text: We have an incident reporting and escalation process designed to detect and analyze cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: • continual monitoring of our systems and logs by both internal and outsourced staff; • immediate escalation to an incident reporting call and review by our CIO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments; • if deemed appropriate, reporting by our CIO to the Executive Risk Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and • informing our Board of Directors (the "Board") and the Audit Committee of the Board of significant or material cybersecurity incidents, as appropriate. All incidents are documented and recorded and cataloged for further review by the CISO team.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: We detect frequent attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. As of the date of the filing of this Form 10-K, we are not aware of and do not believe that any such attempts that have occurred since the beginning of 2023 that have had a material effect, or are reasonably likely to have a material effect, on our business, operations, or financial condition. However, there can be no assurance that our protection efforts will be successful. See "Risks Relating to Our Business and Operations – A security incident impacting customer, employee, supplier, or Company information, or Company systems or infrastructure, may have a material adverse effect on our business, financial condition, and results of operations." in "Risk Factors" on page 9 of this Form 10-K.

companyName: MATERION Corp

ticker: MTRN

secItem: Item 1C


text: Cyber Risk Management and Strategy Our cybersecurity organization's mission is to provide a targeted set of services, support and capabilities to reduce the risk of cyberattacks, rapidly detect and contain threats, and mitigate risks to critical data.

companyName: Moderna, Inc.

ticker: MRNA


text: Our security and legal teams oversee our information security and privacy practices and are responsible for identifying and proactively addressing security and privacy risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and incident response plans and maintaining cybersecurity programs. We maintain an in depth incident response plan that includes a process for identifying, containing and removing any threats and vulnerabilities and a plan to recover and restore normal business operations following an incident. Members of the security team are always on call to be able to address any issues that arise. In addition, we have created a cybersecurity materiality assessment team, which includes representatives from our security, legal, finance, internal audit, communications and investor relations departments that reviews and assesses the impact of cybersecurity incidents on the company, our customers and other stakeholders. Our material assessment framework provides for an escalation path for any potentially material cybersecurity incidents from the security team to our CISO who may further escalate to the materiality assessment team, senior management and the Audit Committee. To ensure our preparedness to appropriately respond to cybersecurity incidents, the cross-functional team meets regularly and conducts simulations of cybersecurity incidents to test its procedures.

companyName: DigitalOcean Holdings, Inc.

ticker: DOCN


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers.

companyName: S&P Global Inc.

ticker: SPGI


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical IT Systems and information.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Our cybersecurity program is led by our Senior Vice President - Strategic Services and Chief Information Officer ("CIO"). Our CIO also serves as the Chair of our Cybersecurity Executive Oversight Committee ("CEOC"), comprised of senior executives representing various teams and functions of the Company including legal, finance, accounting, investor relations, and operations. The CEOC supports efforts to evaluate the materiality of any incidents, determines whether notice to third parties such as residents or vendors is required, and determine whether any disclosures to stakeholders are required. The CEOC is also responsible for ensuring the Company's management and Board of Trust Managers ("Board") are fully aware of key activities and events associated with our cybersecurity program on an ongoing basis.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: The Company maintains arrangements with third party information infrastructure or IT vendors, including “cloud computing” vendors. All potential vendors are evaluated through the Company’s third-party due diligence process, which includes conducting cybersecurity risk assessments prior to integration into the Company’s networks and additional assessments prior to contract renewals or extensions. We further manage potential threats to our systems originating with or associated with IT vendors by integrating cybersecurity requirements and other provisions into various contracts as applicable. Vulnerabilities in third-party software are monitored and managed through our vulnerability management program.

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: Specifically, the Company relies on the enterprise risk management ("ERM") framework of BlackRock, Inc. ("BlackRock") for the Company's cybersecurity risk management and strategy. The Board of Directors of the Company periodically receives reports from BlackRock and from the Advisor regarding BlackRock's cybersecurity program. Key aspects of the ERM framework are summarized below.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: From time to time, our processes are audited and validated by internal and external experts. We leverage third-party cybersecurity experts with the goal of minimizing disruption to our business and production operations, strengthening supply chain resilience in response to cyber-related events, and supporting the integrity of IT systems. We also engage reputable third-party consultants to help evaluate and test our vulnerability to cybersecurity threats as well as to conduct annual penetration tests to help identify exploitable cybersecurity vulnerabilities. Our IT team assesses these testing results and implements any appropriate measures to mitigate vulnerabilities identified.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: Third-party service providers are used in various capacities as part of our cybersecurity risk management program, including performing risk mitigation controls and providing cloud-based, cybersecurity services and platforms. For example, third-party service providers are used to conduct our external penetration testing, as well as assist the Company in detecting, responding, and mitigating cybersecurity incidents. The Company uses a variety of processes to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are required to complete a detailed questionnaire, which is used to identify and assess material cybersecurity risks. In addition, the Company performs an annual review of independent attestation reports of the third-party service providers' control environments designed to ensure that the controls meet Company security requirements and that any identified issues in the independent attestation reports do not present material cybersecurity risks to the Company.

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: Our Board of Directors has established a Risk Committee to assist the Board in its oversight of risk. As part of its responsibilities, the Risk Committee oversees management's implementation of our cybersecurity risk management program.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register; (2) our information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board of Directors, which evaluates our overall enterprise risk.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: We also engage consultants and other third-party advisors to conduct independent assessments of our cybersecurity readiness and control effectiveness. In collaboration with external cybersecurity firms, we seek to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices to inform our cybersecurity response, risk remediation and resilience capabilities, including by working with an external retained incident response team, receiving third-party threat intelligence, participating in incident tabletops, and performing assessments and controls testing on our enterprise environment.

companyName: Avantor, Inc.

ticker: AVTR


text: Our cybersecurity risk management program is managed by our Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.

companyName: PBF Energy Inc.

