text: Incident Management The Company maintains and tests a cybersecurity incident response plan that outlines steps for the containment, investigation of, response to and recovery from cyber events. The plan also includes information pertaining to roles and responsibilities, escalation, third party support, documentation, reporting, and law enforcement engagement. Escalation is designed to raise awareness of events that may require disclosure to help ensure assessments are performed without unreasonable delay. In alignment with our plan, we maintain playbooks that outline processes for responding to certain incidents commonly observed in the insurance industry. In addition, we have implemented a formal crisis management process, which outlines an incident response communication plan with executive leadership as well as criteria for communication with the chair of the Audit Committee and the Lead Director of the Board.

companyName: GLOBE LIFE INC.

ticker: GL


text: The Board of Directors is responsible for overseeing management's development and execution of the Company's risk management process. Risk management is administered by a senior management team called the Management Enterprise Risk Committee (MERC). Periodic risk assessments are performed to identify technical and physical risks to information systems. These risk assessments identify internal and external threats that could cause a cybersecurity incident, assessing the likelihood of potential impact of those threats, and assessing the measures and controls in place to manage the risks. As per FFIEC guidance, a Change Management Policy and Committee are in place to manage changes to technology and systems. Information Security is a member of this Committee to evaluate changes for information security impact.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV

secItem: Item 1C


text: Our IT Director leads our dedicated Information Technology team ("IT team"), which executes on our data privacy and security programs and policies, and our Cyber Incident Response Team ("IRT"), which executes on our incident response procedures in the event of a data privacy or security event and conducts annual exercises simulating cybersecurity and data breach incidents. The IRT is comprised of internal members from the finance, legal, human resources, and operations departments, as well as external cybersecurity vendors and advisors. The members of our IRT understand the complexities of our business and are experienced in the financial, legal, regulatory and operational consequences of a cybersecurity incident or threat to the Company.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: The audit committee receives periodic reports from our CFO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: IN8BIO, INC.

ticker: INAB


text: Management Oversight The Bancorp's Information Security Governance Committee ("ISGC") is a management committee that reviews and discusses critical information security risks that impact the Bancorp, identifies solutions to address these risks and has oversight of the Bancorp's information technology and information security policies. The ISGC provides cybersecurity reports periodically to the Risk and Compliance Committee and is comprised of the Bancorp's senior information security, information technology and enterprise risk management leaders, including the Chief Information Security Officer ("CISO"), Chief Information Officer, Chief Technology & Information Security Officer, Chief Data Officer and Chief Operational Risk Officer. The ISGC's membership enables the ISGC to be informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, if any, in accordance with the Bancorp's incident response plans.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Our Board of Directors has direct oversight over key risks that are broadly applicable across NuStar's businesses, including cybersecurity risk management. At each regularly scheduled meeting of the Board, the Board receives reports from our President and Chief Executive Officer (CEO) and Senior Vice President–Chief Information Officer and Controller (CIO) regarding our cybersecurity program. These reports include (i) regulatory updates, which include information on regulatory initiatives promulgated by governmental agencies and our compliance with such initiatives, and (ii) quarterly metrics and data, which include information on employee training, threats, incidents, preventive practices (e.g., patch installation), tabletop exercises, cybersecurity policies and cybersecurity program resources, risks and controls.

companyName: NuStar Energy L.P.


text: We have established a cybersecurity program, informed by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), that is designed to safeguard our information systems against cybersecurity threats. This program incorporates a variety of processes and cybersecurity tools designed to assess, identify and manage material risks from cybersecurity threats.

companyName: Affirm Holdings, Inc.

ticker: AFRM


text: Candel has implemented cybersecurity risk management processes that are informed by industry standards in accordance with the scale of our business. Our cybersecurity risk management processes are designed to assess, identify and mitigate risks from current and emerging cybersecurity threats.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to prevent data loss and other security breaches. We also only use third party software for accounting, billing and payroll that have successful SOC 1 type 2 compliance. Both management and the Board are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: American Clean Resources Group, Inc.

ticker: ACRG


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Onex Corp. and its affiliates in managing these risks, see "Item 1A. Risk Factors— Risks Related to Our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information" for a discussion of risks from cybersecurity threats." in this Annual Report on Form 10-K.

companyName: Onex Direct Lending BDC Fund


text: As of the time of filing, there are no known cybersecurity threats that have materially affected, or are reasonable likely to materially affect the Company, including its business strategy, result of operations, or financial conditions. The Company pro-actively monitors for cybersecurity threats and responds accordingly to minimize its exposure to such threats.

companyName: Santander Holdings USA, Inc.


text: Employee Training and Awareness Recognizing the importance of human factors in cybersecurity, the Company invests in employee training and awareness programs. Our efforts are particularly focused on common threats, such as phishing attacks, and we require all employees to complete annual cybersecurity training to stay informed about emerging and evolving cybersecurity threats.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: O ur CRMP is integrated into our overall enterprise risk management program. We have designated our Senior IT Manager to oversee the implementation and maintenance of the IRP for Graham Corporation. For BN, we have designated BN's IT Manager to implement and maintain the IRP for BN. Our IT personnel at Graham Corporation and BN have over 50 years of combined experience in the field of cybersecurity and are responsible for the management of our cybersecurity and data privacy programs. Among other information security duties, the Senior IT Manager and IT Manager are responsible for the following for Graham Corporation and BN, respectively: • implementing the IRP; • identifying and managing an incident response team ("IRT") principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, appropriately escalate, make decisions regarding, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on identified cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; and • periodically reviewing the IRP whenever there is a material change in our business practices that may reasonably affect its cybersecurity incident response procedures.

companyName: GRAHAM CORP

ticker: GHM


text: The Company has entered into agreements with third parties for hardware, software, telecommunications, and other information technology services in connection with our operations and is exploring other third-party vendors to support our cybersecurity needs.

companyName: Medicine Man Technologies, Inc.

ticker: SHWZ


text: Risks from Material Cybersecurity Threats We and our third-party service and merchandise providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Form 10-K, we are not aware of any risks from actual cybersecurity incidents that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. It is possible that there have been intrusions into our systems that have not been identified by our controls and procedures and that might manifest in significant events at a later time. There can be no guarantee that the actions and controls we and our third-party service providers have implemented and are implementing will be sufficient to protect our systems, information or other property. See "Risk Factors" in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, forensic investigators, dark web monitoring services, and professional service firms, including legal counsel.

companyName: Confluent, Inc.

ticker: CFLT


text: Consistent with overall policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company conducts global clinical trials. As a consequence, we have global cybersecurity threat operations function 24/7, with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, and other key business functions, third party vendors, as well as the members of the Board through the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, the Company's Vice President, Information Technology, other members of management and relevant management committees and councils.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Recognizing the importance of cybersecurity to the success and resilience of our business, our Board of Directors considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our CAO meets regularly with the Information Technology department ("IT department") which includes individuals who possess extensive experience in information technology and cybersecurity. The IT department reports directly to the CAO and is responsible for managing the Company's cybersecurity initiatives, including technical risk assessments, implementation of controls, and response to cybersecurity incidents. The IT department has significant expertise in IT systems and cybersecurity, enabling the Company to respond effectively to cybersecurity risks and incidents.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: Our cybersecurity risk management program includes but is not limited to the following: • risk assessments performed both internally and by external vendors to assist in the identification of material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise Information Technology (IT) environment; • contracting with and use of third-party service providers, where deemed necessary, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees; • adoption of a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for selecting and working with key service providers, suppliers, and vendors that utilizes our internal assessment of their criticality to our operations and their respective risk profiles.

companyName: PRICESMART INC

ticker: PSMT


text: We conduct risk assessments to identify potential cybersecurity threats and vulnerabilities. This includes evaluating the likelihood and potential impact of various threats, such as data breaches, malware attacks, and insider threats. Based on these risk assessments, we develop and implement risk management strategies to mitigate identified risks.

companyName: GT Biopharma, Inc.

ticker: GTBP


text: We maintain a detailed incident response plan to manage cybersecurity incidents when detected. The response plan includes procedures for identifying, containing, and responding to cybersecurity incidents. Our ability to respond to cybersecurity incidents is tested on a recurring basis.

companyName: Sonos Inc

ticker: SONO


text: Cyber Risk Management and Strategy We have processes for assessing, identifying and managing cybersecurity risks, which are informed by industry standards and built into our overall enterprise risk management function and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: We continuously strive to surpass industry best practices by implementing robust risk-based controls aimed at safeguarding both our partners' and the Company's information systems. In order to protect both commercial and defense-related businesses and support our production operations, the Company has adopted security principles in accordance with the National Institute of Standards and Technology Cybersecurity Framework, contractual requirements and other global standards. We conduct comprehensive annual security assessments, including external and internal penetration tests, social engineering attacks, and vulnerability assessments. These assessments provide critical insights into our security posture and help us identify and address potential weaknesses proactively. Leveraging the expertise of multiple vendors, we ensure a thorough evaluation from diverse perspectives, enhancing the effectiveness of our security measures. Furthermore, as we implement solutions, we engage with industry-leading partners to receive guidance on best practices for solution use and overall security. This collaboration ensures that our cybersecurity strategies align with the latest industry standards and best practices. We also maintain regular communication with external partners to stay abreast of current cybersecurity trends and emerging threats. This proactive approach enables us to continuously enhance our security posture and adapt our defenses to evolving cyber risks.

companyName: ASTRONICS CORP

ticker: ATRO


text: Our information security management system is based upon industry frameworks including but not limited to ISO 27001 and NIST Cybersecurity Framework. Our Chief Information Security Officer (CISO) leads our cybersecurity program, which includes the implementation of controls designed to align with these industry frameworks and applicable statutes and regulations. Our CISO has over 30 years of prior work experience in various roles involving managing information security programs, developing cybersecurity strategy, implementing effective information and cybersecurity initiatives and has been the Head of IT Audit, CISO and CIO at three other companies prior to Gen Digital. He has a Bachelor of Science in Computer Information Systems. We have implemented security monitoring capabilities designed to alert us to suspicious activity and developed an incident response program that includes an annual table top exercise and is designed to restore business operations quickly. In addition, employees participate in mandatory annual training and receive communications regarding the cybersecurity environment to increase awareness throughout the company. We also implemented an enhanced annual training program for specific specialized employee populations, including secure coding training.

companyName: Gen Digital Inc.

ticker: GEN


text: Advisor and its affiliates have a technology team, under the leadership of the Director of Information Technology, who has over 20 years of technology management experience, which defines a work plan designed to maintain strong cybersecurity maturity, sets improvement objectives of key controls and systems, including feedback from third-party assessments, and identifies and implements on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of this planning, management conducts regular testing of our incident response plan to increase awareness, establishes key decision-making criteria, ensures effective communication among key stakeholders, and complies with our disclosure obligations.

companyName: Lightstone Value Plus REIT IV, Inc.

ticker: LTSV


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. While we believe we maintain an effective cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors; A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business and operations."

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our Cyber Security team holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.

companyName: Enviva, LLC


text: Our Information Security program is guided by the ISO/IEC 27001:2022 principles and led by a global-level Information Security Department that develops our security policies, standards and procedures. We seek to evolve our approach to protect against increasing and changing security threats around the world.

companyName: TransUnion

ticker: TRU


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Mr. Patterson. Ms. Randis works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.

companyName: Gamida Cell Ltd.


