text: Cybersecurity risk management will be an integral part of our overall enterprise risk management efforts once the Company has determined how and what security measures will need to be deployed. No enterprise risk can be eliminated entirely. We will seek to mitigate as much risk as possible and manage the remaining financial risk internally.

companyName: ADVANCED OXYGEN TECHNOLOGIES INC

ticker: AOXY


text: We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: Origin Materials, Inc.

ticker: ORGN

secItem: Item 1C


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: SEKISUI HOUSE U.S., INC.


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: BIOLASE, INC


text: The Company has robust processes for assessing, identifying and managing material risks from cybersecurity threats that are integrated into our overall risk management process. The Company utilizes the National Institute of Standards and Technology (NIST) framework as the basis for our cybersecurity management approach. Under the supervision of the Chief Information Officer ("CIO"), we review our cybersecurity insurance policy and regularly identify all computing assets including hardware, software, and network infrastructure for a comprehensive risk assessment. We consider threats that may originate from both internal and external sources and build in technical security controls based on a defense-in-depth strategy. To identify risks, we complete vulnerability assessments on a recurring basis to proactively identify potential weaknesses. We additionally employ third party external and internal penetration testing on an annual basis to assist in identifying additional vulnerabilities in our environment. We also perform disaster recovery exercises throughout the organization annually by our in-house team. In connection with our threat management and overall risk management process, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors and apply the MITRE ATT&CK framework to review defensive coverage against cybersecurity attacks. Employees at H&E receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. Our managed detection and response partner provides 24/7 monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. We additionally have a comprehensive incident response plan that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents.

companyName: H&E Equipment Services, Inc.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY Old National's enterprise risk management program is designed to identify, assess, and mitigate various financial, operational, regulatory, legal, and reputational risks. Cybersecurity is a critical component of that program, especially in light of the significant, persistent, and ever-evolving cybersecurity risks facing us and other financial institutions. For further discussion of such risks, see the section entitled "Risk Factors" in Item 1A of this Form 10-K under the heading "Operational Risks." Our objective is to maintain a robust cybersecurity program designed to protect the confidentiality, integrity and availability of our information systems and critical operational processes, including through identification of material information assets and systems, deployment of controls designed to protect against known cybersecurity threats, prompt detection of any cybersecurity threats that make it past our defenses, maintenance of documented, tested approaches for responding to cybersecurity threats and establishment of recovery techniques and technologies to promote resilience from any cybersecurity incidents.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Board receives updates on a regular basis from senior management, including leaders from our information security, compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status of key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Working with our third-party security operations center, we maintain an incident response plan to timely, consistently and compliantly address any cyber event that may occur and have a designated Incident Response Team consisting of representatives from select business functions which is led by our Vice President of Information Technology ("CISO"). We regularly test our incident response plan, conduct compliance audits, periodic tabletop exercises, vulnerability assessments, and where necessary engage third parties to assist with these audits and assessments, as well as mitigation and remediation options and plans.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: As of the date of this report, we have not identified any impacts from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected our results of operation or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information on risks from cybersecurity threats, see Item 1A. Risk Factors.

companyName: Vistra Corp.

ticker: VST


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: CALIX, INC

ticker: CALX


text: Our CISO also regularly meets with our CEO and other members of our management team (or their designees), including our General Counsel, Chief Financial Officer, Chief Communications Officer, and Senior Vice President of Engineering, including as part of the cybersecurity incident response process.

companyName: Snap Inc

ticker: SNAP


text: These service providers carry out cybersecurity risk evaluations such as periodic assessments and vulnerability scans to pinpoint potential security flaws and suggest enhancements. In addition, we employ third-party technology and other solutions to enhance our protection against cybersecurity risks. These solutions include our use of a managed security service provider to support our in-house technology team, an endpoint detection and response, or EDR, system for ongoing surveillance, detection, and action against threats, as well as a security information and event management, or SIEM, system designed to automate the real time identification, investigation and prioritization of critical alerts.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: The Audit Committee receives periodic reports from our Vice President of Cybersecurity and Information Technology on our cybersecurity risks, updates, as necessary, regarding any cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: Our board recognizes the critical importance of maintaining the trust and confidence of our patients, business partners and employees. Our board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Through our ERM program, risks are identified, assessed and managed at the organization level, mission and business process level, and information system level. Our cybersecurity program, policies and procedures are fully integrated into our ERM program and are maintained in accordance with industry good standards. We also have an Information Security program that more specifically addresses cybersecurity risks and is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Cybersecurity and data protection are important for the Company to maintain the trust of our customers, team members and stakeholders. Overseen by the Board of Directors and its Risk Committee, we regularly review, and as appropriate, adapt our Cybersecurity Program to an evolving landscape of emerging threats, evaluate effectiveness of key security controls, and assess cybersecurity best practices.

companyName: Citizens Community Bancorp Inc.

ticker: CZWI


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: Our cybersecurity risk management program consists of technical and organizational safeguards aimed at protecting the confidentiality of our systems and platforms. From time to time, management will engage external consultants and advisors to perform independent assessments and testing of the cybersecurity risk management program, or otherwise assist with aspects of the program and security controls.

companyName: Okta, Inc.

ticker: OKTA


text: The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by our Board of Directors, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our incident response plan provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, contain, assess severity, escalate, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate reputational damage.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: Our cybersecurity risk management program also includes: • a multi-layered approach to cybersecurity in order to protect our assets; • identification of key risk areas through internal reviews and researching trends; • continuous mitigation in the areas of human behavior, data breaches, remote work, third party vendors, removable media and emerging threats; • performance of multiple assessments both internal and external; • quarterly mandatory security training for employees as well as monthly phishing tests; and • multi-factor authentication.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Third-party risk mitigation in cybersecurity is a crucial aspect of safeguarding our digital assets and ensuring data integrity and privacy. We monitor and manage the potential vulnerabilities and security gaps that can arise when working with external vendors, partners, or suppliers who have access to sensitive information or systems. We assess the cybersecurity practices of our third parties by evaluating their compliance with security standards. Evaluating third-party compliance helps us mitigate the risks of data breaches or security incidents originating from external sources, ultimately safeguarding our reputation, legal compliance, and overall cybersecurity posture.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. Our third party vendors may also experience threats and cybersecurity incidents from time to time. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: Security assessments of all third -party providers proportional to the risks present, before or soon after engagement, and periodically thereafter Contractual requirements for security and privacy protections Continuous monitoring of critical third -party services Incident response coordination with key vendors Regular audits of third -party security controls for those handling sensitive data Before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, we conduct thorough information security assessments. All third parties with access to our information systems must review and acknowledge our acceptable use policy before access is granted.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: To date, we have not experienced cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. For additional information regarding cybersecurity threats, see Item 1 of this Report, "Business – Cybersecurity" and Item 1A of this Report, "Risk Factors—5. Operational Risk—An interruption in or breach in security of our information systems, or other cybersecurity risks, could result in a loss of customer business, increased compliance and remediation costs, civil litigation or governmental regulatory action, and have an adverse effect on our results of operations, financial condition and cash flows."

companyName: FNB CORP/PA/

ticker: FNB


text: We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Seritage Growth Properties

ticker: SRG


text: We have developed and implemented a cybersecurity program that seeks to ensure the confidentiality, integrity, and availability of our information assets, including its critical systems. We use information security management standards like ISO 27001 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: Our Chief Information Security Officer ("CISO") and the direct reports to the CISO (including the Senior Director of Information Security and the Senior Director for Governance, Risk and Compliance, collectively, the "CISO Team") help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of a risk register. The CISO Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and/or external audits, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds, and third-party-conducted red/blue team testing and tabletop incident response exercises.

companyName: Rubrik, Inc.

ticker: RBRK


text: Role in Cybersecurity Risk Management part of our overall risk management process, our management engages at least annually in an enterprise risk management review and evaluation, during which management reviews the principal risks relating to our business and operations. Included in this process is a review and evaluation of our risks relating to our Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including documentation discussing each service providers' information security and privacy controls. Any failure in our or our key service providers' cybersecurity systems could have a material impact on our operating results. See "Item 1A. Risk Factors - General Risk Factors - The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."

companyName: SURO CAPITAL CORP.

ticker: SSSS


text: Third-party security firms are used by the Company in different capacities to provide or operate some of these controls and technology systems. Third parties are also used to conduct assessments, such as vulnerability scans and penetration testing of the Company and its systems. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services.

companyName: LA-Z-BOY INC

ticker: LZB


text: Our CISO and other members of senior management responsible for our information security program have extensive experience assessing and managing risks from cybersecurity threats, including decades of experience in information technology and information security positions; serving in information technology leadership positions at other large public companies; and having other significant experience in the areas of risk management, information technology, and information security. Our CISO has more than 27 years of experience in information technology and/or information security, including more than 13 years in such positions in the hospitality industry.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: As a government contractor, we are required to comply with extensive regulations and standards, including but not limited to, cybersecurity regulations and standards and the requirements of the DFARS. Additionally, our cybersecurity risk management program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our policies and implemented controls have been assessed by external organizations, including industry partners and the federal government. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations. These contractual requirements include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. government.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the FDA related to adequately safeguarding patient information. We work with our in-house and cybersecurity vendors on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We have engaged third-parties to conduct evaluations of our security controls, including through penetration testing, independent audits, and consulting on best practices to address new challenges. We require that our employees and subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on our systems and operations.

companyName: vTv Therapeutics Inc.

ticker: VTVT


text: Changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our Cybersecurity Steering Committee ("CSC"), an executive management-level cross-functional group.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program aligns with Wolfspeed's Enterprise Risk Management (ERM) program and addresses information technology and business environments. Our cyber risk management program is designed based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and we aim to incorporate industry best practices throughout.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risk. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: A dedicated team at our corporate headquarters, which is led by our Director of Data Security ("DDS") and composed of the Chief Technology Officer ("CTO") and representatives from risk management, legal, internal audit, and finance departments, is responsible for assessing and managing our cybersecurity risks and data protection practices. The Audit Committee oversees the measures taken by this team to monitor material risks associated with cybersecurity threats, a role crucial to maintaining a robust and effective cybersecurity risk management approach. The DDS and CTO provide formal briefings to the Audit Committee on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, and other areas of importance at least once a year, with the Board of Directors receiving updates periodically. Regular discussions on enterprise risks are held between the Audit Committee, Board of Directors, and senior management.

companyName: WATSCO INC

ticker: WSO


text: Related to Cybersecurity Risks Our Director of Infrastructure, Operations and Cybersecurity, who has over ten years of experience managing organizational operations, security and infrastructure, manages the Company's cybersecurity program. We have a cyber subcommittee (the "Subcommittee"), which includes members of our finance, legal, and IT departments, that meets periodically to discuss the Company's ongoing cybersecurity efforts. The Subcommittee reports to the Chief Operating Officer ("COO") and Chief Financial Officer ("CFO"), who report outputs from the Subcommittee regarding potential cybersecurity risks to the Company's executive team and the board. The Director of Infrastructure, Operations & Cybersecurity is responsible for the day-to-day monitoring and remediation of cybersecurity risks.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: Although we devote significant resources to implementing, maintaining, testing and upgrading our cybersecurity systems and processes, these security measures do not provide absolute security. Despite our efforts to maintain an effective cybersecurity risk management program, it is possible that our cybersecurity risk mitigation and prevention efforts may not be able to adequately mitigate or prevent all possible security breaches, whether because of the use of new techniques that may not be known or recognized, because cyber-attacks can originate from a wide variety of sources, or for other reasons. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; however, there can be no assurance that a cybersecurity incident that could have an adverse material impact on us will not occur in the future. See "Risk Factors—We are subject to cybersecurity risks and security breaches and may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents."

companyName: Enova International, Inc.

ticker: ENVA


text: Our Cybersecurity Program, which we are aligning with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, provides a framework for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with our regulators to ensure that these policies are adequately designed to appropriately safeguard personal information. We use a variety of processes and technologies to monitor for and identify cybersecurity threats, including vulnerabilities scans, endpoint and network monitoring software, and email scanning software. We also have a Cyber Incident Response Policy and detailed plans which are updated and exercised annually. Our cyber defenses are reviewed annually by third-party penetration testers using the Adversarial Tactics, Techniques and Common Knowledge ("MITRE ATT&CK") framework and the incident response plan is reviewed by experienced counsel. We incorporate cybersecurity risk reviews of third-party service providers within our Enterprise Third Party Risk Management Program. We conduct annual Cyber Risk Assessments which drive strategic decisions. Employees are required to abide by our cybersecurity and data protection policies and are provided formal cybersecurity training. We maintain a corporate cyber risk insurance policy as part of our cybersecurity risk strategy that is reviewed annually. To date, the Company has not experienced a material cybersecurity incident.

