text: Our software development processes are governed by a structured systems development lifecycle process that is designed to review new features and system changes for adherence to security requirements prior to deployment. Our systems are further protected via a regular cadence of patching and prioritized vulnerability remediation. Lastly, the use of third-party software in our environment is governed by our third-party risk management program, which is designed to assess and remediate cyber and business risks associated with vendor-provided software and services.

companyName: KORN FERRY

ticker: KFY


text: Risk Assessment and Strategy Fuel Tech regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our Information Technology Steering Committee on a quarterly basis, or more frequently if deemed appropriate.

companyName: FUEL TECH, INC.

ticker: FTEK

secItem: Item 1C


text: We take various actions designed to maintain and protect the operation and security of our information technology and systems, including the data maintained in those systems. We conduct data security education and testing for our employees, in addition to penetration testing and unannounced email phishing exercises. Additionally, we have implemented a third-party risk management process for third party service providers and vendors. Extensive security questionnaires are issued to third party providers and vendors, the responses to which are weighted and reviewed by our security and compliance team. High risk vendors are reviewed at least biennially and new vendors that interact with our data are assessed as part of our vendor procurement process. In the event of a cybersecurity incident, we have a detailed incident response plan in place for contacting authorities and informing key stakeholders. In addition, we have engaged a qualified third party who conducted an external assessment of our cybersecurity controls.

companyName: RMR GROUP INC.

ticker: RMR


text: The audit committee of our Board oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria, as set forth in our disclosure controls and procedures. Further, at least once per year, our management team reports on cybersecurity matters, including material risks and threats, to the audit committee, and the audit committee provides updates to the Board at regular Board meetings. Our management team also provides updates annually or more frequently as appropriate to the Board.

companyName: RYVYL Inc.

ticker: RVYL


text: Depending on the environment, systems, and data at issue, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: cybersecurity insurance, physical security, incident detection and response, access controls, employee training, penetration testing, and systems monitoring.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Standards and Frameworks Our cybersecurity program aligns with leading industry standards, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The NIST CSF provides a structured and flexible approach to managing cybersecurity risk, enabling us to effectively identify, protect, detect, respond to, and recover from cyber threats. By adhering to NIST standards, we enhance our resilience and ensure alignment with recognized best practices.

companyName: CONNS INC


text: There were no material cyber security incidents discovered in 2024.While cybersecurity risks have not materially affected the Company's business, operations, or financial condition to date, the Company recognized that an increase in cyber threats, data breaches, or system vulnerabilities could have a material impact on future operations.

companyName: Idaho Strategic Resources, Inc.

ticker: IDR


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, property management, cloud-based infrastructure, data center facilities, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: Under the Company's comprehensive risk management program, the board of directors (the "Board") of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to the Company's business, corresponding risk-mitigation efforts and day-to-day management of the Company's risk management program. At least annually, the Board receives cybersecurity briefings from senior executives.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The VP of IT works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: A dedicated committee, the Information Security Steering Group (ISSG), is specifically responsible for overseeing cybersecurity threats and informing the decisions of the Credit and Risk Committee. The ISSG, comprising individuals with diverse expertise in technology, risk management and cybersecurity, meets monthly. They discuss a range of strategic topics, including vulnerability trends, identified or potential third-party risks, risks precipitated by technological changes, confirmed or potential security incidents and other items related to the institution's preparedness measures. The ISSG's purpose is to provide strategic direction for the IS program and to evaluate known risks based on Bancorp's existing controls and risk appetite.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: We view cybersecurity as a shared responsibility across our management team and periodically perform simulations and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity training at least annually and have access to more frequent cybersecurity training through online events.

companyName: Streamex Corp.

ticker: STEX


text: PART I, ITEM 1A – RISK FACTORS above for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: IMMUCELL CORP /DE/

ticker: ICCC


text: We recognize the potential risks associated with the deployment and use of AI systems. We provide training for employees on AI use cases, opportunities, and risk management practices.

companyName: Keenova Therapeutics plc


text: Protection of our customers' data is a fundamental priority for our Board and management team. Our risk management team is integrated into our CIS function and is led by our CIO and CISO. The risk management team reports to the CISO and has combined experience in information security, governance, and compliance, including domains such as engineering, architecture, cybersecurity, and privacy. This team is responsible for defining the program, cybersecurity governance, and gathering insights related to assessing, identifying, and managing cybersecurity threat risks, their severity, and mitigations.

companyName: KROGER CO

ticker: KR


text: Risk Management and Strategy U. S. Steel maintains robust processes for assessing, identifying and managing material risks from cybersecurity threats. U. S. Steel's cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and the risk of cybersecurity threats is integrated into the Company's Enterprise Risk Management ("ERM") program, led by the Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by the Senior Vice President – Global Information Technology and President, USSE (the "CIO") and the Chief Information Security Officer (the "CISO"). Each quarter, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. U. S. Steel works closely with its internal and external auditors to assess, plan for, prevent and mitigate cybersecurity risks.

companyName: UNITED STATES STEEL CORP


text: One of the key functions of our board of directors is informed oversight of our ERM, including risks from cybersecurity threats. Our board of directors receive regular presentations and reports on our cybersecurity risks, which have pertained to a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third-parties. The board of directors also receive prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed and resolved.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Process and Management's Role Management is responsible for designing and implementing policies, processes and procedures and deploying physical and virtual technology and safeguards to measure, monitor and control cybersecurity risk. The primary executives responsible for the oversight of risk and cybersecurity are the Company's Chief Risk Officer, who has over 37 years of experience in the banking industry, including 25 years as a national bank examiner for the Office of the Comptroller of the Currency, and the Company's Chief Information Security Officer ("CISO"), who has an educational and experiential background in information technology and information security for public companies (bachelor's degree in computer science and service as the Company's CISO for the past 10 years, with 10 prior years of information technology and information security experience). The CISO leads the members of the Information Security Department, some of whom maintain a variety of certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Security+ (Plus) Certification (SEC+). Both of these executives, along with the other professionals in the Information Security and Information Technology Departments, have the appropriate knowledge and expertise to effectively assess and manage the Company's cybersecurity risk and establish a system of internal controls in an effort to safeguard the Company's network and comply with regulatory requirements.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Since the start of its latest completed fiscal year and up to the date of this Report, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity service provider, and penetration testing firms.