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. Our Board of Directors has direct oversight of our management of cybersecurity risks.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: The Company's cybersecurity management team is responsible for assessing and managing the Company's material risks from cybersecurity threats, including implementing the Cybersecurity Plan. The team includes the Company's Chief Technology Officer and Vice President of Information Technology (the "CTO"), the Director of Information Security and Cyber Operations, Manager of Cyber Security Operations and two Cyber Operations Engineers, all of whom have an educational background relevant to, professional experience in, or other expertise in cybersecurity. This team is supported by the Company's Information Technology department. The CTO holds a Master of Business Administration and a Bachelor of Science in Electrical Engineering with over 30 years of professional experience in the utility industry with extensive management experience in engineering, operations and information technology. The CTO also assumes responsibilities as the Company's Chief Information Security Officer and Chief Cyber Security Officer. The CTO has overall management responsibility for the Company's cybersecurity. The CTO reports to the Company's Chief Executive Officer. The Director of Information Security and Cyber Operations holds a Bachelor of Science in Computer Science and a Masters Certificate in Cyber Security with a concentration in Power Systems and has over 30 years of experience in the information technology field. The Director of Information Security and Cyber Operations has primary responsibility for the cyber security program including threat and vulnerability management, vendor security posture assessment, Industrial Control System (ICS) and SCADA infrastructure cyber security protection at electric substations and natural gas plants, as well as leading the Cyber Incident Response Team. The Manager of Cyber Security Operations has a Bachelor of Science in Information Technology and over 20 years of experience in various information technology and cyber roles.

companyName: UNITIL CORP

ticker: UTL


text: Data privacy issues are becoming increasingly significant due to the rapidly changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment in our information technology and employee training, and will continue to impact our business.

companyName: Bannix Acquisition Corp.


text: We have implemented a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Digital Locations, Inc.


text: Collaboration, Education, Incident Response and Recovery Planning Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents, including assessing the severity of a cyber incident, which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.

companyName: SPX Technologies, Inc.

ticker: SPXC


text: We deploy online cybersecurity training for employees and consider this a critical step in safeguarding the Company's data and assets. The training provides employees with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The training techniques to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide include insider attacks, phishing and email attacks and data protection. Employee completion of cybersecurity training is tracked and monitored via an online administrative portal.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: Board and Management Oversight Our chief information officer ("CIO") and chief information security officer ("CISO") have primary responsibility for assessing and managing material cybersecurity risks. Quarterly cybersecurity updates are provided to executive leadership to review security key performance indicators, identify security risks, and assess the status of approved security enhancements, and risk mitigation strategies. Our CIO has served in various roles in information technology and information security for over 30 years, including serving as the CIO of three other companies. Our CIO holds an undergraduate degree in computer science. Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations. Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Audit Committee receives regular cybersecurity risk reports from management and, at least annually, our Board receives reports from management, including our CIO and CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.


text: We maintain robust cybersecurity threat procedures, which includes escalating threats to the appropriate level of risk management, mitigation, remediation and the assessment of materiality of cybersecurity threats, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We disclose information regarding our cybersecurity and privacy program and practices on our website and in our public-facing notices.

companyName: Certara, Inc.

ticker: CERT


text: Our CEO in conjunction with our external IT team are responsible for setting the strategy and communicating cybersecurity risks. With the Company's distributed model of data storage, risks have been limited and the Company has not experienced a cybersecurity breach. The Company's security measures and monthly system audits to identify potential vulnerabilities and remediate deficiencies in real time.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. Senior management regularly discusses cyber risks and trends and, if they should arise, will discuss any material incidents with the Audit Committee.

companyName: Compass Group Diversified Holdings LLC


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "If our information technology systems, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Qualifications. We view cybersecurity as a shared responsibility. To that end, the members of our Cybersecurity Committee represent a range of functions from across our company, including our property information technology directors, Corporate Controller, Vice President of Internal Audit and Compliance, Corporate Secretary and General Counsel, and the Western Director of Finance. This group has primary responsibility for assessing and managing material cybersecurity risks. The combined experience of this group consists of approximately 14 decades of direct information technology leadership experience, in addition to multiple degrees and specialized training and certifications in the information technology and cybersecurity field.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: We maintain multiple controls in an effort to manage cybersecurity threats. We employ various preventative and detective controls to monitor, block and prevent suspicious activity including those that provide real-time alerts and response. We have systems designed to mitigate cyber risk, which includes ongoing training for employees, preparedness and tabletop exercises, and recovery testing. We maintain a robust vendor management program that identifies, assesses and documents risk associated with external service providers. We proactively monitor email servers for malicious activity and limit remote work only to qualified positions. We leverage internal and external auditors to review processes, systems and controls related to our information security program to ensure they are operating effectively. Management proactively responds to all recommendations designed to strengthen or improve our operating environment.

companyName: CB Financial Services, Inc.

ticker: CBFV


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incidents may have a material effect, including on our operations, business strategy, results of operations or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the risk factor titled "If our security measures are compromised, or our information technology systems or those of our CROs, CMOs, vendors, contractors, consultants or other third-party partners fail or suffer security breaches, cyber-attacks, loss or leakage of data or other disruptions, this could result in a material disruption of our development programs, compromise sensitive information related to our business or other personal information or prevent us from accessing critical information, potentially exposing us to liability, harm our reputation or otherwise adversely affecting our business."

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: 3. Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, impacting our competitive position in the market.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Training and testing for all employees on cybersecurity risks, mitigation, and best practices. New employees are required to complete cybersecurity training and testing, and all employees must complete annual training and testing. Written policies and procedures that govern the use of information technology and the handling of sensitive information. Written incident response plans. Regular cybersecurity reporting to the Audit Committee.

companyName: NVE CORP /NEW/

ticker: NVEC


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Breaches of security and viruses in our systems could result in client claims against us and harm to our reputation causing us to incur expenses and/or lose clients" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K,which disclosure is incorporated by reference herein. Although we maintain cybersecurity insurance to reduce potential financial losses that may stem from cybersecurity incidents, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: TruBridge, Inc.

ticker: TBRG


text: We have established and maintain incident response and recovery plans and procedures that address our response to a known or potential cybersecurity incident, including in our systems and those that occur on third-party systems that we use. These plans and procedures include the notification and escalation processes, the investigation and containment process, the evaluation, review, and remediation process for a known or potential cybersecurity incident, and a process to assess the materiality of an incident.

companyName: PubMatic, Inc.

ticker: PUBM


text: The Audit Committee of our Board of Directors (the "Audit Committee") oversees our financial and risk management policies, including risk management policies and programs related to cybersecurity designed to monitor, mitigate and respond to cyber risks, threats, and reports. The Audit Committee receives regular reports from the Vice President of Information Security on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's cybersecurity program and the emerging cyber threat landscape. Additionally, the Audit Committee has engaged a consulting firm to serve in the role of a cybersecurity advisor to the Audit Committee. In fulfilling this role, the consultant will engage with the Vice President of Information Security and other associates of the Company to evaluate the Company's cybersecurity maturity and advise the Audit Committee on cybersecurity gaps, best practices and industry trends on an ongoing basis.

companyName: MSC INDUSTRIAL DIRECT CO INC

ticker: MSM


text: At least annually, the Board of Directors receives a report from the CISO covering the Company's information security program. This report includes a review of enhancements to the Company's programs, a discussion of management's actions to identify and detect threats and planned action steps in the event of an incident, and an overview of employee training and engagement efforts. In addition, separately, on at least an annual basis, the Board of Directors receives updates from the CISO on the Company's Incident Response Plan, which outlines steps to be followed in the event of an incident including detection, mitigation, recovery, and notification (including notification to senior management, the Board of Directors, and functional business areas), and remediation.

companyName: BROOKLINE BANCORP INC


text: We maintain a cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. This program includes processes that are modeled after the National Institute of Standards and Technology's Cybersecurity Framework and focuses on using business drivers to guide cybersecurity activities. This program is managed by a team of full-time employees, overseen by our Information Services Security Officer, as part of our Information Services team. Our Information Services team is tasked with conducting our day-to-day information technology operations. Furthermore, we consider cybersecurity risks as part of, and have incorporated our cybersecurity program into, our overall risk management processes.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. We have deployed managed detection and response services for all corporate production systems (servers, desktops, and laptops). This managed service includes 24x7x365 monitoring, threat hunting, remediation, and escalation to help maintain a secure environment. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. At least twice a year, the Audit Committee receives a report from the head of Information Security of our cybersecurity threat risk management and mitigation strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the Company's plans to mitigate those risks, and discusses such matters with our head of GTS and other members of senior management. Potential material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management. Two members of our Board, including one member of the Audit Committee, have earned cybersecurity certifications to help them identify cybersecurity threats and oversee management's efforts to manage and mitigate them.

companyName: GLAUKOS Corp

ticker: GKOS


text: The cybersecurity team delivers cybersecurity training to associates, including security videos and informational tips, new hire training, out-of-band cybersecurity alerts, and simulated phishing campaigns with teachable moments and focused training, all designed to provide security specific knowledge to our associates. Positive reinforcement is utilized and encourages associates' participation, in addition to required periodic training. The PECO cybersecurity team participates in cybersecurity training, activities, and events to stay current with the evolution of security threats, security solutions, best practices, and the risks facing PECO.

companyName: Phillips Edison & Company, Inc.

ticker: PECO


text: Every person with access to eHealth IT systems is required to undergo periodic phishing simulations and receives personalized tools to improve their security behavior. Performance is measured both individually and by functional groups to manage the maturity and improvement of eHealth's overall security posture. Employees must also acknowledge receipt and understanding of their responsibility to comply with eHealth's Code of Business Conduct, including the eHealth Information Security and Acceptable Use Policies, during onboarding and annually thereafter.

companyName: eHealth, Inc.

ticker: EHTH


text: >ongoing cybersecurity maintenance activities, including scheduled maintenance time windows for comprehensive system updates to occur, with additional ad hoc updates, monitoring of all Company devices for timeliness of security updates and pushing time-sensitive updates to our system infrastructure and devices, as appropriate; >recurring, redundant backups of our applications, servers and data, with replication to remote storage locations;

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Our Board has delegated to the Audit Committee primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and information security issues. Our CDDO and CISO, who head our cybersecurity and information security initiatives, provide quarterly updates to the Audit Committee, and annual updates to the full Board. These updates cover various topics, such as efforts to enhance our cybersecurity posture, operational and incident metrics, mitigation actions, and key performance indicators like cybersecurity maturity, program health, and audit and compliance activities. In addition to these regular updates, significant cybersecurity incidents and updates are escalated on an as-needed basis in accordance with our IRP.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: As an externally managed closed-end management investment company that has elected to be treated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board. Our executive officers are senior Blackstone Credit & Insurance professionals and each of the Adviser and Administrator is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Given the Company's status as a pawn store operator and payment solutions company entrusted with the safeguarding of sensitive customer information, the Board believes that a strong enterprise cybersecurity program is vital to the Company's overall enterprise risk management. The Board is responsible for overseeing and monitoring the material risks facing the Company. The Board has tasked the Audit Committee of the Board with leading the Company's cyber and technology risk mitigation efforts. As part of its oversight responsibilities, the Audit Committee is responsible for discussing with management the Company's major risk exposures, such as cybersecurity, and the steps management has taken to monitor and control those exposures, including the Company's risk assessment and risk management policies. The Audit Committee also monitors the Company's compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, the Audit Committee reviews with senior management significant areas of risk exposure involving cybersecurity.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: The Global Cyber Security team reports to the Chief Digital Information Officer ("CDIO"), who in turn reports to the Chief Executive Officer ("CEO"). Refer to the "Information about our Executive Officers" section, which appears in Item 4(a) of this report for more information about the CDIO's relevant professional experience and qualifications.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: Information relating to risks from cybersecurity threats is included in this report in Item 1A under the caption " Cybersecurity breaches or a failure in our e-commerce operations and could disrupt our business."

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: We have a unified and centrally-coordinated team, led by our chief security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Amazon in close coordination with senior leadership and other teams across Amazon. Reporting to our chief security officer are a number of experienced chief information security officers responsible for various parts of our business, including AWS, each of whom is supported by a team of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: AMAZON COM INC

ticker: AMZN


text: Leadership and Communication Our CIO has experience in various roles implementing effective information and cybersecurity programs. The CIO reports to the Company's Senior Vice President and Chief Financial Officer and maintains open channels of communication with the broader senior management team and the Board of Directors. The CIO leads our cybersecurity initiatives and is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident responses, and providing regular updates to management, the Audit Committee and the Board of Directors regarding the Company's cybersecurity status and risk assessments.

companyName: SunCoke Energy, Inc.

ticker: SXC


text: Aemetis utilizes a third -party cybersecurity and information security awareness training programs. Training is administered and tracked through online learning modules and ongoing phishing simulations. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.

companyName: AEMETIS, INC

ticker: AMTX


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our users) and other data, confidential information or intellectual property.

companyName: Match Group, Inc.

ticker: MTCH


text: Our CISO is supported by a team of personnel with experience in cybersecurity, including at other public companies in the technology industry.

companyName: Samsara Inc.

ticker: IOT


text: We integrate the identification, assessment, and management of cybersecurity risks into our overall risk management systems and processes. We detect and address such risks from cybersecurity threats in several ways, including through third-party assessments, internal governance, risk and compliance, participation in industry groups to obtain intel, IT audits, and IT security reviews. To protect against, detect, and respond to cybersecurity incidents, we, among other things, leverage intrusion prevention and detection systems, perform penetration testing, conduct employee training, monitor emerging laws and regulations related to data protection and information security, and implement appropriate changes to comply with the identified emerging laws and regulations. To effectuate these processes, we regularly engage third-party auditors and advisors to assess our cybersecurity programs and ensure compliance with applicable guidelines, standards, and industry best practices.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, employee personal information, and clinical trial data, or Information Systems and Data.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and security incidents that could affect our information or systems. For more information, please see the section entitled "Risk Factors."

companyName: HealthLynked Corp

ticker: HLYK


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires for certain vendors, imposition of information security contractual obligations on certain vendors, verification of relevant industry standard security certifications for certain vendors, and other vendor management program elements. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: NeuroPace Inc

ticker: NPCE


text: We are committed to maintaining robust cybersecurity defenses through regularly evaluating and improving our policies, standards, processes, and practices. This commitment is actualized through a diverse array of assessment and testing activities, which include: Comprehensive Audits and Assessments: We conduct audits and assessments to scrutinize the efficacy of our cybersecurity measures.

companyName: WIDEPOINT CORP

ticker: WYY


text: On an ongoing basis, we assess our people, processes and technology and, when necessary, adjust the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. We conduct regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance our Cyber Incident Response Plan. To support these efforts, we have contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems, and security maturity assessments of our corporate and operational networks. We maintain a training program to help our personnel identify and assist in mitigating cybersecurity and data security risks. Our employees and Board members participate in annual training, user awareness campaigns and additional issue-specific training as needed. We also provide annual training for certain contractors who have access to our information technology networks.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: The DISH TV and SLING TV services remained operational at all times during the incident. As of March 31, 2023, all significant systems had been restored. We have no reason to believe that this cybersecurity incident has not been concluded.

companyName: DISH DBS CORP


text: Notwithstanding the extensive approach we take to cybersecurity, the Company continues to face risks and accompanying threats that could have a material adverse effect on the enterprise. We work to manage these risks and threats on a daily basis. We continue to invest in our cybersecurity program, the resiliency of our networks, and work to enhance our internal controls.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: Our board of directors, or the Board, addresses the Company's cybersecurity risk management as part of its general oversight function. The Board has delegated to the audit committee of the Board, or Audit Committee, responsibility for overseeing the Company's cybersecurity risk management processes generally, including oversight and mitigation of risks from cybersecurity threats.

companyName: NGM BIOPHARMACEUTICALS INC


text: We have established security controls based on the CIS CSC framework. Key components of our cybersecurity program include, but are not limited to, asset management, encryption, data loss prevention technology, access controls, multi-factor authentication, vulnerability management, independent penetration testing, email and web gateway protection, multi-faceted backup and data recovery solutions, anti-malware, firewalls, IDS and IPS, auditing and monitoring, regular policy updates, security awareness training, anti-phishing campaigns, and third-party risk management. We also subscribe to third-party threat intelligence tools and services that support monitoring, analyzing, and responding to emerging risks and threats.

companyName: Silk Road Medical Inc


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Interim Chief Executive Officer, or CEO, and CFO.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board receives periodic reports from management on the integrity of our technology communication infrastructure and any cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: Our general operating procedures for cybersecurity risk management are incorporated into our overall enterprise risk management programs, and share common methodologies, reporting channels and governance processes, including the following: General

companyName: INVO Fertility, Inc.

ticker: IVF


text: Corporate Governance Our information security program is managed by a dedicated Vice President of Information Technology ("VP of IT"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The VP of IT has the relevant expertise in understanding risks from cybersecurity threats and has extensive experience managing cybersecurity risk management programs. Additionally, the VP of IT has served in various leadership roles in information technology and information security for over 20 years. The VP of IT provides quarterly reports to the Audit Committee as well as our Chief Executive Officer and other members of our senior management, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the current threat landscape. Our program is regularly evaluated by internal and external experts, with the results of those reviews reported quarterly to the Audit Committee and senior management. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Thryv Holdings, Inc.

ticker: THRY


text: The Compliance and Regulatory Affairs Committee of the Board (the "Compliance and Regulatory Affairs Committee") provides oversight of risks from cybersecurity threats. The Compliance and Regulatory Affairs Committee receives updates from our Chief Information Security Officer (" CISO ") and other members of management to, among other items, review material cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. The Compliance and Regulatory Affairs Committee updates the full Board on matters relating to cybersecurity. The Audit Committee of the Board provides an additional layer of cybersecurity oversight on specific financial matters.

companyName: Evolent Health, Inc.

ticker: EVH


text: Our cybersecurity strategy, which is effected through our Cybersecurity Risk Management Model, prioritizes the security and protection of our information technology networks and systems, through the detection, analysis and response to known, anticipated or unexpected threats and effective management of security risks. Our Cybersecurity Risk Management Model provides for four levels of industry-standard response activities to protect the Company against cyber threats. These are:

companyName: Bristow Group Inc.

ticker: VTOL


text: In addition, the Company's Global Security Operations Center (the "GSOC"), an internal monitoring and reporting center that is a part of the GIS Program, provides 24/7 monitoring, detection and response capabilities for cybersecurity events. The GSOC also analyzes cyber threat intelligence from a variety of paid and non-paid sources.

companyName: BRINKS CO

ticker: BCO


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including cybersecurity risk. Our Board of Directors considers cybersecurity risk and mitigation as a critical component of its risk oversight function and intends to further develop specific cybersecurity oversight functions and protocols. Our Board of Directors administers this oversight function directly through the Board of Directors as a whole, as well as through various standing committees of our Board of Directors, including the Audit Committee, that address risks inherent in their respective areas of oversight. In particular, our Board of Directors is responsible for monitoring and assessing strategic risk exposure and our Audit Committee has the responsibility to consider and discuss our major financial risk exposures and the steps our management has taken to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. The Audit Committee also monitors compliance with legal and regulatory requirements and is charged with oversight of the adequacy of Company's insurance programs, including cyber insurance.

companyName: Core Scientific, Inc./tx

ticker: CORZ


text: The Cybersecurity Program is integrated into our and our Manager's enterprise risk management framework that assesses, identifies and protects our and our Manager's enterprise information systems, data and business operations from various security threats and contains the following elements: • Information Security Risk Assessment – Conducting internal and external risk and control assessment, quality control and assurance testing. • Identity and Access Management – Managing enterprise identity and access control systems. • Security Architecture – Managing security architecture, including secure code deployment standards, architecture security reviews, and cybersecurity advisory support. • Security Engineering – Designing, implementing and operating security technologies, including but not limited to malware protections, security event and incident management, data loss prevention, and phishing defenses. • Security Operations – Ensuring continuous operational coverage of security events and alerts, maintaining and executing processes for triage, containment, investigation and escalation/communication and threat intelligence. • Attack Surface Management – Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cybersecurity training, cyber-attack simulations and tabletop exercises with senior management to detect control gaps. • Third-Party Assessments – Coordinating, reviewing and analyzing third-party providers' assessments of the Cybersecurity Program. Internal Audit may also perform a periodic cybersecurity program audit that may be supported by external consulting firms. • Third-Party Service Provider Reviews – Identifying and reviewing material risks from cybersecurity threats associated with certain third-party service providers.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Protecting our systems and data from cyberthreats is important for ensuring the continuity of operations and maintaining the trust of our customers and stakeholders. Scripps is committed to respecting the privacy of the personal data in its care and complying with applicable privacy-related regulations.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: The Company's cyber risk management program identifies, tracks, escalates, remediates, and reports risks at the corporate level and across each operating company. These risk areas include internal, product, vendor, supply chain, and external services leveraged across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to ensure ongoing mitigation and tracking.

companyName: Veralto Corp

ticker: VLTO


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM").

companyName: TWILIO INC

ticker: TWLO


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us. The program is integrated into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee of our board of directors as part of the committee's involvement in managing and overseeing cybersecurity risks.

companyName: VOLITIONRX LTD

ticker: VNRX


text: Third parties also play a role in the Company's cybersecurity processes and its associated risk management framework. CNX leverages substantial technological tools and partners to augment and enable the efforts of its internal cybersecurity team. Separately, management and oversight of the risks from cybersecurity threats associated with our engagement of third-party service providers is currently included in our internal auditing procedures and we have plans to further mature these procedures in the current fiscal year.

companyName: CNX Resources Corp

ticker: CNX


text: We also periodically retain outside expertise to conduct a maturity assessment of our program against industry standards and participants. Our program is informed by industry standards such as, for example, the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF"), but this does not imply that we meet all technical standards, specifications or requirements under the NIST CSF, NIST CSF 2.0 or other sources.

companyName: BEST BUY CO INC

ticker: BBY


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as a part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also assessing corresponding processes and procedures to mitigate those risks appropriately. Third-party business applications are also incorporated into these risk assessments.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The audit committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short, intermediate, and long-term timeframe. Audit committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the chief technology officer or CTO on our enterprise risk profile on an annual basis. The audit committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Semler Scientific, Inc.


text: SharpLink has established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Sharplink, Inc.

ticker: SBET


text: News Corp's Board of Directors oversees the Company's processes for identifying, assessing and managing significant risks facing the Company, and each of the Board's standing committees assists the Board within the areas delegated to that committee. The Board of Directors has delegated to the Audit Committee primary responsibility for overseeing risks related to cybersecurity, including reviewing with management the Company's major cyber-related risk exposures and the steps that have been taken to monitor and control such exposures. The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company's cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on the cybersecurity program and initiatives, employee training, technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.

companyName: NEWS CORP

ticker: NWSA


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, and monitoring and detection tools to allow our information security team members to assist us in identifying vulnerabilities in our systems before they are exploited by malicious threat actors. Leadership for our information security team, including our Chief Technology Officer, consist of professionals with cybersecurity expertise across multiple industries.

companyName: Proto Labs Inc

ticker: PRLB


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: TrueCar, Inc.


text: We also maintain technical errors and omissions insurance which includes a cyber incident endorsement of up to $20 million with a premium of $60,700. This endorsement provides coverage for Network Security and Privacy, Privacy Regulation Proceeding, Privacy Event Expense Reimbursement, Extortion Demand Reimbursement, Data Restoration, Network Restoration, Business Interruption and System Failure. This coverage reimburses the most common costs for information security incidents, including attorney's fees, consumer notification costs, and regulatory fines. Company has no material incidents to report through the date of this filing. more information on risks from cybersecurity threats that may materially affect the Company, see Item 1A. "Risk Factors".

companyName: OptimizeRx Corp

ticker: OPRX


text: Our Vice President of Information Technology, Jerry Vigil, leads our cybersecurity initiatives, reporting directly to the Chief Administrative Officer and Corporate Secretary and maintains open communication channels with the broader senior management team, the Board, and our Audit Committee. Mr. Vigil is responsible for implementing our cybersecurity strategy, managing daily operations, coordinating incident response, and regularly and routinely reviewing our security model and its practices and future initiatives with external auditors to ensure alignment with industry best practices, changes in audit compliance requirements, and adherence to planned business objectives, as well as providing regular updates and reports on our cybersecurity status and risk assessments to the Board. Mr. Vigil has over 25 years of information technology management experience and has served as our Vice President of Information Technology since January 2024. Mr. Vigil served in the same role at HighPoint Resources Corporation from May 2014 until its merger with us in April 2021. Mr. Vigil served as our Director of Information Technology from April 2021 through December 2023. Mr. Vigil has a Bachelor of Science in Business Technology Management and Computer Science from Regis University.

companyName: CIVITAS RESOURCES, INC.


text: Item 1A, Risk Factors, for additional information on the Company's cybersecurity risk profile, in particular the risk factors under the headings entitled " Risks relating to data privacy could create additional liabilities for us " and " Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer ".

companyName: CorMedix Inc.

ticker: CRMD


text: IT Management uses a risk-based framework core consisting of cybersecurity activities, outcomes, and references that provide guidance for developing individual organizational profiles. IT Management is tasked with and shall:

companyName: ATEL 14, LLC


text: Our assessment and management of material risks from cybersecurity threats are taken into account as part of the Company's risk management processes. For example, our Director of Information Technology works with management to help mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our crisis management team. The CISO Team works with our crisis management team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the board of directors for certain cybersecurity incidents.

companyName: Rubrik, Inc.

ticker: RBRK


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cybersecurity, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.

companyName: BATTALION OIL CORP

ticker: BATL


text: In 2024, there were no risks from cybersecurity threats that have materially affected or reasonably likely to materially affect the Fund, its business strategy, results of operations or financial condition.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: To date, our business strategy, results of operations and financial condition have not been materially affected, nor are they reasonably likely to be affected by risks from cybersecurity incidents or threats. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: TransMontaigne Partners LLC


text: Board Oversight of Cyber Risk Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, which provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. Periodic updates are provided to the Audit Committee on, among other things, our cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. We also engage third parties to periodically evaluate and audit aspects of our information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.

companyName: ELUTIA INC.

ticker: ELUT


text: The Company has sought to leverage the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a guideline for its cybersecurity framework and to help identify, assess and manage cybersecurity risks related to its business. The Company regularly engages third party experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity risk management systems and processes. The Company's partnership with these third-parties include regular audits and threat assessments. The Company requires all of its third-party information technology vendors to undergo evaluations by the Company's internal data privacy and data security team as a part of efforts to assess, document and mitigate potential cybersecurity threats associated with the use of such vendors and the software, applications and services they provide.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: Our Board oversees our enterprise risk management program, including the management of risks arising from cybersecurity threats. The audit committee of our Board (the "Audit Committee") is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. A cross-functional cybersecurity committee (the "Cybersecurity Committee"), which is comprised of members of our management team, reports to the Audit Committee.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: As part of the above processes, we regularly engage with consultants and other third parties, including a bi-annual review of our cybersecurity program by an independent Qualified Security Assessor.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: Governance and oversight of cybersecurity risks and strategies form a core component of our risk management framework. Recognizing the critical importance of cybersecurity in protecting our operations and preserving shareholder value, we have established a governance structure that emphasizes proactive risk identification, management, and mitigation across the entirety of our organization.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: The Bank's cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products, and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.

companyName: Primis Financial Corp.

ticker: FRST


text: The Board of Directors has designated the Security Committee and Incident Response Team with responsibilities related to information security and cybersecurity.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Plan outlines steps to investigate, contain, report, and recover from cybersecurity events. We have established internal procedures to investigate, contain, report, and recover from cybersecurity incidents. These procedures are designed to enable a prompt and coordinated response to potential threats. In the event of an incident determined to be material under SEC guidelines, we are prepared to make timely disclosures through current reports (Form 8-K) as required.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: Board is aware of the critical nature of managing risks associated with cybersecurity threats. Management works with our Board to establish oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board has delegated to our Audit Committee the primary responsibility for oversight of cybersecurity risks.

companyName: AVAX ONE TECHNOLOGY LTD.

ticker: AVX


text: Governance and Management of Cybersecurity Risk Our Board of Directors ("Board") oversees and guides our business and oversees our exposure to major risks. The Board receives periodic reports from management on various risks, and delegates to its Audit Committee certain oversight responsibilities. The Board monitors cybersecurity risks and receives a report at least quarterly from our Chief Information Security Officer (the "CISO") regarding our Information Security Program. In addition, certain cybersecurity incidents are escalated to the Board in accordance with our escalation criteria as described below. Periodically, the Board also receives third party assessments of our information security. The Audit Committee receives regular updates on both information security and data privacy matters, and oversees data privacy, integrity, incident and breach risks.

companyName: Elevance Health, Inc.

ticker: ELV


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Information Security Officer regularly briefs the Audit Committee on our cybersecurity program and threat posture. These sessions may address a wide range of topics including recent developments, emerging threats, vulnerability assessments, third-party and independent reviews, and information security considerations arising with respect to our vendors and other third parties.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: The Company’s Information Security team is responsible for the Company’s cybersecurity risk management program. Their Information Security policies contain processes and templates which are intended to set standards, assign specific roles and responsibilities with respect to our information security environment, and categorize threats and map them to responses as required by law and contract.

companyName: QUINSTREET, INC

ticker: QNST


text: Our Board of Directors has general oversight responsibility for our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee, which reports on its activities and findings to the full Board after each quarterly meeting. Our Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is or may be exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: HIBBETT INC


text: The Company prioritizes the security of its information systems and data integrity. We have developed a cybersecurity strategy, underpinned by our Cybersecurity Incident Response Plan, to manage and mitigate potential cybersecurity risks. Our strategy is designed to safeguard our systems and data.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Inadequate account security or organizational security practices, including those of companies of third parties GES utilizes, may result in unauthorized access to our systems and data, and cause irrevocable damage to the Company.

companyName: Global Arena Holding, Inc.


text: We require employees with access to information systems to undertake data protection and cybersecurity training. In addition, certain individuals with privileged access, such as system administrators and developers, are subject to additional controls and monitoring activities. We also conduct periodic phishing campaigns to train users to better identify, report, and avoid malicious content.

companyName: FOOT LOCKER, INC.


text: safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures;

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors, since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.

companyName: Fyntechnical Innovations Inc

ticker: FYNN


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information technology risks. Our audit committee oversees our management team's implementation of our cybersecurity risk management program, receives periodic reports from our management team on our cybersecurity risks, and receives reports from our management team, as necessary, regarding material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Boundless Bio, Inc.

ticker: BOLD


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 of Regulation S-K promulgated under the Exchange Act.

companyName: UNITIL CORP

ticker: UTL


text: We have in the past experienced cybersecurity incidents of varying degrees involving our technology infrastructure and information systems, including incidents in which unauthorized parties have obtained access to our information systems and networks. While these incidents have at times resulted in some disruptions to our business operations, as of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "The compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents, data security breaches, other security problems, design defects, information system failures or other events could have a material negative impact on our business" in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K. We have implemented a governance framework related to cybersecurity that includes operational risk-mitigation practices and Board-level cybersecurity risk oversight.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our cybersecurity teams, overseen by our CISO, are responsible for assessing and managing our risks from cybersecurity threats, including defining security policy and board reporting of security risk. The CISO approves all security policies and oversees the identification, assessment, and management of cybersecurity risks, which provides a proactive and comprehensive approach to safeguarding our information assets. The teams have primary responsibility for our overall Information Security Program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity teams' experience includes cybersecurity incident response, in-depth security assessments, and security emulation exercises to evaluate security profile, security research, education and outreach, and security tool development.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: As part of our board refreshment efforts in recent years, we have added directors with information technology governance skills. Currently, five members of our board, including all four members of our Audit Committee, have cybersecurity experience from their principal occupation, other professional experience or third-party director education courses on cybersecurity, including cyber risk governance, and data privacy and security issues and trends.

companyName: Extra Space Storage Inc.

ticker: EXR


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, tests on our systems, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including an information technology consultant, to enhance our cybersecurity oversight.

companyName: Gofba, Inc.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, penetration testing providers, dark web monitoring services, cybersecurity consultants, forensic investigators, training platforms and managed cybersecurity service providers.

companyName: Vital Farms, Inc.

ticker: VITL


text: Board of Directors' Oversight and Management's Role The Board of Directors has primary oversight of risks from cybersecurity threats and recognizes the importance of cybersecurity to the success and resilience of our business. The Board of Directors delegates oversight of our enterprise risk management process, including review of cybersecurity and data protection and compliance with cybersecurity policies, to the Audit Committee. An employee of the Manager is responsible for day to day oversight of our cybersecurity risks and management of our cybersecurity vendor, and that employee escalates cybersecurity risks to the Audit Committee or the Board as appropriate.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: We have established an Enterprise Risk Committee, which is led by our Chief Risk Officer and includes our executive management team, our Chief Cybersecurity and Technology Risk Officer, our Chief Ethics and Compliance Officer, and our Head of Internal Audit, for the purpose of monitoring the Company's identification, assessment, mitigation and management of enterprise risks, including cybersecurity risks. Our Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer and Chief Ethics and Compliance Officer each report to the Enterprise Risk Committee on relevant cyber and data risks, controls, and progress against action plans on at least a quarterly basis, and work in coordination with cross-functional teams to oversee our information security strategy and work collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents globally when they arise. We have established a Cybersecurity Sub-Committee of the Enterprise Risk Committee to regularly review cybersecurity developments.

companyName: Dun & Bradstreet Holdings, Inc.


text: The Risk Committee provides executive management oversight, from a risk perspective, of information systems security. As referenced above, the CIO provides information security updates to the Risk Committee at each meeting. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Risk Committee. Cybersecurity metrics are reported to both management level committees and the ERM Committee and Risk Committee on a quarterly basis.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Management has established policies and processes to identify, analyze, mitigate, and manage cybersecurity risks relevant to our platform, and has integrated these processes into the Company's overall risk management processes. Various types of risks are considered, including, but not limited to, fraud, technological, compliance, and vendor risks. Our program for assessing, identifying, and managing material risks from cybersecurity threats includes the following key controls:

companyName: Vynleads, Inc.

ticker: VYND


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from our Board of Directors (the "Board"), Board committees, employees and third-party experts. The Board, Audit Committee, Technology and Innovation Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology ("IT") team reviews cybersecurity risks periodically, and we have a set of Company-wide policies and procedures concerning cybersecurity matters, including policies related to encryption standards, remote access, multi factor authentication, confidential information, the use of the internet, social media, email and wireless devices and incident response. These policies go through an internal review process by members of management and appropriate Board committees, as applicable.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: As previously disclosed, in fiscal 2023, Fortra, LLC, the third-party vendor that provides the GoAnywhere managed file transfer as a service system (MFTaaS), experienced a data security incident that affected many of Fortra's customers, including us. We use GoAnywhere as a means by which our customers electronically share certain data regarding their employees and other third parties with us. Our understanding is that this activity was the result of the threat actor's exploit of a zero-day vulnerability in Fortra's systems. Based on the information we have obtained from Fortra and our own diligence, we understand that this activity only affected Fortra's systems, and did not involve unauthorized access to our information systems. However, the threat actor in this incident accessed certain of our customers' employees' and other third parties' data and such data included protected health information, as defined by the Health Insurance Portability and Accountability Act, and personally identifiable information. We have engaged outside experts to assist in investigating and responding to this incident and have provided the required notifications to the data owners, and where appropriate, to the individuals affected by the incident and to various State Attorneys General.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: The Company's cybersecurity risk management is integrated in our overall risk management processes. Our enterprise risks, including cybersecurity risks, are reviewed on a biannual basis. The review involves participation and engagement by, among others, subject matter experts like the Company's Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"), representatives of the Company's business segments, and executive management. Mitigation plans are deployed across the Company with cross-functional collaboration as applicable. Enterprise risk management is reviewed with the Board annually.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: The Company deploys a Security Operations Center team who monitor and escalate cybersecurity events to the CISO. In the event of a cybersecurity incident, the Company maintains an incident response plan, which is intended to facilitate response, escalation, and mitigate the impact of the incident and includes long-term strategies for remediation and prevention of future incidents. Significant cybersecurity matters and certain strategic risk management decisions are escalated to the Audit Committee and the Board.

companyName: Civeo Corp

ticker: CVEO


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company works third party companies to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: GEN Restaurant Group, Inc.

ticker: GENK