text: The business continuity management program is designed to oversee and implement resilience, continuity, and response capabilities to safeguard employees, products and services, minimize financial losses and the impact to service to members during a disruption event. A disruption event includes the unavailability of information technology assets due to cybersecurity threats or incidents and other unintentional events like fire, power loss, and other technical incidents such as hardware failures. The business continuity management program provides planning for the restoration of facilities, communications, information technology systems, personnel, and other components necessary for the continuity of critical Bank processes. The business continuity management policy is overseen by the board.

companyName: Federal Home Loan Bank of Atlanta


text: We have established a monitoring strategy and program, which includes: • Active, automated threat detection and screening; • Clearly defined security metrics to be monitored; • Regular security control assessments; • Regular communication about security issues with the executive team and board of directors; • Monitoring information systems to detect attacks and indicators of potential attacks or compromises; • Identifying unauthorized use of information system resources; and • Deploying monitoring systems and agents strategically within the information system environment.

companyName: Pennant Group, Inc.

ticker: PNTG

secItem: Item 1C


text: Risks from Cybersecurity Threats Despite our security measures, our information technology and infrastructure may remain vulnerable to disruptions, including as a result of attacks by increasingly sophisticated intruders or others who attempt to cause harm to, or otherwise interfere with the normal use of our systems. We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to our information systems and computer networks, and we could in the future experience similar attacks. When we do experience cybersecurity incidents like these and the one we disclosed in October 2023, we aim to utilize that experience to inform and strengthen our cybersecurity management efforts. In response to the October 2023 incident, we increased our phishing awareness training and testing, deployed a cybersecurity tool that continuously monitors and verifies the security posture of individual devices within our network, and deployed technology that provides visibility into our sensitive data across different cloud environments, allowing the identification of potential vulnerabilities and take proactive measures to protect data from unauthorized access, misuse, or theft.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The board of directors also receives briefings from senior management on our cyber risk management program.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: Our third-party vendor risk management program addresses third party vendors with access to our systems or data, or processing data on our behalf, and includes a risk-based approach and security assessments throughout the third-party life-cycle, from onboarding to termination, as well as through contractual controls and technological controls to monitor the vendors posture. This program is designed to oversee and identify risks from cybersecurity threats associated with its use of any third-party service providers.

companyName: JFrog Ltd

ticker: FROG


text: The Board of Directors ("Board") is cognizant of the critical value of managing cybersecurity threat risks and is updated on such matters accordingly. Cybersecurity risks are reviewed by the Board, at least annually, as part of our enterprise risk management process and as part of a separate update by our SVP Chief Digital Officer. The Audit Committee assists the Board with its oversight of cybersecurity risks and the steps taken by the Company to monitor and mitigate such cybersecurity risks. The VP Cybersecurity and SVP Chief Digital Officer provide regular, periodic reports to the Audit Committee on cybersecurity metrics and matters. Senior management also keeps the Board apprised of cybersecurity incidents and related materiality assessments as appropriate.

companyName: TEREX CORP

ticker: TEX


text: Our business involves the storage and transmission of a significant amount of confidential and sensitive information. As a result, we take the confidentiality, integrity and availability of this highly sensitive information seriously and invest significant time, effort and resources into protecting such information. Our cybersecurity strategy was designed with the foregoing principles in mind and prioritizes detecting and responding to threats and effective management of security risks.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: Additionally, the VP of IT has participated in Gartner cybersecurity programs and conferences and received training on combating cyber threats, including phishing, malware, and social engineering.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: We have not identified specific risks from known or other broadly publicized cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors".

companyName: System1, Inc.

ticker: SST


text: The Audit Committee reports to our Board of Directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies and ongoing developments, on a periodic basis or more frequently as needed. The Board of Directors also receives updates from our Chief Information Officer on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework. Members of our Board of Directors receive presentations that include cybersecurity topics and the management of key cybersecurity risks from our Chief Information Officer as part of the continuing education of our Board of Directors on topics that impact public companies.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Security Measures: In addition to risk assessments, we employ proactive security measures to enhance our cyber defenses. These measures include the continuous monitoring of network activity, the implementation of access controls and encryption protocols, and the deployment of intrusion detection systems to swiftly detect and respond to any suspicious activities.

companyName: Jet.AI Inc.

ticker: JTAI


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the Chief Audit Executive on our enterprise risk profile on an annual basis. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: While we believe the impacts were not material to our financial condition and results of operations for the fiscal year, we estimate that between $1,000 and $2,000 of sales were lost due to the shutdown during the cybersecurity incident. During the third quarter of 2024, we also incurred legal and remediation costs related to the incident of approximately $98 which are included in selling, general and administrative expenses. In addition, cost of goods sold for year ended November 30, 2024 includes $609 for wages paid to hourly production employees during the work stoppage resulting from the cybersecurity incident. Because no inventory was produced during the temporary shutdown of our manufacturing operations, these wages were charged directly to expense. We are seeking reimbursement of certain costs, expenses and losses stemming from the cybersecurity incident and have submitted a claim to our cybersecurity insurer. We expect final resolution and payment of the claim during the first half of 2025.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: Our cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business. Formalization and implementation of robust IT security policies; vulnerability assessments; of user access request documentation to clearly define the roles and permissions assigned to users; review of the accuracy and completeness of user listings and access;

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Our third-party consultant provides and assists with implementation on a formal IT Security Policy to provide appropriate governance over information security including control requirements for change management and patching, multifactor authentication, data backup, security monitoring, and mobile device management. Management coordinates with its third-party consultant on security controls and any issues are reported to the Audit Committee. In addition, we carry insurance that provides levels of reimbursement protection against the potential losses arising from a cybersecurity incident; however, the insurance may not cover all the costs that we might incur, and we may suffer have not had any reportable cybersecurity breaches, including what we may perceive or recognize as cybersecurity incidents or credible threats during the fiscal year ended December 31, 2023. To date, as a result, there has not been any material adverse effect on our business operations or financial condition. If there is a cybersecurity attack and an infiltration of our files, data, customer data and the like, there would be a material adverse effect on our business, our reputation, our operations and financial condition. For example, our reputation would be damaged in the event of a cybersecurity infiltration. If there were a cybersecurity infiltration, we could lose access to our data which would disrupt our operations, and we even may not be able to operate. Such a loss of access might be temporary or permanent, and it might be localized or general. The level of disruption will depend on our backup systems. Our clients financial and other data could be taken and used against us reputationally or to damage our clients in different ways. In the latter instance, we may be liable for monetary damages to our clients. We may be held for cyber ransom, which would be loss to our financial resources. Our inability to operate, payment of damages, payment of ransom, and the costs of reparation of our systems, consultants and tangential expenses will all result in damage to our business and our financial resources.

companyName: CEA Industries Inc.

ticker: BNC


text: Risk Assessments We identify and categorize existing third-party service providers based on criticality to our operations and prioritize those that pose the highest risks. We leverage a third-party risk management solution to facilitate our risk assessment process for new third parties which includes interviews and questionnaires with internal business contacts and contacts from the third party to perform an inherent risk assessment. We determine applicable security controls based on the inherent risk level to drive the residual risk score to an acceptable level where possible. The goal of the risk assessment process is to evaluate the risks associated with each third party, including operational, financial, legal and reputational risks.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Third-Party Risk Management —We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Redfin Corp


text: We have developed and implemented a cybersecurity program intended to manage risk, and protect the confidentiality, integrity, and availability of our critical systems and information. We design, assess and benchmark our program based on the National Institute of Standards and Technology Cybersecurity Framework.

companyName: ARDELYX, INC.

ticker: ARDX


text: See Item 1A. Risk Factors for additional information on cybersecurity risk. See also Part II – Item 7 – Risk Management for additional information on the Company's Enterprise Risk Management Framework, including further discussion of the Company's risk governance and the management of related risks.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: In addition, the Company's incident response and vulnerability management processes include reporting to the Audit Committee for certain cybersecurity incidents.

companyName: GENELUX Corp

ticker: GNLX


text: Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of Security & Privacy who reports to our Chief Information Officer ("CIO"), to manage the risk assessment and mitigation process.

companyName: Lyft, Inc.

ticker: LYFT


text: We have an incident response plan designed to help quickly detect, contain and remediate cybersecurity incidents. This plan outlines clear escalation procedures, roles and responsibilities to help us respond in a timely manner to potential threats. We also conduct regular employee training on matters such as phishing and email security best practices, among other topics. In addition, we consult with outside advisors and experts when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to help anticipate future threats and trends, and their impact on our risk environment.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See " Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors."

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: We maintain an information security program that includes physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, while timely and effectively responding to, cybersecurity threats or incidents, including those from third-party service providers who have access to our systems, data or are critical to our continued business operations. Through our cybersecurity risk management process, which is overseen by the Amplify Information Technology Steering Committee (the "Steering Committee"), we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats. This process has been integrated into the Company's Risk Management Program, and we have integrated Cyber Incident Response planning into our Business Continuity Program. In addition, we routinely engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. We provide monthly cybersecurity awareness and weekly phishing simulations, data protection modules, tabletop exercises, as well as more contextual and personalized modules for targeted users and roles.

companyName: Amplify Energy Corp.

ticker: AMPY


text: We have also invested in various tools to protect our data and information technology. We maintain a robust system of data protection and cybersecurity resources, technology and processes, and we regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make ongoing strategic investments to address these risks and compliance requirements and help keep Company, guest and team member data secure. We monitor risks of sensitive information compromise at our business partners, where relevant, and reevaluate these risks on a periodic basis. In addition, we have a cybersecurity training program designed to educate and train employees how to identify and report cybersecurity threats. Training programs are conducted on a periodic basis and are focused on giving employees the awareness and tools to manage the most relevant and prevalent cybersecurity risks to us. We also provide specialized training for employees in more sensitive roles. For example, we perform annual and ongoing cybersecurity awareness training for our restaurant management and restaurant support center team members. In addition, we provide annual credit card handling training following Payment Card Industry (PCI) guidelines to all team members that handle guest credit cards. We conduct regular drills, such as tabletop exercises led by third party consultants, to support our overall preparedness for a variety of scenarios.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: Cybersecurity Risks While we have not experienced a material breach of our information systems or data to date, unauthorized parties have in the past gained access and exfiltrated data. Any future incident could significantly disrupt our operations and key business processes, result in the impairment, loss, unauthorized access of critical or sensitive data, be costly and resource-intensive to remedy; harm our reputation and relationship with customers, AutoZoners, vendors and other stakeholders; and have a material adverse impact on our business and operating results. See "Information Technology, Cybersecurity and Data Privacy Risks" in Item 1.A., Risk Factors for additional information related to cybersecurity risks.

companyName: AUTOZONE INC

ticker: AZO


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.

companyName: Great Elm Capital Corp.

ticker: GECC


text: Currently, our Chief Executive Officer is expected to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance. Our Chief Executive Officer will be tasked with staying informed about, and monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes we plan to develop and as described above, including the operation of an incident response plan, and report to the Board of Directors on any appropriate items.

companyName: LIBERTY STAR URANIUM & METALS CORP.

ticker: LBSR


text: The Company deploys commensurate technical safeguards, including firewalls, encryption, network segmentation, real-time monitoring, intrusion prevention systems, anti-malware, and access controls.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: Board Governance and Management The FE Board has identified cyber security as a key enterprise risk and prioritizes the mitigation of this risk through FirstEnergy's enterprise risk management process. Responsibility for oversight of risk management generally lies with the FE Board and the Audit Committee has primary responsibility to oversee enterprise risk management. To effectively manage oversight of FirstEnergy's cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FirstEnergy's Audit and Operations and Safety Committees, respectively, as detailed in each Committees' charters. The Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of the FirstEnergy's overall enterprise risk management program and the internal controls applicable to cyber security matters. The Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy's cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters. FirstEnergy's CISO regularly provides reports at the Audit Committee, Operations and Safety Oversight Committee, and the full FE Board. Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body. These reports include, among other things, current and emerging cyber security risks to FirstEnergy, incidents that were escalated to management during the prior quarter, including those that did not require immediate escalation to the appropriate Committee and/or full FE Board, internal and external assessments of FirstEnergy's cyber security program, and a roadmap of projects to manage its cyber security posture.