companyName: NeuroPace Inc

ticker: NPCE


text: Markel Ventures has established processes for the Markel Ventures businesses to share information about how they assess, identify, and manage cybersecurity risk and shares information on material risks from cybersecurity incidents with Markel Group management, as appropriate. Each Markel Ventures business has a board that meets quarterly. Material matters regarding cybersecurity risk management and cybersecurity incidents are discussed at these meetings. In addition, Markel Ventures management regularly meets with the businesses to discuss their risk identification, assessment, and management approach. These discussions include how the business assesses, identifies, and manages key risks, including cybersecurity risks.

companyName: MARKEL GROUP INC.

ticker: MKL


text: The SVP-GIS is responsible for maintaining our IRP. Potentially significant threats are escalated to an interdisciplinary data breach response team (the "DBRT"), which is led by our EVP-CIO and co-chaired by the SVP-GIS, our head of data privacy, and a representative from our Law Department. The DBRT is responsible for oversight and handling of significant cybersecurity threats, incidents, and issues through a documented process. Potentially material cybersecurity incidents are escalated by our EVP-CIO to executive management and reviewed with members of the Company's Disclosure Committee.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: The oversight of our cybersecurity risk is integrated into our enterprise-wide risk management process. We annually review cybersecurity risk as part of our enterprise risk management process and evaluate whether to integrate those findings into our overall cybersecurity strategy. We have a Cybersecurity Strategy Committee, which is a cross-functional team of business representatives led by our Vice President of IT & Digitization, which is responsible for spearheading the ongoing development and execution of our cybersecurity strategy. The Cybersecurity Strategy Committee meets regularly and at other times as needed, and periodically updates the Company's management on its progress and activities.

companyName: CTS CORP

ticker: CTS


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience, heads the team responsible for cybersecurity. Our CISO's team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. The team includes senior professionals, many with more than 15 years of cybersecurity expertise and industry certifications such as Certified Information Security Systems Professional, CompTIA Security+, Global Information Assurance Certification, and Certified Ethical Hacker. Members of the team are provided with opportunities to attend external training, conferences, and other events to keep abreast of the latest cybersecurity trends. Our CISO receives ongoing updates from his team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: FLUOR CORP

ticker: FLR


text: In line with our commitment to strong corporate governance and the security of our operations, we continuously assess and mitigate cybersecurity risks that could impact our business, stakeholders, and the integrity of our systems.

companyName: NBT BANCORP INC

ticker: NBTB


text: As part of our overall risk management system, we train our staff on the safeguards we have in place to mitigate cybersecurity threats and ensure employees are able to identify potential attempts to breach our security and how to report and deal with any potential threats. We have procedures in place to assess and manage potential supply chain risks posed by third-party vendors and collaborators. As part of our cybersecurity risk management program, we work with certain third-party vendors to assess their cybersecurity processes, including a process for requesting that vendors who have access to our systems and data complete cybersecurity questionnaires prior to onboarding.

companyName: Adaptimmune Therapeutics PLC


text: We currently do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company's business strategy, results of operations, or financial condition. While Insulet maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity and other risks which may impact Insulet.

companyName: INSULET CORP

ticker: PODD


text: As of December 31, 2023, the Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: We view our Global Information Security Program and the processes followed thereunder as just one part of our overall enterprise risk management strategy. As part of our annual enterprise risk management review, we identify and categorize risk areas across our business, including technology risks and those related to cybersecurity. We determine the magnitude of such risks in the context of our overall business and how the technology risks, including cybersecurity specifically, may have an impact on other risks the Company faces and vice versa to help us inform our overall risk management strategy going forward. This allows us to continuously assess cybersecurity risks in alignment with our strategic objectives and operational needs.

companyName: WEX Inc.

ticker: WEX


text: The ongoing improvement of our cybersecurity measures is overseen by our Vice President of Engineering, who has 17 years of experience in software and security, along with a bachelor's degree in Computer Engineering. As part of our Chief Operating Officer organization, he manages the Information Technology team and the designated Data Security Coordinator, ensuring regular program reviews, risk assessments, and employee training sessions to strengthen our proactive security posture. We do not employ or engage any third parties for cybersecurity consulting or monitoring, aside from technical support teams from our application vendors.

companyName: CuriosityStream Inc.

ticker: CURI


text: Our cybersecurity program also engages a variety of consultants, auditors and other third parties to support and assist with implementing and maintaining appropriate security measures. Any number of third parties may be engaged to assist in response actions, including, among others, intelligence providers, product, software and service providers and advisors. Professional services, or consultants, are engaged as needed to help implement, support or advise on a variety of technical matters. Legal counsel, law enforcement and external auditors are also consulted as needed.

companyName: HERBALIFE LTD.

ticker: HLF


text: Furthermore, we are consistently broadening our scope of training and awareness practices to alleviate potential risks associated with human error, including mandatory computer-based training, internal communications, and frequent phishing awareness campaigns.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: Commvault's Board of Directors (the "Board") provides oversight of Commvault's enterprise risk management strategy, which includes risks from cybersecurity threats. The Audit Committee of the Board of Directors receives quarterly briefings on the cybersecurity program from the CISO and briefings on the Enterprise Risk Management Committee ("ERMC") and Cybersecurity Oversight Team ("CSOT") from the Chief Legal and Compliance Officer ("CLCO"). The Board is kept apprised of cybersecurity updates through quarterly, or as needed, reporting from the Audit Committee Chair and annual, or as needed, reporting directly to the Board from the CISO.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: Management's Role in Cybersecurity Risk Management The Adviser's Director of IT and internal cybersecurity team are responsible for the cybersecurity program applicable to the Fund (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Fund's Chief Compliance Officer, are responsible for assessing and managing material risks from cybersecurity threats that impact the Fund. The Adviser's Director of IT has 25 years of experience advising on and managing risks from cybersecurity. The Adviser's Director of IT works closely Fund management to administrator, assess, discuss, and prioritize the Fund's cybersecurity efforts. The Fund's Chief Compliance Officer oversees the Fund's oversight function generally and relies on the Adviser's Director of IT to assist with assessing and managing material risks from cybersecurity threats. The Fund's Chief Compliance Officer has been responsible for this oversight function as Chief Compliance Officer to the Fund since his appointment and has worked in the financial services industry for more than 15 years, during which time the Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Fund.

