text: The Cybersecurity Risk Management and Strategy, Governance, and Incident Disclosure Program (the "Program") at Customers encompasses six key areas that focus on technology governance and compliance, standards management and architecture, physical security, application security, cybersecurity operations, and workforce training and preparedness. This training includes monthly phishing exercises and annual cybersecurity training required by all employees. The Corporate Security Group oversees Customers' documented security and cybersecurity incident ("Incident") response and business continuity functions employing annual table-top exercises to test Customers' preparedness for any Incidents, ranging from pandemics to cybersecurity events. Incidents are classified by priority levels from Level 1 (low) to Level 5 (high). Incidents classified as Levels 4 and 5, which could lead to material or significant disruptions to Customers, are immediately reported to the Customers' Directors' Risk Committee for appropriate disclosure in a C urrent Report on Form 8-K as required by SEC rules requiring public companies to promptly disclose material cybersecurity Incidents.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Our ERM management committee is responsible for providing input and oversight on our ERM program, including cybersecurity risks. Our ERM management committee is comprised of senior leaders, including our CIO, with responsibility across operations and core business functions, and with a breadth of knowledge, influence and experience covering the risks we face. An annual report on our enterprise risks, including cybersecurity risks, is presented to the Audit Committee and/or the full Board of Directors (Board).

companyName: FREEPORT-MCMORAN INC

ticker: FCX

secItem: Item 1C


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy, Written Information Security Policy and Incident Response Plan with Stellus Capital Management (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy also sets forth the role of our Chief Compliance Officer and our Information Security Team in preparing, implementing, and maintaining incident response procedures.

companyName: Stellus Capital Investment Corp

ticker: SCM


text: Impact of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, results of operations, and financial condition are regularly evaluated. During the reporting period, we have not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operation, and financial condition.

companyName: Willow Tree Capital Corp


text: Our executive management team is responsible for the development of our policies and procedures relating to our risk management, including cybersecurity risks. Our board of directors has ultimate oversight of our risk management processes, including any cybersecurity-related risk and activities. In particular, the Audit Committee of our Board of Directors ("Audit Committee") is responsible for monitoring compliance with legal and regulatory requirements, in addition to considering and discussing guidelines and policies to govern the process by which risk assessment and mitigation is undertaken.

companyName: Atlas Lithium Corp

ticker: ATLX


text: Collaborative Approach: The Company's Board and management have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. The Company also purchases cybersecurity insurance to mitigate the financial risk associated with cybersecurity breaches.

companyName: LKQ CORP

ticker: LKQ


text: Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, our cybersecurity program is led by the Director of Information Technology ("Director of IT"), who reports to the President and COO. Our Director of IT has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint and attends training in cybersecurity and risk mitigation.

companyName: EACO CORP

ticker: EACO


text: Our customers rely upon Akamai to power and protect the online experiences of their end user customers. We provide security, delivery and compute solutions and services and maintain internal systems and other data associated with running our business. We have implemented cybersecurity risk management programs and procedures designed to identify and address threats to both internal and customer facing data and systems that are subject to ongoing compliance assessments, certifications and testing.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, disaster recovery and business continuity plans, encryption of certain data, network security controls, data segregation for certain data, access controls, physical controls, systems monitoring, penetration testing, and cybersecurity insurance. Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports as applicable to senior leadership and the audit committee.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: The FedEx Board of Directors has delegated to the Cyber and Technology Oversight Committee of the Board of Directors ("CyTOC") responsibility for overseeing the company's cyber and technology-related risks, including network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as artificial intelligence and machine learning; the technologies, policies, processes, and practices for managing and mitigating such risks; and the company's cyber incident response and recovery plan. The CyTOC also oversees the cybersecurity, cyber-resiliency, and technology aspects of the company's business continuity and disaster recovery capabilities and contingency plans. Several of our Board members, including certain members of our CyTOC, have technological, digital, and/or cybersecurity experience.

companyName: FEDEX CORP

ticker: FDX


text: The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, and are managed and monitored by a dedicated information technology team, which is led by our Director of Information Technology, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers. We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their estimated impact on the Company's risk environment.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: Our CISO leads our cybersecurity risk management program. The individual currently serving in this role has over 20 years of experience assessing and improving cybersecurity programs, and his background spans multiple industries such as fintech, SaaS, critical infrastructure, legal, and federal, state, and local government. The CISO establishes and supervises procedures for the evaluation of our information systems, including the use of security tools and system reviews designed to spot potential weaknesses. The CISO works to keep up to date with the latest trends in cybersecurity, such as emerging risks and best practices for cybersecurity risk management. In case of a cybersecurity incident, the CISO initiates our incident response plan in an effort to respond to the incident and to reduce the potential damage to our organization.

companyName: MeridianLink, Inc.


text: Our Information Security Officer is primarily responsible for this cybersecurity component and reports directly to the EVP-Chief Operations Officer. The Board of Directors has approved an Information Technology Steering Committee, which focuses on technology and business impact. The committee provides oversight and governance of the technology and information security programs. The committee is chaired by the ISO and compiled of managers throughout the entire company. The committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken in the IT Steering Committee to our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: Company's Chief Executive Officer is responsible for developing and implementing our information security measures and overseeing our IT department. The Company has established a physical firewall, with physical gateways that filter suspicious files and data flows entering and exiting our Company's network. In addition, the computers in our R&D department are equipped with behavior control software, which makes emails and files sent from the R&D computers in an encrypted state and inaccessible without specific authorization from designated supervisors.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Day-to-day responsibility for assessing, monitoring, and managing our cybersecurity risk management program rests with our IT Department, supported by broader MSP's service team, and members of our finance and legal teams as appropriate, and our Head of Compliance on cyber matters. Our Head of Compliance oversees our risk management governance and periodic compliance testing and works with our IT Department and other functions, as appropriate, on the mitigation and management of identified cyber risks. The IT Department, supported by broader MSP's service team executes the cybersecurity strategy. The IT Department and Head of Compliance report periodically to the General Counsel as well as to our Governance, Risk Management, and Compliance Committee ("GRC Committee") on cyber matters. Our GRC Committee is responsible for monitoring and overseeing our overall enterprise risk management process, including assessing, identifying, and managing cybersecurity related risks as part of its annual assessment of critical risks facing the Company.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: Our VP of Information Technology provides annual briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our VP of Information Technology or department designee provides annual briefings to the board of directors on cybersecurity risks and activities.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Our board of directors has ultimate oversight responsibility for our strategic and business risk management and delegates cybersecurity risk management oversight to its audit committee. Our audit committee receives reports on, generally, a quarterly basis from our chief technology officer on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Our audit committee is responsible for overseeing the adequacy and effectiveness of our privacy and information security policies and practices and the internal controls regarding privacy and information security. Our audit committee or chief technology officer, as appropriate, also reports material cybersecurity risks to our full board of directors.

companyName: Braze, Inc.

ticker: BRZE


text: Third-party risk management efforts. In addition to the assessment, identification and management of our own cybersecurity related risks, we also consider and evaluate cybersecurity risks associated with certain third-party service providers upon which we rely for a wide variety of technical and business functions. Our efforts in this regard consist of (among other efforts): (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.

companyName: Angi Inc.

ticker: ANGI


text: We maintain plans to address any cybersecurity incidents, including but not limited to a Crisis Management Plan, an Incident Response Plan, an Information Security Incident Management Policy and a Business Resiliency Policy. Information security continuity is embedded in our business continuity management system to minimize the risk that continuity operations could result in a compromise to our security standards. We conduct business continuity, crisis communications and disaster recovery exercises at least annually to test and modify the plan, as needed. The activities related to the business continuity management system are routinely reported to executive management as part of our IT security team's ongoing metrics reporting. In addition, reports related to activities and outcomes are provided to the audit committee of the Board of Directors on a quarterly basis.

companyName: Paycom Software, Inc.

ticker: PAYC


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with our Head of IT and our executive management team.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: The CISO is responsible for managing our information security program. Our CISO has over 25 years of information technology experience and over 20 years of information security experience; is a Certified Information Systems Security Professional, a Certified Information Systems Manager, and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: The Director has over 18 years of experience in the information technology field, and cybersecurity knowledge and skills gained through relevant experiences. The Director and Chief Financial Officer regularly review potential risks and measures implemented by the Company to identify and mitigate cyber security risks.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: Training and Awareness Our cybersecurity program also focuses on providing training and awareness to our employees on cybersecurity best practices. Our training program includes computer-based training sessions assigned to employees and information sharing to educate employees on current cybersecurity-related topics. We also conduct phishing exercises to test and improve our employees' awareness and response to potential cyber threats.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: Technology risks, including cybersecurity threats, undergo a thorough risk management assessment. Voya Financial evaluates risks quantitatively and qualitatively to determine both the probability and potential severity of such risks and whether any such risks could materially affect Voya Financial or its subsidiaries, including VRIAC. We have experienced and may continue to experience cybersecurity incidents and threats that could materially affect our business strategy, results of operations or financial condition. There have been no known cybersecurity incidents that have materially affected us in the past three years. For more information about the cybersecurity related risks that we face, see Interruption or other operational failures in telecommunication, cybersecurity, information technology and other operational systems, including as a result of human and process error or a failure to maintain the security, integrity, confidentiality, or privacy of such systems, could harm our business in Risk Factors in Item 1A of this Annual Report on Form 10-K.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: Our cybersecurity program is designed to protect our information systems from cybersecurity threats and to ensure the confidentiality, integrity and availability of systems and information used, owned or managed by the Company related to our employees, our clients and their users and existing and potential employees. This involves a comprehensive and ongoing effort to protect against, detect and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • policies, procedures and protocols concerning information security and data protection; • regular employee security awareness trainings; • regular employee "phishing" trainings; • regular third-party audits of our cybersecurity program; • an incident response plan that sets forth the steps to be taken following an actual or suspected cybersecurity incident or other data-related event; • periodic tabletop exercises associated with our incident response plan and processes; and • tools designed to detect and prevent cybersecurity incidents.

companyName: Sterling Check Corp.


text: Mitigation Planning: Decisions and actions that will reduce the impact of risks as well as limit the probability of their occurrence or improve the response to a risk occurrence.

companyName: CXApp Inc.

ticker: CXAI


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is annual employee training on cybersecurity around phishing, malware and other cyber risks. We use a third-party provider of security awareness training and simulated phishing for our email phishing reporting and cyber security training. Our employees are required to complete quarterly cybersecurity training programs.

companyName: LXP Industrial Trust

ticker: LXP


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk Factors - Cybersecurity threats and cyber incidents may adversely affect our business by causing a disruption to our operations, or the operations of businesses in which we invest, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, financial condition and operating results." for a discussion of risks related to cybersecurity and cyber incidents.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: Our Risks from Cybersecurity Threats Our Cybersecurity Program is overseen by executives on our Executive Leadership Team and managed by our Cybersecurity Strategy Council, including our Senior Vice President, Chief Information Security Officer (CISO), who reports to our Executive Vice President, Chief Digital and Information Officer (CDO). Our CISO is responsible for day-to-day risk management activities, including staying informed about and monitoring prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, and the use of technological tools and software. Our CDO is responsible for our broader IT program, which includes our ability to remediate and recover from a cybersecurity incident while reducing impacts to the business and operations. Our CDO and CISO regularly report directly to the Cybersecurity Committee of the Board of Directors on our Cybersecurity Program and efforts to prevent, detect, mitigate, and remediate issues. In addition, we have an escalation process in place to inform senior management and the Cybersecurity Committee and the Board of Directors of material issues.

companyName: PTC INC.

ticker: PTC


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Core activities supporting our strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and audits of the areas noted above, including cybersecurity-related vendors.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: The Technology Committee of our board of directors meets quarterly and is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Our ISSC, including the Chief Technology Officer, Chief Legal Officer, Chief Information Officer and CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The ISSC receives monthly reports and updates from the CISO on our cybersecurity risks and cybersecurity incidents. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISSC includes team members who have previously completed ISO 27001 certification for international companies as well as individuals with professional cybersecurity relevant certifications such as CISSP and CCISO.

companyName: TechnipFMC plc

ticker: FTI


text: In the last three fiscal years, we have not experienced any material information security breach incidents and the expenses we have incurred from information security breach incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Deutsche Bank Group has a variety of prevention methods and controls in place, such as threat intelligence, network security, identity and access management, data leakage prevention, cyber hygiene, and encryption solutions. These also include placing a strong emphasis on detection, backed by a robust incident-response process. Deutsche Bank Group actively shares best practices and threat information with national and international security organizations, government authorities, and peer organizations. These relationships help to ensure that Deutsche Bank Group's security technology and procedures reflect current industry best practices and keep pace with the threat environment.

companyName: RREEF Property Trust, Inc.


text: When a potential cybersecurity threat or incident is identified, our processes require that the Senior Director of Information Security be promptly notified of the incident, who then is to conduct an initial investigation to determine the probability and potential of the threat or incident to have a material impact on key business systems and processes. If there is a reasonable possibility for a material impact to the Company's business or information systems, the cybersecurity program requires that the Technology Risk Management Committee be promptly notified, which then assigns a risk level to the threat or incident. All threats and incidents identified as high-risk are promptly escalated to Company leadership and the legal department, who are tasked with activating and implementing a high-risk information security incident mitigation and response plan, which details the roles, responsibilities, and strategies to respond. Our cybersecurity program also requires that high-risk cybersecurity incidents or threats be reported to the Company's Materiality Committee and the Audit Committee of the Board within 24 hours of their designation as high-risk by the Technology Risk Management Committee.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Noble has a process of monitoring all third parties with direct access into the Noble network via various implemented security tools that act as both detective and preventive controls. All third parties with such direct access are also monitored via procurement processes and are subject to specific legal terms and conditions. Noble also engages with various third-party partners, such as ONG-ISAC, DataBreachToday, the US Coast Guard, local FBI, the Norwegian Security Authority, IADC, and IMO, in order to share intelligence regarding external threats. For any cyber incidents, Noble may engage applicable third-party partners for forensic purposes.

companyName: Noble Corp plc

ticker: NE


text: We have an Executive Cybersecurity Committee (ECC), which is comprised of our Chief Financial Officer (CFO), Chief Information Officer, Chief Legal Officer, Chief Accounting Officer, and Global Head of Cybersecurity, with the goal of providing oversight of the Company's cybersecurity program. The ECC is responsible for, among other things, evaluating and determining the materiality of cybersecurity incidents as well as reviewing and approving any public disclosures with respect to material cybersecurity incidents. Our cybersecurity incident response policy is designed for our cybersecurity operations team, which is led by our Global Head of Cybersecurity, who works in conjunction with the cross-functional incident response team, to escalate certain cybersecurity incidents to the ECC depending on the circumstances. The ECC also has the responsibility of reporting to the Board and/or the Audit Committee.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers. We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations and contract manufacturing organizations. We manage cybersecurity risks associated with our use of these providers by reviewing their conducting audits and imposing contractual obligations on the vendor to protect our information.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Our CIO is a member of the Company's senior executive leadership team and is responsible for the administration of the cybersecurity risk management program. Prior to joining the company in 2020, our CIO spent 24 years in the aerospace and defense industry and held multiple senior leadership roles within digital technology, leading large global organizations in all aspects of digital technology, including cybersecurity risk management.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Review and reassess the adequacy of the Cybersecurity Committee's written charter annually and recommend to the Board any changes the Cybersecurity Committee determines are appropriate;

companyName: Cohen & Co Inc.

ticker: COHN


text: Cybersecurity presents significant challenges to the business community in general, including to the financial services industry. Increasingly, bad actors, both domestic and international, attempt to steal personal data and/or interrupt the normal functioning of businesses through accessing individuals' and companies' files and equipment connected to the internet. Recent incidents have reflected the increasing sophistication of intruders and their intent to steal personally identifiable information as well as funds and securities. These intruders sometimes use instructions that are seemingly from authorized parties but in fact, are from parties intent on attempting to steal. In other instances these intruders attempt to bypass normal safeguards and disrupt or steal significant amounts of information and then either release it to the Internet or hold it for ransom. Regulators are increasingly requiring companies to provide heightened levels of sophisticated defenses. The Company maintains processes and systems with an aim to preventing any such attack from disrupting its services to clients as well as to prevent any loss of data concerning its clients, their financial affairs, as well as Company privileged information.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: We assess cybersecurity contingencies within our overall business continuity risk management planning process. Our information technology and information security teams utilize various technology tools to prevent, monitor, detect, and respond to cybersecurity threats. Our incident response policy outlines processes, roles, responsibilities, notifications, and other communications applicable to the assessment, mitigation, and remediation of realized cybersecurity events. The nature and scope of assessed risk of a realized cybersecurity event dictates the pace and extent of relevant processes, and communications, including an evaluation of any necessary or required disclosure. Depending on its nature and scope, a cybersecurity threat may be managed within our IT Department, responsible for day-to-day management of cybersecurity risks, and escalated to our executive management team, the Board, and the Audit Committee, as appropriate.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: We rely heavily on our supply chain to deliver our products and services to our customers, and a cybersecurity incident at a supplier, subcontractor, joint venture partner, or service provider could materially adversely impact us. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable. We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the DFARS and other government agency specific requirements. These contractual flow downs include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. Government. These government contracting regulations may create challenges for our supply chain and increase costs. We also require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified. We also make available cybersecurity education and awareness materials and briefings to our suppliers.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: The Board has delegated their oversight of cybersecurity to the Company's Audit and Compliance Committee which oversees the entire ERMP process. As detailed above, cybersecurity is a standing agenda topic for the Audit and Compliance Committee which receives regular presentations and reports from the Company's CIO on cybersecurity risks, detection protocols, disaster recovery readiness, the threat environment, recent developments in the cybersecurity space (including known incidents affecting the Company or key Company suppliers), evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. Under the current cybersecurity framework, the Audit and Compliance Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident. The Audit and Compliance Committee will keep the full board informed, as may be appropriate, until any such threat has been addressed to their satisfaction. Additionally, cybersecurity is also a standing agenda topic for the Global Risk Committee, with periodic updates to the Executive Committee and Senior Leadership Team.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: The Company has an IRP which details the Company's policies and procedures in the event of a cyber incident. The Company's IT department, led by Mr. Osbeck, logs all potential cybersecurity incidents reported which are then reviewed by an Incident Response Team ("IRT"), a cross-functional internal team including IT, risk management, legal and other departmental representation as necessary to identify the potential impact of the cybersecurity incident. As needed, the IRT will consult with third party legal counsel and IT advisory firms to appropriately respond to existing cyber threats. In the event a material incident is identified, the Company will report such incidents in compliance with applicable law. Material cyber events, if any, are reported to the Board of Directors as they occur. Additionally, Mr. Bundick provides quarterly updates to the Audit Committee on all cybersecurity matters during the quarter.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: Core to our security model is our defense-in-depth framework, comprising multiple layers of processes and technologies that help prevent, detect, and respond to threats. Our approach to safeguarding against external threats incorporates a suite of preventive technologies, including malicious email blocking, defenses against automated attacks and multifactor authentication. These strategies act to proactively intercept and neutralize cyber threats to help ensure data remains secure within our environment. Event monitoring technologies run continuously, detecting suspected intrusion attempts and alerting our Cybersecurity Incident Response team. The Cigna Group undertakes a number of critical security processes to mitigate and protect against cybersecurity risks, which include but are not limited to: • Identity and Access Management. Employees are provided with the minimum amount of access required to perform their jobs using role-based access control methodology, which defines access to our information systems based on job function. Privileged or elevated access to our systems is subject to supplemental approval requirements, increased authentication processes, and additional logging and monitoring. • Security Awareness and Training. Events and education activities are hosted throughout the year, such as the Cybersecurity Awareness Month, expos, videos, training programs and frequent phishing simulations. The Cigna Group continuously trains workforce members on the importance of preserving the confidentiality and integrity of customer data. All new hires have mandatory information protection and privacy training as part of their onboarding, and all workforce members complete an annual cybersecurity refresh training. • Security Operations and Monitoring. Our operational monitoring processes provide valuable insight into the effectiveness of our security program. A centralized system collects security logs and performs event correlation that creates an alert if a trigger occurs. We review any deviations from our established targets and implement corrective actions. • Change Management. Changes to hardware, software, network components, and/or processes introduced into any production environments are managed by a formal change control process. These requests include the submission of required documentation as well as the business justification for the change. • Disaster Recovery / Business Continuity. These processes are designed to maintain service to our customers, providers and members through a wide range of adverse circumstances. Methods of recovery include rerouting business functions, relocating to an alternative site, independent "hot sites", mobile recovery and work at home. • Intelligence Feeds. These are used to monitor the security industry for the latest global security threats, exposures and patches to help keep company servers current with the latest security service packs, patches and hot fixes. • Physical Security. Our physical security system is utilized in an effort to properly identify appropriate individuals, authorize entry and define the working areas to which they have access. Additional controls at our data centers includes a combination of guard service, access keys and magnetic card systems.

companyName: Cigna Group

ticker: CI


text: Our CISO and GIS team meets regularly with our information technology (IT) and cybersecurity service providers and internal teams, such as the Risk Advisory Board (RAB), about our Company's ongoing compliance and risk management. GIS also drives business continuity and crisis management by coordinating and communicating with all levels of the organization and seeks to ensure that trends and emerging issues that could impact the business are considered and communicated as appropriate. Pursuant to our current policies the GIS team also provides, at the minimum, annual briefings to our Board of Directors and periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties, among other relevant topics. The RAB convenes periodically or as needed to review the cybersecurity risks in the business. The RAB consists of individuals from GIS as well as the Chief Technology Officer.

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO and our information security team. Our CISO has served in various roles in information technology and information security for more than 20 years, including serving as the Chief Information Security Officer at a publicly traded SaaS company and large e-commerce company. Our CISO works with our broader Information Technology team on IT security issues and also works with our product organization, finance, legal and internal controls teams.

companyName: Freshworks Inc.

ticker: FRSH


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management, including our VP, IT and Facilities, or VP IT, who reports to our Chief Financial Officer, and our Senior Information Security Manager, or Senior ISM, to manage the risk assessment and mitigation process. We also engage third parties to help us design and implement our cybersecurity systems, as well as monitor and test our safeguards. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We include employees at all levels and departments, and all contractors, in our cybersecurity training programs.

companyName: IMPINJ INC

ticker: PI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Our Business Operations and Industry - Our information technology systems, or those of any of our service providers, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: HilleVax, Inc.


text: Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Compliance Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Compliance Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures. The Board also receives updates from management and the Compliance Committee on cybersecurity risks on at least an annual basis.

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: We rely on information systems to communicate, control and manage our operations, prepare our financial and reporting information, analyze and store data and communicate internally and with third parties, including our service providers and customers. Our cybersecurity program focuses on ensuring the protection of our information systems, computer networks, infrastructure, and industrial control systems.

companyName: California Resources Corp

ticker: CRC


text: Additionally, we have implemented an information security training program for employees, which includes security awareness training on cybersecurity risks, simulated phishing emails, and regular communication about cybersecurity risks.

companyName: EGAIN Corp

ticker: EGAN


text: At the Board level, the full Board and its Environment, Health, Safety, Quality and Public Policy ("EHSQPP") Committee (which oversees many of our operational risks related to manufacturing) are both involved in oversight of the Company's management of cybersecurity risk. Management, including the Chief Information Officer and Chief Information Security Officer, updates our EHSQPP Committee and full Board on cybersecurity matters quarterly. We also have processes by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board.

companyName: Celanese Corp

ticker: CE


text: Technical Safeguards Cybersecurity is an ever-evolving field, and we are committed to continuous improvement of our security practices. We regularly review and update our cybersecurity policies, procedures, and technologies to address new challenges and adapt to the changing threat landscape.

companyName: Paysign, Inc.

ticker: PAYS


text: The Company's application security program is based on the Open Web Application Security Standard ("OWASP") and critical systems have been benchmarked for compliance with our security polices and standards. Security work is jointly prioritized with security staff and product/application/development organizations and third parties with responsibility for application development and maintenance. Security checklists have also been developed and are used in new product development lifecycle processes.

companyName: CINCINNATI BELL INC


text: The Vice President of IT reports on the status of our cybersecurity risk management program to management and our Audit Committee on a periodic basis, which may include a discussion of the results of our annual third party cybersecurity risk assessments and critical updates to our mitigation and remediation efforts.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: In the three most recently completed fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: TheRealReal, Inc.

ticker: REAL


text: During 2023, we refreshed our business continuity program to assess the resilience of our processes and systems against potential threats, including cyber-attacks. Our refreshed crisis management and business continuity program establishes crisis management instructions with a detailed plan for each business department outlining critical processes, internal and external dependencies and recovery strategies. In addition, routine information security training and updates are regularly rolled out to our employees, and we track certain metrics that we believe help ensure we have a strong security posture.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: Our Board of Directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework. The AFC is charged with oversight of data privacy and cybersecurity risks. Our CIO provides updates to either the AFC or to the full Board of Directors on a quarterly basis on our cybersecurity risks and actions taken to mitigate that risk. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and strategies; • compliance with regulatory requirements and industry standards; and • updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The General Partner carries cyber insurance. The General Partner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.

companyName: NESTOR PARTNERS


text: Risk Management and Strategy Managing Material Risks & Integrated Overall Risk Management We assess, identify, and manage our cybersecurity risks by employing several processes, including conducting employee training, monitoring and testing our networks and systems, responding to vulnerability and threat assessments, and maintaining and refreshing backup and protective systems. Cybersecurity risk management is also a component of our overall Enterprise Risk Management ("ERM") program. Both the cybersecurity risk management component of the ERM program and associated risk management plans, including risk mitigation, are reviewed at regular intervals and updated as needed. Related reporting to management occurs on a routine basis, and the Board of Directors is updated through an established cadence via the Board's Audit Committee and the full Board.

companyName: MSA Safety Inc

ticker: MSA


text: Our cybersecurity program is led by our CIO and our CISO. Our CIO has served in various roles in information technology and information security for over twenty years. Our CISO has over twenty years of technology and security experience and has spent more than fifteen years leading cybersecurity functions. He is also a Certified Information Systems Security Professional (CISSP).

companyName: Vistance Networks, Inc.

ticker: VISN


text: We maintain a detailed Cybersecurity Incident Response Plan that guides our incident response process. Upon the occurrence of a cybersecurity event, the cyber incident response team will follow a predefined process, documenting each step taken, to analyze and validate the event, and, if a cybersecurity incident is suspected to have occurred, quickly perform an initial analysis to determine the incident's scope. The team will prioritize the response to each incident based on its estimate of the business impact caused by the incident and the estimated efforts required to recover from the incident. Notification of the incident is made to various stakeholders, including senior management and, if appropriate based upon the incident severity assessment, our Board. The team will also conduct incident containment, eradication and recovery, and post incident activity.

companyName: TEXTRON INC

ticker: TXT


text: Threat Detection and Risk Management: We leverage advanced security technologies, including endpoint detection and response (EDR), security information and event management (SIEM), and vulnerability management tools to proactively identify and mitigate risks.

companyName: Korth Direct Mortgage Inc.


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our information technology team oversees the day-to-day management of our cybersecurity program with regular reporting to representatives of our Cybersecurity Oversight Team. Our Cybersecurity Oversight Team has overall responsibility of our cybersecurity risk management program and procedures and reports regularly to the Audit Committee of our board of directors on cybersecurity matters. From a governance perspective, the Audit Committee as well as our Compliance and Risk Management Committee are provided with updates from the Cybersecurity Oversight Team regarding incidents as well as the policies, standards, processes and practices that the Company implements to address risks from cybersecurity threats. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, our board of directors will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.

companyName: Augmedix, Inc.


text: The Southern Company system's cybersecurity program is increasingly leveraging intelligence-sharing capabilities about emerging threats within the energy industry, across other industries, with specialized vendors, and through public-private partnerships with U.S. government intelligence agencies. By engaging with both the Electricity Information Sharing and Analysis Center and the Downstream Natural Gas Information Sharing and Analysis Center, the Southern Company system benefits from quality analysis and rapid sharing of security information across the energy sector. Such intelligence helps to allow for better detection and prevention of emerging cyber threats before they materialize. Just as it tests its policies and plans internally, the Southern Company system also engages in external exercises such as the bi-annual GridEx Security Exercise to evaluate and address the preparedness of the industry as a whole.

companyName: SOUTHERN CO GAS


text: A key dimension to the security and effectiveness of our information system is our compliance with standards that are unique to the industries in which we operate. For instance, it is critical that our information system achieves TISAX certification. Established by the German Association of the Automotive Industry, Trusted Information Security Assessment Exchange, or TISAX, is a globally recognized assessment and exchange mechanism for information security in the automotive industry. Automotive OEMs rely on the TISAX label to ensure that suppliers and partners have a solid information security management system in place. To successfully complete the TISAX assessment process in our German and U.S. operations, we are actively evaluating our cybersecurity measures and seeking enhancements, including engaging a third-party auditor and global standardization of our cybersecurity training program, to ensure a comprehensive and robust system.

companyName: MICROVISION, INC.

ticker: MVIS


text: Our Security Committee is comprised of key management stakeholders and experts, including our General Counsel, Chief Accounting Officer and Vice President of Ethics and Compliance and is chaired by our VP of IT, who has over 20 years of experience in strategic and operational IT/cybersecurity leadership and has received multiple cybersecurity certificates including (ISC)2, Cloud Security Alliance, Cisco Security and Microsoft Security Professional. The Security Committee is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: The Company uses a risk-based approach to identify and manage cybersecurity risks from third parties, including vendors and service providers. The focus of these efforts is to identify and mitigate threats that could impact Company operations.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: The Company's Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function. The Company's Board of Directors has delegated oversight of risks related to cybersecurity to two Board committees, the Risk Oversight Committee and Audit Committee, and each committee reports on its activities and findings to the Board on a quarterly cadence. The Audit Committee is charged with reviewing the Company's cybersecurity processes for assessing key strategic, operational, and compliance risks. The Company's Information Security Officer provides presentations to the Risk Oversight Committee and the Board, on cybersecurity risks quarterly. These briefings may include assessments of cyber risks, the threat landscape, updates on incidents, and reports on the Company's investments in cybersecurity risk mitigation and governance. In the event of a potentially material cybersecurity event, the Incident Response Team (IRT) is notified and briefed, and meetings with that team and/or Executive Committee members are held, with the Board of Directors being briefed, as appropriate.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: Each employee and contractor is responsible for the security and confidentiality of company and client information. This expectation is communicated at on boarding and through required annual data security and privacy trainings; frequent internal publications; and annual employee attestations to the Company's Standards of Conduct. BOK Financial regularly conducts risk assessments to evaluate internal controls implemented to prevent and detect data breaches. These controls are aligned with ISO 27001:2013 and the NIST Cybersecurity Framework and are frequently monitored to ensure their effectiveness. The controls are routinely tested via tabletop exercises and reviewed by internal auditors.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Key elements of our cybersecurity risk management program, include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: A key component of our enterprise risk management program is our incident response plan, which provides for controls and procedures in connection with cybersecurity incidents. Under this plan, we have established a cybersecurity incident command, a multi-disciplinary management-level team led by the CISO. The plan provides that the incident response team will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of senior members of the IT security team. In such event, the plan provides that the incident response team will assess whether a cybersecurity incident has the potential to materially impact the organization and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit and Compliance Committee and/or the Board of Directors.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: With oversight from the Board of Directors, NNN's management is responsible for managing all cyber risks and overseeing NNN's security programs. Primary cybersecurity risk oversight has been delegated to the Audit Committee. The Chief Accounting and Technology Officer (the "CATO") oversees NNN's security programs and its Incident Response Policy and Plan and provides direct oversight and guidance to the technology team that manages NNN's day-to-day technology and cybersecurity operations. The CATO has been with NNN for over 25 years and has overseen NNN's information systems, including its cyber risk management program, for the last 15 years. The technology team has the appropriate educational background and certifications in the area of information security governance and technical controls, penetration testing and vulnerability assessments, incident response and digital forensics and secure systems design and architecture.

companyName: NNN REIT, INC.

ticker: NNN


text: Outside Consultants. While we have deployed personnel to perform testing and oversight functions internally, we also leverage external consultants and other tools to test the effectiveness of our operating environment and the protection of our data. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and reviews of our information security control environment and operating effectiveness. These assessment efforts include a wide range of activities such as tabletop exercises, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of these assessments are reported to the Risk Committee and the Board. Valley adjusts its cyber and information security program as necessary based on the information provided by these assessments, audits and reviews.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: Our Chief Information Officer and Chief Information Security Officer assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits, and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our Chief Information Officer and Chief Information Security Officer, such as potential threats or vulnerabilities. We also employ various defensive and monitoring techniques based on industry frameworks and cybersecurity standards.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: As required by Item 106 of Regulation S-K, the following sets forth certain information regarding our cybersecurity strategy, risk management and governance.

companyName: Bumble Inc.

ticker: BMBL


text: BAM has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the BAM board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of BAM and therefore is able to report directly to BAM's board of directors regarding cybersecurity risks to the Trust and the Sponsor.

companyName: Bitwise Bitcoin ETF

ticker: BITB


text: We employ a formal risk management process for the identification, assessment, monitoring, acceptance, communication, consultation, and review of cyber-related risks which is designed in accordance with industry practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework and International Organization Standard 27005. The Company's information security standards are externally audited on an annual basis against the System and Organizational Controls (SOC) and compliance with Payment Card Industry Data Security Standard (PCI DSS). Our program is reviewed on a periodic basis against the National Institute of Standards and Technology Cybersecurity Framework in order to measure our cybersecurity preparedness, evaluate whether our cybersecurity preparedness is aligned with risks, determine potential areas of improvement or enhancement for the Company's risk management practices and controls, and inform our risk management strategies.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: Our current Head of IT reports directly to our Chief Financial Officer and has over twenty years of experience managing information technology and cybersecurity matters, holds a Master of Science degree in Telecommunications and Computer Networks and is Project Management Professional, Certified Scrum Master and IT Infrastructure Library certified. We have established a cybersecurity council, facilitated by the Head of IT, which includes senior leadership from various departments. The council meets quarterly to review cybersecurity strategies, assess emerging threats, and receive updates on regulatory and industry best practices.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: The Company's Chief Information Security Officer is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other members of the Information Security Leadership Group. Our Chief Information Security Officer has served in various roles in information technology and information security for over twenty years. Our Chief Information Security Officer holds graduate degrees in cybersecurity and business administration and has attained multiple professional certifications including CISSP, CISA and CISM.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: The Audit Committee is responsible for the oversight of risks from cybersecurity threats. The Audit Committee is composed of independent directors with diverse experiences, including relating to risk management, technology, and finance. Management briefs the Audit Committee on a quarterly basis, and on an as needed basis, regarding our information security program and related risks to Aptar. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's risk management system, including cybersecurity programs. The Audit Committee receives regular updates on any significant developments relating to cybersecurity. Furthermore, significant cybersecurity matters and related strategic risk management decisions are escalated to the Board of Directors.

companyName: APTARGROUP, INC.

ticker: ATR


text: The Company created a Cyber Governance Committee, which includes the Chief Information Security Officer, Chief Information Technology Officer, Chief Accounting Officer, members of the executive management team, and other assurance functions such as Corporate Compliance, Enterprise Risk Management, and Internal Audit.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our tenant relationships, for internal communications, for accounting to operate our record-keeping function, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see "Risk Factors"

companyName: Myseum, Inc.

ticker: MYSE


text: Oversight and Governance The Company's management is responsible for overseeing and managing our cybersecurity risks and activities as part of its overall risk assessment portfolio. Our management regularly evaluates and reviews the Company's cybersecurity posture and performance and reports to the board of directors on any material cybersecurity matters or developments. Our management also coordinates with our CROs, vendors, partners, and other third parties to ensure that they comply with our cybersecurity expectations and requirements and to address any cybersecurity issues or concerns that may arise.

companyName: Mitesco, Inc.

ticker: MITI


text: Our cybersecurity incident response and vulnerability management protocol are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The executive leadership team works with the incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management protocol include reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Cybersecurity governance at QHSLab, Inc. is a board-level priority, with our Board of Directors playing an active role in overseeing our cybersecurity strategy and risk management.

companyName: QHSLab, Inc.

ticker: USAQ


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, investigate, resolve, remediate, and recover from identified vulnerabilities and security incidents in a timely manner. To address potential material cybersecurity risk in association with the use of third-party providers, we require they meet minimum security requirements. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management. Security Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Governance, Risk Management, and Strategy. As part of our overall risk management process, we have established a cybersecurity program and dedicated teams to manage and assess material risks from cybersecurity threats, direct the policies and procedures in place to protect our information systems, and respond to cybersecurity incidents if they occur. These teams and committees, which additionally monitor the prevention, detection, and remediation of cybersecurity incidents, include the following: • Our Cybersecurity Executive Council, which is comprised of executive leadership, including our Chief Executive Officer, General Counsel, Chief Information Security Officer, and senior leaders from our segments and key operating companies. The Cybersecurity Executive Council is responsible for reviewing policies and procedures related to cybersecurity and our cybersecurity program. Such policies and procedures, as well as our cybersecurity program generally, are discussed with the Board. • Our Cybersecurity Compliance Committee, which is made up of key cybersecurity and information technology personnel at the segment and operating company levels, receives regular updates and training with respect to cybersecurity in order to advise and assist management, including the Cybersecurity Executive Council, in implementing information systems security and incident response at our operating companies.

companyName: EMCOR Group, Inc.

ticker: EME


text: In April 2022, an AICPA member firm and HITRUST authorized External Assessor Organization (the "Assessor") completed an independent assessment of the Company's systems. These independent assessments verified that we met the healthcare industry's highest standards in protecting healthcare information and mitigating this risk, including compliance with HIPAA rules and regulations. On March 2, 2023, the Assessor reported that the Company's data recovery system's commitments and system requirements meet or exceed the stringent SOC 2 Type II applicable trust services criteria. On October 13, 2023, HITRUST certified that the platforms, facilities, and supporting infrastructure of our organization meet the HITRUST CSF v11.1.0 Implemented, 1-year (i1) certification criteria. For our cloud computing services, we currently use a cloud service provider who is also HITRUST certified for the contracted services.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: measures that are being taken to ensure proper protection include: computers are protected using a cloud-powered endpoint security solution that helps enterprises prevent, detect, investigate, and respond to advanced threats on their networks. It offers endpoint protection, endpoint detection and response, mobile threat defence, and integrated vulnerability management. It also provides, among other things, malware and spyware detection and remediation, rootkit detection and remediation and network vulnerability detection.

companyName: Awaysis Capital, Inc.

ticker: AWCA


text: Abbott's cybersecurity risk management process is designed to identify and assess internal and external cybersecurity threats and vulnerabilities to and within Abbott's business and operations, and analyze and prioritize risks from cybersecurity threats to inform strategies and action plans aimed at mitigating and managing these risks.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: Our current management and Board do not have in-depth cybersecurity expertise. We are considering educational opportunities or consulting to address this gap.

companyName: Global Innovative Platforms Inc.

ticker: GIPL


text: We manage risks from cybersecurity threats through the assessment and testing of our processes and practices focused on evaluating the effectiveness of our cybersecurity measures. We engage third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews. We maintain cyber risk and related insurance policies as a measure of added protection.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Murphy's cybersecurity environment is led by the Company's Information Technology (IT) group, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. Within the IT group, the Murphy Cybersecurity Team (MCT) is responsible for monitoring and managing security of the corporate network and enterprise systems, including developing and deploying policies, technical controls, and safety protocols and responding to security threats. All members of the MCT hold globally recognized security certifications and have wide-ranging experience in cybersecurity matters. The Incident Management Team (IMT) is responsible for responding to active threats and incidents as they occur. The Chief Information Officer is a member of the IMT, and regularly provides briefings to the Chief Executive Officer, the executive leadership team, and the Audit Committee of the Board. The Audit Committee is ultimately responsible for ensuring that management has processes in place to identify and evaluate cybersecurity risks to which Murphy is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this visibility and oversight structure allows the Board and executive leadership team to make timely, data-driven decisions ensuring that Murphy, its employees, investors, and partners are adequately protected.

companyName: MURPHY OIL CORP

ticker: MUR


text: Risk Management and Strategy routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A "Risk Factors" in this Annual Report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of our CROs or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs," and "Our proprietary information, or that of our customers, suppliers and business partners, may be lost or we may suffer security breaches."

companyName: Kairos Pharma, LTD.

ticker: KAPA


text: Our cybersecurity risk management processes and policies include the following: • We seek to deploy best practice cybersecurity standards promulgated by the National Institute of Standards and Technology Cybersecurity (NIST), the International Organization for Standardization and the Center for Internet Security. • We employ a dedicated cybersecurity team who routinely conduct specific risk assessments and endeavor to mitigate identified risks. This team is responsible for implementing measures to detect, prevent and respond to threats and malicious activity. We also maintain a Security Operations Center (SOC) that provides a mechanism for addressing cyberthreats before they comprise data security. • The cybersecurity team operates, maintains and monitors an integrated eco-system of security tools designed to detect, prevent and respond to threats and malicious activity. These tools include, but are not limited to, firewalls, anti-malware, IPS / IDS, end point protection, encryption, email and cloud app security, privileged access management, vulnerability scanning / patching. These are a blend of on-premise, cloud and network hosted tools. Monitoring activities include threat hunting and use of multiple intelligence sources to manage and respond to events. • Access to information is subject to authorization, review, classification and substantially controlled through multi-factor authentication. • All employees and contractors who are issued a Tronox user account for our IT system must complete and pass cybersecurity training before being provided full system access. • All employees and contractors with access to our IT systems must complete and pass a mandatory annual cybersecurity awareness training and acknowledgement of Tronox's Acceptable Use Policy. Failure to complete the training successfully may result in further system access restrictions and HR escalation. • We periodically orchestrate simulated phishing attacks on all IT system users and those who fall victim to the simulated attacks are required to take additional mandatory cybersecurity training. • To reduce the risk of phishing attacks, we have identified groups of Tronox employees and contractors who do not require access to external emails in order to perform their work responsibilities and begun a process of blocking their external emails. • We have a written Incident Response Plan that encompasses a range of activities to detect, respond to and recover from cybersecurity incidents, including compliance with applicable legal obligations and mitigation damage. • We work closely with a number of regional and international bodies from which we draw intelligence and contribute to cybersecurity initiatives such as incident simulation exercises and development working groups. • We regularly evaluate the appropriateness of cyber insurance coverage in light of the cyber risks we face and we do not currently carry cyber insurance.

companyName: Tronox Holdings plc

ticker: TROX


text: Security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. awareness training of our employees, incident response personnel, and senior management. incident response plan that includes procedures for responding to cybersecurity incidents. risk management process for service providers, suppliers, and vendors.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: Our VP of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, emerging threats and updates, cybersecurity systems testing, activities of third parties, and the like. Our audit committee and VP of IT provide regular updates to the board of directors on such reports. In the event of an actual cybersecurity threat or incident, management is notified in accordance with the cybersecurity response plan above.

companyName: Arq, Inc.

ticker: ARQ


text: We assess our cybersecurity program against various frameworks. Our information security program is certified for compliance with the Payment Card Industry Data Security Standard for the safe handling and protection of credit card data. Annually, we are assessed, either internally or by an independent third party, against the National Institute of Standards and Technology (NIST) 800-53 Moderate Baseline. We also utilize reports prepared by our external partners to assess our cyber proficiency on a standalone basis and comparatively against peers and other companies, and we regularly engage external resources regarding emerging threats. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including contractual mechanisms, as well as the regular review of SOC reports, relevant cyber attestations, and other independent cyber ratings.

companyName: Public Storage

ticker: PSA


text: Our executive management team is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises both our internal cybersecurity and IT related personnel, as well as our retained external cybersecurity consultants and vendors.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has primarily been limited to the use of standard off-the-shelf software (such as Google, Sage 100 Advanced Software, and Microsoft Office) and the use by our employees of standard personal computers. We also employ a full-time internal Information System Employee, as well as an external 24 hour per day, 365 day per year, Information Technology Service, providing Cloud Hosting, Web Protection, License, Firewall, and IP Service. With the assistance of the outside IT service, in conjunction with our Internal IT Team, management has implemented the necessary formal processes for assessing, identifying, and managing risks from cybersecurity threats. Firewalls are regularly checked and updated to the latest firmware. In the case of an actual cyber security threat, our outside IT service has full backups of critical systems and a 6-hour Disaster Recovery plan. from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition.

companyName: INNSUITES HOSPITALITY TRUST

ticker: IHT


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director of IT, to manage the risk assessment and mitigation process.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: Our management team, in conjunction with the Chief Technology Officer and cybersecurity service providers are responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners. Management relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged for strategic cyber risk management, advisory and decision making.

companyName: Banzai International, Inc.

ticker: BNZI


text: IHM undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of IHM's and our critical third-party vendors and other partners. IHM also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.

companyName: Chatham Lodging Trust

ticker: CLDT


text: Our Information Technology Governance ensures alignment between the Bank's technological strategy and business goals. We strive for efficient utilization of IT resources while effectively managing IT risks within the Bank's risk appetite. Additionally, our robust Vendor Management Program ensures proper oversight during the onboarding of new products, projects, and third-party vendors.

companyName: BayCom Corp

ticker: BCML


text: The assessment consists of two parts: Inherent Risk Profile and Cybersecurity Maturity. The Cybersecurity Maturity aspect of the assessment is designed to help management measure the institution's level of risk and corresponding controls. The levels range from baseline to innovative. Cybersecurity Maturity includes tests to determine whether an institution's behaviors, practices and processes can support cybersecurity preparedness within the following five domains: • Cyber risk management and oversight • Threat intelligence and collaboration • Cybersecurity controls • External dependency management • Cyber incident management and resilience We also retain third parties to test the effectiveness of our cybersecurity efforts. Annually, we obtain independent third party audits of the information security program, including program maturity and overall control effectiveness. In addition, multiple times over the course of each year we engage third party security firms to conduct both external and internal penetration tests. The goal of these assessments is to discover vulnerabilities in the Company's in-scope corporate networks. When testing reveals potential vulnerabilities in the Company's security, management works to develop appropriate mitigation plans to resolve any outstanding issues; we also consider other recommendations to enhance our cybersecurity that these security firms may offer, implementing those that management concludes are appropriate within the context of the Company's information security program and processes. In addition to audits and testing by third party security firms, our information security program and infrastructure is subject to continuous supervision by the FDIC and the DBCF, including an annual in-depth examination by subject-matter experts from the FDIC and DBCF. The laws and regulations that these regulators administer impose very high expectations on the Company with respect to its information security policies, procedures, processes and controls. In particular, the Interagency Guidelines Establishing Information Security Standards (the "Guidelines") require us to implement a comprehensive written information security program that includes administrative, technical and physical safeguards designed to (1) ensure the security and confidentiality of customer information; (2) protect against any anticipated threats or hazards to the security or integrity of such information; (3) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer; and (4) ensure the proper disposal of customer information and consumer information. We also must comply with the information sharing requirements and restrictions enacted pursuant to the GLBA. The regulators' continuous supervision of the Company is designed to ensure, among other things, that our information security program meets all the standards set forth in the Guidelines and that we operate in compliance with the GLBA and all other applicable information security laws and regulations. Finally, in addition to external scrutiny, our internal audit department reviews our compliance with the Guidelines, the GLBA and other laws and regulations, including those related to information security. If any of these examinations identify deficiencies or areas for improvement, the Company's information security team works with management to act as promptly as reasonably possible to address the action item resulting from any such examination or review.

companyName: RENASANT CORP

ticker: RNST


text: Cybersecurity Incident Response Plan — In October 2023, we experienced a cybersecurity incident in which certain information of our users was accessed and downloaded from individual 23andMe.com accounts without the account users' authorization. Following the Cyber Incident, we implemented changes to our information systems and processes to provide additional protections to our environment, including enhancements to our Security Operations, reset customer passwords, required two-step verification for new and existing customers, enhanced our detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats which may materially impact our operations. For more information about our cybersecurity related risks, see "We have experienced a criminal cyber incident and could in the future experience other security breaches, disruption to our business, or reputational harm" in Part 1, Item 1A, Risk Factors of this Form 10-K.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to Morgan Stanley and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.

companyName: North Haven Net REIT


text: We have invested in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests), tabletop exercises and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party vendors and service providers. The internal business owners of the hosted critical applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: HASBRO, INC.

ticker: HAS


text: The Ops Engineer may call upon other business and legal stakeholders across our company to help manage cybersecurity threats and incidents. Our Audit Committee is responsible for oversight of our programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee meets periodically with our Corporate Counsel and executive management to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Our Board periodically participates in presentations on cybersecurity and information technology from internal leadership. In addition to periodic presentations, management promptly updates our Board and Audit Committee regarding significant threats and incidents as they arise.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: The CISO reports security related incidents, findings, changes, etc. to the Risk Committee, on an annual basis or quarterly as needed. This information is communicated through the Company's Risk Department. The CISO has more than 25 years of experience in the information security field, including 20 years at WSFS, and holds several professional certifications and memberships in the Information Security, IT, and financial services fields.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: We employ a range of technical measures to secure our network and infrastructure, including firewalls, intrusion detection and prevention systems, and vulnerability assessments. We also use encryption to protect data both in transit and at rest.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK