text: We have operationalized key processes to help us identify, assess, manage, and mitigate reasonably foreseeable risks from potential cybersecurity threats. For example: • USE OF THIRD PARTIES: We engage third-party cybersecurity consulting firms to assist us with various aspects of our cybersecurity risk management program. For example, we currently consult with third party firms to assist with our annual penetration testing for the Tablo device, Tablo cloud and IT infrastructure. In addition, In addition, we used a third-party audit firm accredited by the American Institute of Certified Public Accountants (AICPA) to support us in the SOC 2 certification process for Tablo cloud. We also used a third-party firm to assist us with the National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) 140-3 certification we are pursuing. • VENDOR ASSESSMENT: We leverage a third-party risk assessment tool to help us identify cybersecurity related risks associated with our use of certain third-party service providers. • INCIDENT PREPAREDNESS AND RESPONSE: We maintain a Cybersecurity Incident Response Plan (IRP) which establishes a framework designed to enable us to respond to cybersecurity incidents in a consistent, timely and effective manner. Our IRP outlines procedures for identifying, reporting, investigating, assessing, and responding to cybersecurity incidents, including incident response team formation, roles and responsibilities by department, and communication and escalation protocols. Depending on the severity of the cybersecurity incident, our IRP contemplates escalation to our executive leadership team and the Audit Committee and/or the full Board, as well as periodic briefings on developments related to the incident response. We periodically review and update our IRP and have conducted training of key team members regarding the IRP. In addition, we recently conducted a tabletop exercise to simulate a response to a cybersecurity incident. • SECURITY STANDARDS: Our IT and Tablo cloud security architecture are designed to comply with the HIPAA Security Rule. In addition, our Tablo cloud security architecture leverages recognized frameworks designed to protect customer data. For example, we have received SOC 2 certification for Tablo cloud, we are in the process of pursuing NIST FIPS 140-3 certification, and we are working to align our processes, protocols and software with the FDA's recent cybersecurity guidance finalized in September 2023. We periodically examine our security controls and take steps to review, prioritize and address key compliance gaps where identified, using a risk-based approach. • TECHNICAL SAFEGUARDS: We perform information security maturity assessments and penetration testing for the Tablo device and Tablo cloud (including in connection with new product features and services), as well as for our IT infrastructure. We conduct vulnerability scans across key assets, core infrastructure, and endpoints to identify potential vulnerabilities and potential cybersecurity events. We assess and prioritize the remediation of vulnerabilities and other cybersecurity risks identified through these activities, using a risk-based approach. • INSURANCE: We maintain information security risk insurance coverage to mitigate potential losses in the event of a business disruption.

companyName: Outset Medical, Inc.

ticker: OM


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We monitor various cybersecurity resources to remain informed about new and emerging cybersecurity threats and attack vectors. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Executive Vice President of Platform Development, to manage the risk assessment and mitigation process.

companyName: Cricut, Inc.

ticker: CRCT

secItem: Item 1C


text: Recovery —bring affected production systems back online carefully, to prevent additional attacks. Test, verify, and monitor affected systems to ensure they are back to normal activity. Lessons learned —no later than two weeks from the end of the incident, perform a retrospective of the incident.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: The Director of Enterprise Systems leads the Company's cybersecurity program. The Director of Enterprise Systems assesses and manages XPEL's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The Director of Enterprise manages the third service party service provider engaged to monitor the Company's cybersecurity environment and is regularly updated by the third party service providers on the cybersecurity activities. The Directory of Enterprise Systems has 21 years of experience in information technology and is supported by a team with additional relevant experience and related certifications.

companyName: XPEL, Inc.

ticker: XPEL


text: The board of directors and our executives appreciate the severity of cybersecurity-related risks and support the continuous development of and investment in the information security program.

companyName: FIRST BANCSHARES INC /MS/


text: Westwood management is responsible for the execution of the framework for the management of our information security. These responsibilities include, but are not limited to: a. Designing, implementing and executing our framework for information security management; b. Reviewing and updating our policies and procedures annually;

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Reporting to Board of Directors The ISO, in his capacity as such, regularly reports to management and the BRCC on all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face. In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.

companyName: OP Bancorp

ticker: OPBK


text: Our cybersecurity program efforts are directed by our CISO who, with the support of the chief operating officer, the chief product officer, and the chief legal officer, has the primary responsibility for assessing and managing material cybersecurity risks. The CISO along with these members of our management, acting as a group, drive alignment on security decisions across the Company. The CISO and various members of this group meet quarterly with the Audit Committee to review security performance metrics, identify security risks and review mitigation strategies, and assess the status of approved security enhancements. Our CISO has served in various roles in information technology, information security and risk management for over 27 years, including serving as the Information Security Officer and Chief Security Officer of multiple companies.

companyName: Elastic N.V.

ticker: ESTC


text: Management of Cybersecurity Risk During 2023, we adopted a Cybersecurity Event Plan ("Cybersecurity Plan") which outlines how we identify and manage our cybersecurity risk. The Cybersecurity Plan contains the following elements: • Incident Identification and Reporting – outlines the steps used to promptly identify cybersecurity risks and report those through appropriate means; • Incident Assessment –after collecting information about a potential risk or threat, a protocol has been developed and outlined that will allow a cross-functional team to assess the threat; • Incident Containment–provides for action to be taken to isolate and attempt to contain and minimize any potential threat; • Resolution and Recovery– outlines the steps to be taken, based upon the incident and the systems potentially impacted, to mitigate the potential impact of the threat and restore system access and functionality in the minimum amount of time; • Training and Awareness–development of training and awareness programs to allow employees to understand how to promptly respond in the event of a perceived threat.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: All possible cybersecurity incidents are reported to our General Counsel for consideration of materiality. Our General Counsel escalates consideration of materiality to our Chief Executive Officer, Chief Financial Officer and other corporate officers as appropriate. The Company does not utilize any third-party service providers for consideration of materiality for cybersecurity incidents. Upon determination that the Company has experienced a material cybersecurity incident, the Company will disclose the incident within four business days as required by regulation. Our Board will also be notified of any material cybersecurity incidents immediately upon determination of materiality.

companyName: PROASSURANCE CORP

ticker: PRA


text: People play a significant role in our defense against cybersecurity threats. We have established policies, training, and client education to mitigate cyber risk.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: On a periodic basis, but not less than annually, the ISO in conjunction with the Compliance/ERM Team, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Team reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: We are not aware of any material cybersecurity incidents that have impacted us. However, Vista is aware that similar institutions, as well as its employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity threats in recent years and will likely continue to be the targets of increasingly sophisticated cyber-attacks. We described whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy and results of operations, under the heading "We are dependent on information systems and systems failures could significantly disrupt our business, which may, in turn, negatively affect our liquidity, financial condition or results of operations", included in Item 1A of this Form 10-K, which is incorporated by reference herein.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters. The Board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of the Advisor's cybersecurity program, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Overland Advantage


text: The Audit Committee cybersecurity risk oversight role includes: (i) reviewing and approving technology security policies and internal cybersecurity controls, (ii) monitoring cybersecurity and information security exposures, and (iii) confirming management has adequate procedures in place to not only control and limit these exposures but also to timely respond to any cyber incident. NNN's cybersecurity risk profile and cyber security program status, including results of any third-party evaluations are reported to the Audit Committee by the Chief Accounting and Technology Officer.

companyName: NNN REIT, INC.

ticker: NNN


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's timely and effective response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Executive Response Team of the Company and as guided by the Company's Chief Risk Officer, to the Risk Committee when appropriate.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Our executive management and board of directors oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. Our executive management and board of directors each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our executive management and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX


text: The Chief Information Security Officer ("CISO") is responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. The CISO has been with the Company for two years and has over 30 years of experience in technology, including 15 years in cybersecurity, and has held the CISO position at prior companies before joining Exact Sciences. The CISO is supported by a cybersecurity team that is staffed with experts in strategy, governance, risk management, compliance, engineering and development, security operations, and incident management.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. In particular, the interim Chief Legal Officer and the CSO co-chair a periodic Cybersecurity Steering Committee (the "Steering Committee") meeting to help ensure a strategic approach to assessing and mitigating cybersecurity risks. The Steering Committee is charged with: • providing ownership, oversight, and review of current and future information security risks; • reviewing, approving, and communicating information security policies, exceptions, standards, and processes to the relevant teams and employees and helping ensure business requirements are represented in Steering Committee discussions; • reviewing our approach to security initiatives to assess whether it is designed to meet appropriate risk thresholds and regulatory guidelines; and • providing strategic direction and sponsorship for cybersecurity investments, projects, and services.

companyName: Aspen Technology, Inc.


text: During the last three years we h ave not experienced any cybersecurity incidents that have materially affected our Company, including our business, strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats may be reasonably likely to materially affect us, refer to Item 1A. Risk Factors – Risks Related to our Business – "We rely on information technology and telecommunications systems, many of which are provided by third-party vendors" and – "Cyberattacks or other security breaches could adversely affect our operations, net income or reputation," incorporated by reference into this Item 1C.

companyName: Investar Holding Corp

ticker: ISTR


text: Our cybersecurity framework leverages internationally recognized standards, including the CIS 20 and the NIST SP 800-171 frameworks, and is required to comply with the Department of Defense CMMC. We have policies and procedures in place designed to maintain compliance with relevant cybersecurity and data privacy laws and regulations in the jurisdictions in which we operate, such as the European Union GDPR and the California Consumer Privacy Act.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also share and receive threat intelligence with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: We use a third-party vendor to provide a suite of services to assess, identify, and manage material risks from cybersecurity threats. These services include providing us with a secure email platform, including content examination and data leak prevention; system monitoring and support, including patch management, anti-virus and threat hunting services; and system backup and recovery services. As we expand our business operations, we plan to evaluate the development of enhanced processes that will allow for the identification and assessment of cybersecurity risk that will be integrated into an overall risk management system, which will be managed by senior management and overseen by the Board of Directors.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: The CIO, in coordination with the CISO, works to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. To facilitate the success of this program, the cybersecurity team works to address cybersecurity threats and respond to cybersecurity incidents in accordance with the Company's written incident response plan. The CISO and cybersecurity team regularly meet to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and the CISO consults with the CIO and executive management, including the Chief Executive Officer, to report such incidents to the Audit Committee and the Board and initiate a response to incidents when appropriate.

companyName: Burlington Stores, Inc.

ticker: BURL


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Federal Financial Institutions Examination Council ("FFIEC") regulatory guidance, and other industry standards such as the Center for Internet Security ("CIS"). In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Information Officer regularly collaborate with industry groups to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: While we have experienced data security incidents that have disrupted our operations in the past, to date, no data security incidents have had or are materially likely to have, a material impact on RPM.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: We also have a vulnerability management program in place that is designed to protect our external and internal networks and critical assets. In addition, we have designed policies and procedures so that our Disclosure Committee, which is composed of members of management and is co-chaired by the Company's CFO and General Counsel, is appropriately informed of significant cybersecurity matters to ensure compliance with applicable cybersecurity disclosure requirements for our public filings. The Disclosure Committee meets on a quarterly basis and more often as necessary.

companyName: BRINKS CO

ticker: BCO


text: While we, our customers and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost customer revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, customer dissatisfaction, and loss of investor confidence.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: Company maintains cyber insurance coverage that may, subject to policy terms, conditions, and limitations, cover certain aspects of cybersecurity risks; however, such insurance coverage may be unavailable or insufficient to cover all losses or all types of claims that may arise in the continually evolving area of cyber risk.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: Board and Management Oversight The Company's management is involved in overseeing our cyber, data governance, and privacy program as members of our Data Governance Working Group, and assessing security incidents with the IRT to the extent discussed in the IRP above. The Board and Audit Committee actively oversee our enterprise risk management, including cybersecurity risks, and are notified and updated on any security incidents on a regular basis. The Audit Committee is responsible for overseeing our cyber, data governance, and privacy program and receives regular updates from management and the IRT leader about the Company's ongoing compliance and risk management and reports to the Board regularly.

companyName: ContextLogic Inc.


text: Our board of directors has approved management commitess including the CSI Committee, which focuses on technology impact, and the Management Risk Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by managers within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company. These committees generally meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Risk and Compliance Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: We rely on our technology network infrastructure and information systems to operate our business, interact with vendors and customers, and collect and make payments, among other functions.

companyName: USA Rare Earth, Inc.

ticker: USAR


text: The Company has established controls and procedures to escalate enterprise-level issues, including cybersecurity matters, to the appropriate management levels within its organization and to its Board of Directors, or members or committees thereof, as appropriate. The Company's Board of Directors is responsible for enterprise risk management, including its approach to managing cybersecurity risk, and has delegated oversight responsibility of information security risks to its Audit Committee. Under the Company's framework, cybersecurity issues are analyzed by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact.

companyName: OneMeta Inc.

ticker: ONEI


text: The VP of Technical and Maintenance chairs monthly cybersecurity meetings to review cyber risks or threats related to the operations of our geothermal projects.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: The Company also regularly engages with consultants, auditors, and other third parties, including by having an independent third-party Qualified Security Assessor review our cybersecurity program twice each year to help identify areas for continued focus and enhancement. These third parties analyze data on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity controls, systems and processes.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. In collaboration with the Company's IT leadership, management has established structured processes for identifying, assessing, and mitigating cybersecurity risks that may impact our business operations including processes to identify cybersecurity risks associated with the use of third-party service providers.

companyName: Oklo Inc.

ticker: OKLO


text: Under our incident response plan, the Technology & Security Team is tasked with identifying and responding to actual or suspected cybersecurity incidents or other data-related events, as well as escalating qualifying incidents and events to a cross-functional leadership team, which includes representation from Technology, Security, Privacy and executive leadership, including our Chief Legal & Risk Officer. The leadership team is responsible for supervising incident response, remediation and compliance with any notification and disclosure obligations with respect to any incidents that have been escalated in accordance with our incident response plan. The Technology & Security Team conducts regular security assessments and employee security awareness trainings and tracks cybersecurity events through the preparation of quarterly status reports and metrics. The team presents these reports and metrics, together with additional internal metrics associated with the status of the Company's cybersecurity program and updates on the status associated with enterprise risk mitigation for technology-based programs, including cybersecurity initiatives, to the Audit Committee of the Board of Directors (the "Board") at least bi-annually. Additionally, the Company's Enterprise Risk Management Team ("ERM Team"), which is responsible for assisting the Company in identifying, assessing, managing, mitigating and reporting on top enterprise risks (including cybersecurity risks), provides updates to the Audit Committee at least bi-annually.

companyName: Sterling Check Corp.


text: At Katapult, cybersecurity risk management is an integral part of our overall enterprise risk management program and information security protocols. Our cybersecurity risk management program is based on industry best practices and Center for Internet Security Critical Security Controls for handling cybersecurity threats and incidents, including threats and incidents associated with the use of internally developed applications and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees throughout the year.

companyName: Katapult Holdings, Inc.

ticker: KPLT


text: Monitoring of Federal government alerts (CISA, FBI) and industry threat information is performed to stay current on the newest cybersecurity threats bad actor tactics.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: Cybersecurity Organizational Maturity Assessment: The objective of this service is to understand the level of risk and maturity of the Company's cybersecurity controls (Cybersecurity Assessment). The results of Cybersecurity Assessments are used to design and implement work plans.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Mr. Temm joined Charter in 2020 as Group Vice President, IT Security, where he maintained responsibility for cybersecurity across our IT infrastructure, leading cyber threat intelligence, vulnerability management, security operations, incident response, information security engineering and architecture, risk management and security awareness. Previously, Mr. Temm was Chief Information Risk Officer for the Financial Services-Information Sharing and Analysis Center (FS-ISAC) where he collaborated with global financial services companies – foremost cybersecurity providers, law enforcement and government agencies – to protect the financial services sector against cyber and physical threats while coordinating responses to sector-wide incidents. Prior to FS-ISAC, Mr. Temm spent nearly two decades with Mastercard, serving in various leadership roles in cybersecurity, corporate security, network operations and debit operations. He holds a bachelor of science in business administration from Lindenwood University, where he graduated with Great Distinction. He is also a Certified Information Systems Security Professional ("CISSP").

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Carpenter Technology's cybersecurity team and organizational partnerships are designed to protect our employees, intellectual property and customers from various cyber threats. Our cybersecurity team strives to achieve these protections through obtaining leading certifications and regular engagement with third parties and federal organizations to further protect our information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third party providers. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. Our cybersecurity program is informed in part by industry standards and best practice, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: PINTEREST, INC.

ticker: PINS


text: Our Board oversees our risk management processes, including our risks from cybersecurity threats. As part of its ongoing responsibilities, the Board receives recurring reports from management on the Company's cybersecurity risk environment and regularly meets with management to review the risk landscape and discuss the steps taken by management to monitor and mitigate cyber exposures. In addition, from time to time, our Chief Technology Officer and Chief Information Security Officer ("CISO") brief the Board on the cyber-threat landscape, our information security program and other related information technology topics.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Like most companies, our systems are continually subjected to sophisticated and evolving cybersecurity threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that materially impacted our operations or financial condition. Vulnerabilities could lead to significant additional expenses and an adverse effect on our reputation, business, results of operations, financial condition and cash flows. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to invest in our security controls, incident response capabilities, and third-party vendor management protocols. Additional information on cybersecurity risks we face is included in Part I, Item 1A, "Risk Factors," which should be read in conjunction with the information in this section.

companyName: TORO CO

ticker: TTC


text: We maintain cybersecurity risk insurance coverage; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severability of incidents and to mitigate and manage their effects. The CEO, COO, CIO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives.

companyName: EchoStar CORP

ticker: SATS


text: Although BancPlus has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business, financial condition or results of operations, there can be no guarantee that it will not experience such an incident in the future. There can be no guarantee that BancPlus' policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. For additional information regarding the risks the Company faces from cybersecurity threats, please see the risk factor titled "Unauthorized access, cyber-crime and other threats to data security may subject BancPlus to regulatory action or penalties, require significant resources, harm BancPlus' reputation, and otherwise cause harm to its business" included in Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: BANCPLUS CORP


text: Additionally, prior to engaging any vendor that will store sensitive Company information, PSCM performs due diligence on the vendor's information security infrastructure and requires that the vendor agree contractually that the Company's information will be encrypted in transit and at rest and that the appropriate user access controls will apply. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Pershing Square SPARC Holdings, Ltd./DE


text: The Company maintains disaster recovery plans for key applications and site-specific incident response plans, as well as a cybersecurity and related insurance policies as a measure of added protection.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: Our CTO has over 20 years of experience in engineering and information technology management at various organizations. Our CTO collaborates regularly with our third-party service provider who provides a fractional Chief Information Security Officer, who has extensive experience in cybersecurity and a certification as a CISSP.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Cybersecurity Risk Management: PyraMax Bank employs a comprehensive approach to cybersecurity risk management to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: Management utilizes a cross-functional approach designed to address the risk from cybersecurity threats, involving senior management personnel from the technology, operations, legal, risk management, internal audit and other key business functions, as well as members of the Company's Board and the Audit Committee of the Board. The Company's CIO, with support from our CISO and the other members of the cybersecurity team, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program.

companyName: Burlington Stores, Inc.

ticker: BURL


text: We face cybersecurity threats in the ordinary course of our business and have faced cybersecurity threats and breach attempts in the past.

companyName: SRx Health Solutions, Inc.

ticker: SRXH


text: The Company has a robust Enterprise Risk Management Program that has identified cyber security as a top enterprise risk. The managing and monitoring of risks are the responsibility of the Company's Risk Committee, which meets quarterly and is chaired by the Chief Financial Officer. Members include key leaders of the Company, including the Chief Information Officer.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: Trulieve recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data we produce and collect.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: While the Company continues to face a number of cybersecurity risks in connection with the business, Cass has not experienced any cyber incidents that materially affected business strategy, results of operations or financial condition over the past fiscal year. The Company commits to transparently communicating with stakeholders, including shareholders, regulatory bodies, and law enforcement agencies, as required. To mitigate financial risks associated with cybersecurity incidents, Cass maintains a comprehensive cyber insurance policy. This policy covers various costs, including legal expenses, investigation costs, business interruption, and potential liabilities.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: Our assessment and management of material risks from cybersecurity threats are integrated into our Company's overall risk management process, which, in part, establishes intended uses of our computerized systems and identifies critical and/or material risks. After a system reaches operation, the risk management approach continues following processes for change control, system maintenance, logical access control, discrepancy management and periodic review.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: The Company has processes and procedures as part of its centralized supplier risk management system to oversee, identify, assess and reduce cybersecurity threats and risks associated with key third-party service providers. As part of this process, the Company utilizes external frameworks and tools to provide assessment scoring, planning and monitoring against cybersecurity threats and risks and remediation recommendations, as applicable. Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Audit Committee as appropriate.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: The Company has established policies, processes, and controls that are designed to monitor, detect, investigate, respond to, and escalate management of cybersecurity threats and incidents. If the Company experiences a cybersecurity incident, the Company activates an incident response plan, which includes processes to enable it to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate brand and reputational harm. Based on initial investigation into such incident's impact to the Company, the actor(s) involved, and other factors, the Company assigns a severity level to an incident, which dictates the escalation path for a given incident. Incidents rising to higher levels of severity and potential materiality are escalated to designated members of the Company's senior management for further assessment, response, and remediation. Additionally, the Company has established a Cyber Crisis Management Team, responsible for addressing and responding to the most severe cyber incidents. If warranted, senior management notifies the Audit Committee and/or the full Board of Directors, as appropriate. Throughout this process, the Company continues to investigate the incident and, as its understanding of the incident evolves, updates its severity assessment, as necessary.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: Cooper Standard continuously works to update and strengthen our Incident Response ("IR") program, which defines response procedures and prescriptive controls designed to streamline response to incidents, when and if they occur. Our designated cross-functional Incident Response Team ("IRT") consists of leaders from human resources, global communications, legal, internal audit and information technology. Cooper Standard's IRT is dedicated to maintaining a culture of continuous improvement, taking into consideration lessons learned from table-top exercises and feedback from the third-party expert with whom we annually contract.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: Our regular interactions with third party vendors and suppliers pose a potential cybersecurity risk that could adversely impact our business or employees. We conduct information security assessments before onboarding. In addition, we require providers to meet appropriate security requirements, controls, and responsibilities, and include additional security and privacy addenda to our contracts where applicable. We also make cybersecurity education and awareness materials available to our suppliers.

companyName: BRUNSWICK CORP

ticker: BC


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Neuphoria has and engaged with a range of external experts, including cybersecurity assessors, consultants, advisors, and auditors in evaluating and testing our risk management systems. These partnerships will enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: Governance and Management Our board of directors addresses our cybersecurity risk management as part of its general oversight function. As part of the Board's oversight, the Board will receive a report at least annually from our cybersecurity committee, covering updates on our cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape.

companyName: Aeries Technology, Inc.

ticker: AERT


text: Engagement of Third-Parties Our GISO partners with third-party cybersecurity service and product vendors to provide protection of our networks, information resources, products, services and data for our customers and employees. Furthermore, our GISO engages third-party cybersecurity and data protection experts to perform assessments on the efficacy of our cybersecurity program and measures, including cybersecurity maturity assessments, audits and independent reviews of our cybersecurity control environment and operating effectiveness. Our Chief Information Security Officer reports the results of such assessments, audits and reviews to our executive team and our Audit Committee.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: The Company has a Chief Information Security Officer (the "CISO") whose team (the "IT Security Team") is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across all areas of the Company to protect the Company and its employees and customers against cybersecurity risks, perform investigations and respond to cybersecurity incidents. The CISO reports to the Chief Technology Officer ("CTO") who is also actively involved with assessing and managing cybersecurity risks. The CISO and the CTO are responsible for the quarterly updates to the Audit Committee regarding cybersecurity. The CISO has 28 years of experience in the IT field, with ten of those years in cybersecurity. The IT Security Team has a combined experience of 42 years and two members of the IT Security Team have obtained their Certified Ethical Hacker certifications. The CTO has over 34 years of experience in the IT field with a broad understanding of e-commerce and customer facing technologies.

companyName: LL Flooring Holdings, Inc.


text: Our third-party vendors and service providers also play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party vendor risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: Our cybersecurity program focuses on the following areas: • Vigilance – We maintain 24/7 cybersecurity threat operations in order to rapidly detect, contain and respond to cybersecurity threats and incidents. • Systems Safeguards – We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, endpoint detection and response software that includes anti-virus and anti-malware functionality, data loss prevention mechanisms, access controls and ongoing vulnerability assessments and penetration testing. • Third-Party Management – We screen vendors, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented to users of our systems. The screening includes conducting sanctions and exclusions checks and security risk assessments. • Education – We provide training at hire and annually thereafter for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices. • Incident Response Planning – We have established and continue to maintain an incident response plan that addresses our response to a cybersecurity incident. We conduct annual testing of our incident response plan to measure effectiveness to improve our plan. • Communication and Coordination – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the technology, operations, legal, risk management and other key business functions (the "Cybersecurity Oversight Team"), as well as including our board of directors in an ongoing dialogue regarding cybersecurity threats and incidents. • Governance – Our board of directors' oversight of cybersecurity risk management is supported by our Compliance and Risk Management Committee, which includes our Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer and interacts directly with, and is provided relevant information by, our Cybersecurity Oversight Team.

companyName: Augmedix, Inc.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Chief Financial Officer and our General Counsel. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.

companyName: Fossil Group, Inc.

ticker: FOSL


text: Under our enterprise risk management initiative, our Board of Directors and the Audit Committee engage in regular discussions with our senior management team, including the Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, to manage cybersecurity threats. The Board and Audit Committee are promptly briefed on any cybersecurity incident surpassing predetermined reporting thresholds, receiving continuous updates until resolution.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Company's Senior Director of Cybersecurity and the Cybersecurity Core Team, supported by our Cybersecurity Leadership Team.

companyName: Snap One Holdings Corp.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include assessment of, and response to internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations.

companyName: Verastem, Inc.

ticker: VSTM


text: To date, we have not experienced cybersecurity incidents that have materially affected our business strategy, results of operations, or financial condition. We maintain processes to timely escalate incidents to management and the Audit Committee where appropriate, and to evaluate whether any incident is material. If we determine that a cybersecurity incident is material, we will make required disclosures consistent with applicable SEC rules.

companyName: BITMINE IMMERSION TECHNOLOGIES, INC.

ticker: BMNR


text: Our Security Incident Management Team, which includes our Chief Financial Officer, the Executive Director of Information Technology, Chief Legal Officer and the Quality Assurance Director, has approximately 30 combined years of risk management experience and is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Security Incident Management Team's experience includes prior work experience in cybersecurity; financial management and controls, data quality assurance and liability and risk management.

companyName: BioXcel Therapeutics, Inc.

ticker: BTAI


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our board of directors and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: Luvu Brands, Inc.

ticker: LUVU


text: Additionally, our cybersecurity team maintains a comprehensive set of cybersecurity policies and standards, including a security incident response framework. The framework is a set of coordinated procedures and tasks that our incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the Board of Directors and Audit Committee are kept informed on the status of potential cybersecurity incidents. A summary of recent incidents is also presented by the Chief Law Officer ("CLO") at each regular Audit Committee meeting. Our policies and standards were developed in collaboration with a wide range of disciplines, including information technology, cybersecurity, legal, compliance and business. Our cybersecurity strategy and policies are continually reassessed to ensure they attempt to identify and proactively address the constant changes in the global threats. Decision makers such as the CLO, executive team, and Audit Committee are regularly kept up to date on cybersecurity trends. Ongoing collaboration with stakeholders throughout the business also helps to build continued awareness and visibility of future needs.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: Our Chief Information Officer (CIO) provides annual reports, with additional updates as necessary to the board of directors. Our CIO also attends annual audit committee meetings and provides cybersecurity updates which include specific cybersecurity topics, covering material risks and threats. Our CIO oversees the cybersecurity program. With an extensive background in the IT industry, our CIO has previously been in multiple CIO positions and other top global leadership roles that drove digital transformation and owned technology from end to end. Our CIO leads a cross-functional information security team, comprised of experienced professionals from the global infrastructure and cybersecurity, legal and compliance organizations. Beyond information technology, this leadership team also partners with our Enterprise Operations team managing the operational technology security of our manufacturing facilities.

companyName: DONALDSON Co INC

ticker: DCI


text: See Risk Factors in this Annual Report on Form 10 -K for a description of the risks from cybersecurity threats that may materially affect us and how they may do so.

companyName: Rekor Systems, Inc.

ticker: REKR


text: As of the date of this Annual Report on Form 10-K, we have not experienced any significant cybersecurity attacks and, to date, the risks from cybersecurity threats have not materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For more information regarding the risks the Company faces from cybersecurity threats, see " Item 1A. Risk Factors––Risks Related to Our Business and Operations––We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks."

companyName: LQR House Inc.

ticker: YHC


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing.

companyName: TENNANT CO

ticker: TNC


text: Our board of directors (the Board) is committed to managing data privacy and cybersecurity risks as part of the company's overall risk management framework. The Board oversees the company's cybersecurity risk management program through the Board's Audit and Finance Committee (the Audit Committee). The Audit Committee is responsible for overseeing and reviewing with management GoDaddy's cybersecurity matters. The Audit Committee receives verbal and written reports at least quarterly from GoDaddy's Chief Information Security Officer (CISO) regarding the state of the company's cybersecurity risk management program, the company's current material cybersecurity risks, and general cybersecurity-related risks. The Audit Committee consists of Board members with a diversity of expertise in risk management, technology, finance and cybersecurity, including oversight of security teams. In addition, the company's CISO and Chief Technology Officer (CTO) provide the full Board with written quarterly and annual reports on the state of the company's cybersecurity program and material cybersecurity-related risks, and the chair of the Audit Committee provides a quarterly summary of the Audit Committee's cybersecurity discussion to the full Board.

companyName: GoDaddy Inc.

ticker: GDDY


text: We engage third parties to conduct independent cybersecurity assessments. The assessments include technical control reviews of new technologies, penetration testing, and ongoing monitoring of our security posture. We also rely on third parties to conduct annual audits to maintain cybersecurity certifications, such as ISO 27001 and Cyber Essentials. As a government contractor, we are also subject to numerous Service Organization Control (SOC) audits each year to fulfill contractual requirements.

companyName: MAXIMUS, INC.

ticker: MMS


text: The Company engages a third party to perform an annual cybersecurity audit, which attests compliance with our Cybersecurity Program and industry best practices. The results of the third-party audit and internal vulnerability reviews are used by the CISO to guide investments in cybersecurity capabilities, solutions, and services to reduce the Company's exposure to cybersecurity risks. To aid managing, prioritizing and remediating any identified cybersecurity, software engineering, and IT infrastructure risks, the Company has implemented a risk register. The risk register is maintained by the IT Department and the status of remediation efforts is communicated to management during the quarterly meetings of the IT Steering Committee. Any significant, control failure, weakness or cybersecurity incident is reported by the CISO to the Company's incident response team and prioritized for remediation in accordance with our cybersecurity incident response plan. In addition to the third-party audit, we perform ongoing vulnerability reviews and conduct annual penetration testing of both external and internal systems. These tests are conducted by qualified external consultants and all findings are reported to the CISO and any deficiency is tracked until it has been fully remediated. A risk assessment is conducted regularly against NIST and CIS frameworks to determine gaps in controls that exposes the Company to a risk level that requires mitigation efforts. The Company requires in depth security monitoring continuous and real-time, detection of, and responses to cybersecurity threats and has partnered with industry leading managed service providers to accomplish this objective. Our cybersecurity partners maintain continuous security operations centers, threat intelligence, response capabilities, and incident response services. These services are tested for effectiveness annually as part of the internal penetration testing process. As mentioned above, the Company has implemented an incident response plan and incident response team that meets at least annually to assess breach scenarios and improve our response capabilities. All findings from testing, vulnerability analysis, breach scenarios, and event detection are reported quarterly by the CISO to the IT Steering Committee and Audit Committee.

companyName: International Money Express, Inc.

ticker: IMXI


text: As of the date of this report, though the Company and its third-party service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, financial condition, results of operations or cash flows. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise of our information or operational technology systems.

companyName: OneWater Marine Inc.

ticker: ONEW


text: Cybersecurity Risk Management Strategy OFG has a comprehensive framework in place to assess, identify and manage material risks from cybersecurity threats. Our Information Security Officer ("ISO") is responsible for overseeing and implementing OFG's cybersecurity risk management framework as part of our broader Information Security Program approved by our Board. Our cybersecurity risk management framework is integrated into OFG's broader risk management system with a focus on monitoring key risk indicators within a defined risk tolerance set by our Board.

companyName: OFG BANCORP

ticker: OFG


text: Information about cybersecurity risks and Innventure's risk management processes is collected, analyzed and considered as part of Innventure's overall enterprise risk management program. In connection with Innventure's risk management process, the Audit Committee of the Board (the "Audit Committee") discusses with management and the independent auditors the Company's underlying policies and guidelines with respect to risk assessment and risk management, including with respect to cybersecurity.

companyName: Innventure, Inc.

ticker: INV


text: As a regulated energy infrastructure company, for decades we have used an incident command system (ICS) as a standardized approach to the command, control and coordination of a variety of emergency situations. In the event of emergencies, including cybersecurity events, we stand up a cross-functional Incident Command Team (ICT) to respond to the emergency. We exercise and train the ICT for a variety of emergencies, including cyber events on a regular basis.

companyName: Northwest Natural Holding Co

ticker: NWN


text: The Information Technology ("IT") Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (the "CIO") who reports directly to the Company's Chief Operating Officer and Chief Financial Officer. The CIO has more than 38 years of relevant experience both with the Company and with other organizations in the IT field. The CIO also oversees the Company's Information Security Program and manages a third-party consultant that is an expert in the Information Security field and acts as our Information Security Officer ("ISO"). The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The IT Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology and Information Security Committee ("IT/IS Committee"), and presents information security and cybersecurity updates on a monthly basis to the IT/IS Committee and periodically to the Board of Directors.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: As is the case for other companies in our industry, we may be the target of cyberattacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management, or ERM, program. Our management performs a semi-annual assessment of enterprise-wide risks to help assess, identify, and manage existing and emerging risks for our company, including cybersecurity risks. Through our ERM program we assess the characteristics and circumstances of the evolving business environment at the time and seek to identify the potential impacts to our company of a particular risk.

companyName: Dare Bioscience, Inc.

ticker: DARE


text: Our strategy for managing cybersecurity risk is multifaceted and includes, without limitation: (i) robust security policies and procedures, designed in part to comply with the Payment Card Industry Data Security Standard (PCI-DSS), (ii) an incident response plan backed with industry-leading incident response support services, (iii) comprehensive system security vulnerability scanning, and oversight by a 24 hours a day, 7 days a week, 365 days a year Securities Operation Center; (iv) periodic cybersecurity awareness training and testing for employees and certain contractors; (v) risk management of our third-party suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that generally allow for periodic auditing, and (vi) security assessments of any businesses that we acquire.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Our CIO and CISO provide regular updates to the full Board on the performance of, and enhancements to, key information technology projects, our enterprise security program and risk mitigation efforts, including relevant findings of the Cybersecurity Steering Committee. The full Board also receives updates from the audit committee. In addition, there are protocols in place for immediate escalation in the event of any cybersecurity issues or developments that may require consideration between regularly scheduled audit committee or Board meetings. Our internal audit team also provides regular updates to the audit committee on the performance of our enterprise security program from an internal audit perspective. In addition, our Chief Compliance and Risk Officer, who oversees our overall enterprise risk management and compliance programs and chairs our Enterprise Risk Management Committee, provides regular reports to the full Board, including periodic updates on risk management.

companyName: ANALOG DEVICES INC

ticker: ADI


text: Breeze's cybersecurity risk profile will significantly change upon completion of the pending Business Combination transaction with TV Ammo, Inc. described in Item 1. Business within this Report. The cyber risk management program will be re-evaluated upon the close of the Business Combination.

companyName: Breeze Holdings Acquisition Corp.


text: Our cybersecurity program is focused on protecting critical assets, including data, systems and applications; minimizing the impact of cyberattacks; understanding and preparing for the evolving threat landscape and complying with applicable law. The program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board delegated oversight of cybersecurity risk management to the Audit Committee, which regularly interacts with our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including the Information Security Governance team and the Cybersecurity Risk Management team. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also continuously improving our cybersecurity program and maintaining a strong cybersecurity posture. Key to this approach is to broadly assess the potential impact of cybersecurity incidents on business operations and financial stability as well as any legal and regulatory requirements regarding cybersecurity. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection and prevention systems, encryption, multi-factor authentication, privileged access management least privileged access controls, secure coding practices and other security controls, which are regularly evaluated and improved through vulnerability assessments and penetration testing designed to identify weaknesses in our systems and networks. • Incident Response and Recovery Planning: We have a dedicated Incident Response Team dedicated to responding to and recovering from cybersecurity incidents. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including our vendors who handle our data and systems through due diligence and vendor assessments. • Education and Awareness: We provide regular, training for all employees and contractors, which is designed to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Management is responsible for managing cybersecurity risks and bringing to the Board's attention any material risks. Under the oversight of the Audit Committee, the Company's Chief Financial Officer is primarily responsible for the assessment and management of cybersecurity risks and utilizes a third-party consultant to assist with managing these risks.

companyName: Trilogy Metals Inc.

ticker: TMQ


text: The secure collection, maintenance, processing and transmission of confidential and sensitive information, including personal data, is a critical element of our operations. We rely on encryption and authentication technology licensed from third parties in an effort to securely transmit certain confidential and sensitive information, including credit card numbers. Our information technology and other systems, and those of our third-party service providers, that collect, maintain, process and transmit customer, employee, service provider and business partner information are susceptible to increasing threats of continually evolving cybersecurity risks.

companyName: Flutter Entertainment plc

ticker: FLUT


text: Enterprise Cybersecurity. Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology (NIST) standards, among others. The program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications.

companyName: RTX Corp

ticker: RTX


text: Aspects of the information systems of our Homebuilding operations and our Financial Services operations are separate and distinct, and therefore each operation has a separate CIO and CISO. The CIOs are responsible for managing their respective CISO and ensuring their information security team is assessing and managing cybersecurity risks in accordance with our processes and procedures. Each of our CIOs has over 20 years' experience managing enterprise information technology systems. The CISO of our Homebuilding operations is a certified information security manager as certified by the Information Systems Audit and Control Association (ISACA). Pursuant to our Cybersecurity Incident Response Plan (CIRP), when a cybersecurity event has been identified through our detection processes, it is assessed in order to determine whether the event is a cybersecurity incident. Our CIRP designates the primary manager of a cybersecurity incident, describes the parties who should be informed about the incident and outlines the processes for containment, eradication, recovery and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, members of our senior management team and Board of Directors are notified of an incident and kept informed of the mitigation and remediation of the incident. We are not aware of any material cybersecurity incidents in the last three years.

companyName: PULTEGROUP INC/MI/

ticker: PHM


text: We have developed an incident response plan designed to coordinate the activities that we and our third-party security service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage. Additionally, as part of our overall risk management program, we maintain a global insurance portfolio with cybersecurity coverage.

companyName: Evolus, Inc.

ticker: EOLS


text: We have policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities for preliminary assessment, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our policies and procedures include processes which incorporate regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through an internal reporting channel.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Our governance framework includes oversight by the Audit Committee of the Board of Directors. The Audit Committee meets quarterly with the CFO regarding the cybersecurity risk management program, including as relates to critical cybersecurity risks and cybersecurity initiatives and strategies. Additionally, on an annual basis, the VP of IT reports the current state of cybersecurity risk management to the full Board of Directors. The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management.

companyName: PLUG POWER INC

ticker: PLUG


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information technology ("IT") systems and protect the confidentiality, integrity, and availability of our data.

companyName: FTC Solar, Inc.

ticker: FTCI


text: Our customers and suppliers face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Cybersecurity Incident Impact As previously disclosed, in August 2021, we experienced a cybersecurity incident that resulted in numerous lawsuits, including mass arbitration claims and multiple class action lawsuits. In January 2023, we experienced another cybersecurity incident that also resulted in consumer class actions and regulatory inquiries. As a result of the August 2021 cyberattack and the January 2023 cyberattack, we have incurred and may continue to incur significant costs or experience other material financial impacts, which may not be covered by, or may exceed the coverage limits of, our cyber liability insurance, and such costs and impacts may have a material adverse effect on our business, reputation, financial condition, cash flows and operating results. For additional details regarding the impact of both cybersecurity incidents, see Note 18 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Under our Cyber Risk Program, our SVP, and the cybersecurity staff, along with our management-led Cybersecurity Subcommittee, with input where appropriate from our third-party advisors, work to identify our cybersecurity threats, assess the risks and deploy appropriate technologies and processes to mitigate the risks. When cybersecurity incidents occur, these resources work to manage through the incident utilizing advanced security tools and playbooks, and in accordance with processes set out in our various policies and practice documents, which include internal communications protocols to keep the executive team and, where appropriate, the Risk Committee and board or directors, informed. Pertinent policy and practice documents include, among others, E2open's Guidelines for Cybersecurity Determination for Item 1.05 of Form 8-K (governing the Company's materiality determination for reporting purposes) and our Crisis Response Plan.

companyName: E2open Parent Holdings, Inc.


text: The Vice President, Information Technology, works closely with other management positions, including our Chief Financial Officer and our General Counsel, to help us maintain an effective incident response communication plan and understanding of our cybersecurity risk management processes. Our cybersecurity incident response plan provides processes for escalation if there is an emerging cybersecurity incident, including timely notice to our Board of Directors if the incident is deemed material or as otherwise appropriate.

companyName: Chord Energy Corp

ticker: CHRD


text: Our approach to cybersecurity risk is based on processes that monitor threats, adapt our capabilities and services, and align our practices with business goals in order to provide security controls that reduce information security risk to the organization and customers.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: The Audit Committee exercises its risk oversight function by carefully evaluating information and cybersecurity reports they receive from management; assessing the priorities and roadmap of the cybersecurity program; and making inquiries of management with respect to areas of particular interest to the Board. Senior leadership, including our chief information officer ("CIO") and our chief information security officer, periodically briefs the Audit Committee on our cybersecurity and information security programs and reviews cybersecurity incidents.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: The CSO manages a team that is responsible for day-to-day tracking, assessing and management of threats. The N-able security team has a dedicated incident response team, with trained resources that are responsible for the various stages of our incident management strategy, including preparation, detection and analysis, containment, eradication, and recovery. Through ongoing communications with the team, the CSO and the SRC are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity infrastructure initiatives. In the event of a material cybersecurity incident or investigation, management will, in accordance with the Company's IRP and other policies in place, promptly report to the Cybersecurity Committee and the Board, as appropriate. This escalation is in addition to the regular reports by the CSO to the Cybersecurity Committee on at least an annual basis.

companyName: N-able, Inc.

ticker: NABL


text: We conduct regular internal and external audits to adhere to our security policies and procedures and identify improvement areas. Our audits include: annual audits conducted by third-party service providers, internal audits, compliance audits, risk assessments, and incident response audits. In addition to these audits, ASGN collaborates with industry partners, law enforcement agencies, and government organizations to share intelligence and best practices related to cybersecurity. This collaboration helps us stay ahead of emerging threats and continuously improve our security posture.

companyName: ASGN Inc

ticker: ASGN


text: We maintain a comprehensive cybersecurity program designed to protect our information systems and digital assets, including identity and access management controls, network security monitoring, employee awareness training, and periodic third-party assessments. Our cybersecurity policies are reviewed by management and overseen by the board's audit committee at least annually. We regularly evaluate emerging threats and update our security controls and incident-response procedures accordingly.

companyName: TREASURE GLOBAL INC

ticker: TGL


text: Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.

companyName: SideChannel, Inc.

ticker: SDCH


text: Cybersecurity Steering Committee Our Cybersecurity Steering Committee currently includes our CEO, CFO, CISO, General Counsel and Chief Ethics & Compliance Officer and has broad oversight of our cybersecurity risk management processes, in coordination with the rest of the Management Leadership Team and the Board. The Cybersecurity Steering Committee has been established to meet and to discuss our cybersecurity risk management measures designed to identify and mitigate data protection and cybersecurity risks, along with procedures and practices related to incident response, including escalation and notification.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Risk Assessments and Operational Audit Our information security policies and protocols undergo regular assessments and audits, and we engage with external parties to review our protections, including benchmarking to industry standards and best practices, such as the NIST CSF. In addition, we benchmark our programs against key regulatory frameworks and conduct technical assessments of our controls, which may include penetration testing and other technical testing. These processes are integrated into our established Enterprise Risk Management (ERM) framework, which is led by Chubb's senior management and overseen by our Board's Risk & Finance Committee. Refer to "Enterprise Risk Management" under Item 1 for further description of our ERM function and Board oversight.

companyName: Chubb Ltd

ticker: CB


text: We have identified information technology and cybersecurity risk as some of the most significant risk types to our business. Related to these identified risk types, we have classified our top risks and report them to both senior management and the risk committee of Genworth Financial's Board of Directors, which in turn reports to the Board of Directors. For additional information regarding the risks associated with these matters, see "Item 1A—Risk Factors."

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: Tredegar's IT Director and Bonnell's Director of Information Security are responsible for managing the Program, including the prevention, mitigation, detection and remediation of cybersecurity incidents. Tredegar's IT Director has over 10 years of cybersecurity expertise, including working in similar roles at other companies, has cybersecurity certifications from EC-Council and ODU Global and holds a degree in Computer Science from Universidade Catolica de Pernambuco and an MBA in IT Management from Universidade Federal de Pernambuco. Bonnell's Director of Information Security has over 30 years of cybersecurity experience, including working in similar roles at other companies, has cybersecurity certifications from EC-Council and ISC^2 and holds a degree in Mechanical Engineering from the Georgia Institute of Technology. Tredegar's IT Director and Bonnell's Director of Information Security also regularly collaborate closely with key management, including the Chief Financial Officer, General Counsel, Compliance Manager, and Human Resources Executive Director, to foster effective communication regarding the Program within Tredegar.

companyName: TREDEGAR CORP

ticker: TG


text: Our Board of Directors has delegated to its Audit Committee primary responsibility for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on our cybersecurity program, including regular presentations regarding our cybersecurity risks; our efforts to address evolving standards; vulnerability assessments, including results of third-party penetration testing; and external audits of our cybersecurity IT controls. Management and the Board also receive prompt and timely information regarding any significant or potentially significant cybersecurity incident and our remediation efforts.

companyName: CULP INC

ticker: CULP


text: The company's current CISO has more than two decades of IT leadership experience and holds several relevant IT and healthcare specific certifications including CISSP, CISM, CRISC, CCSK and CCSP, and has a Bachelor of Science in Computer Information Systems and a Master of Science in Medical Informatics. Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Information Security team's experience includes more than 75 years of combined IT experience, 35 of which are focused specifically on Information Security. The broader Information Security team's accredited industry certifications include Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), and Blue Team Level II.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: Incidents and Threats We have in the past experienced, and expect to continue to confront, cybersecurity incidents and cybersecurity threats from hackers and other third parties. Although such prior incidents have not had a material adverse impact on our operations or financial performance, there can be no assurance that we will be successful in preventing cybersecurity incidents or successfully mitigating their effect on our Company. Any cybersecurity incident could have a material adverse effect on our reputation, competitive position, business, financial condition and results of operations.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to the CISO, CTO, and CIO, as appropriate. The CTO, CISO, and CIO work with the Company's incident response team to help the Company mitigate and remediate such cybersecurity incidents. In addition, the Company's incident response and vulnerability management processes include updates to the audit committee of the board of directors as appropriate.

companyName: PagerDuty, Inc.

ticker: PD


text: We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to our board of directors.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: While we have not identified any cybersecurity threats that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition, our cybersecurity risk management program cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected material cybersecurity incident or will not experience a material cybersecurity incident in the future. For more information about these risks, please see "Risk Factors - A failure in or breach of our operational or security systems, networks or infrastructure, or those of third-party vendors with which we do business, including as a result of cyber-attacks and other data security incidents, could have a material adverse effect on our business."

companyName: CENTENE CORP

ticker: CNC


text: Our Board considers cybersecurity risk as part of its risk oversight function, including oversight of cybersecurity and other information technology risks. The Board oversees management's implementation of our cybersecurity risk management program.

companyName: Expensify, Inc.

ticker: EXFY


text: While we have experienced cybersecurity incidents in the past, we do not believe any of these incidents have materially affected or are reasonably likely to materially affect the Company or its operations and financial condition.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: We have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have adopted the standard 2FA (two factor authentication)

companyName: Strive, Inc.

ticker: ASST


text: As part of our Board's oversight of risk management, our Board will review our cyber-risks and the actions being taken to mitigate such risks with our Advisor. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for the Advisor's employees. Board oversight of risk is also performed as needed between meetings through our Audit Committee and communications between our Advisor and our Board. Our Board will receive periodic education around cybersecurity risks and best practices.

companyName: Net Lease Office Properties

ticker: NLOP


text: The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management. As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: We assess our information security program against the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This program includes policies, processes and procedures to help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. Such risk assessments along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.

companyName: Arhaus, Inc.

ticker: ARHS


text: Our cybersecurity risk assessment, management and strategy processes are led by our Chief Technology Officer. Our Chief Technology Officer has over 15 years of experience in various roles involving managing information security, managing privacy and data protection, developing cybersecurity strategy, and implementing cybersecurity programs. The Chief Technology Officer was recently promoted and is training to be a Certified Information Security Manager (CISM), is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through management of the cybersecurity risk management and strategy processes described above, including our incident response plan.

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: While our board of directors is responsible for oversight and risk management in general, our audit committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The audit committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents. Our management team is responsible for assessing and managing the material risks from cybersecurity threats.

companyName: PALATIN TECHNOLOGIES INC

ticker: PTNT


text: Our CISO is responsible for assessing, monitoring, and managing our cybersecurity risks. With nearly three decades of experience in the field of cybersecurity, including extensive experience as an enterprise CISO, his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our cybersecurity governance programs, tests our compliance with applicable standards, remediates known risks, and leads our employee cybersecurity training program.

companyName: AUTONATION, INC.

ticker: AN


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit and Risk Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Risk Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Security Officer as well as other members of the senior leadership team. The Board also receives periodic updates from management and the Audit and Risk Committee on cybersecurity risks.

companyName: PINTEREST, INC.

ticker: PINS