companyName: Stone Point Credit Income Fund


text: The Company has a Technology Risk Management Program (First Line), including Cyber and Information Risk Management, and an Information Risk Management Program (Second Line) under its Enterprise Risk Management Framework for the identification, assessment, measurement, mitigation, monitoring, and internal reporting of risks associated with its information systems, information assets, and third parties, including vendors and service providers. The Cyber and Information Security Risk Management Program and Technology Risk Management Program align with the Company's Third-Party Risk Management Program in regard to protecting information assets.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Risk Management Strategy The Director of Information Technology, who reports to the Chief Financial Officer, has extensive information technology ("IT") and cybersecurity knowledge and skills gained from over 15 years of relevant work experience at the Company, and is responsible for leading the Company's cybersecurity and cyber risk management program which includes certain cybersecurity processes covering the Company's corporate systems. These processes include, among other items, the Company's information technology and risk management departments' use of an internal set of applications and control activities to actively monitor potential threats to its corporate IT environment and regularly conduct internal testing to identify potential vulnerabilities to the Company's corporate information technology infrastructure and systems. These activities include, but are not limited to, continuous monitoring of network and infrastructure vulnerabilities, automated patching and software updates, redundancy and back-up systems, and incident response planning and handling. The Company's employees are required to report cybersecurity events, including suspicious activity or emails, to the Company's information technology department. Should a cybersecurity event occur within its corporate systems, the Company is positioned to coordinate a swift response to mitigate impacts to its information technology infrastructure and systems. The Company has in place an incident response plan which provides guidance for leadership and employees to swiftly evaluate and respond to cybersecurity incidents. The Company also carries cybersecurity insurance to further mitigate certain potential losses from a cybersecurity incident affecting its corporate IT equipment and systems.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: Cybersecurity has become a significant issue for financial institutions around the globe, and the Company is no exception. The Company's management has integrated cybersecurity issues into the Company's overall risk management system by making cybersecurity risk a key focus of its internal Strategic Technology Committee, Enterprise Risk Management Committee, and Board Risk Oversight Committee. These committees are provided regular updates on the Bank's cybersecurity risk management program.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: Our CISO has over twenty-five years of experience in cybersecurity and holds active Certified Information Systems Security Professional and Certified Information Security Manager certifications. Our policies require teammates, contractors, service providers and suppliers who become aware of a cybersecurity incident or the individual's supervisor must immediately report the cybersecurity incident to the appropriate reporting channels, which include the CISO. In the event of a cybersecurity incident, in addition to the standing members, teammates would be selected to serve on the Cybersecurity Incident Response Team (CIRT) based on the facts and circumstances of the particular cybersecurity incident. Additionally, our outside legal counsel is held on retainer to assist with our response to cybersecurity incidents.

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact. We also conduct tabletop exercises to simulate responses to cybersecurity incidents.

companyName: CITIZENS, INC.

ticker: CIA


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats. However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. In the event of a cybersecurity incident impacting us, the management team will report to our board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Translational Development Acquisition Corp.

ticker: TDAC


text: We maintain an incident response plan which includes, among other areas, prioritization guidelines, data collection and evidence handling, communication channels and partners, and if required, law enforcement engagement. We maintain relationships with both local and national law enforcement agencies. We evaluate security incidents on a scale of severity to determine the appropriate incident handling protocols.

companyName: IonQ, Inc.

ticker: IONQ


text: We have established and maintain a corporate-wide information security management system and an integrated risk management framework with practices that are derived from industry standards, including ISO 31000, ISO 27001, HITRUST, PCI DSS, and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and data privacy regulations, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the General Data Protection Regulation ("GDPR"). The data security controls from these standards and regulations are evaluated as a component of our risk management framework, based on the needs of our business and our clients, the nature of our industry, and applicable regulations.

companyName: Concentrix Corp

ticker: CNXC


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, no risks from cybersecurity threats have materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our Company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: The Company's Chief Information Officer ("CIO") and CISO work closely with other management positions, including the Chief Financial Officer, Chief Legal Officer, Head of Internal Audit, and Internal Communications, to evaluate cybersecurity risks in alignment with our business objectives and operational needs.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Q32 Bio Inc.

ticker: QTTB


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader technology environment; • the use of external service providers with specific expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management, as well as periodic experiential learning through "phishing simulations"; • segmentation of, and back-ups for, certain of our sensitive systems and data; • third-party cyber risk management process for vendors including, among other things, a security assessment, contracting program, and ongoing monitoring for vendors based on their risk profile; and • physical security around our sensitive infrastructure and cybersystems.

companyName: Northwest Natural Holding Co

ticker: NWN


text: The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of our company is responsible for oversight of risks from cybersecurity threats.

companyName: Knife River Corp

ticker: KNF


text: While no company can or will be completely immune from cybersecurity threats, especially as they relate to vendors and government agencies that we rely on, we know of no cybersecurity incident that has or is likely to materially affect us, our business strategy, or our results of operations, or financial condition.

companyName: LITHIA MOTORS INC

ticker: LAD


text: Although risks from cyber threats have not materially affected the Trust’s business strategy, results of operations or financial condition, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. Risk Factors.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: APPlife Digital Solutions Inc

ticker: ALDS


text: Our cybersecurity risk management program utilizes a variety of technical and process controls that are designed to identify, protect against, detect, respond to, and recover from cybersecurity threats, including: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;

companyName: Azenta, Inc.

ticker: AZTA


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our ISO, nonmember of the executive management team, oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a annual basis and subject to oversight by our board of directors.

companyName: Community West Bancshares

ticker: CWBC


text: In the ordinary course of business, our board of directors receives at a minimum annual updates from the ISO regarding the Information Security Program and compliance with relevant regulations, as described above. Both our Information Technology Steering Committee and Enterprise Risk Management Committee consists of members of the Executive Management Team and department heads with relevant technology experience and meets on a monthly cadence with minutes, reports, and presentations flowing up to the Board of Directors Audit Committee which also meets on a monthly cadence. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors via the Audit Committee sooner than its next monthly update.

companyName: COMMUNITY WEST BANCSHARES /


text: Likewise, the Company's internal audit function periodically performs audit engagements focused on information technology processes and cybersecurity risks. These audits have provided the Company with assessments of the effectiveness and efficiency of our information technology and cyber threat management processes with the goal of safeguarding Company assets and information.

companyName: CVR ENERGY INC

ticker: CVI


text: There can be no assurance that such measures will be sufficient to prevent, mitigate or remediate cybersecurity incidents or breaches. Although we have experienced cyberattacks as discussed in "Item 1A, Risk Factors" above, based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect BD. Despite our efforts in implementing and maintaining our cybersecurity risk management program, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident or breach in the future that may materially affect us. For further discussion of how our business, results of operations, and financial condition could be materially adversely affected by risks from cybersecurity threats, see "Item 1A, Risk Factors."

companyName: BECTON DICKINSON & CO

ticker: BDX


text: The Audit Committee reports regularly to our board of directors concerning the matters covered under the policy and advises our board of directors of any developments that it believes should have our board of directors' consideration.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. We have faced—and in the future may face—sophisticated attacks, including attacks referred to as advanced persistent threats, which are cyberattacks aimed at compromising our intellectual property and other commercially sensitive information, such as the source code and game assets for our software or confidential customer or employee information, which may remain undetected for prolonged periods of time. In September 2022, we experienced a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from Rockstar Games' systems, including early development footage for the next Grand Theft Auto. Subsequently, also in September 2022, an unauthorized third party illegally accessed credentials for a vendor platform that 2K Games uses to provide help desk support to its customers. The unauthorized party sent a communication to certain players containing a malicious link. 2K Games immediately notified all affected users and took steps to restrict further unauthorized activity until service was restored. In connection with this activity, we have incurred certain immaterial incremental one-time costs related to consultants, experts and data recovery efforts and we generally expect to incur additional costs related to cybersecurity protections in the future.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: The Audit Committee receives reports at least quarterly from our Vice President of Information Technology and IT security leader on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our internal IT security personnel, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Enovis CORP

ticker: ENOV


text: Audit Committee is responsible for oversight of cybersecurity risk. Our Chief Executive Officer is the member of management responsible for managing and assessing our cybersecurity practices. Our Chief Executive Officer has over 20 years' experience as a C-Level technology executive for private and public companies. The plan for the future is that our Chief Executive Officer will report to the Audit Committee on cybersecurity on a quarterly basis. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Audit Committee and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.

companyName: Safe Pro Group Inc.

ticker: SPAI


text: Our policies require that certain of our employees and contractors complete mandatory security awareness training upon hire or engagement and annually thereafter. The training covers essential topics such as phishing awareness, password security, data protection, social engineering, physical security and compliance requirements. Additionally, targeted training is provided based on roles, responsibilities and access levels to ensure relevance and effectiveness. The awareness and training program also includes practical exercises, such as simulated phishing attacks, to reinforce training objectives and improve understanding of security vulnerabilities. We also participate in a variety of initiatives and groups for collaboration and for increasing our security knowledge and awareness.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our management team will work to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have not been subject to cybersecurity challenges that have materially impaired our operations or financial standing. In the future, the Company will require the Board and employees to complete cybersecurity training related to the physical security of assets, data privacy and other information security policies and procedures.

companyName: Mexus Gold US


text: We employ continual monitoring of our systems and data, managed by an external detection and response firm. In the event of a cyber incident, we maintain an incident response plan coordinated across multiple departments. This strategy is designed for rapid and effective incident management to minimize operational disruption. Our response protocol includes steps for detection, containment, eradication, recovery and post-incident review, including impact on safety, data loss, operational disruption, cost and potential reputational damage.

companyName: EZCORP INC

ticker: EZPW


text: Medallion Financial Corp., the Bank and Medallion Capital are each responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These programs have been guided by the National Institute of Standards and Technology Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable, and seek to protect each entity against cybersecurity risks and provide a foundation to respond promptly to cybersecurity events. Each entity maintains technical and organizational safeguards, including, among other things, employee testing and training, incident response programs and tabletop exercises, evaluations and assessments by third parties, vulnerability scanning, vendor management, cybersecurity insurance, and business continuity mechanisms for the protection of Company assets. Our programs also assess and manage third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third-party service providers.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: response procedures to detect, contain, and remediate security events; and of third-party providers to conduct vulnerability testing and supplement technical expertise where internal resources are limited.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership and subject to oversight by the Information Technology and Security Committee of our Board of Directors. Our cybersecurity program is managed by our Vice President of IT & Information Security, who is a Certified Information Systems Security professional (CISSP) and reports to our Chief Operating Officer. Our Chief Operating Officer and Vice President of IT and Information Security provide periodic briefings about our cybersecurity risk management to the Information Technology and Security Committee.

companyName: NLIGHT, INC.

ticker: LASR


text: The Company maintains an incident response plan that includes procedures for evaluating and addressing a cybersecurity event. The initial impact of each cybersecurity event is evaluated by a designated team using pre-established risk criteria. If an event meets certain parameters, it is escalated to a cross-functional core team of executives, including the Company's Chief Information Security Officer ("CISO") and designated internal legal counsel. The Company has a cyber incident disclosure committee that evaluates and considers whether public disclosure of an event is required. The incident response plan identifies certain third-party advisors, consultants and legal counsel who have been designated to assist if necessary. The plan contains procedures for escalating cybersecurity incidents to the Board of Directors.

companyName: KEMPER Corp

ticker: KMPR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a vulnerability management policy; conducting risk assessments; encrypting certain of our data; maintaining network security controls; segmenting certain of our data; maintaining access and physical security controls; asset management, tracking, and disposal protocols; systems monitoring; vendor risk management processes; employee training; maintaining cybersecurity insurance; and retaining a third party information technology strategy and risk reduction vendor.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: The Company addresses identified risks and develops and implements controls to mitigate issues. The Company engages third parties in connection with its cybersecurity processes as appropriate. The Company has established processes to identify risks from cybersecurity threats associated with its third-party service providers.

companyName: TREES Corp (Colorado)

ticker: CANN


text: As designated by the Company's Executive Committee and the Audit Committee, our CRC leads Regency's cybersecurity risk management program. This includes risk identification, assessment, management, prevention and mitigation, as well as securing necessary resources and reporting on cybersecurity preparedness to the Executive Committee (which is currently comprised of the CEO, CFO, and several of the Company's other senior leaders) and the Audit Committee.

companyName: REGENCY CENTERS LP


text: The company's cybersecurity program is managed by the Canada IT Manager, with support from cross-functional teams led by information technology (IT) and operational technology cybersecurity operations managers in the company and in Exxon Mobil Corporation and its affiliates (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyber threats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Nu-Med Plus, Inc.