companyName: OneMain Holdings, Inc.

ticker: OMF


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition. As cybersecurity threats become more sophisticated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures.

companyName: Cycurion, Inc.

ticker: CYCU


text: Our CISO and our Security Steering Committee, along with other senior executives including the CEO and CTO, review and manage our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.

companyName: QUALYS, INC.

ticker: QLYS


text: We do not currently believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including its business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future. See "Risk Factors—Operational Risks" for additional discussion of cybersecurity risks to our business.

companyName: U.S. SILICA HOLDINGS, INC.


text: annual cybersecurity awareness training, including phishing simulation campaigns, to educate employees on recognizing cybersecurity threats and preventing actions that could unintentionally grant unauthorized access to our systems;

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The Company recognizes the importance of securing its information, devices, and data and the IT systems it relies on to conduct its business. The Company has established its Network, Information, and Data Security Policy Guidelines (the "NIDSP Guidelines") designed to protect the integrity and confidentiality of data and information belonging to or being exchanged by the Company and its employees, partners, customers, service providers, and suppliers and to safeguard that information and the Company's IT infrastructure from unauthorized access, use, disclosure, alteration, and destruction.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, CROs, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Pluri Inc.

ticker: PLUR


text: Our website is monitored by a third party to check if our website is secure. We are prepared to inform all parties necessary if any breach of cyber-security were to happen. We have never had this problem and so we have never had to inform consultants, auditors, or other third parties.

companyName: IIOT-OXYS, Inc.

ticker: ITOX


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: GTJ REIT, INC.


text: Our Information technology security team has a working relationship with our third-party vendors such as Rapid7, Carbon Black and Cisco to provide guidance related to the management of cybersecurity risks. Our strategy includes both short- and long-term projects to increase the security surrounding our assets by using threat monitoring, threat detection, and SIEM tools within our security systems. We perform cybersecurity assessments with respect to asset scanning, risk assessments, and vulnerability scans with respect to users in our organization and third parties who provide critical services or who have access to critical confidential data.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: The medical device industry faces unique cybersecurity challenges, given the sensitive nature of the data and the critical role of devices in patient care. Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, suppliers, patients and customers. We remain committed to implementing robust security measures to protect against potential cyber threats and vulnerabilities that are constantly evolving across the globe.

companyName: Inogen Inc

ticker: INGN


text: The Audit Committee receives reports from management on our cybersecurity risks no less than twice per calendar year. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Erasca, Inc.

ticker: ERAS


text: •24/7 cyber monitoring. Our security operations center is located in multiple time zones to ensure around-the-clock coverage and timely threat detection and response.

companyName: INSULET CORP

ticker: PODD


text: The Company leverages ISO 27005, an international standard for identifying, measuring, and assessing cybersecurity risks, as a model for measuring its cybersecurity risk. An annual baseline is established to guide development of the information security program. The ISO 27005 model is refreshed as new cybersecurity risks are identified.

companyName: Employers Holdings, Inc.

ticker: EIG


text: Our security team, managed by our Chief Technology Officer ("CTO") and Senior Director, Information Security, helps identify, assess and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk acceptance register. Our security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools; conducting vulnerability scans; penetration tests conducted internally and by third parties; leveraging threat intelligence feeds; reports and services that identify cybersecurity threats; and working with third parties who conduct threat assessments of our platform and APIs.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: Molecular Templates, Inc.


text: We have an enterprise-wide risk management framework for identifying, assessing, managing, monitoring, and reporting our material risks, including cybersecurity risks. Our risk identification and risk and control self-assessment ("RCSA") process assesses the potential likelihood and impact of, among other things, cybersecurity risks to the Company, and the control environment in place to mitigate identified risks. See Item 1A. Risk Factors – "Risks Related to Information Technology, Security and Data" for a description of the cybersecurity risks we face.

companyName: Jackson Financial Inc.

ticker: JXN


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk.

companyName: Jackson Acquisition Co II

ticker: JACS


text: Additionally, we have established a cross-organizational IT steering committee, comprising senior and executive leadership, enterprise risk management representatives, and IT management, many of whom have over 15 years of experience and hold professional certifications in their respective fields. In an effort to build a comprehensive cybersecurity strategy across the organization, this committee convenes as needed to discuss ongoing cybersecurity initiatives, emerging regulatory requirements and industry standards, and results of risk assessments.

companyName: ARGAN INC

ticker: AGX


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Data privacy and data security considerations could impact our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Part of our Enterprise Risk Management program involves understanding risks that third parties, including those that our supply chain introduce to our organization. Our cybersecurity program is in the process of maturing how we assess third-party cyber risks, particularly in situations where we share confidential or sensitive information, or in situations where our operations may be impacted through a cybersecurity incident at a third party.

companyName: Spirit AeroSystems Holdings, Inc.


text: The Company acknowledges that cybersecurity threats present a risk of material adverse impacts on our operations, reputation, and financial condition. Cybersecurity threats are continuously evolving, becoming more sophisticated, and increasing in frequency. For Hawkins, these threats can potentially lead to data breaches, theft of intellectual property, operational disruptions, damage to persons and property, and financial losses. We have a comprehensive cybersecurity risk management strategy designed to promptly identify, assess, and mitigate the risk of occurrence and impact from cybersecurity threats. Despite our efforts, it is not possible to completely identify, prevent or mitigate the impacts of cybersecurity threats.

companyName: HAWKINS INC

ticker: HWKN


text: Our cybersecurity risk management program also seeks to manage cybersecurity risks associated with our use of third-party service providers through risk assessments and imposition of contractual obligations.

companyName: SITIME Corp

ticker: SITM


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; vulnerability management activities; encryption of data; network security controls; data access controls; penetration testing; cybersecurity insurance; and a dedicated security operations team.

companyName: Sweetgreen, Inc.

ticker: SG


text: In addition, our Executive Incident Management Team ("EIMT") is a cross-functional management committee focused on providing executive guidance on the cybersecurity incident response process to facilitate an appropriate and timely response, make decisions related to cybersecurity incidents, and notify appropriate parties with relevant cross-functional expertise in the event of a cybersecurity incident.

companyName: ROKU, INC

ticker: ROKU


text: individuals, including employees and external third-party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; awareness training of our employees, incident response personnel, and senior management;

companyName: SurgePays, Inc.

ticker: SURG


text: As part of our program management activities, we actively engage internal and prominent external experts, as well as industry participants, as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. The Company has adopted a cybersecurity incident response plan (the "Incident Response Plan") which defines our approach for prompt detection, analysis and determination of materiality, prioritization and mitigation of cybersecurity incidents. The Incident Response Plan also includes criteria for escalation to cross-functional committees, including executive management, and notification to our Board, as appropriate. Management also periodically performs tabletop exercises to simulate actual cyber threats to strengthen our policies, standards and related governance processes in response to cyber events. In addition, our internal audit function performs periodic audits or other evaluations to assess our cybersecurity program and compliance with policies and procedures.

companyName: Trinseo PLC

ticker: TSEOF


text: To support our preparedness, we have constituted a Cybersecurity Review Committee ("CRC") and adopted a written incident response plan ("IRP"). The CRC is comprised of cross-functional personnel including Reliance's Chief Information Officer ("CIO"), Chief Financial Officer ("CFO"), General Counsel and Vice President, Enterprise Risk. In the event of a cybersecurity incident, our CRC refers to our IRP and existing management internal controls processes. Pursuant to these prescribed processes, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon reporting obligations, escalating information about the incident to senior management and potentially representatives from the Board, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform tabletop exercises to test our incident response procedures, identify cybersecurity gaps and vulnerabilities and improvement opportunities and exercise team preparedness.

companyName: RELIANCE, INC.

ticker: RS


text: Like other comparable-sized companies, our information technology systems, networks and infrastructure and technology embedded in certain of our control products have been and may continue to be vulnerable to cyber-attacks and unauthorized security intrusions. These types of attacks may include computer viruses, malicious code, unauthorized access, phishing attempts, denial-of-service attacks, among others. For more information about these and other cybersecurity risks faced by us, see Part IA, Item 1A, "Risk Factors - Risks Related to Cybersecurity and Technology."

companyName: Trane Technologies plc

ticker: TT


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our managed cybersecurity provider, notifications from employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event and assessing the severity of the event.

companyName: W. P. Carey Inc.

ticker: WPC


text: Impact of Cybersecurity Risk To date, we have not been subject to any cybersecurity incidents that, individually or in the aggregate, have had a material impact to our operations or financial condition, although we recognize that cyberattacks impacting our networks or systems may have a material adverse effect on our operations in the future, as discussed in our Part I, Item 1A—Risk Factors. We do not have reason to believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our business, reputation, operations, or revenue over the long term.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Oversight of Third-Party Providers When engaging with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity and disaster recovery preparedness. Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide an independent information security audit report and, for vendors unable to provide such audit reports, we take additional steps to assess their cybersecurity preparedness. We also include security and privacy addenda in our supplier contracts where applicable. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Cybersecurity Risk Management Strategy OFG has a comprehensive framework in place to assess, identify and manage material risks from cybersecurity threats. Our Information Security Officer ("ISO") is responsible for overseeing and implementing the Company's cybersecurity risk management framework as part of our broader Information Security Program approved by the Board. Our cybersecurity risk management framework is integrated into the Company's broader risk management system with a focus on monitoring key risk indicators within a defined risk tolerance set by our Board.

companyName: OFG BANCORP

ticker: OFG


text: program, periodic risk assessments are performed the Company's cybersecurity risk, the maturity level of the program, the risk of cyber threats, and the effectiveness practice. The the National Institute of Standards and Technology ("NIST") Framework and the FFIEC's Cybersecurity Assessment Tool to help management identify its risks and determine the Company's cybersecurity posture. environment. defense-in-depth security the cybersecurity controls and fostering a resilient operational framework.

companyName: USCB FINANCIAL HOLDINGS, INC.

ticker: USCB


text: The management team anticipated to have primary responsibility for assessing and managing Revelyst's cybersecurity risks have extensive years of collective experience on the subject and members hold multiple certifications, including CISSP, CCNP, CISA, and CySA+.

companyName: Revelyst, Inc.


text: Blackstone's CSO and CTO have extensive experience in cybersecurity and technology, respectively. Blackstone's CSO is a Senior Managing Director in BXTI and is responsible for all aspects of cyber and physical security across Blackstone. He has over 25 years of information security, technology and engineering experience, including having previously led the international security organization at a large credit bureau.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Our business does not require us to collect personal customer information. We minimize other cybersecurity risks by using specialized service providers for sensitive operations such as payroll processing, credit card transactions, email, and remote data backup. We verify our information service providers ' cybersecurity policies.

companyName: NVE CORP /NEW/

ticker: NVEC


text: Our cybersecurity program is aligned with various frameworks for managing cybersecurity risks, such as the National Institute of Standards and Technology Cyber Security Framework for IT systems and International Electrotechnical Commission 62443 which governs cybersecurity for Industrial Control Systems. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access; protection of sensitive information; detection, assessment, and response to cyber threats; and continuous improvements to our cybersecurity measures. We seek to achieve our cybersecurity program priorities through a multi-pronged and -tiered approach to address cyber threats and incidents that includes implementation of various industry best practices, proactive monitoring of our IT systems, ongoing employee training, and regular risk assessments. We also maintain cyber insurance coverage to help mitigate a portion of the potential costs in the event of covered events.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives a briefing from management on our cyber risk management program at least annually. Board members receive presentations on cybersecurity matters from our Chief Information Security Officer (CISO), information security team or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: We maintain various technical, physical, and organizational measures, in the form of policies, standards, processes, and technical capabilities, designed to manage and mitigate material risks from cybersecurity threats to our Systems and Data, including, among other things, risk and threat assessment, internal reporting, annual and ongoing cybersecurity awareness training for employees, mechanisms to detect and monitor unusual network activity, as well as threat detection, containment, incident response and backup recovery tools.

companyName: INTELLINETICS, INC.

ticker: INLX


text: As part of our overall risk management strategy, we leverage a defense in depth philosophy, which includes, but is not limited to, additional end-user training, layered technology defenses, identifying and protecting critical assets, strengthening monitoring and warning systems, and engaging industry and subject matter experts. We regularly test defenses by performing simulations and exercises at both a technical level and by reviewing our operational policies and procedures with third-party experts. At the management level, our cybersecurity team regularly monitors alerts and meets to discuss industry threats, trends, and remediation tactics. The cybersecurity team also regularly prepares a cyber report that includes metrics and compliance performance, collects data on cybersecurity threats and risks and conducts an annual risk assessment, which it uses to assess and refine Conduent's overall security posture. Furthermore, we receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity associations, as well as conduct periodic external penetration tests and gap testing to assess our processes and procedures and the ever-changing threat landscape. We have created and continually update, as required, a detailed incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification, and which we implement in the event of a cybersecurity incident.

companyName: CONDUENT Inc

ticker: CNDT


text: The CISO is responsible for assessing and managing material cyber risks. His expertise with assessing and managing material cyber risks is based on more than 20 years of cybersecurity experience with prior roles as a CISO and Global Head of Operations. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity by the ECSO through regular reporting and escalations, as required. He, the CIOO, and others report information about material risks from cybersecurity threats to the Board or a committee or subcommittee of the Board, as described below.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: We maintain a formal cybersecurity program with guidance drawn from the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and other industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: Our Cybersecurity Incident Response Team ("CIRT") is responsible for detecting and coordinating responses to all security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify our Cyber Security Watch Team ("CSWAT"), which is responsible for addressing cybersecurity incidents that raise more significant risks.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CSO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews our cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. In addition to regular updates to the audit committee, we have protocols by which we escalate certain cybersecurity incidents to the board and the audit committee.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, reputational harm, and loss of investor confidence. See Item 1A, Risk Factors, for more information on the cybersecurity threats facing our Company.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: The CISO provides regular updates to the Audit Committee on cybersecurity and other risks relevant to our information technology environment, including developments in the cybersecurity space and evolving standards, the results of periodic exercises and response readiness assessments and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. Our cybersecurity program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee.

companyName: GoPro, Inc.

ticker: GPRO


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. The IT security team is led by our CIO, who has significant experience across information security, infrastructure, operations and compliance. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: The audit committee may receive periodic reports from our CFO concerning the Company's significant threats and risk, including, if applicable, those related to cybersecurity threats, and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: DBV Technologies S.A.

ticker: DBVT


text: Our information security program is one component of our broader enterprise risk management program. As such, KRIs related to cyber risk (which are a subset of operational risk KRIs) are reported to, and overseen and monitored by, our enterprise risk management committee, which is comprised of senior executives of the Company. Additionally, we maintain an incident response framework that details the applicable teams, their functions, and guidelines when a cybersecurity incident occurs. The framework is designed to cover significant aspects of the incident including detection, containment, remediation, and post incident analysis. Various groups of senior executives help oversee responses to security incidents, including the data loss prevention team, the core computer security incident response team, and the extended computer security incident response team.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: PGT Innovations, Inc.


text: We work closely with our internal and external auditors to assess, identify and manage cybersecurity risks. Our IT internal controls are audited by our external auditor as part of our Sarbanes-Oxley Act compliance activities, and this process includes assessing the design and operating effectiveness of those controls.

companyName: RLJ Lodging Trust

ticker: RLJ


text: Management -- Under the oversight of the Audit Committee of the Company's Board of Directors, the Chief Technology Officer, with over 20 years of experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Company's Chief Financial Officer and Chief Technology Officer are responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. See "Item 1. Risks Related to Information Systems Security - As the threat landscape is everchanging, the Company must make continuous mitigation efforts, including risk-prioritized controls to protect against known and emerging threats; tools to provide automated monitoring and alerting; frequent employee training; and backup and recovery systems to restore systems and return to normal operations. However, there can be no assurance that the Company's ability to monitor or mitigate cybersecurity risks will be fully effective, and the Company may fail to identify cybersecurity breaches or discover them in a timely way."

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: Our Processes Regarding Cybersecurity Threats We apply a layered approach, or a defense-in-depth strategy to cybersecurity. This layered approach to security leverages governance, people, processes, and technology to provide our information technology ("IT") teams with preventative measures and strategies such that they are prepared to respond to cybersecurity threats and incidents.

companyName: HERBALIFE LTD.

ticker: HLF


text: As part of our cybersecurity risk management program, our incident response team tracks and logs cybersecurity and data privacy incidents across the Company to identify, assess, mitigate, remediate, and resolve any such incidents. Prior to forming a contractual relationship with a material vendor or third-party service provider that will have access to our information systems or data, we perform due diligence on their cybersecurity and data privacy posture. We conduct annual reviews and tests of our information security program and we periodically review and update our cybersecurity policies. We also periodically utilize qualified third parties to evaluate and assess our cybersecurity risk management program, including through conducting cybersecurity maturity assessments. We utilize cybersecurity user awareness trainings with our employees, cybersecurity insurance, business continuity mechanisms, tabletop exercises, penetration testing, and vulnerability scanning to evaluate the effectiveness of our information security program and improve our security measures and planning. The material results of these assessments are reported to our executive leadership team and the Governance, Risk and Nominating Committee of the Company's Board of Directors (the "Board").

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: As a provider of cybersecurity offerings, we understand that threat actors are increasingly becoming more sophisticated and extremely effective at compromising information and operational technologies. As this trend continues, it is vital that we have processes in place to timely and accurately detect, mitigate, respond to, and remediate cybersecurity incidents, threats or vulnerabilities that may create a material risk to our Company, that could, if the risk occurs, materially impact our Company, including, but not limited to, our financial condition and results of operations. For additional information regarding the variety of material risks we may face, including, but not limited to, those that relate to cybersecurity, refer to "Part I – Item 1A – Risk Factors" in this report.

companyName: SecureWorks Corp


text: We have a Product Cybersecurity Management Review Group (Product Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the product cybersecurity program. The Product Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. The Product Cybersecurity MRG meets regularly with the Principal Engineer – Product Cybersecurity to review the product cybersecurity program, including risks and the status of key initiatives.

companyName: CUMMINS INC

ticker: CMI


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital trust compliance programs. The senior executive leadership-level Cybersecurity Steering Committee ("CSC") is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CSC also receives monthly reports on the Company's cybersecurity program and developments from our CISO and legal representatives. The CSC is chaired by our CISO. The senior executive leadership members include the CIO, Chief Legal Officer, Chief Financial Officer, Chief Compliance Officer, and Senior Vice President of Operations Excellence.

companyName: Baker Hughes Co

ticker: BKR


text: From time to time, the Company engages third party experts to assess the Company's cybersecurity controls and processes. For example, in 2021, the Company engaged an information security consultant to conduct and external, design-focused assessment using the National Institute of Standards and Technology framework to evaluate the Company's cybersecurity controls. The Company's management used the assessment to assist them in evaluating the Company's cybersecurity controls, and its Company's policies and procedures to further align them with industry standards.

companyName: Turtle Beach Corp

ticker: TBCH


text: While we believe that our current cybersecurity measures are robust, we recognize that the cybersecurity landscape is constantly evolving, and we remain vigilant in monitoring and adapting our practices to address emerging threats. We are committed to maintaining the confidentiality, integrity, and availability of our systems and data and to protecting the interests of our clients and stakeholders. ]

companyName: GT Biopharma, Inc.

ticker: GTBP


text: We did not experience a material cybersecurity incident during the year ended December 28, 2024; however, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.

companyName: DIXIE GROUP INC

ticker: DXYN


text: Our cybersecurity program is an enterprise-wide, risk-based program that is designed to support the security, confidentiality, integrity, and availability of our systems and information. We conduct periodic assessments of the cybersecurity program to identify and manage material cybersecurity threats and risks using internal teams and independent third parties. The assessment results are used to develop appropriate cybersecurity controls best practices and risk mitigation strategies, which are then implemented throughout the Company.

companyName: Howard Hughes Corp


text: Global cybersecurity threats and targeted attacks are an evolving risk to data, infrastructure, and overall operations. These risks are addressed through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cyber security threats and effectively responding to cybersecurity incidents when they occur.

companyName: Magnera Corp

ticker: MAGN


text: The Company provides regular, mandatory training for applicable personnel on cybersecurity threats to help them identify, avoid and address cybersecurity threats and to communicate the Company's Cybersecurity Program, including applicable policies, standards, processes and practices.

companyName: BORGWARNER INC

ticker: BWA


text: The Audit Committee of our Board of Directors, or the Audit Committee, provides direct oversight over cybersecurity risk. Our Audit Committee and Board of Directors receive periodic updates from our Chief Business Officer, together with our outside information technology management/cybersecurity consultant, and the Audit Committee and Board of Directors is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: KALA BIO, Inc.

ticker: KALA


text: All tasks related to assessing and managing the Company's material risks from cybersecurity threats are delegated to the risk management committee that oversees our ERM program, which includes cyber-related risk items. In addition, our risk management committee receives quarterly reports on cybersecurity from our global cybersecurity team that has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats. members of our management team have been provided sufficient training to obtain an understanding of cybersecurity risks and exposures.

companyName: Unique Logistics International, Inc.


text: Our executive officers who have experience in IT, work with our board of directors to manage our cybersecurity policies and processes. Together, they stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. They also track how we prevent, identify, lessen, and address cybersecurity issues. This is done through regular checks of our systems, tests to identify security weaknesses, and maintaining an incident response plan. In addition to such regular system checks, our executive officers, together with the board of directors, regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update management with these changes, as well as our cybersecurity risks, so that management can administer its oversight function as a part of its broader oversight and risk management.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: We have designed and assessed our program using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LANDS' END, INC.

ticker: LE


text: IT systems are protected using various tools like multi-factor authentication (MFA), virtual private network (VPN), firewalls, end-point protection, spam and web filters, mobile device management, and privileged access management. A third-party monitoring service aids in detecting any threats or anomalies with the network. A multi-department incident response plan has been developed to facilitate a swift response in the event of a cybersecurity incident, which includes notifying the appropriate regulatory agencies. IT systems critical to the business operations have been identified and plans have been developed for a swift recovery of IT services in the event of a service failure. We utilize various IT cloud service providers. Annual security reviews of all service providers that provide critical service to the business are conducted. A cybersecurity risk assessment is conducted prior to contracting with a new IT cloud service provider providing high-impact services.

companyName: Koppers Holdings Inc.

ticker: KOP


text: The Security Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Security Committee receives reports regarding such risks from management, including our chief security officer, and reports to the Board at least annually. The Security Committee also oversees the Board's response to any significant cybersecurity incidents.

companyName: AMAZON COM INC

ticker: AMZN


text: Our cybersecurity risks and associated mitigation efforts are continuously monitored and evaluated by senior management as part of the Company's overall risk management process. In addition, a report prepared by the chief information security officer outlining any material cyber risks as well as any mitigation efforts is presented by the chief information security officer to the Audit Committee of our Board of Directors on a quarterly basis as part of the Company's enterprise risk assessment.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors."

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third-party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things:

companyName: SPAR Group, Inc.

ticker: SGRP


text: Our CIO joined Washington Trust as CISO in 2016 and has more than 35 years of experience in the financial, technology, auditing, and banking industries. He has expertise in technology deployment, information technology risk management and information security policies and programs. Our current CISO has served in that position since 2018 and is a 28-year employee of Washington Trust. He has extensive experience and expertise in information technology risk management and information security policies and programs. He holds a Bachelor of Science in Computer Information Systems and several certifications, including Certified Information Systems Security Professional and Certified Information Security Auditor. Our CTO has served in that position since 2021 and is a 13-year employee of Washington Trust. He has broad technical experience and expertise in information technology and holds a Bachelor of Science in Information Science and several certifications, including Cisco Certified Network Associate.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships. The DIS has over 10 years of industry experience and 25 years of information security experience focusing on management of security and vendor relationships. The DIS also possesses several industry certifications, including certification as a Certified in Risk and Information Systems Control and Certified Information Security Manager from the Information System Audit and Control Association.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: We contract with a third party to perform a cybersecurity risk and vulnerability assessment annually. We regularly test areas of potential vulnerability, utilizing penetration testing, ransomware-focused disaster recovery tests as well as testing exercises for other higher risk areas. We have also implemented most of the voluntary practices recommended under the National Institute of Standards and Technology cybersecurity framework. Additionally, the Company maintains cybersecurity risk insurance coverage.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: Management is responsible for assessing and managing cybersecurity risk. Specifically, the CISO is responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents. The CISO regularly meets with the Chief Executive Officer ("CEO") and Executive Leadership Team to inform them on cybersecurity risks. These briefings encompass a broad range of topics, including: • Threat intelligence; • Risk updates with regional vice presidents; • Third-party assessments and results of tabletop exercises; • Training programs for employees; • Results of phishing simulations; • Cybersecurity technologies and best practices; and • Significant cybersecurity incidents and/or trends (if any).

companyName: Allegion plc

ticker: ALLE


text: When a cybersecurity threat or incident is identified, our policy is to review and triage the threat or incident, and to then manage it to conclusion in accordance with our cybersecurity incident response processes. When a cybersecurity incident is determined to be significant, it is addressed by management committees using processes that leverage subject-matter expertise from across Ford and Ford Credit. Further, we have in the past and may in the future engage with third-party advisors and government and law enforcement agencies as part of our incident management processes. All cybersecurity incidents that are identified as reasonably having the potential to be highly significant to Ford and Ford Credit are brought to the attention of Ford's Chief Enterprise Technology Officer and General Counsel by Ford's Chief Information Security Officer as part of the Company's cybersecurity incident response processes.

companyName: FORD MOTOR CREDIT CO LLC


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors" under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.

companyName: New Mountain Private Credit Fund


text: As of the date of this Form 10-K, we are not aware of any cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, including our business strategy, consolidated results of operations, or financial condition. However, despite our security measures, we cannot assure that we or our third-party partners will not experience a future cybersecurity incident that could materially affect us.

companyName: Hillenbrand, Inc.

ticker: HI


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of AES' cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including DPL and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2024.

companyName: DAYTON POWER & LIGHT CO


text: An information security training program instructing company employees with access to our networks how to be aware of, and help defend against cybersecurity risks; Evaluating the cybersecurity risk of third party service providers; and Business continuity plans and critical recovery backup systems.

companyName: ELUTIA INC.

ticker: ELUT


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. We believe with the cybersecurity and governance program we have in place that we have and continue to implement effective processes and controls to prevent cybersecurity incidents from being reasonably likely to materially affect the Company. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Failure to maintain the integrity of our information technology systems, protect our internal information, or comply with applicable privacy and data security regulations could adversely affect us", for additional discussion about cybersecurity-related risks.

companyName: BOYD GAMING CORP

ticker: BYD


text: Process Our information security program is based on five key functions as set forth in the NIST CSF: (i) identify; (ii) protect; (iii) detect; (iv) respond; and (v) recover. As part of that program, we maintain an incident detection and response process that is designed to ensure we appropriately identify, investigate, respond to, and recover from, cybersecurity incidents in order to protect our information, systems and resources. As part of our process, we maintain operational plans for incident response and recovery activities. We regularly review our incident response process and conduct multiple incident response exercises each year, including sessions with management, to test and assess our preparedness to respond to a cybersecurity incident.

companyName: EQUIFAX INC

ticker: EFX


text: Run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies as needed. Carry cybersecurity risk insurance that provides protection against potential losses arising from a cybersecurity incident.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Risk assessment and management efforts. We assess, identify and manage cybersecurity risks as part of a comprehensive information security program that is intended to be aligned with standard industry frameworks, such as International Standard for Organization (ISO) 27000 and the National Institute of Standards and Technology (NIST) Cyber Security Framework.

companyName: IAC Inc.

ticker: IAC


text: The Company has developed and implemented a cybersecurity program (the "Program") designed to identify, assess, and mitigate material cybersecurity related risks. The Company's program leverages recognized frameworks and standards, including the National Institute of Standards and Technology, Cyber Security Framework, the Center for Internet Security Critical Security Controls, and the Payment Card Industry Data Security Standards, to assess, organize, and improve our program. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we leverage various security standards, guidelines and best practices to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: Our Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and experience, with over ten years in the field of information security, is primarily responsible for assessing and managing cybersecurity risk. The CISO oversees a team of dedicated information security professionals (the "Information Security Team") who focus on specialty areas such as application security, security compliance, security architecture and engineering, vulnerability management, and security operations, each with relevant experience and industry certifications in their respective areas.

companyName: CARVANA CO.

ticker: CVNA


text: Our board of directors and management exercise oversight over the Company's cybersecurity program, which represents an important component of the Company's overall approach to enterprise risk management.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: We regularly assess and identify potential cybersecurity risks that could impact our business, financial condition, or reputation. Our risk assessment process includes: • Enterprise Risk Management: We maintain an enterprise risk management process that embeds cybersecurity within the risk assessment strategy. • Threat Landscape Analysis: We monitor emerging threats, vulnerabilities, and attack vectors relevant to our industry and business operations. • Risk Scenarios: We evaluate potential scenarios, with considerations to both internal and external threats, to understand their potential impact. • Risk Quantification: We assess the likelihood and potential financial, operational, and reputational impact of identified risks.

companyName: ICF International, Inc.

ticker: ICFI


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our IT Director based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Our assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our Information Technology and Information Security teams meet weekly across several disciplines to ensure that risks are timely identified, patch and vulnerability requirements are monitored, and the necessary changes are implemented.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: Employees are obligated under the terms of our IT Appropriate Use Policy to protect IT assets from attack and to maintain proper control of access to IT systems and passwords.

companyName: Airspan Networks Holdings Inc.


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Therefore, we rely on the cybersecurity strategy, expertise and policies provided and implemented by 26North, the indirect parent company of our Adviser and affiliate of our Administrator, as well as other service providers.

companyName: 26North BDC, Inc.


text: The IT Security Team addresses and responds to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The team oversees compliance with the cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The IT Security Team also assists with the review and approval of policies, completes benchmarking against applicable standards, and oversees the security awareness program.

companyName: EASTMAN KODAK CO

ticker: KODK


text: Charter's Board of Directors has delegated to the Audit Committee oversight of our privacy and data security, including cybersecurity, risk exposures, policies and practices, including the steps management have taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. Charter's Audit Committee receives quarterly updates on the enterprise risk management program, including information on cybersecurity risks and initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates or internal audit observations, if applicable.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Our IT Director is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets and, along with our IT Director and our legal department, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: Protection Measures We implement and maintain cybersecurity controls, including firewalls, access controls, and intrusion detection systems, to safeguard our systems and data from unauthorized access, use, or disclosure. Furthermore, we use external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: We have a dedicated internal cybersecurity team that maintains our readiness and security posture by overseeing our cybersecurity program's information security policies and standards. In doing so, our cybersecurity team works with independent external cybersecurity advisors to develop appropriate standards to identify, assess, mitigate and remediate material cyber risks and issues. For example, PCI standards include quarterly external vulnerability scans that are conducted by a vendor approved by the PCI security standards council. Further, as part of our annual risk assessment controls, we obtain and review the SSAE (SOC-1 Type 2) reports of our key third-party service providers. The annual assessment includes consideration of materiality, identification and prioritization of financial reporting elements ("FREs") using quantitative and qualitative risk factors (including fraud risk), and identification of business processes and information technology systems linked to FREs. The reports are reviewed to identify and evaluate subservice providers, key reports, exceptions and complementary user entity controls and determines the appropriate response on any identified concerns.

companyName: Cable One, Inc.

ticker: CABO


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our InfoSec Leadership Team. The executives on this team have collectively over 60 years of prior work experience in the management of information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. In addition to their work experience, Mr. Madigan has a Master of Business Administration in Information Technology Management and Mr. James has a Master of Science in Information Security and Assurance.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: Cybersecurity risk management is a key component of our overall risk management efforts at Franklin Covey. We have implemented a layered cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may have material effects on the confidentiality, integrity, and availability of our information systems, networks, and offerings. Cybersecurity risk is addressed at both management and Board of Director levels as described below.

companyName: FRANKLIN COVEY CO

ticker: FC


text: The Program is based on the National Institute of Standards and Technology Cybersecurity Framework ("CSF") version 2.0. The CSF offers a framework for cybersecurity management, including program governance, asset and risk identification, systems protection, threat detection, and incident response and recovery. In particular, our cybersecurity strategy, as set forth in the Program, uses the CSF to address security safeguards across six dimensions of information security (Govern, Identification, Protection, Detection, Response, and Recovery). The Program guides the execution of our cybersecurity responsibilities for our digital infrastructure, including network security, endpoint security, data protection, incident response, awareness and training, compliance, and risk management.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: See "A failure of our information technology ("IT") and data security infrastructure or cyber or other security incidents, vulnerabilities or other deficiencies, could adversely impact our business, reputation or results of operation or could cause us to default under our contractual obligations." in Item 1A, Risk Factors.

companyName: Ameresco, Inc.

ticker: AMRC


text: Incident Management We have developed an incident response plan that establishes a process for addressing issues arising from third-party relationships and communication channels for reporting and managing incidents involving third parties.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: We regularly engage independent third-parties and auditors to assess our cybersecurity program and practices and assist in the mitigation of risk. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third-parties. These assessments are performed in connection with standards and requirements under the Payment Card Industry (PCI) data security standard, Sarbanes-Oxley Act (SOX), and the U.S. Department of Defense, cybersecurity capability maturity benchmarking and voluntary certifications by us, such as the Service Organization Control Type 2 (SOC 2). The results of these audits and assessments are promptly reviewed and enhancements are made to our cybersecurity program and practices based on such findings as appropriate. We also maintain a cybersecurity third party risk management program which evaluates third parties that either host or have access to our data and/or systems to ensure that they are aligned with our security requirements. The program includes initial review, ongoing monitoring and contractual agreements with cybersecurity requirements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is acceptable.

companyName: Trane Technologies plc

ticker: TT


text: The Audit Committee reviews and discusses, at least annually, the Company's cybersecurity risks, including the Company's information security and risk management programs, controls and procedures, as well as high level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential security incidents. The Audit Committee also reviews the recovery and communication plans for any unplanned outage or security incident.

companyName: Jade Biosciences, Inc.

ticker: JBIO


text: Cybersecurity is among the risks identified by our ERA for Board-level oversight. The Audit Committee of the Board has oversight of information technology controls related to financial reporting, while the Compliance Committee of the Board has oversight of technology-related risk, including privacy and cybersecurity. The Audit Committee and Compliance Committee meet jointly at least annually to review cybersecurity risks and programs, and they are updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile. The chairs of the Audit Committee and Compliance Committee provide updates to the Board after each committee meeting. The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. External consultants also periodically update the Board on cybersecurity trends and developments. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.

companyName: MCKESSON CORP

ticker: MCK


text: As of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the risk factor titled "Our security measures, and those of the third parties with whom we work, have been compromised in the past and may be compromised in the future. If our security measures are compromised in the future or if our information technology fails, this could harm our reputation, expose us to significant fines and liability, impair our sales, and harm our business. In addition, our products and services may be perceived as not being secure. This perception may result in customers and users curtailing or ceasing their use of our products, us incurring significant liabilities, and our business being harmed" in Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: Zoom Communications, Inc.

ticker: ZM


text: Noble has a process of monitoring all third parties with direct access into the Noble network via various implemented security tools that act as both detective and preventive controls. All third parties with such direct access are also monitored via procurement processes and are subject to specific legal terms and conditions. Noble also engages with various third-party partners in order to share intelligence regarding external threats. For any cyber incidents, Noble may engage applicable third-party partners for forensic purposes.

companyName: Noble Corp plc

ticker: NE


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Committee oversees management’s implementation of our cybersecurity risk management program.

companyName: CG Oncology, Inc.

ticker: CGON


text: Our assessment, identification and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. We rely on a multidisciplinary team, including our information technology department, legal department, management, engineering operations, and third-party service providers (the "Security Function") to help assess, identify and manage the Company's cybersecurity threats and risks. Various members of the Security Function monitor and evaluate our cybersecurity threat environment using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and evaluating threats reported to us.

companyName: Pulmonx Corp

ticker: LUNG