ticker: PBF


text: Northern Trust's disclosure procedures and controls also address cybersecurity incidents and include elements to ensure an analysis of potential disclosure obligations arising from any such incidents. Northern Trust maintains compliance programs to address the applicability of restrictions on securities trading while in possession of material, nonpublic information, including instances in which such information may relate to cybersecurity incidents.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: The CISO, in coordination with other members of senior management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company are tasked with addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed promptly about, and monitor the prevention, detection, investigation, mitigation and remediation of, cybersecurity threats. These teams are expected to operate pursuant to documented plans and playbooks that include processes for escalation of incidents to leadership and to the Audit Committee and the Board, as appropriate, based on the severity level of an incident. In addition, the Company periodically consults with outside advisors and experts to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk management environment.

companyName: FAIR ISAAC CORP

ticker: FICO


text: As part of its overall risk oversight function, our Audit Committee, which is comprised entirely of independent directors, considers cybersecurity risks in connection with overseeing our overall enterprise risk management system. Management, including our CISO and CIO, provide updates on our cybersecurity risk management program and cybersecurity matters to the Audit Committee, and also reports to the Board of Directors as necessary. During 2023, the Board received dedicated cybersecurity training and performed an exercise tabletop relating to potential cybersecurity risks. As part of our cybersecurity risk management program, we maintain industry standard procedures and policies, which are reviewed and revised frequently, and certified to comply with ISO 27001 standards, to both proactively assess, identify and manage potential cybersecurity risks and respond to any actual cybersecurity threats and incidents. Such procedures and policies include: actively monitoring our information technology systems to ensure compliance with applicable legal and regulatory requirements; engaging third-party consultants and other service providers to monitor and, as appropriate, respond to cybersecurity risks; requiring our service providers and our business partners who connect directly to our information technology systems, to comply with our cybersecurity standards, due diligence processes and be subject to our non-disclosure and other confidentiality agreements that include cybersecurity-related terms; providing and analyzing specialized industry sector intelligence on cybersecurity threats; regularly testing our cybersecurity systems and disaster preparedness, including our back-up information technology systems; developing and updating incident response plans to address potential cybersecurity threats; and maintaining and training our personnel on cybersecurity incident reporting procedures.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: We rely on industry-standard software applications, IT systems, computing infrastructure, enterprise resource planning systems, and cloud service providers (collectively referred to as "Information Systems") to perform essential operations. Many of these systems are managed, hosted, provided, or utilized by third parties, to support our business activities.

companyName: Embecta Corp.

ticker: EMBC


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer and the information technology team. Such individuals have extensive experience in various roles, including in other publicly traded companies, involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. These management team members monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: our Risk Management and Compliance Committee (the "Risk Committee"), which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk; our Internal Audit Department, which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment;

companyName: EASTMAN KODAK CO

ticker: KODK


text: We evaluate our third-party information system providers, as well as any other provider that may have access to our data, for their maturity and reliability, and as a matter of policy we choose to only work with reputable vendors.

companyName: MICROVISION, INC.

ticker: MVIS


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect our systems and sensitive data. This model is composed of a variety of different components including administrative controls, technical controls and other safeguards. These various components are centrally managed and monitored, creating a multi-layered and interlocking cybersecurity defense system. Unauthorized access to our customers' confidential or proprietary information as a result of a cybersecurity incident or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: TVA's cybersecurity risk management framework provides the structure for protecting against cybersecurity threats, including through promoting risk management efforts, situational awareness, and cyber risk modeling and simulations. Within this framework, TVA operates numerous programs under internal written policies and procedures, which are aimed at helping protect TVA's information resources. These include a vulnerability management program to help address cybersecurity threats to TVA digital assets; a patch and remediation management program to help computer systems remain current with software patches or software updates; an offensive threat management program to emulate threat actor activities; a cybersecurity training program to help educate employees and contractors, including by providing scenarios designed to train the workforce on responding to cybersecurity incidents; implementation of standard terms and conditions where appropriate in TVA's supply chain contracts to help mitigate TVA's cybersecurity risk, including through requiring timely notice of vendor cybersecurity incidents and data impacts and compliance with laws, regulations, and TVA's policies on cybersecurity; and a program to accomplish cybersecurity event detection alerting. These programs are based on principles from the National Institute of Standards and Technology and certain regulatory standards that are designed to protect against cybersecurity incidents, including the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Nuclear Regulatory Commission cybersecurity standards, and are periodically assessed by third-party experts.

companyName: Tennessee Valley Authority

ticker: TVE


text: The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our information security framework leverages information and guidance from external sources and is managed by an internal team, led by the Cybersecurity Manager. This team provides updates on the overall effectiveness of the cybersecurity framework, including information on cyber threats and incidents, to the Information Services leadership team consisting of the Executive Vice President ("EVP") – Global Business & Information Services, Vice President ("VP") – Global Business Systems, VP – Global Information Technology Operations and Governance, and Senior Director – Data Insights and Innovation. We utilize a multi-layered, risk-based approach to our security controls to prevent, detect, and respond to cybersecurity threats. Our capabilities, processes, and security measures include, and are not limited to: • reactive endpoint protection to detect and prevent virus and malware threats, • network perimeter firewalls, including malware prevention, • e-mail scanning to prevent spam and phishing campaigns, • vulnerability scanning and remediation of vulnerabilities based on priority, • logical access controls, including multi-factor authentication, • incident response procedures, and • disaster recovery protocols.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: We conduct periodic and event-driven risk assessments to identify reasonably foreseeable internal and external cybersecurity risks. Following these assessments, we implement and maintain safeguards designed to minimize identified risks and remediate gaps, including multi-factor authentication, privileged access management, network segmentation, endpoint protection, vulnerability scanning, and patch management. For digital asset-related operations, we emphasize multi-party key controls, segregation of duties, and monitoring of validator performance and custody providers.

companyName: BITMINE IMMERSION TECHNOLOGIES, INC.

ticker: BMNR


text: The BOD and IT Steering committee are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cyber security and information security. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the National Institute of Standards and Technology ("NIST") standards for cybersecurity and the Federal Financial Institutions Examination Council ("FFIEC") examination guidelines, along with applicable privacy laws.

companyName: Oak Valley Bancorp

ticker: OVLY


text: The Board has overall responsibility for the Company's enterprise risk management program, including cybersecurity risk, and the Audit and Risk Management Committee assists the Board with this oversight. The Company's internal audit function reports to the Audit and Risk Management Committee and, among other things, provides independent assurance on the Company's risk management activities and internal controls related to cybersecurity risk. For more information, see Part 3, Item 10 "Directors, Executive Officers and Corporate Governance – Enterprise Risk Management".

companyName: BLACKBERRY Ltd

ticker: BB


text: The information technology group has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes. The group reports to our Chief Financial Officer. Our cybersecurity senior manager, who has held roles in security, infrastructure management, and enterprise information technology management, is responsible for assessing and managing the cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: As discussed above, these members of management report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters at least annually, with updates to the Audit Committee on a quarterly basis.

companyName: Sunrun Inc.

ticker: RUN


text: The CIO and the VP of IT Security and Compliance regularly report to senior management and the board on the governance aspects of our data security program. The CIO and the VP of IT Security and Compliance are also members of our information security steering committee, which is comprised of executives throughout the Company who oversee areas such as finance, operations, legal, human resources, strategy and development, digital, and commercial. This committee meets regularly to, as relevant, discuss oversight of the Company's cybersecurity program, program enhancements and new risks or threats that the Company might be facing.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: Within our cybersecurity program, we have identified and implemented a variety of processes for cybersecurity risk management: • We conduct regular risk assessments to identify and evaluate potential cybersecurity threats, including threats to our business operations, technology infrastructure, and data. • We monitor threat intelligence feeds to stay updated on the latest cybersecurity threats and vulnerabilities. • We scan our systems for vulnerabilities on an ongoing basis, with vulnerabilities prioritized and remediated based on their potential impact. • We have implemented a variety of access controls to restrict access to our systems and data, including user authentication, authorization, and encryption. • We conduct regular security awareness training for our employees to help them identify and avoid cybersecurity threats. • We periodically conduct test exercises to review our cybersecurity controls and identify improvements. • Consultants and other third-party vendors that assist with cybersecurity risks or processes are included in our vendor risk assessment program, which identifies and oversees cybersecurity risks specific to our use of these vendors.

companyName: Western Union CO

ticker: WU


text: As of December 31, 2023, cybersecurity risks have not materially affected our business, strategy, results of operations, or financial condition. Although we have invested in the protection of our data and information technology and monitor our systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to our information technology systems that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents. For additional information about our cybersecurity risks, see Item 1A, "Risk Factors - AbbVie depends on information technology and a failure of, or significant disruption to, those systems could have a material adverse effect on AbbVie's business."

companyName: AbbVie Inc.

ticker: ABBV


text: His in-depth knowledge is instrumental in developing and executing our cybersecurity strategies. Our CFO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Members of our executive leadership team, including our CFO, Senior Vice President and General Counsel, as well as the other members as needed, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, alerts and reports produced by security tools deployed in the IT environment.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: The Board — The Chief Executive Officer, the Chief Financial Officer, the CIO, members of senior management, and other personnel and advisors, as requested by the Board, report on the risks to the Company, including cybersecurity risks, at regularly scheduled meetings of the Board and its committees. Based on these reports, the Board requests follow-up data and presentations to address any specific concerns and recommendations. Additionally, the Board committees have opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks. KNIGHT-SWIFT TRANSPORTATION HOLDINGS INC.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Teknova's Vice President of Information Systems and Architecture (VP of IT) manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes, and risk assessment related to information security and data protection, including data privacy and network security (our Cybersecurity Program). The VP of IT has served in various roles in information technology and information security, along with other members of the IT department, and holds relevant and applicable certifications. The VP of IT reports directly to our Chief Executive Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our board of directors, and the audit committee of our board of directors.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Our management team and incident response team have overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants that conduct vulnerability scans on a quarterly basis per PCI DSS standards. While cyber-attacks are common threats to all businesses, the Company did not experience a material cyber security incident in either fiscal year 2024 or 2023.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Security Officer ("CSO"), who receives reports from our information security team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CSO and dedicated personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications. Management, including the CSO and our information security team, regularly update the Audit Committee on the Company's cybersecurity program, including cybersecurity vulnerabilities, risk, threats and incidents, and developments in the cybersecurity risk landscape.

companyName: Rapid7, Inc.

ticker: RPD


text: We have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact on our business or operating results to date.

companyName: Harbor Custom Development, Inc.


text: Any new organization or party that we show interest in establishing a relationship with the Bank will/may require the potential to share or access confidential client information must go through a series of guidelines for qualification prior to releasing information or implementing services. These procedures are in place in order to demonstrate our commitment to safeguarding confidential information while documenting due diligence. New third parties are assessed through our pre- engage ment process. The next level of engagement involves a Risk Dependency Assessment, to determine the vendor's Tier Level and a full due-diligence review of policies and independent audits of Critical Vendors as defined in policy.

companyName: River Financial Corp

ticker: RVRF


text: Board of Directors as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board of Directors. The oversight responsibility of the Board of Directors and its committees is enabled by management reporting processes that are designed to provide visibility to the Board of Directors about the identification, assessment and management of critical risks and management's risk mitigation strategies. Accordingly, our Board of Directors provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from our Chief Compliance Officer (or more frequently, as needed) regarding the overall state of our Cybersecurity Program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.

companyName: SURO CAPITAL CORP.

ticker: SSSS


text: Recognizing the complexity and evolving nature of cybersecurity threats, Vital engages with a range of third-party service providers to evaluate and monitor our cybersecurity risk management program. These providers conduct cybersecurity assessments, penetration testing, vulnerability assessments, and threat analysis. This collaboration aims to fortify our cybersecurity program on an ongoing basis. Our information security and financial controls are audited annually by third-party auditors.

companyName: Vital Energy, Inc.

ticker: VTLE


text: Executive Management is responsible for managing the Information Security Program's operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal's Information Security Officer ("ISO") is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The ISO is a Senior Vice President and has served in such role since 2010. The ISO has over 38-years of combined financial institution experience, which includes compliance, BSA, operations, physical security and information security. The ISO provides an annual report to the Board on the overall status of the Information Security Program and information technology incidents as necessary. The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management. The Technology Subcommittee of the Management Risk Committee focuses on three pillars: Technology Strategy, InfoSec/Cyber, and Data.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: The process for materiality determination of a cybersecurity threat event considers the possibility of contacting the Audit Committee for assistance, if needed, or to inform of the evolution of an incident with possible material impact.

companyName: Satellogic Inc.

ticker: SATL


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Executive Director of IT, who has 26 years of experience developing and deploying network and data security policy and technology.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: As many security threats involve social engineering, the Company has a multifaceted security training program for its employees. Mandatory cybersecurity training classes are administered semi-annually, and a security awareness assessment is given annually. Tests of employees' ability to thwart attacks are run successively throughout the year, and remedial refresher courses are required when employees fail the tests. Compliance reporting on these programs is included in the annual review process.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: Security Policies and Requirements SilverBow maintains written policies designed to formalize our risk management program and other security requirements including cybersecurity and incident management. Such policies are applicable to all employees, contractors with access to the Company's systems and our Information Technology department.

companyName: SILVERBOW RESOURCES, INC.


text: The cybersecurity risk management program, processes and strategy described in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), our own third-party critical systems and services supporting or used by the Company (collectively, "Critical Systems"), and service providers. The Company's subsidiaries lease to our tenants the properties we own, but we do not have actual or contractual access to the systems or information maintained or used by our tenants. Our tenants are directly or indirectly (through their own service providers) responsible for maintaining programs and processes to protect their systems and information from various risks from cybersecurity threats.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: Our Board of Directors receives periodic updates on cybersecurity matters and the overall state of our cybersecurity program from our CEO (based on consultation with our CISO and other senior members of our Information Security and/or Technology teams).

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company's cybersecurity incident response efforts. This team collaborates closely with other internal teams as well as with external legal advisors, communication specialists, and other key stakeholders, as appropriate, in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its cybersecurity response plan and its processes and capabilities in addressing cybersecurity threats.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Security Awareness and Education The Bank provides annual, mandatory, onsite training for personnel regarding security awareness to equip personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Bank's information security policies, standards, processes, and practices. Staff IT training process is monitored, tracked and reported to the IT Committee and Board of Directors. We have also employed a program of staff phishing tests with staff response evaluated and reported to the IT Committee and the Board of Directors. Incident Response Program (IRP)


text: As described above, our board of directors has an important role in the oversight of the Company's cybersecurity risk management and strategy, with certain components of such oversight, including matters related to the security of and risks related to computerized information and technology systems, delegated to the audit committee.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: Furthermore, we have also obtained cybersecurity insurance coverage to enhance protection and minimize potential financial losses arising prioritize cybersecurity within our supply chain, both nationally and globally, by assessing our third-party cybersecurity posture to provide secure visibility with our partnerships. As part of our due diligence processes, we conduct security questionnaires and service provider reviews, to align our cybersecurity standards on the onset of our partnerships. Additionally, we collaborate closely with a third-party vendor to enhance supply chain resilience. This collaboration involves leveraging their expertise to inform decision-making and enhance risk oversight processes, ensuring greater robustness, and adaptability in managing supply chain challenges.

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our CFO. Senior Director, Information Technology, and General Counsel. As part of those processes, members of management, including our Senior Director, Information Technology and CFO, would work to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes are designed to report certain cybersecurity incidents to the audit committee of the board of directors.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: Our management team, including our Cybersecurity management team, has primary responsibility for our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity management team is led by Brian Fellon, our Vice President, Chief Information Officer and Chief Information Security Officer (VP, CIO and CISO). Mr. Fellon joined NW Natural and was appointed to his role by the Board of Directors in September 2024. Mr. Fellon reports to our Chief Financial Officer. He has 28 years of experience in information technology. Prior to joining NW Natural, Mr. Fellon served as Director of Information Technology at Puget Sound Energy in Bellevue, Washington from 2016 to September 2024, where he was responsible for applications services, artificial intelligence and data.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, due to evolving cybersecurity threats, it may not be possible to anticipate, prevent or stop future cybersecurity incidents, including attacks on our information systems and data or those of our relevant business partners. See "Risks Related to Information Technology" in Item 1A. Risk Factors.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: To strengthen the defenses of our information systems, we have already implemented foundational controls that secure our customers' and employees' data and data relating to our intellectual property, We are also currently developing and deploying other various security tools and measures. These include internal reporting mechanisms and frameworks, monitoring systems, and certain third-party programs and solutions, including penetration testing with third-party security firms.

companyName: META MATERIALS INC.


text: Chief Executive Officier ("CEO") is tasked with oversight of risks from cybersecurity threats. Our CEO interfaces with our consultant periodically to assess vulnerability to cybersecurity threats and determine actions to be taken in response to such threats.

companyName: Norris Industries, Inc.

ticker: NRIS


text: We design and assess our program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF, ISO 27001 and other frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program is assessed by third-party security auditors on a yearly basis through our SOC II Type 2 and SOX audit processes.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment, including, by regularly scanning our environment for vulnerabilities, performing penetration testing and engaging third parties to assess the effectiveness of our technical cybersecurity practices.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We continue to expand investments in IT security, including additional end-user security awareness training, using layered defenses, identifying and protecting critical systems, strengthening monitoring and alerting, and engaging experts as needed. We also use an industry standard risk quantification model to identify, measure, and prioritize cybersecurity risks. This in turn, helps us develop and implement effective security controls and technology defenses. In addition, all employees are required to complete various cybersecurity awareness trainings on a regular basis. Further, we perform periodic simulations and tabletop exercises with the IT security team and will continue to expand its participants as appropriate. Our assessment of risks associated with the use of third party providers is on a limited basis and is part of our current overall cybersecurity risk management approach. As the threats and attacks are becoming more sophisticated, we will modify and enhance our cybersecurity program as needed.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: Our CISO holds degrees in Business Administration and MIS from the University of Oklahoma and is certified in Leadership from Harvard Business School's executive education. In 2018, he obtained his Chief Information Security Officer certification from Carnegie Mellon University.

companyName: NORTHWEST PIPELINE LLC


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Business Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Business Manager's management, and our Board and Audit Committee, as appropriate.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer and Senior Director, Information Security. Such individuals have collectively over 20 years of prior work experience in various roles involving managing and safeguarding information security, formulating and executing strategies for cybersecurity, and instituting programs for information and cyber protection, as well as several relevant degrees and certifications, including Certified Information Systems Security Professional, or CISSP, Offensive Security Certified Professional, or OCSP, M.S. Cybersecurity and Information Assurance, M.B.A. Information Systems. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: Our information security function is led by our Chief Information Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: We regularly assess our cybersecurity program's capabilities and tools to help us enhance reliability and scan our environment for vulnerabilities. Our IT risk management team, including our Corporate Vice President – Chief Information Security Officer ("CISO"), communicates with senior management on the cybersecurity risk posture of our IT assets, strives to ensure consistent risk remediation activities, and monitors the effectiveness of our IT-related controls. In addition, our internal audit team performs reviews of our information security organization to help ensure controls are operating effectively and as designed.

companyName: FEDEX CORP

ticker: FDX


text: We regularly experience cyberattacks and other incidents, and will continue to experience varying degrees of attacks and incidents in the future. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however we cannot guarantee that material incidents will not occur in the future.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our Board of Directors for consideration.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: Our operations rely on third-party suppliers, vendors, software programs, hardware products, and network systems, including cloud-based technologies, and we have processes to identify and evaluate cybersecurity risks and incidents associated with certain identified third-party providers.

companyName: Installed Building Products, Inc.

ticker: IBP


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and contract manufacturing organizations. We maintain a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. The strategy includes vendor risk assessments, security assessment reviews, and imposing information security contractual obligations on a vendor as appropriate. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategy may involve different levels of assessment designed to help identify, mitigating and manage cybersecurity risks associated with a particular provider.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: We have in place an incident response plan to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents. The Information Security Risk Council, Executive Leadership, the Audit Committee, and the Board are notified of any material cybersecurity incidents through an established escalation process. Additionally, we maintain a qualified third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.

companyName: FASTENAL CO

ticker: FAST


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. Specifically, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register; (2) the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Technology Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the board of directors, which evaluates our overall enterprise risk.

companyName: MACROGENICS INC

ticker: MGNX


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: NEVRO CORP


text: We also use third-party service providers to perform a variety of other functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, and distributors. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a review of certain vendors' written security program, a risk assessment for certain vendors, and imposition of information security contractual obligations on certain vendors.

companyName: GENELUX Corp

ticker: GNLX


text: Additionally, all of the Company's employees are required to undertake an annual cybersecurity training program on how to identify characteristics of various cybersecurity threats and ways to report such threats, which is augmented by additional training and communications on IT and cybersecurity matters throughout the year. Periodically during the year, the Company's IT department leads simulations of cybersecurity incidents with employees, including annual tabletop exercises for offshore employees, to test the organization's ability to respond to a variety of cybersecurity-related scenarios.

companyName: Valaris Ltd

ticker: VAL


text: Our cybersecurity strategy encompasses a comprehensive suite of measures designed to protect our systems and data from unauthorized access, use, alteration, or destruction. These measures include, but are not limited to: Implementation of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols, to safeguard our network and data. Regular security assessments and penetration testing conducted by external experts to identify and remediate potential vulnerabilities. Establishing and maintaining incident response and recovery plans to ensure timely and effective responses to any cybersecurity incidents.

companyName: AppTech Payments Corp.

ticker: APCX


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: We have developed and maintain a Material Cyber Incident Disclosure Program. The program includes processes for the identification, review and assessment of materiality of cyber events, notification of our senior leadership and Board of Directors of such events, and financial reporting disclosure where applicable. As part of the program, we also engage in due diligence regarding the cybersecurity capabilities of our current and potential third-party vendors in accordance with industry best practices. Under the program, all material cyber incidents will be reported to our Board of Directors. The program is led by our Cyber Event Disclosure Committee, which includes members of our Information Security, Corporate Legal, External Reporting and Enterprise Risk Management teams. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. For all critical third party service provides, we perform a review of the vendor's System and Organization Controls (SOC), which is referred to as a SOC 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to understand and mitigate any additional risks. Our assessment of risks associated with use of third-party providers is part of our overall risk management framework.

companyName: REVVITY, INC.

ticker: RVTY


text: Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Revance Therapeutics, Inc.


text: Our Risk Assessment Program The Company has a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks the Company faces include targeted attacks, ransomware, data theft, virus and intrusion software, as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. For a full discussion of cybersecurity risks facing the Company, please see Part I, Item 1A. Risk Factors - WE ARE SUBJECT TO CYBERSECURITY AND INFORMATION TECHNOLOGY RISKS RELATED TO BREACHES OF SECURITY PERTAINING TO SENSITIVE COMPANY, CUSTOMER, EMPLOYEE AND VENDOR INFORMATION AS WELL AS BREACHES IN TECHNOLOGY USED TO MANAGE OPERATIONS AND OTHER BUSINESS PROCESSES. Key aspects of the Company's cybersecurity program include the following: • layered technical protective capabilities and detective surveillance controls; • utilizing independent third parties to assess the Company's practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • courses and awareness training on information security for employees with Company email or access to Company devices, including phishing, social engineering and other cybersecurity training as well as targeted training for specific roles based on responsibilities and risk level; • global security and privacy policies; and • business continuity, incident response and disaster recovery procedures, including table top exercises involving senior leaders. The Company carries cyber insurance which provides coverage in connection with cybersecurity breaches.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Material Risks & Integrated Overall Risk Management the Company does not have a formalized cybersecurity risk management process. However, the organization is working toward implementing a framework for assessing, identifying, and managing material risks from cybersecurity threats. This includes assessing cybersecurity risk as part of an overall risk assessment and considering the likelihood and potential consequences of each risk. Plans also include the identification of critical cybersecurity risks (e.g., malware, phishing, ransomware, and unauthorized access) and the implementation of formalized mitigants to address those risks such as cybersecurity policies and incident response strategy.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB


text: The Board, in coordination with the ESCR Committee, is responsible for the oversight of risks from cybersecurity threats. The responsibilities of the ESCR Committee include overseeing policies and management systems for cybersecurity matters and reviewing CNX's strategy, objectives, and policies relative to cybersecurity. In addition, the Board and the ESCR Committee receive regular presentations and reports on cybersecurity risks that address a wide range of topics, including recent developments, personnel changes, discussion of testing and vulnerability assessment efforts, technological trends or tools, third party updates, and regulatory standards. The CNX IRP calls for prompt and timely direct notifications and updates to the Board (or its committees) as necessary in connection with potentially significant cybersecurity incidents that may occur. On a periodic basis, the Board and the ESCR Committee discuss our approach to cybersecurity with our Vice President Information and Technology.

companyName: CNX Resources Corp

ticker: CNX


text: Our cybersecurity risk management program includes: • Ongoing risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Teads Holding Co.

ticker: TEAD


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence..

companyName: BlackRock Capital Investment Corp


text: We and our advisor have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems as they have been designed to fit within and complement the enterprise-wide risk assessment framework as implemented by our management and our advisor and as overseen by our board of directors. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers.

companyName: Pacific Oak Strategic Opportunity REIT, Inc.

ticker: PCOK


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the security management department, CIO, Chief Financial Officer ("CFO"), Chief Executive Officer ("CEO") and others. The security management department, CIO, CFO, CEO, and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes reporting to the Board for certain cybersecurity incidents.

companyName: TerrAscend Corp.

ticker: TSNDF


text: We engage third-party service providers, including professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and dark web monitoring services, to assist in identifying, assessing, and managing material risks from cybersecurity threats.


text: Our internal audit team conducts security controls testing over systems in scope for various regulatory and compliance requirements. In addition, management performs periodic third-party risk assessments, vulnerability testing, system and cloud security assessments against our information technology environment. Management also engages third-party external auditors to perform independent testing against all systems in scope for our regulatory and customer-driven compliance obligations.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Cybersecurity risk management is an essential part of our overall risk management strategy. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: We also require our employees to participate in cybersecurity training and awareness programs. Company's employees are expected to help safeguard the Company's information systems and to assist in the discovery and reporting of cybersecurity incidents.

companyName: ZyVersa Therapeutics, Inc.

ticker: ZVSA


text: Management, including our Principal Executive Officer and Principal Financial Officer, oversees our enterprise risk management process in collaboration with our Manager and our Manager's parent company. Our Principal Executive Officer and Principal Financial Officer bring over 17 and 20 years of experience, respectively, in overseeing IT infrastructure management as part of their executive and audit committee roles across various companies. Additionally, both have completed cybersecurity training to enhance their expertise in risk management and IT security.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: We also conduct external and internal risk management audits to assess and report on our internal incident response preparedness and help identify areas for continued focus and improvement. We conduct periodic penetration testing to identify vulnerabilities in our products, services, and systems. We also undergo security-related industry certifications and attestations by external auditors, including System and Organization Controls (SOC) 1, SOC 2, International Organization for Standardization (ISO) 27001, 27017 and 27018, Cloud Security Alliance Security Trust Assurance and Risk (CSA STAR), Payment Card Industry Data Security Standard (PCI DSS) and other compliance frameworks. Additionally, our vendor risk management program identifies and mitigates risks associated with third-party service providers, including those within our supply chain and those with access to our customer or employee data or systems. We use the findings from these and other processes to review our information security practices, procedures and technologies.

companyName: ORACLE CORP

ticker: ORCL


text: Our information security program covers a range of cybersecurity activities with a primary objective of maintaining the confidentiality, integrity, and availability of information for our business and customers. The program and our systems are designed to identify and mitigate information security risks and data privacy breaches. Our risk mitigation processes include a cybersecurity incident response plan that is exercised regularly with tabletop exercises, security awareness training with attack simulations to reinforce the training, cybersecurity risk assessment integrated with technology acquisition processes and utilization of third-party partnerships for threat intelligence, incident response and escalation, and attack surface monitoring.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: The Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity program and receives periodic reports regarding the program. These reports include updates on our information security program and the status of projects to strengthen our information security systems. The Board also receives reports regarding cybersecurity risks.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: Cybersecurity threat risks have not materially affected the Company, including its business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Organizational Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."

companyName: Apollo Realty Income Solutions, Inc.


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board receives periodic updates from our Chief Executive Officer and President regarding the overall state of our cybersecurity program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.

companyName: Nxu, Inc.

ticker: NXUR


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.

companyName: New York REIT Liquidating LLC


text: Annual tabletop exercises to test incident response plans, improve communication and coordination between relevant employees, and identify gaps to inform needed adjustments to plans;

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: –Information Technology Department: The information technology department consists of employees with extensive cybersecurity experience, including the Chief Digital and Technology Officer and Corporate Vice President, IT Infrastructure Operations and Security, as well as a team of compliance and security associates. Cybersecurity experience within the information technology department includes prior work experience and bachelor's degrees or higher in technology related fields. In addition to internal resources, management engages a cyber insurance carrier with comprehensive data privacy and security risk management services; a managed security service provider with comprehensive security solutions, including continuous network monitoring, reporting and assistance with investigation; and an information security consulting company that consists of cybersecurity experts and information security practitioners to provide additional cybersecurity support. Management also maintains a system of information technology controls and procedures, including controls and procedures related to authentication and access, recovery plans and secured backups of data, the design of applications and selection of packaged software, and testing of significant changes in applications and infrastructure technology. Management also provides training to its employees about cybersecurity, performs penetration testing at least annually, performs security incident preparedness activities at least annually, and performs an annual Payment Card Industry ("PCI") attestation. Third party providers involving information technology are identified as part of the contract review process. System and Organizational Controls ("SOC") reports are reviewed annually for third party providers. The information technology department continuously monitors for cybersecurity threats in order to detect if a cybersecurity incident has occurred. The department uses endpoint detection and response ("EDR") and security information and event management ("SIEM") with the assistance of a managed security service provider and internal analysts to detect and identify threats. Lastly, management follows the National Institute of Standards and Technology ("NIST") Framework, which enables management to compare the Company against the industry and manage dynamic cybersecurity risks.

companyName: Six Flags Entertainment Corporation/NEW

ticker: FUN


text: Board Oversight and Governance Getty Images' board of directors has delegated the oversight of cybersecurity risks to the Audit Committee. The Audit Committee assists Getty Images' board of directors in its oversight of the policies and practices used by Getty Images to identify, assess and manage key risks facing Getty Images, including cybersecurity risks. Members of management, including the Company's Chief Technology Officer ("CTO"), provide the Audit Committee with updates on cybersecurity and information technology matters. In turn, the Audit Committee and management also provide updates to Getty Images' board of directors. In addition to reporting to the Audit Committee and Getty Images' board of directors, the CTO provides periodic reports to our Chief Executive Officer and other members of our senior management as appropriate. The Audit Committee, or Getty Images' board of directors, is notified of cybersecurity incidents, as appropriate, in accordance with the Company's incident response processes.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: The Company, with its information technology partner, maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident.

companyName: Longeveron Inc.

ticker: LGVN


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024. The CCO has been responsible for this oversight function as CCO to the Fund for three years and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.

companyName: Fidelity Private Credit Co LLC


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties. Any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data.

companyName: AA Mission Acquisition Corp.


text: Potential and actual cybersecurity incidents are primarily handled by our internal incident response team, which is supervised by our CISO. Our incident response team is responsible for assessing the potential risk posed by an incident, providing notice to appropriate stakeholders in the company based on the perceived risk, and coordinating the assessment, containment, mitigation, and remediation efforts. Depending on the severity and scope of the incident, we also may engage external consultants. Security personnel and consultants retained by our service providers also may be involved in cases where our vendors experience a cybersecurity incident. We have processes for escalating an incident to determine whether it is material and requires notification required under applicable laws, rules and regulations.

companyName: GoDaddy Inc.

ticker: GDDY


text: During the year ended December 31, 2024, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Company. For discussion of the risks from cybersecurity threats, including potential impact to the Company's business strategy, results of operations, and financial condition, refer to "Item 1A – Risk Factors – The Company's information systems may experience an interruption or breach in security" in this Report, which is incorporated by reference in this paragraph.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, and financial condition. For more information about these risks, see the disclosure under the heading "Technology and Cybersecurity Risks" in Part I, Item 1A. Risk Factors.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: In order to oversee and identify risks from cybersecurity threats associated with the Company's independent bottling partners, distributors, wholesalers, retailers and other business partners, as well as our use of third-party service providers, we maintain a third-party risk management program designed to help protect against the misuse of information technology. We have various processes and procedures to evaluate cybersecurity threats associated with third parties, including requiring key third-party service providers to complete initial and periodic security assessments. In addition, our Global Chief Information Security Officer ("CISO") and other senior leaders regularly meet with key bottling partners to discuss cybersecurity risks and mitigation programs in order to advance risk management capabilities and proactively share cybersecurity guidelines and best practices.

companyName: COCA COLA CO

ticker: KO


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having an independent third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: Inhibrx, Inc.


text: We perform periodic risk assessments of the Company's information systems based on regulatory guidance issued by the Federal Financial Institutions Examination Council (FFIEC) and state and federal regulators, including the FDIC and the UDFI. We use multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents. We also engage multiple independent third parties or cyber experts to detect and defend against cybersecurity threats and to assess information security programs and practices including penetration testing. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analyses regarding current threats.

companyName: Finwise Bancorp

ticker: FINW


text: Our Senior Vice President of Information Technology manages our security program. Oversight of the program occurs via IT metrics-based updates provided to an Information Technology Steering team (consisting of the executive officers and other key employees of the Company) on a quarterly basis. Additionally, multiple elements of our cybersecurity security program are tested internally and externally on a bi-yearly basis in alignment with our Sarbanes-Oxley information security controls, and we engage independent third parties annually to assess the risks associated with our information technology assets. Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets. Lastly, a cybersecurity risk assessment is provided to our Board of Directors on an annual basis which includes metrics, security incidents, key risk indicators, and risk mitigation plans as well as on the status of material risks, mitigation measures, and incidents related to such risks. Our Board of Directors has overall responsibility for risk oversight, with the Information Technology Steering team assisting the Board in performing this function based on its respective areas of expertise. As such, the Information Technology Steering team performs materiality determinations of cyber incidents and advises the Board of Directors accordingly.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: The cybersecurity and data protection program at Littelfuse is based on foundational principles outlined in applicable industry and internationally accepted-cybersecurity frameworks. The Company has experienced and will continue to experience cyber-attacks, attempts to breach its systems, and other similar incidents, however we do not believe that the prior cyber incidents have materially affected or are reasonably likely to materially affect the Company. Littelfuse faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows, or reputation. Like all cybersecurity programs, there is no guarantee that every attack method and technique has been fully addressed, as these change constantly, but Littelfuse is diligent in its attempts to protect data of the Company and its stakeholders.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Information Systems Acquired from Horizon Therapeutics plc On October 6, 2023, we completed our acquisition of Horizon. Horizon's legacy information systems are currently maintained separately from Amgen's preexisting information system infrastructure. After we are able to fully evaluate Horizon's legacy information systems, protocols and practices, we plan to operationally integrate the legacy Horizon systems into our own, and these integrated systems will then be subject to Amgen's cybersecurity risk management structure and strategy. While we integrate these systems, our CISO and CDT function are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Horizon information systems are assessed, mitigated and remediated by our CDT function's Incident Response and Cyber Threat Intelligence teams and reported in accordance with the governance processes detailed above. See Item 1A. Risk Factors—Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions and Item 1A. Risk Factors—A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.

companyName: AMGEN INC

ticker: AMGN


text: Our Information Security Program includes proactive measures to manage cybersecurity risks and threats, including mandatory annual security awareness training for all personnel with enhanced training for designated information security personnel; enterprise-wide phishing simulations and security assessments; a business continuity and recovery plan in the event of a cybersecurity incident; and the implementation of targeted access controls and various other measures, including multi-factor authentication, with respect to certain systems containing sensitive information. We have also implemented an incident response plan to guide our response to cybersecurity incidents, with a dedicated, cross-functional response team, including senior management from our information technology, information security, finance, risk management, investor relations and legal teams, responsible for overseeing efforts related to detection, containment, threat mitigation and notification, as appropriate. We identify vulnerabilities in our information systems through proactive scanning of system assets for known vulnerabilities. Our outsourced managed security source operates 24/7, identifying threats and vulnerabilities, and our information security team regularly monitors alerts and meets to discuss trends in cybersecurity threats. We proactively manage vulnerabilities from major software publishers through a global patching program. To prevent unauthorized access to our information systems, we have a system of controls in place to manage user access to our information systems. Our employees acknowledge an acceptable use policy and are trained in how to identify information security risks in the workplace.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: Our board of directors plays a crucial role in overseeing our cybersecurity program. The board receives regular updates on cybersecurity program's status and effectiveness by the Cybersecurity committee. The audit committee oversees the cybersecurity program and provides strategic guidance to management, ensuring that our approach to cybersecurity remains robust, proactive, and aligned with our business needs.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: Our full Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, and, in conjunction with the Audit Committee, the related effects, if any, on financial reporting and internal controls. Our Chief Digital Officer and Chief Legal Officer, in conjunction with members of the Global IT Security team, regularly update the Board of Directors on the Company's cybersecurity risk profile and incidents, if any, and our overall cybersecurity strategy and process improvements.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats by the Vice President of Information Technology. The Company's information technology landscape is not large or complex and it has a limited data footprint which allows the Vice President of Information Technology to be directly responsible and stay aware of all incidents. The Company has sufficient tools and processes in place to allow the Vice President of Information Technology to be effective as the central point person of monitoring and reporting incidents.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: The Adviser has a dedicated cybersecurity team, led by the CISO, which manages and monitors our data protection, privacy and cybersecurity program. In addition, our Adviser has established a Security Governance Committee, led by the CISO, that is responsible for, among other things, communicating information security status and needs to all stakeholders; overseeing that appropriate communication channels about cybersecurity risk occur at all levels and to executive management, including our management and the Audit Committee; and overseeing that appropriate action is being taken and monitored where information risks are identified.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program on a quarterly basis. Board members receive presentations on cybersecurity topics from our Senior Vice President of Information Systems as well as our Vice President of Information Security and Compliance, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Extra Space Storage Inc.

ticker: EXR


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program and is responsible for monitoring and assessing strategic risk exposure, while our management team is responsible for the day-to-day operations over the material risks we face. Our management team, including our Acting Chief Executive Officer, Chief Financial Officer and Vice President of Information Technology, provide periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, if applicable.

companyName: Lite Strategy, Inc.

ticker: LITS


text: follow common industry security standards, such as having two-factor authentication for all accounts, using corporate VPN for service minimize the period of time customers' personal information is stored in our database.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: Our approach to cybersecurity governance is embedded within the broader governance structure of the Company. The Audit Committee of the Board of Directors is tasked with reviewing our policies and procedures related to cybersecurity risks, including the Company's cybersecurity risk management program discussed above, to ensure their alignment with industry best practices and regulatory standards. The Audit Committee and the Board of Directors ("Board") regularly engages with management to assess cybersecurity risks, mitigation efforts, and the overall effectiveness of our cybersecurity program.

companyName: AZZ INC

ticker: AZZ


text: Other members of the CCDC include top executives and management from the Company and its subsidiaries, including A-Mark's General Counsel and Assistant General Counsel, CPO, President, Chief Financial Officer, Chief Operating Officer, Senior Director of Financial Reporting, Senior Director of Internal Audit, and Director of Enterprise Development and Administration, as well as JM Bullion's President and Chief Executive Officer and its Chief Financial Officer. Finally, the CCDC is assisted by an external compliance consultant with over twenty years of IT experience, and A-Mark's outside legal counsel for privacy and data security.

companyName: Gold.com, Inc.

ticker: GOLD


text: Our Head of Information Technology and Security, or Head of IT, has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of information technology professionals to monitor cybersecurity risks on behalf of TScan. Our Head of IT has over 16 years' experience with information technology and cybersecurity risk management programs.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: Our cybersecurity risk management program is a key component of our broader enterprise risk management ("ERM") infrastructure. Cybersecurity and information security, administered by our Head of IT and BrightSpire IT Partner (each, as defined below), is a key component of our broader ERM program, which includes diverse internal management, financial reporting, legal, compliance and risk management controls, policies and procedures primarily under the supervision of senior management. The results of our ERM layers of management control, risk control and compliance oversight and independent assurances are reviewed with senior management, our Audit Committee (independent directors, primarily responsible for oversight of our overall risk profile and risk management policies) and Board of Directors quarterly. We have focused on the following cybersecurity initiatives.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CFO, the Chief Operating Officer ("COO") and the IT consultant having over 30 years of information security experience. The CFO and COO each have over 10 years of experience in roles with responsibility for overseeing information technology and security functions.

companyName: IN8BIO, INC.

ticker: INAB


text: If a potential cybersecurity breach were to be identified, management would implement its incident response plan. This plan, which provides for a quick, effective and orderly response to information security incidents relies on our Incident Response Team ("IRT") to report findings to management and the appropriate authorities as necessary. The IRT, comprised of various cross-functional subject matter experts, is also responsible for: a. Detecting and analyzing suspicious events that might indicate an event has occurred;

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG