness, accountability and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). Risk Assessments (Detail)

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Related to Our Business and the Products—Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in this annual report on Form 10-K.

companyName: Acutus Medical, Inc.


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program. The Board receives regular reports from the ISC on our cybersecurity risks. In addition, ISC updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board also receives briefings from ISC on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Solo Brands, Inc.

ticker: SBDS


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Turnstone Biologics Corp.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws. Pursuant to CIM's cybersecurity policy, management of the Fund will be promptly notified of any material cybersecurity incident required to be disclosed under Item 105 of Regulation S-K and shall oversee the Fund's response to such matter.

companyName: CIM Opportunity Zone Fund, L.P.


text: As of the date of this Annual Report on Form 10-K, the Company has contracted with a third-party firm to provide CISO services, who reports to the Chief Risk Officer and the IT Committee Chair. This engagement allows the Company to access specialized knowledge, industry best practices, and regulatory insights while maintaining flexibility in managing its information security strategy. The external CISO provides guidance and oversight on cybersecurity risk assessments, incident response, and compliance.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: Having been a target of cyber criminals in November 2022, we are keenly aware of the risks and consequences that a cybersecurity incident unleashes on the technology function within a company. While this previous cyber-attack did not materially affect us and, in our belief, is not reasonably likely to materially affect us, future cybersecurity incidents and threats may materially affect us, including by affecting our business strategy, results of operations, or financial condition. See Item 1A., "Risk Factors" for additional details regarding cybersecurity risks.

companyName: PGT Innovations, Inc.


text: The Company has processes in place to identify, assess, and manage material risks from cybersecurity threats. The Adviser manages the Company's day-to-day operations and has implemented Lord Abbett's information security policy that applies to the Company and its operations.

companyName: Lord Abbett Private Credit Fund


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: Regenerative Medical Technology Group Inc.

ticker: RMTG


text: In cases where cybersecurity threats are deemed significant or pose a potential risk to the Company's operations, they are escalated to members of management who oversee cybersecurity matters. Depending on the nature and criticality of the threat, it may be escalated to executives such as the CISO, Chief Information Officer, Chief Risk Officer, Chief Financial Officer, General Counsel, or other relevant senior management personnel. These leaders possess the expertise and authority to assess the situation's impact on the Company's operations, finances, and reputation. Further, these leaders have over 15 years of experience each in their respective fields of expertise. Upon receiving this information, they engage in deliberation and decision-making, collaborating with the cybersecurity team to formulate and execute an appropriate response plan, which may include elevating the matter to the Risk Committee, or the Board, if warranted. This hierarchical escalation process is intended to ensure that key decision-makers are properly informed, enabling appropriate actions to mitigate the identified cybersecurity risks.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: We rely on third-party service providers for a variety of services to run our sales and payment processing. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. A cyber-attack at a third-party service provider could have a significant impact on our business, and we continuously monitor the risks associated with our service providers. believe that currently we have not encountered a cybersecurity event that has had a material impact on our business.

companyName: Resonate Blends, Inc.

ticker: KOAN


text: Our cybersecurity risk management program includes: risk assessments performed internally and with the help of third-party vendors that are designed to help identify material cybersecurity risks to our critical systems, information, products, services, equipment, and our broader enterprise IT and customer-facing network environments;

companyName: ATN International, Inc.

ticker: ATNI


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub-committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: We manage information security incidents pursuant to a documented incident response plan executed by an incident response team consisting of senior leaders and their team members who are integral to effective incident response management, including but not limited to representatives from information security, legal, compliance, risk management, communications, facilities, operations, marketing and distribution, finance, and human resources, as well as external, nationally recognized legal and forensics resources who are familiar with our operations and incident response team, and who routinely participate in our tabletop training. We employ a formal incident escalation process based on the nature of the incident and its risk severity, for alerting and engaging with executive leadership and members of our Audit Committee and Board of Directors. The incident response plan includes processes integrated with our business continuity and emergency response plans.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: As of December 31, 2023, cybersecurity incidents and threats have not had a material adverse effect on Federated Hermes' Financial Condition. See Item 1A - Risk Factors - General Risk Factors - Operations-Related Risks - Systems, Technology and Cybersecurity Risks for additional information regarding the cybersecurity risks to Federated Hermes' business, offerings, customers, shareholders, and service providers.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are defined and managed by Cimpress' central security and privacy team and are designed to help protect our information assets and operations from internal and external cyber threats and secure our networks and systems. Our cybersecurity processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems, incident simulations, and routine reviews of our policies and procedures to identify risks and improve our practices. Our cybersecurity incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We have security policies that apply to all employees worldwide, and we conduct annual employee trainings on data protection, cybersecurity, and incident prevention, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. In addition to our internal penetration testing and vulnerability management program, we engage an external party to simulate attacks on our systems to test our defenses and response. We also use a third-party vendor risk assessment platform to score vendors' cybersecurity vulnerabilities and provide suggested mitigations.

companyName: CIMPRESS plc

ticker: CMPR


text: We acknowledge the evolving nature of cyber threats to our business and industry. The Board oversees management's processes for identifying and mitigating cybersecurity risks to help align our risk exposure with our strategic objectives. To that end, cybersecurity risk management is integrated into the Company's overall enterprise risk management function. The Company utilizes a combination of processes and systems designed to assess, monitor, and respond to organizational cybersecurity risks in an effective manner across our operations. The cybersecurity risk management program includes regular assessments, providing a holistic view of our risk posture; this contributes to the ongoing improvement of our process, cybersecurity program, and security position.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: The assessment of cybersecurity incidents are integrated as part of the Company's business continuity and disaster recovery program ("BCDR"). Our BCDR includes an incident response protocol that provides a framework for the assessment, response, and recovery phases for any business disruption, including cybersecurity incidents. It also incorporates various event, incident and response teams that comprise the Company's information security, risk management, compliance, legal and other functions as needed in response to any cybersecurity incidents. Our incident response protocol also provides for reporting mechanisms to senior management and our Board of Directors in the event of a material cybersecurity incident.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: As a part of the Company's overall risk management and compliance programs, we have developed an enterprise cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. Our enterprise cybersecurity program classifies potential threats by risk levels and we typically prioritize our threat mitigation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. In recent years, we have increased our investments in our ability to detect, identify, classify and mitigate cybersecurity and other data privacy risks within our environment. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement when responding to such issues. Additionally, our cybersecurity program is regularly audited by independent third parties, and we incorporate regular information security training as part of our employee education and development program. We maintain cybersecurity insurance as part of our comprehensive insurance portfolio.

companyName: Hanesbrands Inc.


text: We engage third party auditors to conduct periodic reviews of our security controls protecting our Information Systems and Data, as well as third party penetration testing of our network infrastructure and related systems. The results of these reviews are reported to the audit committee of our Board of Directors.

companyName: LUMOS PHARMA, INC.


text: The Company's cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties. The Company's internal IT team performs monthly vulnerability scanning and performs an annual risk assessment based on the National Institute of Standards and Technology Cybersecurity Framework. The results are reported to the ITSC. The Company's IT and compliance staff also review potential cybersecurity threats associated with the Company's third party vendors, including performing a review of and obtaining a System of Organization Controls report from all vendors rated as "high risk" by the Company's internal vendor management program. The Company also has an internal Incident Response Plan and Team, which is charged with overseeing the Company's response to any cybersecurity incident. The team performs a table top exercise at least annually to prepare to respond in the event of any actual cybersecurity incident. In addition to these internal resources, the Company uses a third party vendor to complete annual penetration and vulnerability testing, with the results reported to the ITSC. Finally, the Company's cybersecurity compliance program is audited by the Bank's outsourced internal auditor.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: Management policies and procedures We recognize the need to protect our data, systems and technology. We have described related risks in Item 1A under the heading "Risks Related to our Technology and Data." We have previously assessed and periodically measure our security maturity using the US National Institute of Standards and Technology Cybersecurity Framework. ("NIST CSF") supported by other internal and third-party assessments. Gaps or perceived weaknesses in our NIST CSF score are highlighted to our Cybersecurity Risk Committee and subsequently to the Board of Directors. A reassessment of our maturity using NIST CSF was carried out in the early part of 2024, demonstrating ongoing improvement. These assessments allow us to prioritize investment into those areas which provide the greatest improvement in the CSF scoring and by implication, our ability to identify, protect, detect, respond and recover from information and cybersecurity incidents. Risks are recorded in OneTrust and are formally assessed monthly, considering likelihood and potential impact and mitigating actions are implemented where possible to reduce identified risks. Controls designed to reduce or eliminate risk are designed into our technology, processes and management of third parties. We conduct regular vulnerability scanning and use a third party for regular penetration testing designed to help us identify new weaknesses or vulnerabilities. In addition, we use the same third party to help us conduct cybersecurity incident simulation which is subsequently used to inform updates to our Cybersecurity Incident Response Plan. We also have procedures designed to assess risks related to the use of third-party suppliers.

companyName: Soho House & Co Inc.


text: ISG maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and the Company's client-facing products. We regularly assess the threat landscape, taking a holistic view of cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: Information Services Group Inc.

ticker: III


text: Our enterprise risk management program is designed to identify, measure, monitor and control significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. The cybersecurity risk management program contains eleven key elements: Information Security Policies, Strategic Planning, Risk Assessment, Audit and Examination, Business Continuity Planning, Incident Response Planning, Third-Party Due Diligence, Cyber Insurance Coverage, Employee Training and Testing, Patch and Vulnerability Management, and the Federal Financial Institutions Examination Council ("FFIEC") Cyber Assessment Tool ("CAT").

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: The Board, acting through its committee structure, is responsible for overseeing management's implementation and execution of the enterprise risk management processes and for coordinating the outcome of reviews by Committees in their respective risk areas. Although each Committee is responsible for overseeing the management of certain risks, the full Board is regularly informed by the Committees about these risks. This helps enable the Board and the Committees to coordinate risk oversight and the relationships among the various risks faced by the Company, including cybersecurity risk. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management processes.

companyName: RELIANCE, INC.

ticker: RS


text: The Board has overall responsibility for the oversight of risk management at Vitesse, which includes cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program. In addition, the Board receives annual briefings from our Director of Infrastructure and Cybersecurity,on our cybersecurity program. Our internal auditor also reports to the Audit Committee on the internal controls and procedures that are implemented to assess and mitigate cybersecurity risk on an as needed basis.

companyName: Vitesse Energy, Inc.

ticker: VTS


text: Under the guidance of the Cybersecurity Governance Company, we have adopted (i) a Security Incident Response Plan, (ii) a Cybersecurity Materiality Assessment Policy, and (iii) a Cybersecurity Register of Events.

companyName: FTC Solar, Inc.

ticker: FTCI


text: Our CISO reports quarterly to the Risk and Compliance Committee and leads the Company's overall cybersecurity function. The Risk and Compliance Committee receives reports from our CISO on key security topics, which may include, among other things, the cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The Board receives quarterly reports from the Chair of the Risk and Compliance Committee with applicable updates on the Company's cybersecurity risk landscape, and briefings on our cyber risk management program and significant cybersecurity incidents. The CISO and/or the Chief Legal Officer also periodically present to the Board on cybersecurity topics that impact public companies.

companyName: TransUnion

ticker: TRU


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company relies on the cybersecurity strategy and policies implemented by Bain Capital, the parent of the Advisor and Administrator, which apply to the Company and its operations.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: Audit Committee of the Board of Directors is responsible for oversight of our cybersecurity risk assessment, risk management, incident response procedures and cybersecurity risks and provides updates to the Board of Directors regarding such oversight. Periodically during each year, the Audit Committee receives an overview from our Vice President, Head of Technology of our cybersecurity threat risk management and strategy processes, including potential impact on us, the efforts of management to manage the risks that are identified and our incident response preparations.

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: We engage third-party vendors, such as independent service auditors, consultants, regulatory auditors, law firms, forensic specialists, and other third-party service providers in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. Additionally, we endeavor to include cybersecurity requirements in our contracts with service and solution providers and to require them to adhere to security standards and protocols. Further, we request that third-party service providers with access to personally identifiable information enter into data processing services agreements and adhere to our policies and standards.

companyName: Enviva, LLC


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management team. We have established a cybersecurity governance framework that encompasses policies, procedures, and controls designed to support cybersecurity risk management practices. Our Senior Information Systems Administrator is responsible for assessing and managing material risks from cybersecurity threats. This position reports directly to our Senior Vice President of Business Transformation. In addition, we have retained Virtual Chief Information Security Officer services to support our cybersecurity risk management and governance practices. Such individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our Managed Security Services Provider and our Board of Directors on any appropriate items. Our Board of Directors oversees the cybersecurity program and receives program metrics as well as information related to identified cyber-related risks when meeting with the company's management.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: We seek to mitigate cybersecurity risks we identify through a variety of methods; however, we acknowledge that even a robust, well-designed information technology control environment may not fully eliminate cybersecurity risk. It is possible that we will be unable to detect certain vulnerabilities in time to remediate them, or that our implemented controls may not operate as intended.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, some of which are managed by a third-party service provider.

companyName: Loop Industries, Inc.

ticker: LOOP


text: We engage with third parties to provide us with hardware, software, and services to operate our information systems and run our business. In particular, we host a substantial portion of our IT infrastructure and data on services maintained by Amazon Web Services. When engaging a third-party vendor or service provider, we use a variety of processes and controls to identify and oversee risks relating to that engagement, which may include one or more of the following depending on the scope and nature of the engagement: • incorporating provisions in vendor contracts that require third parties meet certain minimum cybersecurity standards based on the nature of the product or service provided; • installing monitoring software and other tools to detect malicious software and activities in systems operated by third parties; • maintaining processes for monitoring for and applying updates and patches to third-party hardware and software to address vulnerabilities; and • performing security and data privacy assessments before engaging new vendors or acquiring new hardware and software.

companyName: GoDaddy Inc.

ticker: GDDY


text: We have not identified any cybersecurity threats, including as a result of prior incidents, that as of the date of this Annual Report have materially affected us, or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. However, there can be no guarantee that such controls, policies and procedures will be fully implemented and properly followed in every instance, or that those investments or policies and procedures will be effective. We therefore can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors—Risks Related to Privacy, Consumer Protection and Cybersecurity—Any significant interruptions, delays or discontinuations in service or disruptions in or unauthorized access to our information technology systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, including subscriber and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."

companyName: FuboTV Inc.

ticker: FUBO


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and events through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; tabletop training exercises; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. The Company established a cybersecurity incident response plan, which includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the Chief Digital Officer ("CDO") and VP of IT, Director, and President. The Company regularly conducts risk assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.

companyName: REGIS CORP

ticker: RGS


text: The Company regularly assesses the threats and vulnerabilities to its environment so it can update and maintain its systems and controls to effectively mitigate these risks. Layered security controls are designed to complement each other to protect customer information and transactions. The Company periodically engages third-party experts and consultants to conduct evaluations of our security controls, whether through penetration testing, audits, assessments, or consulting on best practices to address new challenges. Results are used to help drive priorities and initiatives to improve the Program. Additionally, as a regulated entity, bank regulators assess the quality of our information security program during their regular examinations of the Company and its compliance with federal regulations and requirements.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: As of March 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and financial statements.

companyName: Greentech Innovations, Inc.

ticker: GTIC


text: • Detection. Avanos has a formal framework consisting of people, processes and technologies dedicated to monitoring, detecting and responding all security events. We utilize multiple intrusion detection systems and processes. These include user access reviews to determine appropriate access to systems and data and a Security Identity and Event Management (SIEM) software solution, which consists of system logs with correlation logic to identify malicious activity. Logs and alerts cover our network, devices, applications and email. • Response. We have an incident response plan for cybersecurity incidents and conduct response planning with tabletop exercises. We have engaged a third party to assist with forensic investigations and expert support when needed. When a cybersecurity incident is identified by our IT Security Director and Security Team, our Vice President, Chief Information Officer (the "CIO") and other members of our IT team are alerted. Incidents are classified by severity with predefined definitions, actions and notifications for each severity level. Incidents that are defined as medium, high or critical are reported the Chief Financial Officer, Principal Accounting Officer, General Counsel and CIO to determine materiality and associated public disclosure steps. For these incidents, we engage our third-party forensic partner to assist with containment, remediation and issuing a report on the incident. • Recovery. Our dedicated security operations team, defined incident response plan and third party forensic partner are employed to contain and recover from an incident. In addition, the IT organization conducts an annual disaster recovery exercise. Following an incident, the IT Security Team conducts a post-mortem to identify opportunities to improve our cybersecurity program. Any follow-up communications are provided as part of the recovery process.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Our Information Security team manages our Information Security Program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity risk on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and our Board of Directors (the "Board"), as described below under the sub-heading " Governance."

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: The Information Technology Risk Management Committee, or ITRMC, was established to assist in identifying, assessing, and managing risks across various domains to protect our interests, assets, reputation, and enhance its resilience. The ITRMC consists of members with diverse backgrounds, expertise, and experience relevant to risk management, including the CFO and Head of IT. The ITRMC is informed about our cybersecurity risks, including risks from cybersecurity incidents, through information obtained directly from and through working with our internal security team and outside experts. The ITRMC provides oversight, guidance, and recommendations on risk management strategies, policies, procedures, and practices to the executive management team and the audit committee. The ITRMC, as needed with assistance from external experts, provides regular reports to executive management and the audit committee, covering items such as risk management activities, significant risk exposures, mitigation efforts, and audits.

companyName: ALPINE IMMUNE SCIENCES, INC.


text: Lumen's CSO has extensive experience working in the public and private sectors leading security organizations, managing risk management functions, and driving large information technology deployments. He has an Engineering degree, a Master of Business Administration, a Chief Information Security Officer Certification, and a Global Information Assurance Certification Security Leadership Certification. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

companyName: QWEST CORP

ticker: CTBB


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Chief Information Officer. The Chief Information Officer extensive experience working in and leading the Company's information systems. In addition, a dedicated Cybersecurity team, including the Chief Technology Officer and Cybersecurity Manager, provide regular updates to the Chief Information Officer.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: Before joining State Street, our CISO worked at a global information technology firm for more than 10 years, holding various positions, including senior vice president and chief security officer, and, prior to that, chief information security officer for that firm's software division. Earlier on, she held leadership and general manager roles at an information management firm and an information security firm, each based in both the United States and Europe. She has worked with the World Economic Forum as a member of their Global Future Council on Cybersecurity. She holds a Doctor of Philosophy in information security and a Bachelor of Science in computer science.

companyName: STATE STREET CORP

ticker: STT


text: While we maintain teams that specialize in cybersecurity and information technology, we also leverage third-party experts to provide objective feedback on our program and posture. These are accomplished via penetration tests, security posture assessments, and technology consulting. These independent evaluations help validate existing controls, identify potential focus areas, and aid in securely deploying technology in an increasingly complex environment.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Management is responsible for the cybersecurity risk management program as well as actions to identify, assess, mitigate, and remediate material issues. The Company's cybersecurity risk management program is supervised by our Chief Technology Officer ("CTO"), who reports directly to the Company's Chief Executive Officer. The CTO and his team are responsible for leading cybersecurity strategy, policy, standards, architecture and processes.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: We have continued to expand investments in IT security. For example we are in the process of implementing a Cyber & Data Protection Council that will use a risk-based methodology to support the security, confidentiality, integrity, and availability of our information and IT systems. The Cyber & Data Protection Council will be chaired by the CFO and members include IT, legal, and HR leadership. Significant incidents will be escalated and communicated by senior IT management to the CIO and the Cyber & Data Protection Council to determine severity, cause and remediation.

companyName: SUPERIOR ENERGY SERVICES INC


text: Cybersecurity risks are integrated into the Registrants' Enterprise Risk Management process. The Enterprise Risk Management process engages internal stakeholders, helps identify key internal and external business risks, including cybersecurity risks, and then supports evaluations of those risks, providing consistent assessment. Key risks are then assessed using a methodology that includes a quantification of potential financial and operational impacts. Priority cybersecurity risks are assigned internal risk owners which report to the Vice President of Technology, Data and Security, who is responsible for the Registrants' Enterprise Security including, among other responsibilities, developing and updating risk management plans.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Incidents and Risks We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, management is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Please see Item 1A "Risk Factors" for further discussion of the material risks associated with the interruption or breach of our information systems or information assets.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: In addition, the Sponsor enforces stringent security requirements for storage devices and applications, including encryption at rest, full user activity tracking, and secure sharing of client data. The Sponsor's email environment is further fortified with dual factor authentication and other security measures. The Sponsor requires both two-factor and at rest encryption on all systems. The Sponsor requires through its compliance and cybersecurity policy that all system breaches detected by an employee are immediately escalated to the Chief Compliance Officer and Head of Legal.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We are also engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT


text: All suspicious activity involving the Information Systems affecting the Trust recognized or uncovered by personnel should be promptly reported to his or her supervisor and/or the CISO; and and/or the CISO to report a lost or stolen laptop, mobile device, and/or flash drive. The Chief Compliance Officer ("CCO") oversees the Sponsor's Cybersecurity policy and in collaboration with the CISO reviews it annually. There have been no cybersecurity incidents since the Trust has been founded.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: The Innovation and Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Innovation and Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Innovation and Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews key metrics summarizing our cyber security risk profile on a quarterly basis. The Innovation and Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: Our management team is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from third-party service providers as needed. management team oversees our cybersecurity policies and processes, including those described in the "Risk Management and Strategy"

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: We continue to develop and implement a framework designed to safeguard our organization's digital assets from threats and vulnerabilities as part of our overall risk management system. It involves a systematic approach of identifying, assessing, and mitigating risks associated with our technology systems, data, and operations.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Our processes also address cybersecurity threat risks associated with our use of third -party service providers, including our suppliers and manufacturers or who have access to confidential, proprietary, personal, or employee data, or to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third -party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or audits for System and Organization Controls (SOC) compliance.

companyName: Azenta, Inc.

ticker: AZTA


text: Our cybersecurity risk management program is managed by the Chief Information Security Officer (the "CISO") and overseen by the Chief Executive Officer and the Chief Administrative Officer. Our CISO has over 25 years of experience in maritime IT. He holds an MBA and a Master of Science degree in Information Management and is a Certified Information Security Manager from the Information Systems Audit and Control Association, certified in Cybersecurity Risk Management by Harvard University, Cybersecurity Oversight by Carnegie Mellon, and Maritime Cybersecurity by Lloyds Maritime.

companyName: International Seaways, Inc.

ticker: INSW


text: In line with its broader strategic oversight, the Board oversees cybersecurity, including strategy and processes. To assist with oversight of cybersecurity, the Board has delegated to its Audit Committee responsibility to oversee certain aspects of cybersecurity, including controls and reporting. At least semi-annually, the Audit Committee or full Board receive reports from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). Reports include topics such as updates on the Company's cybersecurity risk profile, assessments of the Company's enterprise and product security programs, management's strategy for managing risks, measures implemented to identify and mitigate cybersecurity risks, the status of projects to strengthen the Company's cybersecurity posture, the emerging cybersecurity threat landscape and other relevant topics. The Board also receives a report from management on the results of the Company's annual ERM Program risk assessment, as well periodic updates on the ERM Program and ongoing monitoring of the Company's risks, including cybersecurity risk, as appropriate.

companyName: Xylem Inc.

ticker: XYL


text: FirstEnergy conducts cyber security exercises and training. For example, all personnel with any form of computer system access must complete cyber security training on a recurring basis, which educates personnel on FirstEnergy's policies and procedures for using FirstEnergy systems, keeping FirstEnergy information secure, and for safe, reliable operation of electric utility systems. FirstEnergy also conducts various tests of its cyber incident response plans, disaster recovery plans and business continuity plans with key stakeholders and responders for various areas of FirstEnergy's utility and business functions. FirstEnergy's management also holds executive cyber security incident tabletop exercises to train on cyber security incident response.

companyName: FIRSTENERGY CORP

ticker: FE


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Cybersecurity Risk Management Team, (which includes our General Counsel) an external cybersecurity consultant with over 15 years of experience providing cybersecurity services and training (who is also a member of the Company's Cybersecurity Risk Management Team) and an external information technology consultant.

companyName: GENELUX Corp

ticker: GNLX


text: Training and Awareness provide ongoing cybersecurity training and awareness programs for all employees to promote a culture of security. Our training programs cover topics such as phishing prevention, secure data handling, and recognizing potential cyber threats.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: The board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk management, including cybersecurity. The Audit Committee receives an annual comprehensive report from the Company's President and the Vice President of Information Technology ("VP of IT") covering the Company's cybersecurity posture, incidents, if any, and risk mitigation efforts, and receives ad hoc reporting of any material cybersecurity incidents.

companyName: DallasNews Corp


text: To further enhance our risk mitigation strategy, we maintain annual cybersecurity insurance policies designed to offset costs associated with covered cybersecurity incidents.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: The CISO's organization monitors, manages and works to identify and assess, cybersecurity risks through various technologies, resources, processes and policies that are regularly updated to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. Our global cybersecurity program is aligned to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and is certified to the ISO 27001 global standard on Information Security Management. Our cybersecurity program is closely integrated with our QMS under the ISO 13485 standard. Our program utilizes layered defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability. Among other things, this includes ongoing systems monitoring with support from a managed detection and response service provider and other third-party vendors to augment our monitoring and response capabilities, as well as a standardized incident response program with incident response team members participating in regularly scheduled management reviews and tabletop exercises. Our CISO and CIO conduct regular cross-functional management reviews of our programs, including with members of senior leadership. All employees and those contractors of the Company with access to our information systems receive annual cybersecurity awareness training, and we have integrated cybersecurity and data protection topics into our Code of Conduct. All critical information systems have a written business continuity plan that is exercised at least annually. The entire program is audited annually by both internal and third-party auditors.

companyName: HAEMONETICS CORP

ticker: HAE


text: Our CSRM program complements our overall enterprise risk management program, using similar methodologies and governance processes to identify risks and mitigating strategies.

companyName: Avery Dennison Corp

ticker: AVY


text: The Cybersecurity Executive Steering Body includes members of the Executive Leadership Team, among other senior managers, including cross-functional representation from Cybersecurity, Product and Technology, Law, Finance, and Operations departments. Collectively, the Cybersecurity Executive Steering Body has decades of enterprise risk management experience, including cybersecurity risk management.

companyName: MSA Safety Inc

ticker: MSA


text: The Board oversees our information security program. The Audit Committee of the Board (the "Audit Committee"), which is tasked with oversight of certain risk issues, including cybersecurity, receives reports from the Chief Technology Officer throughout the year. The Board and the Audit Committee also receive updates about the results of readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and our internal response preparedness. The Audit Committee regularly briefs the full Board on these matters, and the full Board also receives periodic briefings on cybersecurity threats to enhance our directors' literacy on security issues.

companyName: EXP OldCo Winddown, Inc.


text: As discussed further in "Item 1. Business—Our Manager and Ellington," we are externally managed and advised by our Manager, an affiliate of Ellington. Our Manager does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. We rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Ellington Credit Co

ticker: EARN


text: Increased cybersecurity risk due to the diversification of our data across external service providers and cyber incidents may adversely affect our business by causing a disruption to our operations, compromise our confidential information and/or damage to our business relationships, all of which could negatively impact our financial results. As of the date of this Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our financial position, results of operations and/or business strategy. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future where we may be unable to implement effective preventative measures in a timely manner.

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, through the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network. We maintain processes and procedures to continuously assess third-party cybersecurity risk and include security and privacy addendums to our contracts where applicable. We seek to work directly with any suppliers to address potential deficiencies when identified.

companyName: Information Services Group Inc.

ticker: III


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. To date, we have not experienced any cyber incidents that have had an adverse material effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Related to Our Business – Security breaches, computer viruses and cybersecurity incidents could harm our business, results of operations or financial condition."

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: We have adopted guidelines and processes, led by our information technology ("IT") department, for preventing cybersecurity incidents and for assessing and responding to such incidents should they occur. These guidelines and processes, as well as our overall cybersecurity risk management, include consideration of cybersecurity threats associated with our use of third-party service providers. We also consider the internal risk oversight programs of our third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Mural Oncology plc


text: The information set forth under "Risk Factors" (Part I, Item 1A of this Form 10-K) — "We have been and could be vulnerable to disruption in our IT systems, cybers incidents, security breaches and loss of data (associate and client) that have occurred, and may continue to occur, and have resulted in and could continue to result in the incurrence of significant costs and harm to our business and reputation." — on page 14 of this Annual Report on Form 10-K is hereby incorporated by reference. As of December 31, 2023, our financial condition, results of operations or business strategy have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: UNISYS CORP

ticker: UIS


text: Cybersecurity Risk In recent years there has been an increased risk of information and security risks due to increased sophistication and activities of perpetrators of cyber attacks. The computers are used for our everyday business operations including mobile devices and other online means of activities to connect with our customers, employees, suppliers, and other parties. This extensive use gives rise to cybersecurity risks such as system disruption, theft, and release of confidential information. There is sensitive information stored in the systems and intellectual property, including employees, customers and other financial information.

companyName: ECO SCIENCE SOLUTIONS, INC.

ticker: ESSI


text: The Company partners with third parties to assess the effectiveness of its cybersecurity prevention and response systems and processes, including third-party review of the Company's Information Security Management System for ISO 27001 controls, assessment of the Company's cloud products and managed services according to the American Institute of CPAs (AICPA) Service Organization Control (SOC) Audit Type II, and new product validation as part of the Company's secure development lifecycle. The Company additionally engage s third-party providers in support of endpoint detection and responses, data loss prevention efforts, and incident management efforts.

companyName: NetApp, Inc.

ticker: NTAP


text: The audit committee of the Company's Board of Directors is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate cybersecurity threats by reviewing with management the cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. The Chief Information Officer, a member of the Company's incident response team, provides reports at least annually to the entire Board of Directors and other members of our senior management team as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our Chief Information Officer also regularly updates senior management on our cybersecurity risk governance and management and the status of ongoing efforts to strengthen cybersecurity effectiveness. We also actively engage with key vendors, customers, and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Stereotaxis, Inc.

ticker: STXS


text: The Audit Committee of the Board of Directors, which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the CIO and Operational Risk Management throughout the year. At least annually, the Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential's annual external integrated audit.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: We also conduct the following activities at various intervals during the year, which vary in maturity across our business: • monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply; • undertake regular reviews of our customer facing policies and statements related to cybersecurity; • through policy, practice, and contract (as applicable) require employees, who provide services on our behalf, to treat customer information and data with care; • leverage the NIST incident handling framework to help us prepare, detect, analyze, contain, eradicate, respond, and recover when there is an actual or potential cybersecurity incident; • run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team; • run tabletop exercises to train our executives and increase their cybersecurity awareness; • conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations. • hold an annual Cybersecurity Awareness Month programming, which is available for all employees during which we provide seminars, presentations, and employee engagement activities designed to reinforce our employee information security training and enhance the culture and knowledge of cybersecurity risks among our employees; • carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.

companyName: JUNIPER NETWORKS INC


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors who have access to our critical systems and information.

companyName: Amplitude, Inc.

ticker: AMPL


text: In the event of a cyberattack, we engage our CIRP, which provides a framework of processes and procedures related to identifying, categorizing, responding, containing, analyzing, and eradicating cybersecurity threats to mitigate downtime and promptly restore systems and services. Management has responsibility for reporting cybersecurity incidents to the Audit Committee as they occur, if consistent with our CIRP. The CIRP also addresses management's responsibility, with Audit Committee oversight, with respect to any reporting or disclosure determinations related to a given cybersecurity incident and provides for Audit Committee and Board of Trustee briefings as appropriate.

companyName: JBG SMITH Properties

ticker: JBGS


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake regular reviews of our consumer facing policies and statements related to cybersecurity; • proactively inform our customers of substantive changes related to customer data handling; • conduct annual customer data handling and use requirements training for all our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct regular network monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K); • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • conduct annual training with all employees on our security standards and requirements.

companyName: KINETA, INC./DE


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures; • training and awareness programs for employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: STRYVE FOODS, INC.


text: Our information security team is led by our Chief Information Security Officer ("CISO"), who has served in the role since 2015 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors. The CISO oversees a team of information security professionals who are devoted full time to assessing, identifying and managing cybersecurity threats on a day-to-day basis. The CISO attends each quarterly meeting of the RCOC to brief members on information security matters and discuss cybersecurity risks generally.

companyName: APPFOLIO INC

ticker: APPF


text: Yubo Beijing's management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by Yubo Beijing; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: We also integrated cybersecurity risk management into our overall risk management framework to ensure that cybersecurity risks are considered in all aspects of our business. The integration ensures that cybersecurity considerations are integral to our strategic and operational decision-making. Our management team works closely with our Chief Technology Officer (CTO) and Chief Information Security Officer (CISO), ensuring that our cybersecurity efforts align with our business objectives and operational needs. Key components of our cybersecurity approach include, among other things: • establishing a dedicated action team, led by our CTO and CISO, to oversee and manage cybersecurity risks; • implementing a comprehensive cybersecurity risk assessment process and strategy based on industry standards and established frameworks such as the National Institute of Standards and Technology (NIST) Special Publication 800-61; • implementing a vendor risk management program, which includes cybersecurity and data privacy audits, evaluating vendor risk level, and monitoring risk mitigation efforts; • conducting penetration tests and security maturity assessments throughout the year; • periodically engaging independent third-party assessors to audit our cybersecurity and information system programs to evaluate their effectiveness; • implementing industry-standard technologies and processes to protect our system and data and to help detect potential suspicious activity; • maintaining access controls to safeguard data and systems; • providing annual trainings to employees on responsible information security, data security and cybersecurity practices including appropriate action to take against cybersecurity threats; • conducting periodic phishing simulations to our employees; • engaging in cybersecurity incident tabletop exercises and scenario planning exercises; • maintaining a cybersecurity and information security risk insurance policy, which insures for data incidents or breaches and other technology related exposures; and • periodically reviewing and updating our IRP, privacy policy, and other relevant policies/procedures. These approaches are not exhaustive, and we plan to continuously improve our approaches to cybersecurity risk management.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: Our cybersecurity risk management program also includes: • a multi-layered approach to cybersecurity designed to protect our assets; • identification of key risk areas through internal reviews and researching trends; • ongoing mitigation in the areas of human behavior, data breaches, remote work, third party vendors, removable media and emerging threats; • performance of multiple assessments both internally and externally; • quarterly mandatory security training for employees as well as monthly phishing tests; and • multi-factor authentication.

companyName: Utz Brands, Inc.

ticker: UTZ