ticker: NUMD


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, and strategic or competitive in nature, and our clinical trial and related data ("Information Systems and Data").

companyName: Vor Biopharma Inc.

ticker: VOR


text: Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Board and Audit Committee regularly review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Board and Audit Committee regularly receive reports and presentations from management regarding our information and technology security program, including the CISO, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: HP INC

ticker: HPQ


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to help maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes that are designed to assess, identify and manage material risks from cybersecurity threats and includes: maintenance and monitoring of information security policies aligned with global regulatory controls; user and employee awareness of cyber policies and practices; simulated phishing exercises; information systems configuration management; identity and information asset protection; infrastructure security systems; and cyber threat operations with regular monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also maintain a cyber incident response plan designed to assist us in identifying, responding to and recovering from cybersecurity incidents. We use the findings from these and other processes to help us improve our information security practices, procedures and technologies. We also collaborate with third parties to assess the effectiveness of our cybersecurity program. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of material risks from cybersecurity threats, as well as to support associated mitigation plans when necessary.

companyName: ASSEMBLY BIOSCIENCES, INC.

ticker: ASMB


text: Engaging in tabletop exercises and threat modeling allows us to simulate and prepare for potential cybersecurity scenarios, ensuring readiness and adaptability. Vulnerability Testing: Vulnerability testing is performed to proactively identify and address potential security weaknesses.

companyName: WIDEPOINT CORP

ticker: WYY


text: They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; of ongoing cybersecurity initiatives and strategies;

companyName: SideChannel, Inc.

ticker: SDCH


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates at least annually from senior management, including leaders from the CTO, internal audit and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our board of directors also engages in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: We have incurred and may in the future incur significant costs in order to implement, maintain, and/or update security systems we believe are necessary to protect our IT infrastructure. We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, intrusion prevention, and intrusion detection systems. We have established disclosure controls and procedures to address cybersecurity events, which include elements relating to comprehensive analysis of events and communication within the company, as well as addressing potential disclosure obligations arising from security breaches.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Technical Safeguards. Valley also deploys technical safeguards that are designed to protect Valley's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, continuous scanning of our environments for potential weaknesses, behavioral-based protections against malware and filtering of inbound emails to protect the firm against phishing attacks. The effectiveness of these safeguards is evaluated through vulnerability assessments and cybersecurity threat intelligence with the goal of implementing improvements as needed.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: The Audit Committee receives periodic reports from our Chief Financial Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: On an annual basis, we conduct an evaluation of our cybersecurity risks as part of the ERM program. Through the ERM program, the CISO and other internal subject matter experts review potential cybersecurity threat scenarios, such as data theft, cash theft, widespread outages and business disruptions, and the potential consequences of such scenarios. The results of the risk assessment are shared with management and the Audit and Finance Committee.

companyName: Phillips 66

ticker: PSX


text: We have developed and implemented a cybersecurity risk management program intended to protect the security, confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: American Assets Trust, Inc.

ticker: AAT


text: 1.Vendor Risk Management: We recognize that third-party service providers may introduce additional cybersecurity risks to our organization. As such, we have established a vendor risk management program to assess and monitor the cybersecurity posture of our third-party vendors and partners.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Our cybersecurity policies, standards, and procedures include cyber and data breach response plans benchmarked against multiple cybersecurity risk frameworks. Our incident response plan is designed to help coordinate the response to and recovery from cybersecurity incidents and includes processes to identify, investigate, triage, assess the severity of, escalate, contain, and remediate incidents and comply with applicable legal or regulatory obligations. We also regularly perform technical reviews of our systems to help secure our digital environment and confirm software patches are appropriately up-to-date.

companyName: Sage Therapeutics, Inc.


text: We deploy, configure, and maintain numerous technologies to enforce security policies, detect and protect against cybersecurity threats, and help safeguard the Company's information systems and assets. We operate a Security Operation Center (SOC) to monitor cybersecurity threats, coordinate incident response resources, and reduce response times. Our internal SOC team is augmented by a third-party managed security services provider. The Company maintains a cybersecurity incident response plan that provides a structured approach for the Company's response to cybersecurity incidents. Under the plan, cybersecurity incidents are escalated based on a defined incident severity scale, including to the Board of Directors as appropriate. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises multiple times throughout the year. These exercises are conducted by internal team members and in some instances with assistance from third-party experts. The Company's cybersecurity program also includes regular cybersecurity trainings for staff. We actively evaluate the training effectiveness and adjust the trainings based on the evaluations.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: We perform annual assessments of information technology risk, including threats associated with our third-party service providers. We conduct diligence on all third-party providers we work with to evaluate their security practices consistent with our security principles, including compliance with regulatory and industry controls such as NIST 800-53 and System and Organization Controls reports. Cybersecurity risks, both internally and from third-party providers, are tracked quarterly as part of the Corporate Enterprise Risk Management program.

companyName: KAMAN Corp


text: Our information security program's ultimate goal is preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of an identified cybersecurity incident, we have developed a detailed cybersecurity incident response process, which outlines the steps to be followed from incident detection, analysis, containment, eradication, recovery and notification, including notifying functional areas (e.g. information technology, legal, finance, operations, privacy), as well as senior leadership and the Audit Committee, as appropriate. In certain instances, incidents are escalated to certain members of our legal team who are responsible for, among other things, the accurate and timely disclosure of material cybersecurity incidents required under federal securities laws, including making the materiality determination and approving related securities disclosures.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: We use third-party service providers to perform a variety of other functions throughout our business, such as application providers, hosting companies, and supply chain resources (such as shipping). We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve risk assessments, data privacy and security questionnaires, assessments, and imposition of cybersecurity-related contractual obligations on the vendor.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: The Information Security group and senior leadership are responsible for assessing and managing risks from cybersecurity threats. The Information Security group is led by the Company's CISO, who is also responsible for the day-to-day management of the Information Security Program. Katelynn Sandy is the Company's CISO. Ms. Sandy has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, and technology. Additionally, Ms. Sandy holds various information security certifications.

companyName: Root, Inc.

ticker: ROOT


text: Our CIO and information technology team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CIO and information technology team implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO and information technology team are equipped with a well-defined incident response plan, which includes escalation to the cybersecurity risk management committee and the Audit Committee, and relevant public disclosure, as appropriate.

companyName: Liberty Energy Inc.

ticker: LBRT


text: Management plays an important role in assessing and managing our material risks from cybersecurity threats. Our Chief Information Officer – which is the management position responsible for assessing and managing material risks from cybersecurity threats – is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. He has over a decade of experience leading cybersecurity oversight, and leads other members of our information security team, who have professional cybersecurity experience, training, or certifications.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: The Board is actively engaged in the oversight of cybersecurity and data privacy. On a quarterly basis, the Board receives updates on (a) our progress on security improvement objectives, (b) relevant reported cybersecurity internal incidents and the global evolving risks, and (c) results of work performed by our third-party information security partner. We engage subject matter experts in conducting independent assessments of our cybersecurity program maturity, penetration tests, and other tests and assessments.

companyName: BGSF, INC.

ticker: BGSF


text: We recognize the importance of being able to assess, effectively respond to, and manage material cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of our information systems, data, or network resources. To address these concerns, we plan to develop and implement company-wide policies and procedures to help raise awareness of, identify, assess, and manage cybersecurity threats. Our Information Security organization will have primary responsibility for the implementation of our cybersecurity policies and procedures and the management of our responses to information technology and security risks, including risks related to cybersecurity threats.

companyName: Revelyst, Inc.


text: We have an Information Security Office that is responsible for preventing, assessing, detecting, mitigating, and remediating cybersecurity risks. The Information Security Office, which is led by our Chief Information Security Officer ("CISO"), works cross-functionally with different business and corporate functions, as all Dynatrace employees are considered critical to our company's security. Our Information Security Office also partners with external organizations to maintain and enhance our cybersecurity systems and processes. Our Board of Directors and two of its committees are also involved in the oversight of our cybersecurity risk management. We discuss our CISO and the Board in more detail in the "Governance" section below.

companyName: Dynatrace, Inc.

ticker: DT


text: The Company has deployed a layered security approach to identify, measure, monitor and control information technology risks. The Company also maintains a documented Incident Management Standard and Technology and Cyber Incident Response Plan. These documents addresses the prevention, detection, mitigation, and remediation of cybersecurity incidents, and include appropriate timely incident escalations to be followed during an incident, up to and including executive leadership, management committees, such as of the ITRGC, and depending on incident severity, the Board or Board committee. The volume, severity, and root case of security incidents are reported on at monthly management committees. The Company will regularly engage independent third parties to assist in its cybersecurity preparedness, including but not limited to vulnerability scan assessments, secure code scan reviews, and cybersecurity incident response simulations. The Company's internal audit department also performs annual cybersecurity penetration testing over the Company's internal and external networks. Additionally, for third party related technologies, the Company's Third Party Risk Management Program ("TPRM") is involved with onboarding and ongoing monitoring of these vendor relationships. TPRM documents the Company's view of applicable third party vendors assessing the vendor's technological capability to provide products and/or services in a viable and risk adverse manner.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Technology Officer (CTO) and Chief Operating Officer are responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.

companyName: Owlet, Inc.

ticker: OWLT


text: Board has primary responsibility for oversight of our cybersecurity and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: To address these risks, we maintain a comprehensive, risk-based cybersecurity program focused on protecting sensitive data and systems. Our approach includes: • Layered Security (defense-in-Depth): Implementing multiple levels of controls to safeguard against cyber threats. • Employee Awareness: Delivering mandatory cybersecurity training, conducting phishing simulations, and fostering a culture of vigilance. • Proactive Monitoring and Testing: Leveraging real-time monitoring, regular vulnerability assessments, and external audits to continuously evaluate and enhance defenses. • Preparedness: Maintaining and testing business continuity and disaster recovery plans with scenarios such as simulated cyberattacks. For more information on risks related to cybersecurity and data security, see Item 1A. "Risk Factors - Risks Related to Our Regulatory Environment" and "Risk Factors - General Risk Factors". To date, no cybersecurity incidents or risks from cybersecurity threats have materially impacted our business strategy, results of operations, or financial condition.

companyName: MASIMO CORP

ticker: MASI


text: We use third-party service providers to perform a variety of functions throughout our business, including, for example, application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We have certain vendor management processes to help manage cybersecurity risks associated with our use of certain of these providers, and, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, those processes may involve different levels of assessment and risk mitigation measures, including, for example, the imposition of contractual obligations related to cybersecurity on the provider.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: The audit committee will engage in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, which will include those that result from material cybersecurity threats as necessary.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: The Audit Committee is primarily responsible for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on cybersecurity risks, addressing matters such as evolving standards; vulnerability assessments, including results of third-party penetration testing; audits of our cybersecurity IT controls, and independent reviews of our cybersecurity processes. Management and the Board also receive prompt and timely information regarding any significant or potentially material cybersecurity incident and our remediation efforts.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data, and we maintain a cybersecurity risk management program as a part of our overall risk management program that is focused on identifying, assessing and managing cybersecurity risk. Key elements of that program include: Alignment with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyberattacks; Engaging external cybersecurity experts in incident response development and management;

companyName: ELUTIA INC.

ticker: ELUT


text: The Board and the Audit Committee each receive regular presentations and reports from the Company's Chief Technology Officer and/or General Counsel on cybersecurity risks, which address a wide range of topics including, among others, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third party service providers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds under the Company's incident response plan.

companyName: Phreesia, Inc.

ticker: PHR


text: In an effort to deter and detect cyber threats, we annually provide all employees with a data protection, cybersecurity, incident response, and prevention, training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: We use third-party service providers to perform a variety of functions throughout our business, such as third-party distributors for our products in certain countries and third-party suppliers for the manufacture of our products, as well as third-party application providers and third-party hosting companies. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may impose contractual obligations related to cybersecurity on the provider.

companyName: CERUS CORP

ticker: CERS


text: Company's Information Security Team, led by our Director of Information Security, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the Company's Information Security Governance Board. The Company's Director Information Security holds high-level licenses and certifications relating to information security, including being a Certified Chief Information Security Officer and holding a BCS Foundation Certificate in Formation Security Management Principles. The Company's Information Security Governance Board, chaired by the Company's Director of Information Security and comprised of the General Counsel, the President & Chief Executive Officer, the Interim Chief Financial Officer, and the Chief Technology Officer - Product, drives awareness and alignment across broad stakeholder groups for cybersecurity governance and risk management and reporting. The Information Security Governance Board receives quarterly reports from the Company's Director of Information Security. The Audit Committee receives at least quarterly reports from the Company's Director of Information Security. The Audit Committee periodically reports to the Board.

companyName: Inspired Entertainment, Inc.

ticker: INSE


text: A key aspect of this integrated framework is the role of our Internal Audit team, which serves as an independent, objective assurance function tasked with evaluating the effectiveness of risk management, internal controls, and our governance processes.

companyName: HERBALIFE LTD.

ticker: HLF


text: In 2024, we did not identify any cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see " Risk Factors— Cyberattacks and security breaches of our system, or those impacting our third parties, could adversely impact our brand and reputation and our business, operating results, and financial condition." and "We may suffer significant and adverse effects due to hacking or one or more adverse software events ".

companyName: Bit Digital, Inc

ticker: BTBT


text: The InfoSec Committee evaluates the implications of cybersecurity incidents to determine whether such incidents have had or are reasonably likely to have a material effect on our business strategy, financial condition, and results of operations. If a cybersecurity incident is deemed material by our InfoSec Committee, our Chief Financial Officer or General Counsel will notify the other members of our senior management team and the Chair of the Risk Committee of our Board of Directors as needed.

companyName: EXELIXIS, INC.

ticker: EXEL


text: As an externally managed trust, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Manager. While w e rely on our Manager's and our Manager's parent company's technology infrastructure and information systems to perform operational activities as well as to maintain the Trust's business records and financial data, we do not possess sensitive personal data for any third parties or employees. The Trust's business is highly dependent on the communications and information systems of the Manager, its affiliates and third-party service providers or employees. The Manager has adopted processes designed to identify, assess and manage material risks from cybersecurity threats to the Trust. These processes include assessments of internal and external threats to the confidentiality, integrity and availability of the Trust's data and systems along with other material risks to its operations. These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting, and responding to threats.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: Innospec's Board and its committees provide oversight of the Company's IT, including cyber security, in connection with the Company's efforts to assess and manage the Company's risk exposure. Oversight of risk management, including cyber security risk management is an integral part of Board and committee deliberations throughout the year. Since 2019, the Board has retained NCC Group ("NCC") to perform cyber security reviews. NCC reports its findings directly to the Board.

companyName: INNOSPEC INC.

ticker: IOSP


text: Reliance mandates regular cybersecurity training for employees and applicable contractors and considers this a critical step in safeguarding the Company's data and assets. The training is designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. The course includes enhancements to strengthen our defensive stance against the increasing number and sophistication of cyberattacks worldwide and also includes interactive modules covering various cyberattack methodologies, including insider attacks, phishing and other email attacks, malware attacks, data protection, data handling, password protections, cloud and internet security and cybersecurity fundamentals for mobile devices. We take a risk-based approach with respect to our use and oversight of third-party service providers, using a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires, conducting due diligence in connection with onboarding new vendors, and negotiating for cybersecurity-related terms in vendor agreements as appropriate. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available.

companyName: RELIANCE, INC.

ticker: RS


text: The full Board of Directors of MPLX GP oversees enterprise-level risks and has delegated to the Audit Committee of the MPLX GP Board oversight of risks from cybersecurity threats as informed through MPC's ERM program. MPC's CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The MPC CDO and CISO provides regular cybersecurity briefings to the MPLX GP Board of Directors and the MPLX GP Audit Committee as needed, with a minimum of two briefings per year. The MPLX GP Audit Committee further reviews and provides input on our cybersecurity and information security strategy.

companyName: MPLX LP

ticker: MPLX


text: Compliance and Regulatory Considerations Our cybersecurity practices are in alignment with industry standards and regulatory requirements. We conduct regular reviews to ensure compliance with evolving cybersecurity laws and regulations. There have been no legal or regulatory proceedings related to cybersecurity against the Company in the reported period. We intend to further enhance our cybersecurity measures in response to the dynamic cyber threat landscape. This includes continuing to invest in advanced security technologies, refining our risk assessment methodologies, and continuing our commitment to staff training and development in cybersecurity awareness and best practices.

companyName: INNOVATE Corp.

ticker: VATE


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee, which is responsible for overseeing that management has processes in place designed to identify and evaluate cybersecurity risks and that management has implemented processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including through the intentional acts or carelessness by employees, customers and other individuals who are authorized to use them, and by criminals, who often use sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue, and any intrusion into our systems could result in material financial losses and operational problems. See "Operational, Strategic and Reputational Risks."

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: The CISO and Cybersecurity Manager support the information security risk oversight responsibilities of the Board of Directors and its committees. The CISO reports to our Chief Information Officer, who in turn reports to our Chief Executive Officer and President. The Cybersecurity Manager reports to the Information Technology Director, who in turn reports to the Chief Information Officer.

companyName: FIRST BANCSHARES INC /MS/


text: Our cybersecurity risk management processes are integrated into our overall business risk management program. As part of our risk management program, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. As part of risk management processes, we maintain cybersecurity insurance that provides coverage for certain costs related to cybersecurity-related incidents. However, the amount or type of coverage may not be sufficient to address costs for handling an incident, or future changes may occur to insurance coverage.

companyName: Keenova Therapeutics plc


text: ii. Engagement with Third Parties We maintain strategic partnerships with third-party assessors, consultants, and auditors to enhance our defense mechanisms. This includes the use of third parties for penetration testing and log evaluation, and network monitoring to assist in rapid identification and mitigation of any suspicious network access to ensure the effective detection and mitigation of cybersecurity threats. The results of such tests and assessments are reported to our audit committee and our board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the tests and assessments.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: In addition, the CIO, CISO, General Counsel and certain other members of senior management meet periodically with the audit, risk, and legal and regulatory committees of the board of directors to review our information technology and cybersecurity risk profile and to discuss risk mitigation plans. While the board risk committee is ultimately responsible for overseeing the management of our information security program at the board level, the audit and legal and regulatory committees assist the risk committees in fulfilling its duties. Each of the board committees regularly briefs the full board of directors on matters reported to them. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Risk Management Oversight for additional information regarding the role of our board of directors in risk management oversight, including its oversight of risks from cybersecurity threats. As of February 1, 2024, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. See Item 1A. Risk Factors—Risks Relating to Our Business Operations—Interruption or other operational failures in telecommunications, information technology and other operational systems, including as a result of threat actors attacking those systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on those systems, including as a result of human error, could have a material adverse effect on our business and Item 1A. Risk Factors—Risks Relating to Our Relationship with Apollo—Interruption or other operational failures in telecommunications, information technology and other operational systems at Apollo or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on Apollo's systems, including as a result of human error, could have a material adverse effect on our business for further discussion of the risks we face from cybersecurity threats.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: A subcommittee of our IRT reviews and assesses associated public reporting implications of cybersecurity incidents. Our process also includes informing the Board of Directors and the Audit Committee following a material cybersecurity incident.

companyName: STERIS plc

ticker: STE


text: The Audit and Risk Committee receives periodic reports from management regarding cybersecurity and privacy risks, any material updates thereto and a summary of any cybersecurity and/or privacy events or incidents that have occurred, in each case, since the most recent update provided to the Audit and Risk Committee. The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity and privacy. In addition, at least once every twelve months and promptly after the occurrence of certain specified cybersecurity/data privacy incidents, the Board and our Chief Executive Officer and President receive the written Cybersecurity and Privacy Program materials, which include the results of the most recent cybersecurity and privacy risk assessment and any evaluations thereof or updates thereto (collectively, the "Reporting Materials"). On an annual basis, management also leads the Board through a comprehensive review of the Reporting Materials, including, among other things, a review of the identified material cybersecurity and privacy risk exposures and the safeguards implemented to control such risk exposures.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: Our head of the ITS Department and our executive management are primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: We design and assess our program based on the Information Systems Audit and Control Association's Control Objectives for Information Technologies framework and National Institute of Standards and Technology cybersecurity framework, as well as threat trends identified by multiple external and internal cybersecurity intelligence reports.

companyName: AGENUS INC

ticker: AGEN


text: We have established controls for identifying, assessing and managing material risks from cybersecurity threats that could adversely affect our information systems or the information residing on those systems. These include a combination of policies, procedures, technologies and safe-guards (based on frameworks such as Cybersecurity Maturity Model Certification ("CMMC") and Payment Card Industry ("PCI") that are designed to prevent, detect, and mitigate data loss, theft, misuse, unauthorized access, and other security incidents or vulnerabilities affecting our systems and data, and to assess and evaluate the risk of such incidents and vulnerabilities. Additionally, we have processes in place designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including our cloud computing platforms.

companyName: MSC INDUSTRIAL DIRECT CO INC

ticker: MSM


text: Our cybersecurity measure is primarily focused on ensuring the security and protection of computer systems and networks. All pertinent Chinese operating entities of the Company shall adhere to a standardized Company Confidentiality System, which shall be centrally overseen and enforced by Shuhai Beijing, subject to oversight by our management and Board of Directors. This Company Confidentiality System shall include specific provisions for information pertaining to network security, data security, and information that, if disclosed, could have detrimental effects on the public interest and the Company. We plan to establish an appropriate confidentiality framework and adhere to relevant document management regulations. The Company and its employees are also required to sign confidentiality agreements for purposes including ensuring cybersecurity. As of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: DATASEA INC.

ticker: DTSS


text: All information assets are inventoried, classified, prioritized, and protected based on the respective risk, with appropriate cybersecurity controls applied to each. We have also implemented and maintain a documents management program which governs the classification, protection, and use of sensitive company data within the Albemarle environment.

companyName: ALBEMARLE CORP

ticker: ALB


text: We face risks from cybersecurity threats that could have a material adverse effect on our relationship with our partners, suppliers and eventual customers, or on our business, operations or products. We have experienced, and will likely continue to experience, cybersecurity incidents in the normal course of our business, however, we are not aware that we have experienced a material cybersecurity incident during fiscal 2023. See "Risk Factors – Risks Related to Privacy and Security – If we experience a significant cybersecurity breach or disruption in our information systems or any of our partners' information systems, our business could be adversely affected."

companyName: SES AI Corp

ticker: SES


text: The Company's cyber risk management program is supervised by a dedicated Chief Information Officer whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes, as well as managing the Company's information security and risk management awareness program. We provide regular awareness training to our employees, including periodic phishing tests, to help identify, avoid and mitigate cybersecurity threats. We also periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.

companyName: BlueLinx Holdings Inc.

ticker: BXC


text: We perform a formal risk assessment each year. As part of the Company's risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: Our cybersecurity program includes procedures for the detection, analysis, and mitigation of cybersecurity incidents. Our cybersecurity incident response includes criteria for prioritization and escalation based on severity under an established incident prioritization framework. Incidents are reported internally to senior management, the Board or the Board's Audit and Finance Committee, as appropriate based on the potential severity of the incident. Incidents that are elevated based on their potential severity, including any event that is potentially material, are promptly escalated and analyzed for potential external reporting requirements.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board receives annual cybersecurity updates from senior management, and the Audit and Compliance Committee provides a deeper level of oversight through an annual review of management's approach to cybersecurity risk with the Director – Information Systems. The Board and the Audit and Compliance Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: BADGER METER INC

ticker: BMI


text: We have engaged the services of various third-party service providers to, among other things, review and evaluate our processes and procedures designed to control access to our information systems, perform penetration testing on our cybersecurity systems on a biannual basis, and provide regular information technology reviews based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition, we contracted with a third-party managed detection and response security company ("MDR") in the fourth quarter of 2023 to commence testing for cyber vulnerabilities on a continual basis.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: We regularly review our Incident Response Plans to ensure readiness if and when an incident does occur, including through live testing via planned and surprise tabletop exercises. In the event of a cybersecurity incident, if a system does become non-operational, we maintain disaster recovery capabilities to return to normal operation in a timely manner.

companyName: MEDIFAST INC

ticker: MED


text: We have formed and maintain a 24/7 Security Operations Center (SOC)/Network Operations Center (NOC) that continually monitors our key systems and logs.

companyName: Rumble Inc.

ticker: RUM


text: Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats. Our program leverages components from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which we use to help us identify, assess and manage cybersecurity risks relevant to our business. O ur cybersecurity program is a component of our overall enterprise risk program. We deploy multiple strategies and dedicate significant resources toward systems designed to identify, assess, manage, mitigate and respond to cybersecurity threats. We also consistently strive to improve the detection and response capabilities of our cybersecurity program. To do this, we monitor best practices across the cybersecurity space and endeavor to incorporate those in our own cybersecurity program.

companyName: POOL CORP

ticker: POOL


text: The Company has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into its overall risk management systems and processes. The Company routinely assesses material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through its information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein.

companyName: GOLD RESOURCE CORP

ticker: GORO