text: We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We also have a process for newly-hired employees to participate in security awareness training. We also have a process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.

companyName: MBX Biosciences, Inc.

ticker: MBX

secItem: Item 1C


text: We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers. A critical part of our strategy involves focusing on gathering data without collecting, maintaining or using sensitive personal data such as social security numbers, credit card numbers, financial account information or medical records. The Cardlytics platform is designed so that we do not receive or have access to any PII from our FI partners. We only perform targeted marketing using data that has undergone processing such that it is only linked to anonymized identifiers.

companyName: Cardlytics, Inc.

ticker: CDLX


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. – See Item 1A. "Risk Factors – We are subject to cybersecurity risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss." for more information about these and other risks related to information security.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: Our cybersecurity program is aligned with the National Institute of Standards and Technology (NIST) 800 Cybersecurity Framework and uses a layered strategy, relying on technology and human processes to safeguard our systems and client data. Our cybersecurity strategy utilizes numerous layers of security controls, processes, and procedures across our information systems and networks, including but not limited to, multi-factor authentication, identity access management, endpoint security, mobile security, application security, network security, web security, and encryption. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support and operations; and other functions. The Company provides ongoing mandatory cybersecurity training for associates that is intended to help them understand cybersecurity risks and comply with our cybersecurity policies.

companyName: FRANKLIN COVEY CO

ticker: FC


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: PERMIAN BASIN ROYALTY TRUST

ticker: PBT


text: Our ERM program is designed to identify the top risks applicable to us and document risk mitigation plans and initiatives by management. We have identified, and we expect to continue to identify, cybersecurity threats as among the top risks that we face. As one of the critical elements of our overall ERM approach, our information security program is focused on the following key areas: • Governance: As discussed in more detail below under "Cybersecurity Governance," the Board's oversight of cybersecurity risk management is supported primarily by the Audit Committee of the Board (the "Audit Committee") and our Information and Privacy Risk Committee ("IPRC"), which is the key management-level governance body that oversees management of cybersecurity threat and data privacy risks. • Cross-Functional Approach: Through the IPRC, we have implemented a cross-functional approach to managing cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of significant cybersecurity incidents, either in the form of a single unauthorized occurrence or a series of unauthorized occurrences, so that decisions regarding the public disclosure and reporting of such incidents can be made by appropriate members of management in a timely manner. • Threat Assessment: We engage in an annual cybersecurity-focused risk assessment process, which helps identify our cybersecurity risks by comparing our processes to standards set by the NIST and by engaging third-party experts to attempt to infiltrate our information systems. • Technical Safeguards: While no system is impenetrable, we deploy sophisticated technical safeguards that are intended to provide multiple layers of security designed to identify cybersecurity threats and protect our information systems from such threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which we evaluate and seek to improve through vulnerability assessments and cybersecurity threat intelligence. We leverage both internal and third-party resources to implement and monitor our technical security controls and perform threat and vulnerability assessments. Assessment results feed an iterative process intended to improve our cybersecurity posture and address the constantly evolving threat landscape on an on-going basis. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, processes and practices. • Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans for critical systems, applications and business functions that address our response to a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.

companyName: Travel & Leisure Co.

ticker: TNL


text: In the event of a cybersecurity incident, whether the attack is on the Company or on a third-party service provider, the IT team conducts an initial assessment to estimate the scope and potential impact of the attack. The team also identifies critical information yet to be determined. A cross-functional team meets about the results of the initial assessment, including the nature and scope of the attack, which Company functions are affected, the response from the service provider (if a third-party incident), both financial and non-financial measures of materiality, the expected duration of the incident, any open or unknown information, and the status of the Company's response.

companyName: Portillo's Inc.

ticker: PTLO


text: Our management, represented by our Chief Executive Officer, Dean Medwid, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance, including integration of cybersecurity risk considerations into our overall risk management strategy and communication of key priorities to relevant personnel. Management is responsible for cybersecurity-related matters including approval of processes; review of assessments and other matters; evaluation of potential impact of incidents to determine materiality based on the nature and scope of the incident and any impact to operations, assets, or reputation; and response to incidents, including reporting certain incidents to the audit committee.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: We have historically been dependent on AIG's risk management, cybersecurity and privacy policies, standards and procedures to identify, monitor, mitigate and communicate to us and our Board of Directors the cybersecurity risks to which we are exposed and manage. As a result, during 2023, we primarily relied on AIG to provide cybersecurity risk management and cybersecurity services to us pursuant to the Transition Services Agreement with AIG. While we remain reliant on AIG for the provision of certain of these services, as part of our separation from, and in cooperation with, AIG, we have developed and are in the process of implementing an Information Security Program for Corebridge (the "Program") that includes, among other things, conducting periodic risk assessments designed to evaluate potential security threats, to detect potential vulnerabilities, and to mitigate identified security risks. The Program is informed by industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of Corebridge's information assets and systems that store, process, or transmit material non-public information. Where appropriate, we also engage third-parties to evaluate our Program and our cybersecurity risk management and to provide operational support for the Program.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Information Technology Committee (the "IT Committee") oversight of cybersecurity and other information technology risks, which includes, among others things: • oversight of IT and cybersecurity related risks with regard to the Company's IT platforms and investments; • advising and making recommendations to the Board regarding the state of the Company's cybersecurity preparedness, including review of the threat landscape facing the Company; and • monitoring and evaluating the effectiveness of IT security and cybersecurity protocols within the Company, including disaster recover capabilities.

companyName: EVERTEC, Inc.

ticker: EVTC


text: Enterprise Risk Management Our cybersecurity risk processes are a key element of our Enterprise Risk Management (ERM) process, which is designed to identify and evaluate the full range of significant risks to RTX Corporation (RTX). As part of our ERM program, RTX's functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning, and includes risks identified by our Enterprise Cybersecurity and Product Cybersecurity functions as part of the overall review of significant RTX risks. The top ERM risks are compiled annually and shared with the Audit Committee of the Board of Directors as well as the full Board of Directors. In addition, Internal Audit incorporates these risks into its continuous risk assessment process and periodically audits specific ERM risks.

companyName: RTX Corp

ticker: RTX


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we leverage strategic external partnerships to assist with assessing and mitigating cybersecurity threats to us. For example, we utilize a third-party managed security service provider who performs security operations center consulting and investigative duties as a backup to our in-house dedicated cybersecurity team.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: Executive management plays a significant role in assessing and managing material risks from cybersecurity threats. Our VP of Information Technology manages our information security program.

companyName: Outset Medical, Inc.

ticker: OM


text: The Board of Directors is responsible for the overall oversight of risk at the Company and has delegated to the Audit Committee the oversight of the risk management strategy specific to cybersecurity. Bi-annual reports regarding cybersecurity are provided to the Audit Committee by the CIO. These reports include information about the prevention, detection, mitigation, and remediation activities related to cybersecurity, any updates to internal processes surrounding cybersecurity, and any other relevant topics or information that allow the Audit Committee to provide proper oversight into cybersecurity risks. Additionally, the Board of Directors receives an annual update on cybersecurity from the CIO, which includes updates on any material cybersecurity incidents, and updates on topics related to cybersecurity both on a broad and company-specific level.

companyName: REV Group, Inc.


text: Our Cybersecurity Program, and portions thereof, are periodically reviewed by third-party assessors, consultants, auditors or other firms. For example, we periodically conduct penetration tests and tabletop exercises to simulate attacks against our infrastructure, systems, or portions thereof, in order to validate the efficacy of our security controls and response capabilities. Such exercises are typically conducted with assistance from third-party advisors and experts. Incident response efforts are also supported by external resources such as legal advisors, cybersecurity forensic firms, communications specialists, and other outside advisors and experts as well as law enforcement support, as appropriate. We benefit from engaging third parties to provide specialized skills, knowledge, tools and resources, and such third parties may also help reduce costs, increase efficiency and/or improve the quality of our Cybersecurity Program.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout our company. We dedicate resources commensurate with our risk profile and business size to programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats.

companyName: iQSTEL Inc

ticker: IQST


text: The CISO's cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO's Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company's CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers.

companyName: HERSHEY CO

ticker: HSY


text: The Company maintains cybersecurity policies and standards which align with the International Organization for Standardization (ISO) 27001 standard and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Company's cybersecurity policies and standards have been developed in collaboration with groups across the enterprise, such as Legal, Compliance, Technology, and each of its business segments. The Company's policies include, for example, Information and System Use policies for employee and non-employee system users. These policies reinforce the data privacy and protection sections of the Company's Code of Business Conduct and Ethics.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: J.P. Morgan's Security Awareness Program includes training that reinforces compliance with its policies, standards and practices relating to information technology risk and security management. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protects our, the Adviser's, J.P. Morgan's and its affiliates' resources and information. This training is mandatory for all employees globally on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests. Finally, J.P. Morgan's Global Privacy Program requires all employees to take periodic awareness training on data privacy. This privacy-focused training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats nor provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see discussion captioned "Our business could be negatively affected by security threats. A cyber-attack or similar incident could occur and result in information theft, data corruption, operational disruption, damage to our reputation, and/or financial loss." in Item 1A. Risk Factors.

companyName: EVOLUTION PETROLEUM CORP

ticker: EPM


text: Additionally, we engage third -party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.

companyName: Whitestone REIT

ticker: WSR


text: As a part of our comprehensive cybersecurity program, we have developed an incident response plan (IRP) designed to quickly respond to, mitigate, and recover from cybersecurity incidents. The IRP includes procedures for incident detection and reporting, initial assessment, containment, eradication, recovery, post-incident activities, and continuous improvement.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: Cybersecurity threats are inherent in the banking and financial services industry. To safeguard our customers' sensitive data, financial transactions, information systems and information assets, we have established a comprehensive cybersecurity risk management program that is part of our enterprise risk management strategy. Our risk management team oversees the program and regularly collaborates with our information security function, led by our Chief Information Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity and potential mitigations.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: We, like others in our industry, experience cybersecurity incidents and attempts to access our systems. In the event we experience an incident, we classify it based on its significance and track remediation actions and outcomes. Although we do not believe we have been materially affected by cybersecurity incidents or threats in the past, we cannot provide any assurance that we will not experience a material incident in the future. As described above, we utilize a risk-based approach to manage cybersecurity risk and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. See Item 1A. Risk Factors for additional discussion of our cybersecurity risks.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Tracking and measuring of the above certification processes takes place within our Information Security Program. This program reports on the risks and remediation progress across our information systems, as well as measures them against our own standards and processes, which have been developed in part using the National Institute of Standards and Technology Cybersecurity Framework 2.0. The Information Security Program also measures the overall cybersecurity program against other key regulatory standards such as the Payment Card Industry standard known as PCI 4.0 and the Sarbanes-Oxley Act of 2002.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: As of the date of this report, we have not experienced any cybersecurity incidents that have materially affected us, including our business strategy, results of operations, or financial condition. For certain risks from cybersecurity threats that may materially affect our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," including the section titled, "If our security measures or information we collect and maintain are compromised or publicly exposed, publishers, CPG brands, retailers, and consumers may curtail or stop using our platform, and we could be subject to claims, penalties, and fines."

companyName: Ibotta, Inc.

ticker: IBTA


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report.

companyName: Repare Therapeutics Inc.


text: Additionally, in Item 1A. Risk Factors, under the heading of Risk Related to Information Security and Business Disruptions, forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: Our information security team is led by our Chief Information Security Officer ("CISO"), who has served in the role since 2015 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors. The CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. The CISO attends each quarterly meeting of the RCOC to brief members on information security matters and discuss cybersecurity risks generally.

companyName: APPFOLIO INC

ticker: APPF


text: As part of our risk assessments, we engage third-party services for network penetration testing and security evaluations, conduct annual incident response table-top exercises, and perform regular testing of controls related to our financial information systems by our Internal Audit function.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: We may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.

companyName: GRAHAM CORP

ticker: GHM


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: Our cybersecurity program ("Cybersecurity Program") provides a framework for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with our regulators to ensure that these policies are adequately designed to appropriately safeguard personal information. We use a variety of processes and technologies to monitor for and identify cybersecurity threats, including vulnerabilities scans, endpoint and network monitoring software, and email scanning software. We also have a Cyber Incident Response Policy and detailed plans. We conduct annual cybersecurity risk assessments which drive strategic decisions. Employees are required to abide by our cybersecurity and data protection policies. We maintain a corporate cyber risk insurance policy as part of our cybersecurity risk strategy that is reviewed annually. To date, the Company has not experienced a material cybersecurity incident.

companyName: Citizens Community Bancorp Inc.

ticker: CZWI


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. These policies are found within our Compliance Manual and are the chapters "Cybersecurity, Privacy Protection, and the Prevention of Identity Theft" and "Business Continuity and Succession Planning" (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy is available upon request.

companyName: X1 Capital Inc.


text: We engage diligenced third parties as part of our cybersecurity program. On a periodic basis, we engage third-party auditors to assess our cybersecurity controls and procedures. We also engage reputable third-party security firms to conduct annual penetration tests of our physical and digital security. We then work to remediate critical vulnerabilities identified through these assessments.

companyName: Hamilton Lane INC

ticker: HLNE


text: When reviewing third-party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: For further information on risks to the Company from cybersecurity threats, see "System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation and other potential losses" under Item 1A. Risk Factors."

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis, which may identify additional risks or require additional costs to remediate.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition. As cybersecurity threats become more sophisticated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures. For additional information concerning risks related to cybersecurity, see Item 1A of this report, "Risk Factors – Risks Related to Our Business and Our Industry – A breach of our security systems may have a material adverse effect on our business."

companyName: AMBARELLA INC

ticker: AMBA


text: We continue to make significant investments in our information technology systems pursuant to our operations. We believe that these investments, including additional technology changes to implement our strategic plan, are essential to enhance our overall customer experience, to support our compliance, internal controls and efficiency initiatives, to expand our capabilities to offer new products, and to provide scale for future growth.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: Our information security team for UCTS is led by our President of Digital Strategy & Innovation ("PDSI"), who also serves as our CISO for UCTS. Our PDSI/CISO reports to our President, BRP & CEO, Underwriting, Capacity and Technology Operations. Our PDSI/CISO has served in the role since 2022 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams at Crum & Forster, QBE North America, QBE FIRST, N.E.W. Customer Service Companies, Inc. and Wipro Technologies. Our PDSI/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our PDSI/CISO also attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: We have prepared a written incident response plan and crisis management plan to enhance our ability to respond to cybersecurity incidents. We periodically conduct internal tabletop exercises to enhance incident response preparedness. Our employees are required to participate in regular cybersecurity awareness trainings upon hiring and on a quarterly basis thereafter.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: Reporting to Management and the Board of Directors Our IT Manager will provide regular updates to our CEO, Spyros Papapetropoulos, regarding all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks faced by Neuphoria. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: • The Company has cybersecurity operations and engineering capabilities that provide comprehensive monitoring to detect and respond to cyber threats and alerts and execute cyber incident response playbooks. This includes a vulnerability management program which identifies and drives remediation of risks. The Company employs a wide array of industry-leading security platforms and tools. • The Company has retained data security and data privacy legal counsel whose practices focus on data breach response, information security compliance, and compliance with the data privacy laws in the various jurisdictions in which the Company operates. • In addition, the Company engages specialized consultants and third-party managed service providers on a project-specific basis to assist it with projects that will improve the Company's IT infrastructure, strengthen its security posture and cyber incident investigations, and improve its cyber readiness.

companyName: Sleep Number Corp

ticker: SNBR


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Also see Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: Since September 2022, we have engaged a seasoned cyber consultant from a global cybersecurity risk firm to provide CISO-level advisory services to assist our technology teams, business leadership and Board of Directors with guidance and direction as we strengthen our security systems and improve our cyber readiness, as well as to provide insight and intelligence on existing and emerging threat landscapes. The scope of service includes reviewing our current information security policies, past and current security reports, cybersecurity program, and staffing models to assess our ability to prevent and respond to cyberattack incidents and mitigate any impacts they may have.

companyName: Century Communities, Inc.

ticker: CCS


text: This multi-layered approach has been integrated into the Company's overall risk management system and processes. Integrating cybersecurity risk management into the overall risk management system demonstrates the Company's commitment to addressing threats that could significantly impact its operations, financial stability, and reputation. This integration is intended to provide a holistic approach to risk management and helps in creating a more resilient organization against cybersecurity threats.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Our Chief Financial Officer and Head of IT are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Additionally, they are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: We maintain organizational safeguards that include employee training, business continuity planning and cybersecurity insurance. These safeguards are reviewed on an annual basis or more frequently as the business environment warrants and are adjusted as needed to account for changes in the Company and overall risk environment. Cybersecurity training is provided to employees through both online and classroom instructor led trainings.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: 4. Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: Butterfly Network, Inc. uses, stores, and processes data for and about our customers, employees, partners, and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: Our cybersecurity risk management program includes: physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third-party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;

companyName: Fold Holdings, Inc.

ticker: FLD


text: Cybersecurity threats pose a risk to the Company, as crimes committed through or involving the internet, such as phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into the Company's internal systems or the systems of the Company's third-party vendors could adversely impact the Company's operations or damage its reputation. The Bank manages cybersecurity threats proactively and maintains robust controls to protect its critical systems and data by investing in secure, reliable, and resilient technology infrastructure, fostering a culture of technology risk awareness, and continuously improving its technology risk management practices. The Company's process for monitoring and mitigating cybersecurity risk is designed in conjunction with its overall Enterprise Risk Management Policy. The Company's Information Security Program follows ISO 27002, an international standard for information security controls, as well as references to the Federal Financial Institutions Examination Council Information Examination Handbook, and other regulatory guidance and industry standards.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: The Company faces risks associated with cybersecurity, including operational interruptions, financial losses, personal information leakage and non-compliance risks. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors — We are subject to a variety of laws and regulations regarding cybersecurity and data protection, and any failure to comply with applicable laws and regulations, including improper use or appropriation of personal information provided directly or indirectly by our customers or end users, could have a material adverse effect on our business, financial condition and results of operations."

companyName: BAIYU Holdings, Inc.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see the risk factor in Part 1. Item 1A, including the risk factor entitled "Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access."

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: Our Vice President and Head of Information Technology and our cyber committee, which includes Facilities, HR, IT, Legal, and Management, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Vice President and Head of Information Technology has years of cybersecurity experience and expertise including holding numerous applicable cybersecurity certifications, such as ISC2 Certified Information Systems Security Professional (CISSP).

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: We are subject to various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; virtual and cyber threats to our directors, officers, and employees; and threats to the security of our infrastructure and assets. To mitigate the threats to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors, and have integrated these processes into our overall risk management systems and processes. We have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make investments as may be required to maintain the security of our data and cybersecurity infrastructure.

companyName: BTCS Inc.

ticker: BTCS


text: The Corporation's information security program is managed by its Data Protection Manager ("DPM") and its Information Technology Department (collectively, the "IT Team"). The DPM has extensive experience in cyber and global data protection initiatives with the Corporation and reports directly to the Corporation's Chief Executive Officer. The IT Team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: During 2023, there were no identified cybersecurity risks or threats, including as a result of previous cybersecurity incidents, that had, or were reasonably likely to have, a material effect on our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents or disruptions may not be fully insured. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. As such, we rely on our advisor's cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats. Our cybersecurity program, as implemented by our advisor and overseen by our board of directors, is integrated into our overall risk management system, and included as part of our information technology security incident response plan.

companyName: Strategic Realty Trust, Inc.


text: The GM Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing our cybersecurity program, among other things. The Company's cybersecurity organization is led by the CISO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to the Risk and Cybersecurity Committee. The CISO has served in this role since December 2024 and has more than 20 years of experience in various information technology, cybersecurity and software engineering roles. The CISO's experience includes building and leading cybersecurity functions at large enterprises, startups, and research and development centers, as well as leading software engineering teams responsible for building and operating large-scale software services. The CISO also has expertise in building and designing secure software, scalable and resilient systems, incident response practices, privacy programs and other critical security disciplines and practice areas. The CISO holds a master's degree in information security policy and management, has taught information security courses at the graduate level, is an inventor on cybersecurity-related patents and has been a speaker at leading cybersecurity conferences.

companyName: General Motors Co

ticker: GM


text: As part of our overall risk management program, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cybersecurity threats. We designed and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Cybersecurity Framework"). This does not imply compliance with specific technical standards, specifications or requirements of the NIST Cybersecurity Framework, but signifies its use as a guiding principle.

companyName: Knowles Corp

ticker: KN


text: SoundHound will report any cybersecurity incidents determined to be material. Material aspects of the nature, scope and timing of the incident, and the impact or reasonably likely impact of the incident on the Company, including on SoundHound's financial condition and results of operations will be disclosed.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we intend to take a comprehensive approach to cybersecurity risk management. Our Board and our management oversee our risk management program, including the management of cybersecurity risks. We plan to establish policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We intend to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to make investments to maintain the security of our data and cybersecurity infrastructure when feasible. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We do not believe that risks from prior cybersecurity threats have materially affected our business to-date. We can provide no assurance that there will not be incidents in the future or that future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Zapata Quantum, Inc.

ticker: ZPTA


text: The IT Security Steering Committee, which is in charge of our cybersecurity policies and procedures, including the ones discussed in "Risk Management and Strategy" above, is led by our Chief Financial Officer, who has eight years of senior leadership experience at public biotechnology companies, including five years with 89bio. The IT Security Steering committee also includes our Director of IT, who is an experienced Information Technology professional and has over 20 years of experience managing information technology, of which 10 years pertain to cybersecurity related experience.

companyName: 89bio, Inc.


text: Risk Management and Strategy CMC has established a comprehensive cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats to our computer systems, outsourced services, communications systems, industrial processing equipment, hardware and software, and to safeguard our data and our customers' data. Our risk management program includes a documented cybersecurity incident response plan and a data breach response plan (the "response plans") that outline how to respond to and contain incidents and data breaches. Additionally, we maintain a cybersecurity incident disclosure and evaluation plan (the "disclosure plan") which is used to assess the impact of a cybersecurity incident and promptly issue required SEC disclosures if needed. The response plans and disclosure plan are adapted based on the type of incident or data breach and are tested at least once per year. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our risk management program and engage third parties to regularly review our response plans.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: We work with third parties from time to time that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms and information technology consulting and support firms. To operate our business, we utilize certain third-party service providers to perform a significant portion of our critical functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. To address risks associated with third-party service providers, we will review and assess the cybersecurity controls of our third-party service providers and make changes to our business processes to manage these risks. This approach is designed to mitigate risks related to data breach or other security incidents originating from third-party service providers.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Our Chief Information Security Officer is the member of our management team that is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The Company's Chief Information Security Officer has served in various roles in information technology and information security for over 25 years. The Chief Information Security Officer holds an undergraduate degree in Business Administration with a major in Accounting and Finance and a graduate degree in International Management. The Chief Information Security Officer also holds advanced certifications as a Certified Information Systems Security Professional and as a Qualified Technology Executive granted by Digital Directors Network. The Chief Information Security Officer works in coordination with the other members of management, which includes, but is not limited to, the Company's President and Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, Chief Digital Officer, Chief Information Officer, and General Counsel. The Company's Chief Information Officer has served in various roles in information technology and information security for over 29 years. The Chief Information Officer holds an undergraduate degree in Electronic Engineering from DeVry University and graduate degree in Technology Management. The Company's Chief Technology Officer holds an undergraduate degree in computer science and economics from Northwestern and has served in various roles in information technology for over 33 years with Boyd Gaming and numerous other public companies. The Company's Chief Digital Officer has served in various roles in information technology and information security for over 25 years. The Chief Digital Officer holds a degree in political science with a minor in accounting from Belmont University. The Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.

companyName: BOYD GAMING CORP

ticker: BYD


text: Our board of directors (the "Board") in conjunction with the Audit Committee and members of management are actively involved in the oversight of our risk management program, of which cybersecurity represents a vital component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats, including but not limited to, our ability to sufficiently defend against all types of sophisticated tactics, techniques, and procedures ("TTPs") used by malicious nation-state governments sponsored cyberthreat activity We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.

companyName: PGT Innovations, Inc.


text: Although we believe we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. We have experienced targeted cybersecurity incidents in the past that have resulted in unauthorized persons gaining access to certain of our information systems, and we could in the future experience similar incidents. As of the date of this Form 10-K, no cybersecurity incident or attack, or any risk from cybersecurity threat, has materially affected or has been determined to be reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned. For further discussion of the risks associated with cybersecurity incidents, see "A failure of any of our information systems or those of our third-party service providers, or a data security breach with regard to personally identifiable information ("PII") about our customers or employees, could have a material adverse effect on our business, results of operations, financial condition and cash flows." beginning on page 27 of the section entitled "Item 1A. Risk Factors" in this Form 10-K.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: We are actively and diligently working to address and mitigate these gaps by enhancing our security controls and aligning them with our enterprise-wide cybersecurity strategy. This proactive approach ensures that our systems remain resilient and secure in an evolving regulatory and operational environment.

companyName: AIRGAIN INC

ticker: AIRG


text: The cybersecurity capabilities of third-party vendors providing system solutions to NEE or accessing NEE's systems or data, including those related to NEP, is evaluated as part of the new vendor establishment process. NEE retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or NEP's contracts with third-party vendors accessing their systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: The Company leverages internal auditors and independent external partners to periodically review processes, systems, and controls, including with respect to the Company's information systems and cyber security policy and program, to assess their design and operating effectiveness and make recommendations to strengthen the risk management program.

companyName: LAKELAND BANCORP INC


text: Disclosure of the Board ' s Roles and Responsibilities Our Board oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles. Additionally, our CISO and Chief Compliance Officer regularly report on cybersecurity matters to the Board, as discussed above.

companyName: AvePoint, Inc.

ticker: AVPT


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property, and we have experienced an unauthorized release of certain digital content assets. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of members and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors - Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including member and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."

companyName: NETFLIX INC

ticker: NFLX


text: Chief Executive Officer and Chief Financial Officer provide periodic briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and similar issues.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: In connection with the Company's review and approval for potential new vendors, the Company assesses the data types or Personally Identifiable Information that the vendor may maintain, store or access and reviews the adequacy of their cybersecurity procedures and legal protections. Legal counsel and the SVP, Chief Privacy Officer review the cyber and contractual protections and consider the overall risk profile considering the type of agreement, data involved, vendor, and jurisdiction, among other factors. Vendors deemed to have insufficient controls balancing the relevant criteria will not be approved.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") and AI Risk Management Framework. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Plymouth Industrial REIT, Inc.


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce the time it takes to detect a cybersecurity threat and improve our recoverability capabilities. These defenses include the ongoing monitoring of our systems (including with the assistance of third-party vendors), conducting response and recovery exercises with employees and senior management (including our executive officers) to promote awareness of related matters and improve internal processes, and engaging with external cybersecurity rating agencies that assess our cyber risk. In addition, to help promote privacy and security awareness throughout the company, the CISO maintains a Cyber Awareness and Engagement Program. As part of this program, all employees with a Baxter email address receive annual training on the recognition and prevention of cybersecurity threats as well as training on how to report suspicious activity or potential breaches through the appropriate channels. Our Cyber Awareness team communicates cybersecurity best practices to our employees through internal communications, including the company intranet, newsletters and global virtual seminars, and also hosts ongoing cybersecurity awareness campaigns, including phishing simulations. Further, our Third-Party Risk Management Program utilizes a managed service that uses a standard framework to help identify, assess and monitor potential cybersecurity risks posed by third parties. Third-party cybersecurity risks (including reputational ones) are assessed by evaluating the third party's security practices (including those associated with data protection), compliance with applicable regulations and planning associated with business continuity and incident detection and response.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan; incident detection and response tools; risk assessments of certain environments and systems; encryption of certain data; network security for certain environments and systems; access controls for certain environments and systems; data segregation of certain data; access controls; physical security; asset management; third-party systems monitoring; employee cybersecurity training; and cybersecurity insurance.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: EnLink faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We have not been subject to cybersecurity incidents that have materially impaired our operations or had a material adverse effect on EnLink's business, financial condition or results of operations. For additional discussion of our cybersecurity risks, see "Risk Factors–Business and Industry Risks–A failure in our computer systems or a terrorist or cyberattack on us, or third parties with whom we have a relationship, may adversely affect our ability to operate our business."

companyName: EnLink Midstream, LLC


text: The Chief Information Officer ("CIO") is the management position with primary oversight responsibility for the team responsible for the development, operation, and maintenance of our information security program. Pursuant to the Company's written IRP, the CIO is a member of the executive incident response team and severity classifications in the IRP are used to escalate matters to the executive incident response team. The CIO has more than 20 years of comprehensive IT experience across a breadth of technologies. The CIO is also a member of the Company's executive leadership team and meets regularly with the CEO, CFO, and other members of the executive leadership team. The CIO reports directly to the Board, at least twice a year, on cybersecurity risks and strategy and attends Board meetings to be available to discuss cybersecurity matters with the Board. Oversight of the information security program at the Board level sits with the Audit Committee. The CIO reports to the Audit Committee on risks and internal controls related to cybersecurity and information technology and systems at least annually and attends quarterly Committee meetings to be available to discuss such matters with the Audit Committee.

companyName: LA-Z-BOY INC

ticker: LZB


text: The Company's processes to assess, identify, and manage material cybersecurity risks We developed an ISO/IEC 27001-certified Information Security Management System ("ISMS") designed to enhance our corporate security measures, identify and mitigate information security risks, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by the Company and that of its customers and suppliers in our control. Our ISO certification can be verified on the BSI Group website using certificate number IS 649202.

companyName: TELOS CORP

ticker: TLS


text: Identification of assets at risk from cybersecurity threats Identification of potential sources of cybersecurity threats Assessment of the status of protections in place to prevent or mitigate cybersecurity threats Given that landscape, how to manage cybersecurity risks

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Roles and Responsibilities of Management Our cyber security team, which reports to the Vice President - Technology, has primary responsibility for cybersecurity strategy and assessing cyber risk. The Vice President - Technology is responsible for informing the Chief Executive Officer and other Officers, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cyber security team. Collectively, our cyber security team holds numerous industry certifications related to cybersecurity and have experience in desktop support, networking, application administration and programming.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: Our Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, the CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews the our programs and processes related to information security, third-party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.

companyName: Level 3 Parent, LLC


text: The Corporate Risk Governance Committee receives quarterly reports on the Company's overall cybersecurity risk exposure including the individual top cybersecurity threat scenario residual risk ratings and the plan and status of the cybersecurity risk program, to facilitate calibration with other enterprise risk domains and validation of the risk response plans. The Corporate Risk Governance Committee includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), General Counsel ("GC"), Senior Vice President Operations, and our Chief Digital & Information Officer ("CDIO").

companyName: Philip Morris International Inc.

ticker: PM


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any previous cybersecurity incidents; however, we cannot assure that cybersecurity threats will not be material to us in the future. During the three fiscal years presented within this Form 10-K, we have not experienced a known material information security breach nor incurred material breach-related expenses. For a detailed discussion of significant risk factors regarding cybersecurity threats, see Item 1A — "Risk Factors — Risks Related to Information Systems and Data Security."

companyName: RALPH LAUREN CORP

ticker: RL


text: We follow a zero-trust architecture approach and enforce the use of multi-factor authentication and virtual private network technologies for all external access to provide secure support for our remote workers. Information security training is part of our compliance program, and includes mandatory security training for new hires, mandatory yearly security training for all staff, and regular phishing tests to raise awareness and response actions.

companyName: ALBEMARLE CORP

ticker: ALB


text: We also work with trusted and recognized third parties to help us assess, strengthen and monitor the operations of our information security program. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also share and receive threat intelligence with information sharing and analysis centers and cybersecurity associations.

companyName: AtriCure, Inc.

ticker: ATRC


text: The Company consistently identifies and evaluates cybersecurity threats that could significantly impact our business strategy, financial condition, and operational results. As of fiscal 2024 year-end, no significant cybersecurity threats or incidents have materially impacted our strategy or operational results.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: When an incident is reported, the CIRT determines the scope, scale and severity of the event and determines if the event is an incident. When the CIRT has determined an incident has occurred, the team is responsible for responding to such incident in a timely, cost-effective manner and reporting findings as necessary and appropriate, including communicating to other key stakeholders for the duration of such incident. In general, the CIRT reports such findings to the CISO, the CISO reports the information to the Chief Risk Officer ("CRO"), and the CRO ultimately reports those findings to the Risk Committee.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: Our CISO plays the key management role in assessing and managing our material risks from cybersecurity threats. The CISO also works closely with AT&T Legal to oversee compliance with legal, regulatory and contractual security requirements. The CISO has extensive technical leadership experience and cybersecurity expertise, gained from approximately 20 years of experience, including serving as the Chief Information Security Officer and Director of the Office of Cybersecurity at a U.S. government agency, in addition to serving as the Chief Information Security Officer of two large public companies. Prior to that, he served for 20 years in the U.S. military, in various information technology roles of increasing seniority. The security professionals in the CSO have cybersecurity backgrounds and expertise relevant to their roles, including, in certain circumstances, relevant industry certifications.

companyName: AT&T INC.

ticker: T


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: There is an established Incident Response Program ("IRP") that provides a framework for us to respond quickly, decisively, and appropriately to limit the impact of an adverse event, such as a cybersecurity incident, on customers and information resources. Procedures have been developed that outline the necessary steps should an incident occur, such as incident identification, classification, and escalation. We use a Cybersecurity Assessment Tool to assess our cybersecurity preparedness on a periodic basis. A Cybersecurity Incident Response Team, which is part of our general Incident Response Team, will take the appropriate actions as outlined in the IRP in the event a cybersecurity situation occurs.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Third-Party Cyber Risk Management Recognizing the potential vulnerabilities posed by third-party relationships, Kroger has implemented a comprehensive TPCRM program. The TPCRM program is designed to assess third-party cybersecurity risks by employing third-party risk assessments, vendor tiering, and a dedicated team tasked with recommending holistic improvements to strengthen Kroger's cybersecurity posture, sourcing, and contracting processes. Kroger's Information Security Operations Center ("iSOC") responds to known third-party incidents on a continuous basis. The iSOC is a part of the Corporate Information Security ("CIS") department and is responsible for detecting, responding to, and escalating security incidents. We partner directly with business stakeholders and technology custodians to determine an appropriate response to manage incident risk to minimize the effect to the business. This response process is a regular and critical function of the iSOC and is defined in a separate appendix to the IR Plan. Any material risk identified from these incidents is escalated and communicated using formal severity and impact criteria as defined in the IR Plan.

companyName: KROGER CO

ticker: KR


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factors within "Item 1A. Risk Factors" in this Form 10-K.

companyName: Oil-Dri Corp of America

ticker: ODC


text: Our Board of Directors is responsible for overseeing our cyber risk. Our Vice President, Information Technology or other members of our information technology group provide at least semi-annual in-person updates to the Board that encompass a broad range of topics, including: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; and • Compliance status and efforts with regulatory requirements and industry standards.

companyName: LGI Homes, Inc.

ticker: LGIH


text: from Cybersecurity Threats have no t encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such an incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section Governance

companyName: Birdie Win Corp

ticker: BRWC


text: Our New Manager, through Rithm, maintains a comprehensive cybersecurity program and regularly assesses any risk of cybersecurity threats. In doing so, Rithm continuously monitors and tests our information systems for potential vulnerabilities pursuant to our cybersecurity program. Rithm's cybersecurity program is led by its interim Chief Information Security Officer ("CISO") and is part of its overall enterprise risk management program.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: In the event of a cybersecurity incident, our initial focus is to contain the cybersecurity incident as quickly as possible consistent with our incident response plan. Once a cybersecurity incident is contained, we focus on remediation and recovery activities which depend on the nature of the cybersecurity incident. We have relationships with third-party providers to assist with cybersecurity containment and remediation efforts, including for example forensic investigations, and incident response management. If a cybersecurity incident materially impacts us, or is expected to materially impact us, we promptly notify senior management, the Franklin Board of Directors ("Board") and/or Franklin Audit Committee, as appropriate based on the severity of the incident. Our response plan also addresses engagement with appropriate individuals and committees with respect to disclosure determinations related to cybersecurity incidents. We review and, if necessary, update our cyber security incident response plan at least annually.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: Risk Management Strategy Our business is dependent upon our information technology ("IT") systems, devices and networks to collect, process and store the data necessary to conduct our business and record and report our business and financial information. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our IT systems and protect the confidentiality, integrity, and availability of our confidential and personal data, including with respect to our customers, suppliers, and employees, as well as our intellectual property.

companyName: TECOGEN INC.

ticker: TGEN


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The Nominating and Enterprise Risk Management ("NERM") Committee of the Board of Directors specifically assists the Board in its oversight of risks related to cybersecurity. In accordance with its charter, the NERM Committee receives regular reports at each of its quarterly meetings from management, including the SVP, Operations. Such reporting includes updates on the Company's cybersecurity program, information security matters, the evolving cybersecurity threat environment, applicable privacy law compliance, and the Company's mitigation plans and evolving mitigation strategy. The Chair of the NERM Committee regularly reports to the Board of Directors on cybersecurity risks and other related matters. In addition, both the NERM Committee and the Audit Committee, in a joint meeting, receive an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. Management reports to the NERM Committee and/or the Board of Directors in between meetings as appropriate regarding any significant cyber events.

companyName: Zevia PBC

ticker: ZVIA


text: Our Board of Directors is responsible for overseeing our cyber security risk management and strategy. Our senior leadership, including our Chief Financial Officer and controller, regularly meets with and provides periodic briefings to our Board of Directors regarding our company performance and risk management, which include reports of any cybersecurity incidents and improvements and strategy of the Company's cybersecurity risk management. The Audit Committee of the Board of Directors will regularly review cybersecurity requirements and risks on a quarterly basis.

companyName: Kuvatris Therapeutics, Inc.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks and address any identified gaps in existing safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity program is delegated to our Senior Director, Head of IT, who reports on IT operations, risk mitigation and assessment efforts, and other general cybersecurity matters to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, audits, and threat intelligence feeds to facilitate and promote program effectiveness.

companyName: FIRST OF LONG ISLAND CORP


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Cybersecurity measures that pertain specifically to Company's Boot Hill subsidiary have been delegated to Boot Hill's Board of Managers, a committee comprised of directors and officers of the Company and officers of Boot Hill. This committee is responsible for ensuring compliance with Kansas Racing and Gaming Commission regulations.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and commercially sensitive or confidential information. Our business depends on the proper functioning and availability of our information technology platforms, including communications and data processing systems. We are also required to effect electronic transmissions with third parties including clients, vendors and others with whom we do business, and with our Board. We also recognize that, as we continue to increase our dependence on information technologies to conduct our operations the risks associated with cybersecurity also increase.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: Our Audit Committee receives an annual briefing regarding our company's cybersecurity risks and activities, including the status of cybersecurity system development, company-wide cybersecurity training programs, material changes to the cybersecurity system, policies or practices, any recent cybersecurity incidents and related responses, cybersecurity systems testing and engagement of third-party service providers in support of our cybersecurity system. Special meetings may also be called with the Audit Committee to brief the members on any material cybersecurity incidents and related responses thereto. After such briefings, our Audit Committee will provide an update to the Board on such reports. In addition, the Board will receive periodic updates in meeting materials or directly from our Senior Vice President, Finance on cybersecurity risks and activities.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: Our secondary custodian is Coinbase Inc., a subsidiary of Coinbase Global, Inc., a Delaware corporation, which is primarily used for the acquisition of digital assets. On May 5, 2025, the Company entered into an Institutional Client Agreement with Coinbase (the "Coinbase Agreement"). The Coinbase Agreement is terminable at will by either the Company or Coinbase. The Company pays Coinbase its regularly scheduled fees based on the dollar trading volume over a thirty-day period. The Coinbase Agreement is terminable by either the Company or Coinbase on ten days' notice as a result of a breach of the Agreement and may be suspended by Coinbase if the Company violates the intended use of the account or due to a change in the applicable law, governmental proceeding, litigation or bankruptcy. Coinbase may also close the Company's account if it has been inactive for more than one year.

companyName: UPEXI, INC.

ticker: UPXI


text: The Company engages third parties to perform periodic assessments of certain aspects of our cybersecurity measures, including vulnerability assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Nominating and Governance Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: The Information Security group, senior leadership and the CISO are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Information Security Program. At least quarterly, the CISO provides updates to the Audit, Risk and Finance Committee, which includes updates on the overall Information Security Program status and compliance, cybersecurity related risks, and recommended changes to the Information Security Program. Senior members of our Information Security and Internal Audit functions also provide detailed, regular reports on information security and privacy to the Audit, Risk and Finance Committee.

companyName: Root, Inc.

ticker: ROOT


text: The Company's Board is responsible for overseeing cybersecurity risk management as part of its oversight of the Company's enterprise risk management framework. The Board receives periodic updates from management on cybersecurity strategy, risk assessments, and significant developments but is not involved in day-to-day operational decision-making. The Company's management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, risk management, and compliance. Additionally, our Cybersecurity Committee, which is composed of certain of our executive management, legal and operations leaders, provides sponsorship and guidance to help achieve our management objectives. Our Chief Information Security Officer ("CISO") reports to our CTO and assists in the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security management systems.

companyName: IBEX Ltd

ticker: IBEX


text: Our Michael Farkas, who has cybersecurity knowledge and skills, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at the Company.

companyName: Balance Labs, Inc.

ticker: BLNC


text: Our assessment and management of material risks from cybersecurity threats will be integrated into the Company's overall risk management processes. For example, our Information Security Management committee will evaluate material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: SunPower Inc.

ticker: SPWR


text: The Company has what it believes are appropriate physical, technical, and administrative controls in place that are designed to protect customers' data. However, as previously disclosed, on May 4, 2022, the Company determined that certain of its information technology systems were affected by ransomware impacting certain internal systems. Upon detecting the security event, the Company took immediate steps designed to contain the incident and implement its business continuity plans to restore and support continued operations. Subsequently, the Company contained the incident and restored substantially all of its critical information technology systems.

companyName: OMNICELL, INC.

ticker: OMCL


text: IT Manager and our IT Administrator oversee our information security program and lead our information security team. Our IT Manager has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over ten years of experience leading cross-functional organizations in the development and operation of large-scale systems.

companyName: GIFTIFY, INC.

ticker: GIFT


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, among other things: incident response, identity and access management, vulnerability management, logging and systems monitoring, disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls for certain systems; data segregation and access controls for certain systems; physical security measures; asset management; annual employee training; certain testing; and IT and software development lifecycle training. NetScout also employs certain proprietary detection tools, enabling enhanced visibility and warning systems in response to certain cybersecurity threats.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Cybersecurity is incorporated into our overall business strategy as cybersecurity risks may have a negative impact on our business as outlined within "Item 1A, Risk Factors." Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and security incidents of our and our third-party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."

companyName: Toast, Inc.

ticker: TOST


text: The Company engages third party vendors to periodically test, monitor and maintain the performance and effectiveness of the Company's cyber risk program. In addition, in 2023 the Company participated in a comprehensive third-party cyber risk review as part of its annual insurance renewal process and consideration of cyber risk coverage.

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the board of directors.

companyName: AMERICAN BATTERY TECHNOLOGY Co

ticker: ABAT


text: The Information Security teams include experienced, highly qualified architects, engineers and analysts who support all aspects of cybersecurity including security architecture, identity and access management, vulnerability management, security operations, as well as governance, risk and compliance. The majority of the Information Security staff holds at least one cybersecurity-related certification.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: We believe we have implemented a cybersecurity program that is aligned with the ISO 27001 framework, SEC regulations, and industry best practices. It is our goal to identify and manage material risks related to cybersecurity and implement effective controls and measures to mitigate such risks. The Board endeavors to provide effective oversight and governance of our cybersecurity program and ensure that our cybersecurity program supports our strategic objectives and risk appetite.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: We have continued to expand investments in information security and cybersecurity, including providing additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging third-party cybersecurity experts. For example, in 2023, the Bank engaged a third-party cybersecurity consultant to conduct a review of the Company's information security and cybersecurity program in relation to overall threat trends and specific factors affecting the Bank's cyber risk profile. The review assisted management in enhancing the Company's cyber-risk reduction efforts, including updating Bank's cybersecurity strategy and program. The Company also maintains cybersecurity insurance provided by carriers that can provide additional technical, legal, and consultation services in the event of a security event that requires additional staff or expertise, including attorneys, forensic accountants, and public relations professionals, among others. In addition to assessing our own cybersecurity preparedness, we also identify, evaluate and manage cybersecurity risks associated with use of third-party vendors and service providers. Our third-party risk function conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. Our information security area regularly reviews third-party vendors and service providers, including their System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor or service provider is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess its cybersecurity preparedness and assess our relationship on that basis. The frequency and granularity of our review of third-party vendors and service providers is based on an assigned risk rating for each third-party vendor and service provider. Our assessment of risks associated with use of third-party vendors and service providers is part of our overall cybersecurity risk management framework.

companyName: SouthState Bank Corp

ticker: SSB


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors, including: "We are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse business consequences."; and "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, interruptions to operations or clinical trials, reputational harm, litigation, fines and penalties, disruptions of our business operations, and a loss of customers or sales."

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: We identify, assess and manage material risks from cybersecurity threats by following written policies and procedures, which are in compliance with the International Organization for Standardization (ISO) 27001 Information Security Management System. The output of this process is then integrated with our enterprise risk management (ERM) program. The ERM program is managed by our Chief Operating Officer (COO), with input from various representatives across our business operations, and is used to assess risks to our business based on their potential likelihood and magnitude of impact. Our information technology organization provides the inputs to our ERM process related to material cybersecurity risks and mitigation plans. The information technology team is responsible for the prevention, detection, mitigation and remediation of cybersecurity incidents. Cybersecurity incidents are documented and triaged in accordance with a defined process. Incidents deemed to be significant are escalated to the Audit Committee of our Board of Directors after appropriate assessment by the information technology organization and other internal stakeholders. In the event an incident highlights an emerging or previously unidentified cybersecurity risk, such risk is then synthesized into the ERM process.

companyName: REGENXBIO Inc.

ticker: RGNX


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet periodically to develop strategies designed to preserve the confidentiality, integrity and availability of Company and customer information, identify, prevent and mitigate cybersecurity threats, and to attempt to effectively respond to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in an informed and timely manner.

companyName: Skillz Inc.

ticker: SKLZ


text: Risk Management and Strategy Managing Material Risks and Integrated Overall Risk Management Flywire has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our security and risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Flywire Corp

ticker: FLYW


text: PMI relies heavily on the availability, reliability, and security of our information systems, networks, data, and intellectual property to, among other things, help manage our business processes and operations, collect and interpret data, and communicate internally and externally with employees, suppliers, consumers and customers, and business partners. We have a cross-functional cybersecurity risk program developed using standard industry practices, which monitors and manages cybersecurity threats to our business and information systems. We invest in administrative, technical, and physical safeguards, including continuity planning, to enhance resilience on our core processes, to maintain information security protections of our data and to safeguard the privacy of consumers, customers, employees and business partners.

companyName: Philip Morris International Inc.

ticker: PM


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. Our cybersecurity risk management program includes: • annual external and internal penetration tests to help identify material cybersecurity risks to our critical systems, information and our broader enterprise IT environment; • a security team that includes internal IT and data privacy personnel and external managed services partners, principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including: • annual external and internal penetration tests; •24-hour monitoring of our networks and cloud resources to help detect, respond to and recover from cyber-attacks;

companyName: Avidity Biosciences, Inc.

ticker: RNAM