companyName: FIRSTENERGY CORP

ticker: FE


text: We recognize that cybersecurity threats have been increasing in number and severity in the general marketplace and in our industry. In an effort to address these threats, we maintain a cybersecurity risk management strategy that is designed to identify, assess, and manage cybersecurity risks to our business. Our cybersecurity risk management strategy includes various policies and components, including cybersecurity assessments, an incident response plan, evaluation of the security practices of our key vendors, and cybersecurity awareness training for our staff. We also leverage third-party technology and security tools and solutions, including alerting and monitoring tools, to support our cybersecurity program.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: All Kestra team members participate in quarterly security awareness training, such as phishing tests as well as mandatory annual Security Awareness and HIPAA Covered Entity training to keep pace with industry standards, evolving challenges, and innovative solutions with respect to information security, data privacy, and cybersecurity risks to the Company. With respect to artificial intelligence, the Company has identified the potential exposure of trade secrets and protected health information to open large language models as a risk, accordingly an Artificial Intelligence Acceptable Use Policy has been implemented, and all Kestra team members have been trained on its requirements.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: Coherent's cybersecurity program is overseen by the Board's Environment, Sustainability and Governance ("ESG") committee. The ESG Committee is briefed quarterly by management on, among other things, updates to cybersecurity and related programs, and notable cyber incidents, threats and vulnerabilities, and provides direction on cybersecurity risk management. In addition, Coherent has established a Crisis Management Team (CMT) with responsibility for, among other things, oversight and management of cybersecurity events, including significant and material cybersecurity events. The CMT reports, as appropriate, to the ESG Committee. The CMT is headed by Coherent's Chief Risk Officer (CRO). Additionally, Coherent has a dedicated internal cybersecurity team (Cybersecurity Team), managed by the Global Head of Cybersecurity.

companyName: COHERENT CORP.

ticker: COHR


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. Our enhanced approach is grounded in industry-leading practices, including the National Institute of Standards and Technology Cybersecurity Framework version 2.0, and is designed to actively manage cyber risks while embedding cybersecurity into our Company's workplace culture. We have in place and continuously monitor and improve cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We continue to make investments in people, processes and technology to enhance our cybersecurity risk assessment, identification and management capabilities and to strengthen our cybersecurity risk response posture. Additionally, as part of the Company's Information Technology controls framework, management has established a suite of preventative and detective controls which enhance and strengthen the Company's cybersecurity program.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors included in Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences."

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: AFG describes whether and how risks from identified cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition in its risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference in this Item 1C.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: We recognize that cybersecurity risks represent a significant operational and reputational threat to our business. Our cybersecurity risk management program is designed to identify, assess, mitigate, and respond to cybersecurity threats in a timely and effective manner. The program is integrated into our broader enterprise risk management framework through a defense-in-depth approach. internal and external vulnerability assessments and penetration testing; employee training with user phishing simulation tests; dedicated incident response plan, tested and refined annually; of multi-factor authentication, encryption, and access control policies; Recovery and Business Continuity Plans; acknowledgment; risk assessments; of least privilege access across environments; improvement loop using CI/CD pipeline, providing accountability and segregation of duties: monitoring by security operation center; with third-party security consultants for audits and advisory services.

companyName: Verses AI Inc.

ticker: VRSSF


text: We maintain a cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care and is integrated into our overall enterprise risk management program.

companyName: Woodward, Inc.

ticker: WWD


text: Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related to our Business," in Item 1A, "Risk Factors" in this Annual Report.

companyName: Digital Media Solutions, Inc.


text: We have established policies to govern the security of our systems and the protection of customer and patient data, which include regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. Our Cybersecurity department, which reports to our CISO, is responsible for our cybersecurity program and our Global Risk & Integrity department, which reports to our CRO, is responsible for our privacy program as further discussed below. To identify, assess, and manage material cybersecurity risks, our Cybersecurity team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework and HIPAA. To ensure appropriate and consistent risk evaluation and decision-making processes among our Cybersecurity and Global Risk & Integrity departments, we utilize an Adjusted Risk Rating ("ARR") system that considers certain attributes that represent impact to the Company, and we prioritize our actions based on our ARR system. Our cybersecurity risk assessment program provides the underlying basis for the activities our Cybersecurity and Global Risk & Integrity departments take to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: We are working towards the implementation of relevant controls within the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to better address cybersecurity threats and we actively maintain a risk management plan that outlines the processes and procedures we use to identify, assess, mitigate and respond to cybersecurity risks. The plan is designed to protect the Company's assets and safeguard the confidentiality, integrity and availability of its data and operations. Our cybersecurity risk management plan is integrated into the Company's overall risk management process and establishes a clear framework with roles and responsibilities for managing cybersecurity risks. The Company currently uses a variety of security controls, including but not limited to firewalls, intrusion detection systems, data encryption in transit and at rest, and multi-factor authentication. We provide regular training to our employees and educate them on cybersecurity risks and best practices to mitigate these risks. The Company also maintains a comprehensive incident response plan to detect, respond to, assess the materiality of, and recover from cybersecurity incidents effectively.

companyName: Snail, Inc.

ticker: SNAL


text: Our Company depends on third-party technology providers that are critical to our business operations through software, services, solutions and hosting. We utilize programs to assess the controls of these providers in an effort to reduce the likelihood of potential impacts to the confidentiality, integrity and availability of our systems. We also design our systems and the ways such providers may access our systems to limit their ability to impact our operations or systems beyond what they require. In addition, for third parties that may hold our information on their own systems, we implement processes to gather information about how such third parties secure their systems, which may include obtaining and reviewing attestations and reports from the third parties.

companyName: Post Holdings, Inc.

ticker: POST


text: Our Board of Directors engages in the assessment, oversight, and management of material risks that could affect the company. The board has delegated to the Nominating/Governance and Compliance Committee the oversight responsibility for our cybersecurity risk management program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. This oversight includes compliance with disclosure obligations and requirements, cooperation with law enforcement, and related effects on financial risks and is responsible for reporting its findings and recommendations to the full board for its consideration. Our IT operations team and other members of management discuss cyber risks and trends, and if they arise, any material incidents with senior executives and the Nominating/Governance and Compliance Committee.

companyName: MANNATECH INC

ticker: MTEX


text: Third-party Risk we are aware of the risks associated with third-party service providers, SideChannel, Inc. implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Information Security Officer ("CISO") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: SideChannel, Inc.

ticker: SDCH


text: The Board receives prompt and timely information from the Bank's CISO on any cybersecurity or information security incident that may pose significant risk to the Bank and continues to receive regular reports on each such incident until its conclusion. The Bank's Board also receives regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. At least quarterly, the Board discusses cybersecurity and information security risks with the Bank's CIO and CISO.

companyName: Federal Home Loan Bank of New York


text: A multi-functional enterprise cyber security and Infrastructure team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the CFO and Senior Vice President ("SVP"), IT, and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program and, when identified, are reported to relevant business and governance leaders within the Company for appropriate action.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our cybersecurity governance program includes reporting channels to the executive management team and an internal Cybersecurity Oversight Committee, as well as governance processes which communicate cybersecurity risks to departments across the organization, including legal, strategic, operational, and financial areas. This encourages consideration of cybersecurity oversight, accountability and diligence across the organization.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: We engage with multiple teams across the business, including IT, Product, Engineering, DevOps, Legal, Human Resources, Compliance, and Sales, in an effort to address all aspects and phases of the cybersecurity risk lifecycle, including identification, assessment, treatment, monitoring, and reporting. We also engage with external independent partners on a regular basis to assess the maturity of our cybersecurity risk management program and to recommend improvements thereto, including with respect to third-party risk. We also conduct annual audits and control testing to evaluate the efficiency of our controls across the organization.

companyName: SailPoint, Inc.

ticker: SAIL


text: Management is aware that preventive measures cannot prevent all cyber incidents. The SVP of IT has direct oversight over the Company's security programs on a daily basis. When a cyber incident occurs, NNN's actions are guided by an incident response plan decision tree to (i) detect, contain and eradicate any threats, (ii) assess materiality, (iii) notify internal parties and the Audit Committee Chairperson, (iv) recover any compromised NNN data and information systems, (v) limit impacts of any such incident on NNN's operations, and (vi) report any such incident as require by law or as otherwise necessary. For a detailed discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."

companyName: NNN REIT, INC.

ticker: NNN


text: Once the possibility of a cybersecurity incident has been noted, employees assigned to appropriate teams do the necessary research and analysis to confirm either that there is an incident requiring additional action, or that no further action is necessary. This will typically involve some combination of Operations and Information Technology. If an incident is confirmed, an incident response team is formed, and the team takes steps to contain the incident to limit damage, eradicate the incident to restore our full control of all Bank systems and eliminate unauthorized access, and recover data and full functionality. Detection and analysis continue during this phase as necessary to ensure that this phase has been successfully executed. This phase also involves communication as needed with employees, customers, partners and service providers, legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as necessary and appropriate.

companyName: ESSA Bancorp, Inc.


text: The Bank's cybersecurity risk management framework is designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data. The Bank utilizes the cybersecurity risk management concept of defense-in-depth and deploys multiple layers of controls across operations to manage the multi-faceted nature of cybersecurity risk. Cybersecurity risk management is part of the Bank's Enterprise Risk Management program which includes pre-established risk appetite statements that outline the various risk indicators and their respective risk tolerance levels for the monitoring, assessing, mitigation, and reporting associated with those risks. The Bank's Information Security program is designed to evaluate our cybersecurity infrastructure and performance on an on-going basis through regular control assessments, vulnerability scans and remediation, penetration tests, and threat intelligence feeds that enable the program to effectively identify, prioritize, and mitigate cybersecurity risks. The Bank attempts to mitigate cybersecurity risk using an array of activities, including the Bank's Information Security Policy, information security training, periodic cybersecurity incident tabletop exercises, adequate cybersecurity insurance coverage levels, the Bank's Cybersecurity Incident Response Plan, and the Bank's business continuity management program focusing on the continuance of the Bank's operations in the event of a threat or incident.

companyName: Federal Home Loan Bank of San Francisco


text: We use various controls, technologies and other processes designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0. These include, but are not limited to, internal reporting, monitoring and detection tools, threat intelligence and general and role-based training. We also maintain third-party management processes to identify and manage the cybersecurity risks associated with third-party service providers. We periodically evaluate and improve the effectiveness of our cybersecurity program internally and by engaging with consultants and other third-party advisors to conduct reviews and assessments of our program. These periodic assessments and reviews may include penetration and vulnerability testing, simulations, table-tops and other exercises.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats. These processes are part of our overall enterprise risk management process and are part of our operating procedures, internal controls, and information systems. These risks include, among other things, operational risks; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: Run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies as needed. cybersecurity risk insurance that provides protection against potential losses arising from a cybersecurity incident.

companyName: I-ON Digital Corp.

ticker: IONI


text: The Board oversees our enterprise risk management processes, which includes cybersecurity risk, directly and through its audit committee. The audit committee of the Board assesses with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures. The audit committee reviews management's risk assessment and risk management programs and reports on such matters to the full Board.

companyName: Stereotaxis, Inc.

ticker: STXS


text: Integrated Risk Management The Program is integrated into the Company's enterprise risk management framework and functions to identify risk, form a strategy to manage risk, implement the strategy, test the implementation, and monitor our technology environment to control risk. Our information technology team works closely with stakeholders across security, risk, compliance, operations, other business stakeholders, and senior leadership to conduct an annual cybersecurity risk assessment utilizing the FFIEC Cybersecurity Assessment Tool.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: The Global Vice President of Information Technology earned a Bachelor of Science Degree in Management Information Systems from Western Connecticut State University and has served in various roles in information technology and information security for over 30 years, including serving in leadership roles of two large public companies. The Director of Cyber Security earned a Bachelor's Degree in Information Systems from Western New England University and has extensive cybersecurity leadership experience, including expertise in threat data analytics, digital forensics, and data recovery. Prior to joining the Company, the Director of Cyber Security formed and served as CEO of a successful incident response and cybersecurity consulting firm.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: We employ a layered security approach leveraging people, process and technology — structuring our cybersecurity program to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We also intend that our cybersecurity program aligns with applicable laws and regulatory requirements. Our program and the related controls we employ are designed to identify and assess risk with the aim of preventing, detecting or mitigating cybersecurity risks to avoid material harm to our business, customers, associates and other stakeholders.

companyName: Cable One, Inc.

ticker: CABO


text: Cyber Risk Management and Strategy Through a combination of security, risk and compliance resources, AB implements information security through a dedicated Information Security Program ("ISP ") that is intended to identify, assess and manage material risks from cybersecurity threats and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by our Chief Information Security Officer ("CISO") who actively partners with our Chief Compliance Officer ("CCO") and Chief Risk Officer "("CRO"). Ultimately, our ISP is part of our full enterprise risk framework, which includes information technology, business continuity and resiliency, in addition to cybersecurity risk. Our ISP is coordinated with our broader risk management team, including our Chief Security Officer. Enterprise risk, including cybersecurity risk, is overseen by the Audit and Risk Committee on behalf of the Board.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. Cybersecurity threats may, among other things, cause material disruptions to our operations, which may materially affect our results of operations and/or financial condition. For more information about risks from cybersecurity threats that may materially affect us and how they may do so, see "Risk Factors — Despite our security measures, we have been subject to attacks by hackers, and our information technology and infrastructure may in the future be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions." as well as the other risk factors contained in Item 1A of this Annual Report on Form 10-K.

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: Risks from Cybersecurity Threats We do not currently believe there are any cybersecurity threats or vulnerabilities that would have materially impaired our operations or financial conditions during the fiscal year ended December 31, 2024.

companyName: Capstone Holding Corp.

ticker: CAPS


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as software-as-a-service providers whose products are used to store our data, including through review of System and Organization Controls (SOC) reports prior to onboarding.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: Board of Directors oversee our cybersecurity risk management. Directors receive reports as requested from management, including senior IT leadership and third parties, on cybersecurity matters. Additionally, the Board of Directors is kept informed about cybersecurity risks as part of our overall enterprise risk management program and through regular business updates.

companyName: Outdoor Holding Co

ticker: POWW


text: Horizon's senior management briefs the Cyber Security Committee at each Cyber Security Committee meeting (see below for detailed discussion). In 2023, Horizon's information technology/cyber security program was audited by Horizon's internal and external auditors. The Cyber Security Committee Charter is posted on Horizon's website at www.horizonbank.com in the section headed "About Us – Investor Relations – Corporate Information" under the caption "Corporate Governance."

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: Our information technology department collaborates with our security and compliance team (a cross-functional team), product development department and the legal department to help identify, assess and manage the company's cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile, using various methods including, among others, manual and automated tools, internal and external audits, third-party threat assessments and external intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, and conducting vulnerability assessments to identify vulnerabilities.

companyName: Moatable, Inc.

ticker: MTBLY


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—Risks Related to Our Business and the Single-Family Rental Housing Market—We are highly dependent on information systems and systems failures could significantly disrupt our business" and "Security breaches and other disruptions could compromise our information systems and expose us to liability, which would cause our business and reputation to suffer."

companyName: VINEBROOK HOMES TRUST, INC.


text: The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management, including topics such as data security posture, results from third-party assessments, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Information Security Leadership Team, comprised of Chris Walter, our Chief Information Officer, Frank Madigan, our Vice President, Information Technology and Security and Kelvin James, our Senior Manager, Information Security (the "InfoSec Leadership Team").

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: To support our technical development and operational scalability, Brag House partnered and is engaged with two experienced technology companies—Artemis and EVEMeta. Both companies work under the supervision of Brag House executive management and are led by a shared Chief Technology Officer with extensive experience in enterprise-scale software development and infrastructure management. These technology partners are integral to our engineering and product support, and we coordinate closely with them on matters relating to information security, data protection, and secure development practices.

companyName: Brag House Holdings, Inc.

ticker: TBH


text: Our management team gathers information to support our efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents from various sources, including reports from internal security personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by the information security tools we utilize. Our Cyber Defense Operations Center (the "CDOC") is a security operations center that operates 24 hours a day, seven days a week and is our first line of defense against cybersecurity threats. The CDOC continually monitors our information technology security infrastructure for anomalous behavior and other indications of potential threats to protect our data and systems.

companyName: Concentrix Corp

ticker: CNXC


text: The Committee receives periodic reports from management on our cybersecurity risks, including reports of external service providers relating to testing. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: Cybersecurity Risk Management and Governance Information security is an integral part of the Company's overall enterprise risk management program. The Company's information security program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of third-party service providers. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity testing, detection, response, prevention and mitigation strategies and informing management and the Company's Board of Directors of material cybersecurity threats and incidents. The Company's information security team also engages third-party security consultants for penetration testing, training and system enhancements.

companyName: TIMKEN CO

ticker: TKR


text: Our CISO, Mr. Richard Balducci, is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Mr. Balducci has worked in the cybersecurity field since 1996. His background includes both the public and private sectors. Mr. Balducci has served as our CISO since 2020 and has built out a comprehensive security program for the Company by adding cybersecurity capabilities and aligning our cybersecurity systems to leading industry standards, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, Mr. Balducci oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our cybersecurity training program for associates.

companyName: Integer Holdings Corp

ticker: ITGR


text: When appropriate, we use external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls and risk assessment process. Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis and have established an external bug bounty program to allow security researchers to help identify vulnerabilities in our systems before they mature into real-world cybersecurity threats. We also maintain a vendor risk management program designed to identify and mitigate risks associated with third-party service providers, including those in our supply chain and those who have access to our customer or employee data or our systems. This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.

companyName: Workday, Inc.

ticker: WDAY


text: The Board exercises oversight over the Information Security Program and reviews and approves the Information Security Program at least annually. Cybersecurity risk management is also incorporated into Coastal's overall enterprise risk management framework, which is updated on an annual basis and subject to oversight by the Management Risk Committee and the Board.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including protected health information and the systems that store and transmit such data. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Oscar Health, Inc.

ticker: OSCR


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant.

companyName: Expensify, Inc.

ticker: EXFY


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee of the board of directors. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee also reports material cybersecurity risks to our full board of directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Information Services (VP-IS) who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our VP-IS and dedicated personnel are information system security professionals and information security managers with many years of experience. Management, including the VP-IS and our cybersecurity team, regularly update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: Our cybersecurity risk management process is integrated as part of our overall risk management program. Our information security professionals have primary responsibility for overall cybersecurity risk management. Our cybersecurity professionals are led by our Chief Technology Officer, who has over 30 years of experience in the information technology field, including over 20 years of experience focusing solely in the cybersecurity space. Our Chief Technology Officer, works in conjunction with the Compliance Manager, Information Security Manager/Information Security Officer and Enterprise Risk Manager to develop and maintain the cybersecurity program. In addition to our own employees, we engage third parties to provide security products and services as needed, using their technology and expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third-party service providers are managed by the Information Security Manager/Officer.

companyName: California BanCorp


text: The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics, incident response plan and conduct tabletop exercises. The Company engages outside consultants to review both its Cybersecurity posture, and maturity, and perform for a cyber assessments of the Company's manufacturing/operational technology environments. The Company has a process in place to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider, namely its Third-Party Risk Management Assessment Process. We utilize the NIST framework when assessing third parties. The framework covers 23 categories. When applicable, we may request if the third party vendor is SOC1/2, GDPRS, certified.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: 26North conducts annual cybersecurity awareness training for all employees and conducts quarterly phishing exercises to assess employee cybersecurity recovery tests to simulate a response to a cybersecurity incident, and uses the findings therefrom to improve practices, procedures, and technologies. 26North also assesses the risks from cybersecurity threats that impact our third-party service providers and has established oversight processes to identify and manage cybersecurity risks associated with the products or services we or 26North procure from such suppliers.

companyName: 26North BDC, Inc.


text: During the fiscal year ended December 31, 2023 and through the date of the filing of this Form 10-K, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition.

companyName: CONMED Corp

ticker: CNMD


text: We do not believe that any risks from cybersecurity threats, including any as a result of prior cybersecurity incidents we have experienced, have had a material adverse impact on our operations, business or financial condition. For more information regarding the risks we face from cybersecurity threats, see "Item 1A. Risk Factors."

companyName: AZZ INC

ticker: AZZ


text: Board, in coordination with the Audit Committee, oversees the Company's processes for assessing and managing risk. The Board and Audit Committee may review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: Sprout Social maintains an overarching security program comprising several teams including (1) Security Operations, (2) Information Technology, (3) Application Security, (4) Infrastructure Security, and (5) Governance, Risk, and Compliance. Together, these teams help identify, assess and manage the Company's cybersecurity threats and risks using various methods including, for example, internal and external audits, automated and manual tools, threat assessments for internal and external threats, software and services that identify cybersecurity threats, third party threat assessments, a vulnerability management policy and program, incident response exercises, and evaluating threats reported to us through an external bug bounty program.

companyName: Sprout Social, Inc.

ticker: SPT


text: • threat intelligence service providers; • cybersecurity software providers; • managed cybersecurity service providers; • penetration testing firms; • dark web monitoring services; and • professional services firms, including legal counsel.

companyName: MANNKIND CORP

ticker: MNKD


text: During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1A. Risk Factors" for more information regarding the Company's cybersecurity-related risks.

companyName: LFTD PARTNERS INC.

ticker: LIFD


text: Role of Management Helios Technologies, Information Systems organization is led by the Global Head of Information Technology and is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation, with oversight by the ESG Committee.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: In addition, we maintain processes governing interconnections with third-party systems and we perform due diligence procedures before onboarding service providers with access to our systems or processing sensitive data on our behalf. This process includes, as applicable and appropriate based on risk profile and criticality, a review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), ISO 27001 certifications, and/or Cybersecurity Maturity Model Certifications, as well as reviewing penetration tests, conducting vulnerability tests, and administering security questionnaires and assessments.

companyName: Woodward, Inc.

ticker: WWD


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee primary responsibility for oversight of our risk management programs, including processes and procedures related to cybersecurity threats and incidents. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: FreightCar America, Inc.

ticker: RAIL


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. We conduct a cybersecurity risk assessment for vendors that manage, host or process our Information Systems and Data. Depending on the vendor, the program includes a security assessment questionnaire, a review of existing security assessments or reports related to the vendor and the use of third-party risk assessment services and scoring. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: CS Disco, Inc.

ticker: LAW


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit and Risk Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity activities into five categories: identify, protect, detect, respond and recover. Our cybersecurity risk management program is part of our overall risk assessment. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation, and investments in a partnership with a third-party vendor whose experts further advise our processes. Our executive team, which includes VPs of IT, review enterprise risk management-level cybersecurity risks annually, along with other key risks to the organization. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security policy as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, malware protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: Our Board employs a principles-based approach to identify and provide oversight with respect to the myriad of risks impacting the Company, including cybersecurity risks. The executive leadership team monitors our risk environment, including attempting to identify potential unknown risks, and regularly reports on such matters to our Board or committees thereof. We have an enterprise risk management ("ERM") program designed to identify, assess, prioritize, manage and mitigate major risk exposures that could affect our ability to execute on our corporate strategy and fulfill our business objectives. Our ERM program is administered by a risk council made up of members of senior management supported by subject matter experts within our organization. The Board fulfills certain risk oversight functions through its standing committees. Representatives of the risk council report to the Audit Committee on risk exposure, management and tolerance, and related matters. The Audit Committee oversees the risks related to the integrity of the Company's financial statements and receives an ERM report at least annually. Further, the Company's Disclosure Controls Committee reports directly to the Audit Committee on certain matters relating to our public disclosures. Our Nominating and Governance Committee has the responsibility of periodically monitoring, reviewing and discussing with management the Company's cybersecurity preparedness, vulnerabilities, defenses and planned responses, including related risk management programs and practices.

companyName: Cable One, Inc.

ticker: CABO


text: Our audit committee of the board of directors is responsible for ensuring that management has processes in place designed to identify and evaluate risks, including cybersecurity risks, to which the company is exposed and implements processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our board of directors and/or our audit committee receive regular updates throughout the year on cybersecurity risks. At least annually, each of our board of directors and/or our audit committee receives reports on cybersecurity matters and related risk exposures from our Chief Technology Officer, or CTO. When covered during an audit committee meeting, the audit committee reports on its discussion of cybersecurity risks to the full board of directors.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: Our cybersecurity program leverages the NIST Cybersecurity Framework to help protect the Company's operations, information, production systems and networks from threats through cybersecurity practices, programs and tools that establish defenses in depth. The cybersecurity program includes, among other items, vulnerability and patch management, segmentation, identity and access management, application of zero-trust principles, automated ingestion of multi-source threat intelligence, end point and network detection/response, application security, secure configurations for operating systems and databases, continuous security monitoring and 24/7 security operations. The program has dedicated business resilience, insider threat and governance, risk and compliance ("GRC") functions that report to our Chief Information Security Officer ("CISO"). Incident management is governed by our Incident Response Plan that assigns incident command and control parameters and escalation protocols to management and the Board of Directors. Our cybersecurity program also focuses on risks from the use of third-party services. Our GRC team assesses the cybersecurity practices of current and prospective service providers for compliance with our requirements, and our procurement functions seek terms and conditions, including by example, audit rights and vulnerability or breach disclosure obligations, to enhance our defenses against supply chain risks.

companyName: VERISIGN INC/CA

ticker: VRSN


text: We rely on the cybersecurity policies and procedures implemented by New Mountain Capital. New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Finance Corp

ticker: NMFC


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and dark web monitoring services.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: We maintain a Business Continuity and Disaster Recovery Plan that addresses our preparation for, management, recovery from, and ultimate resumption of business after a crisis, including emergency response, continued recovery, and business resumption activities such as information systems recovery, when a cybersecurity incident may potentially have a significant impact on our business strategy, results of operations, or financial condition.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Engage Third Parties As part of the Corporation's cybersecurity risk management process, the Corporation engages a range of third parties, including consultants, advisors and software providers, to assist with security assessments and operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and the Corporation's vulnerability management platform. These relationships enable the Corporation to access specialized knowledge and insights with respect to its cybersecurity strategies and processes.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: We have a unified cybersecurity leadership team, composed of members of our Security Executive Steering Committee ("Security ESC") to oversee implementation of appropriate cybersecurity protections and promote accountability. The Security ESC is led by senior executives in our information technology ("IT") and network operations groups and is comprised of senior executive leaders across the organization with the goal of driving cybersecurity focus through not just technical teams, but the entire business. The Security ESC reviews and evaluates current cyber threats and risks and improvements to our program and provides quarterly updates to the Chief Executive Officer as well as ad hoc updates on urgent matters. We also have a Cyber Security Council ("CSC") and Security Operations Steering Committee that, under the direction of the Security ESC, collectively focus on cybersecurity across Charter and the overall protection of our internal network and related processes, policy, training and actions to protect customer and employee data. The CSC is comprised of senior leaders across the organization and operates under the auspices of the Security ESC, which is ultimately accountable under our enterprise risk management program for cybersecurity.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Risks from Cybersecurity Threats—Likely Material Impact See the risk factor entitled Cyber-attacks and security vulnerabilities could result in serious harm to our reputation, business and financial condition. in Item 1A, Risk Factors. To date, we have not identified any material cybersecurity threats or incidents that have materially affected our business strategy, results of operations or financial condition. However, we cannot guarantee that future incidents will not have a material impact.

companyName: E2open Parent Holdings, Inc.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling or processing our Information Systems and Data. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including completion of security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, and security assessment calls with the vendor's security personnel.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: Board Oversight of Privacy, Cybersecurity and Technology Risks Our Board recognizes the importance of maintaining the trust and confidence of our customers and employees. As a part of its independent oversight of the key risks facing our company, the Board, primarily through its Privacy, Security and Technology Committee, devotes significant time and attention to the oversight of privacy, cybersecurity, and technology risks. The Privacy, Security, and Technology Committee oversees management's approach to staffing, policies, processes, and practices to gauge and address privacy, cybersecurity, and technology risks. The Privacy, Security, and Technology Committee regularly reports to the full Board and discusses the significant privacy, cybersecurity, and technology issues at the Board level.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Risk Management and Strategy Risk Assessment. We have incorporated policies and procedures aimed at securing and protecting company records and operations. At a minimum, our cybersecurity programs are benchmarked against and aligned to the Center for Internet Security (CIS) Version 8 framework a universally accepted and recognized controls standard published in 2021 to guide annual risk assessments and ongoing control monitoring activities. External experts are also utilized for both annual and periodic risk assessments, as needed, to ensure broad and in-depth evaluations of the transforming cybersecurity environment.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: We have implemented a comprehensive Enterprise Risk Management ("ERM") process to identify, assess and manage risks related to our overall organization, including material risks from cybersecurity threats. Our ERM process takes a holistic view of our specific risks and our strategy to anticipate and manage possible risks. Our Executive Vice President, General Counsel and Chief Risk Officer ("CRO") oversees our ERM program and execution of our risk strategy, including as it relates to cyber risk. The Chief Information Security Officer ("CISO"), who reports to the CRO, leads our cyber risk management and strategy and the Information Security Department.

companyName: GLOBE LIFE INC.

ticker: GL


text: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at NeurAxis. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations, and industry risks.

companyName: Neuraxis, INC

ticker: NRXS


text: Incident Response Policies: The Company has established and maintains incident response policies that address the Company's response to a cybersecurity incident.

companyName: Farmland Partners Inc.

ticker: FPI


text: Our assessment and management of material risks from cybersecurity threats are integrated into our Company's overall risk management process, which, in part, establishes intended uses of our computerized systems and identifies critical and/or material risks. After a system reaches operation, the risk management approach continues following standard processes for change control, system maintenance, logical access control, discrepancy management and periodic review.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: We are proactively taking steps to enhance our monitoring of third-party service providers' cybersecurity, including the commencement of a vendor third-party risk management program. This program should better enable the Company to identify and manage material risks from cybersecurity threats related to our third-party service providers.

companyName: DMC Global Inc.

ticker: BOOM


text: An important part of our business involves the receipt, processing and storage of personal information of our customers and associates, including, in the case of our customers, payment information. Security of this information and our other proprietary data is imperative to ensure the trust of our customers, vendors, and employees. We assess, identify and manage material risks related to potential cybersecurity attacks on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems through various processes. These processes include a wide variety of controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft and misuse, and unauthorized access to, or other cybersecurity attacks or vulnerabilities affecting, our data.

companyName: GameStop Corp.

ticker: GME


text: As mentioned above, in response to the increasing threats presented by cyber incidents, in 2020 we established the RSC, which meets regularly. This committee is comprised of our Chief Security Officer, our Interim Chief Operations Officer, our General Counsel / Privacy Officer, our Head of Human Resources, each Director of Operations of each of our business units, and our Chief Financial Officer, as well as other key leaders. The RSC (in conjunction with the CSO), oversees activities related to monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The RSC, along with our CSO, develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors, and receives regular updates on cybersecurity-related matters.

companyName: HARTE HANKS INC

ticker: HHS


text: The Company has not incurred material cybersecurity incidents over the past three years. The Company is not aware that any risks from cybersecurity threats, including because of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the company. The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics, incident response plan and conduct tabletop exercises. In addition, the Company has: • Managed Security Service Provider (MSSP) that maintains 24 hours per day, 7 days per week, monitoring of the Company's environment; and • Performed an internal phishing campaign and awareness program.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and the Risk Management Team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, the Board receives updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Historically, we have not experienced cybersecurity incidents that materially impacted our business strategy, operating results and financial condition but we cannot guarantee a future cybersecurity incident would not materially impact us.

companyName: Vystar Corp

ticker: VYST


text: The Audit Committee receives regular updates from the Chief Information Security Officer and other members of management on our cybersecurity program, including on information security and technology risks, program assessments, and risk management practices. Our Chief Information Security Officer also provides similar topical updates to the full board of directors at least annually.

companyName: AbbVie Inc.

ticker: ABBV


text: As of December 31, 2023, there were no risks from cybersecurity threats, including due to any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations, or financial condition.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: The program was integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. In addition, our program emphasizes the maintenance of controls and procedures for the prompt escalation of certain cybersecurity incidents, conducting cybersecurity risk assessments, regularly assessing and deploying technical safeguards, establishing incident response and recovery plans, and providing relevant privacy and cybersecurity information to employees to enhance awareness and response to cybersecurity threats.

companyName: Motorsport Games Inc.

ticker: MSGM


text: We engage third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Our ISSC assists our management team to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: TechnipFMC plc

ticker: FTI


text: Our cybersecurity program is staffed by a team of skilled cybersecurity professionals, including ~20 dedicated internal cybersecurity resources. Four members of the security team currently have Certified Information Systems Security Professional (CISSP) credentials, many hold one or more Global Information Assurance Certification (GIAC)/The Sans Institute (SANS) cybersecurity certificates, and in total the team has over 70 security and network certifications. Our response team members are in various global locations to ensure 24/7 monitoring and response capabilities and are backed by a 24/7 Managed Security Services Provider (MSSP) who monitors cybersecurity alerts.

companyName: Crane Co

ticker: CR


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal IT risk register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes on an as needed basis; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • periodic tabletop exercises conducted by outside counsel to evaluate our incident response plan and response capabilities; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: The Audit Committee reviews and advises on Management's strategic decisions related to cybersecurity, offering guidance and approval for major initiatives when deemed appropriate.

companyName: HashiCorp, Inc.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information, see "Risk Factors—Risks Related to Our Information Technology and Intellectual Property" in Part I, Item IA of this Annual Report on Form 10-K.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: Our senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. In particular, the Company's Senior Manager, IT, has 24 years of experience in enterprise IT and has primary responsibility for managing our cybersecurity program and efforts. Our finance and IT teams are responsible for the testing and audit of our information-technology related internal controls.

companyName: CorMedix Inc.

ticker: CRMD


text: Management and Strategy have developed and continue to enhance our cybersecurity governance program to help protect the security of our computer systems, software, networks, and other technology assets against material risks from cybersecurity threats, including unauthorized attempts to access confidential information or to disrupt or degrade our business operations. Our cybersecurity governance program is strategically integrated into our broader risk management framework and aims to (1) proactively manage cyber and information security risks at the Company, (2) implement the internal controls required by cybersecurity regulatory requirements as well as the Company's information security control objective documents and information security standards, and (3) improve the efficiency, maturity, and effectiveness date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: LogicMark, Inc.

ticker: LGMK


text: training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a third-party risk management process for service providers, suppliers, and vendors.

companyName: Marvion Inc.

ticker: MVNC


text: Collaborative Approach —We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents, so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. The ISSC and the CSIRT work collaboratively to build and implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.

companyName: Redfin Corp


text: The Audit Committee is responsible for ensuring sufficient oversight of our cybersecurity risk exposures and leads the full Board in periodic reviews of the adequacy and effectiveness of our information security program and internal controls, including quarterly and ad hoc updates of cybersecurity risks, initiatives, and key metrics. Senior leaders from our Information Security, Legal and Compliance teams provide the Board and Audit Committee with periodic briefings of our current risks and security strategy, as well as future plans with regard to cybersecurity posture, preparation, prevention, and incident response.

companyName: CARVANA CO.

ticker: CVNA


text: We have established procedures for evaluating, recognizing, and managing significant risks stemming from potential unauthorized events occurring on or through our electronic information systems. These procedures comprise an important part of our overall enterprise risk management systemand are aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. Internally we have an Internet, Email and Computer Use Policy and all of our employees have been trained on the policy and related tools. Additionally, we employ processes to manage and identify risks arising from cybersecurity threats linked to supplier and customer relationships and our utilization of third-party technology and systems.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: Our Vice President of Risk Management monitors and tests these initiatives on a periodic basis. Additionally, our Chief Financial and Administrative Officer partners with the MSSP and our information technology staff throughout the organization to manage material risks from cybersecurity threats, as well as to provide managerial and operational support for our information systems and information technology resources on a daily basis.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM