text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. Delek has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.

companyName: Delek US Holdings, Inc.

ticker: DK


text: The Company's Director of Information Technology ("IT"), who reports to our CFO, has over 20 years of experience leading cyber security oversight and is responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our IT security team, lead by the Director of IT, consists of professionals with broad cybersecurity experiences, including a number of cybersecurity certifications and degrees. Our cybersecurity initiatives benefit from a wealth of practical knowledge and strategic insight. The IT security teams' comprehensive understanding of industry best practices, combined with hands-on experience in implementing cybersecurity solutions, ensures that our networks and systems are effectively protected against emerging threats. As a result, cybersecurity remains a top priority across the organization, with resources allocated efficiently to mitigate risks and enhance our overall security posture.

companyName: ASTRONICS CORP

ticker: ATRO

secItem: Item 1C


text: Our internal cybersecurity professional reports to our CEO and is responsible for assessing and managing our material risks from cybersecurity threats. The CEO is supported by our Chief Legal Officer in exercising primary oversight for our overall cybersecurity risk management program. Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: To date, risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our operations or financial standing. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect us.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: Related to Cybersecurity Risks Our Executive Director, IT & Operations, or Executive Director, who reports to the Chief Financial Officer, is responsible for the strategic leadership and direction of our cybersecurity program. With over 15 years of experience in information technology, the Executive Director works alongside individuals across other functions, such as legal and engineering, to establish and implement our cybersecurity strategy.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Information Technology, Intellectual Property and Data Privacy and Security" - "A real or perceived bug, defect, security vulnerability, error, or other performance failure involving our platform, products or solutions could cause us to lose revenue, damage our reputation, and expose us to liability." and "If we or our third-party service providers experience a security breach, data loss or other compromise, including if unauthorized parties obtain access to our customers' data, our reputation may be harmed, demand for our platform, products and solutions may be reduced, and we may incur significant liabilities."

companyName: KALTURA INC

ticker: KLTR


text: Cybersecurity risk management is an integral part of Ford Credit's overall enterprise risk management program. As part of its enterprise risk management efforts, the Ford Credit Board meets with senior management to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Ford Credit Board. Once identified, each of the risks viewed as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with Ford Credit's Chief Technology Officer assigned as the executive risk owner. Ford Credit's Board is responsible for the oversight of cybersecurity and information technology risks, and Ford Credit's preparedness for these risks.

companyName: FORD MOTOR CREDIT CO LLC


text: The Company has established an information security program to assess, identify and manage material risks from cybersecurity threats, which is an integral part of the Company's overall enterprise risk management program. This program is established at the executive level, with regular reporting to, and oversight by, the Company's Board as described below.

companyName: Uniti Group LLC


text: Cybersecurity and related matters are a recurring topic at meetings of the Audit Committee and the Company's Executive Vice President and Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") provide the Audit Committee with an update on the Company's cybersecurity risk profile and strategy at multiple Audit Committee meetings each year. These updates include both qualitative and quantitative information on the effectiveness of the Company's cybersecurity controls.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized activity on or conducted through our production and information systems that may result in adverse effects on the confidentiality, integrity, or availability of our systems or any information residing therein.

companyName: Samsara Inc.

ticker: IOT


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer, Chief Operating Officer, General Counsel and Head of Human Resources. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact. Our Head of IT works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to our audit committee for certain cybersecurity incidents.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of our President & COO, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Our CIO has worked in the information technology industry since 1997 and has led our IT function since 2016. The IT management team responsible for developing and executing our cybersecurity policies is comprised of individuals with extensive experience working in the fields of information technology and cybersecurity, formal education and degrees in information technology and cybersecurity and industry certifications such as Certified Information Systems Security Professional, Certified Information Security Manager and Certified Information System Auditor. Our CIO and IT management team also receive regular training and education on cybersecurity-related topics.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: Our cybersecurity risks and associated mitigations are evaluated by the Adviser and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our Board of Trustees on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of New Mountain Capital's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.

companyName: New Mountain Net Lease Trust


text: Kroger's CIO reports to the CEO and leads technology and digital capabilities for the Kroger Co., including the overall cybersecurity strategy. Kroger's CIO & Chief Digital Officer, has over 20 years of both leading and transforming technology, digital growth, and e-commerce in the retail and food industry. Kroger's interim CISO brings nearly 20 years of experience developing and leading security and risk programs. His experience includes governance, information security, and threat management.

companyName: KROGER CO

ticker: KR


text: For the response phase of an incident, after the SRC Director or the designated alternate IRT leader receives notification of any potential or realized privacy or security incident, the SRC Director or the designated alternate IRT leader makes an initial severity classification and determines if it is appropriate to convene the IRT, the members of which will be based on the nature and severity of the incident. The IMT has general authority and responsibility for incident response, which includes allocating resources to respond to incidents and providing the appropriate reports and statuses to senior management through the office of the CIO. The Incident Response Team Members support the IMT in these efforts.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions, as we have described in the Risk Factors section of this Form 10-K.

companyName: PARSONS CORP

ticker: PSN


text: Our security team has several touch points within the business in order to adequately address and mitigate risks. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive testing to detect vulnerabilities and respond. Our technical security teams also build new tools and solutions in an effort to improve our security posture on an ongoing basis.

companyName: Criteo S.A.

ticker: CRTO


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. The Company also has engaged a third-party digital forensics and incident response consultant on retainer.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: As of this filing, we have not experienced any cybersecurity breach that has materially impacted our business or financial condition, nor have we identified any risks from cybersecurity threats that have materially impacted or are reasonably likely to materially impact us, including our business strategy, results of operations, or financial condition. However, we recognize that our operations involve the collection, transmission, and storage of sensitive data, which may expose us to cybersecurity threats, including unauthorized access and cyberattacks. We remain committed to identifying and managing these risks as part of our business strategy and operations. Board of Directors and Management Governance.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Finance & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO and Deputy CISO. The CTO and Deputy CISO have a combined four decades of information technology and cybersecurity leadership experience across public and private sectors.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Our Executive Director of Cybersecurity and Infrastructure has over 15 years of cybersecurity and information technology experience, including as Director of Cybersecurity for various institutions. Our Executive Director of Cybersecurity and Infrastructure has a Bachelor of Science in Information Science and Technology and a master's degree in information sciences, cybersecurity, and information assurance, and he has a Certified Information Systems Security Professional certification, a GIAC Information Security Professional certification and a CompTIA Network+ ce certification. Our CIO has over 25 years of information technology experience, including serving in the information technology function at Cummins Inc., where she served as the information technology leader for Cummins Filtration Inc. Our CIO holds an undergraduate degree in business administration with emphasis in management information systems. Each of the other members of the Information Security Council have relevant educational and industry experience, including managing risks at our Company and at similar companies.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: Our Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Our overall Board of Directors ("Board") has oversight of all enterprise risks, including those arising from cybersecurity threats. The Board has not assigned that responsibility to any committee or subcommittee of the Board. Assessments of ongoing and emerging enterprise risks, including cybersecurity threats, if applicable, are an integral part of our regularly scheduled Board meetings.

companyName: PARKERVISION INC

ticker: PRKR


text: In addition, we employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include from time to time: • monitoring emerging data protection laws, including the California Consumer Privacy Act and the General Data Protection Regulation, and implementing responsive changes to our processes; • undertaking periodic reviews of our policies and statements related to cybersecurity; • conducting cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conducting phishing email simulations for employees and contractors with access to corporate email systems; • requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care; and • conducting tabletop exercises to simulate a response to a cybersecurity incident and using the findings to improve our processes and technologies.

companyName: TheRealReal, Inc.

ticker: REAL


text: As part of the cybersecurity program, WEC Energy Group has adopted a cybersecurity incident response plan (the "Plan") designed to identify, evaluate, respond to, and resolve cybersecurity incidents impacting IT/OT systems. Pursuant to the terms of the Plan, WEC Energy Group has established a CSIRT Steering Committee which includes, among others, WEC Energy Group's Chief Financial Officer (who also serves as our Chief Financial Officer), CAO, and the Enterprise Security Director. The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including WEC Energy Group's CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the WEC Energy Group Board of Directors at regularly scheduled meetings or more frequently, as needed.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's management team.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Our VP of Information Technology has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 36 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The VP of Information Technology provides regular reports on ongoing risk and mitigation practices to our COO and CFO, who then reports to the Board. Our incident response policy, which is updated from time to time, provides that management reports to the Board in the event of any detected material incident and regularly updates them on the mitigation and remediation steps being taken in connection with the Company's response.

companyName: ORTHOPEDIATRICS CORP

ticker: KIDS


text: We face certain continuing and ongoing material risks from cybersecurity threats, which the SEC defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—Risks Relating to Cybersecurity or Data Privacy—A breach or other compromise of our security measures or those of third parties we rely on could materially and adversely impact our reputation, business, financial condition and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: In addition, our third-party service providers play a role in our risk management and strategy as well as with the investigation of cybersecurity incidents. Based upon the assessment of the type of incident and risk presented, the ISIRT engages outside counsel and/or external resources, such as forensic consultants, to conduct or assist with cybersecurity investigations in order to provide advice to the Company. The vendors we engage with are globally recognized companies with expertise in cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards. The Company also conducts appropriate cybersecurity exercises and training. For example, employees must complete cybersecurity training on at least an annual basis, which educates our employees on the Company's policies and procedures for handling personal data, incident reporting, and avoiding common cybersecurity threats such as phishing attacks.

companyName: BRUKER CORP

ticker: BRKR


text: Our board administers its cybersecurity risk oversight function directly through our audit committee. Our audit committee has primary responsibility for overseeing our risk assessment and risk management policies (including with respect to cybersecurity matters). Our audit committee regularly discusses with management, counsel, and auditors the Company's major risk exposures. This includes potential financial impact on the Company and the steps taken to monitor and control those risks. Additionally, our board is informed regarding the risks facing the Company and coordinates with management and our cybersecurity team to ensure our board receives regular risk assessment updates from management.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: The Director of IT leads the day-to-day management of cybersecurity at Genasys, supported by a team of two IT professionals with a combined 45 years of IT and cybersecurity experience. This team handles ongoing risk assessments, manages threat detection through our SOC and Security Information and Event Management (SIEM), ensures compliance with industry regulations, and informs executive management about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. This may include briefings from internal security personnel; sharing publicly or privately available threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and forwarding alerts and reports produced by network monitoring and security tools we deploy. Management also ensures that employees and contractors undergo quarterly cybersecurity training and phishing simulations, as part of a comprehensive awareness program.

companyName: Genasys Inc.

ticker: GNSS


text: The Company's information technology team is responsible for assessing and managing cybersecurity risks and has a depth of experience focused on increasing the Company's resilience to security threats and stays current on new developments through monitoring of the cybersecurity landscape. The Company's information technology environment is actively monitored for potential security threats, and security events are investigated and acted on to minimize potential risk to the environment.

companyName: BM Technologies, Inc.


text: The Company's cybersecurity program is designed to protect its assets and information, and to maintain the secure storage and of proprietary information relating to our customers, employees, applicants, vendors, and other parties, including financial information and personal information. The Company's cybersecurity program is formed using a risk-based approach with recommendations from cybersecurity consultants, cybersecurity insurers, and other third-party consultants.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Cybersecurity threats are identified by the Incident Response Team ("Response Team") pursuant to the Cybersecurity Response Policy ("Cybersecurity Policy") and escalated to the Enterprise Risk Management Executive Committee ("ERM Committee") or member thereof pursuant to criteria set forth in this policy (See "Governance—Management" below for further discussion of the ERM Committee and the members of management comprising the ERM Committee). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: The CISO and executive management play a pivotal role in informing the Audit Committee on cybersecurity risks. Executive management, including the CISO, meets regularly with the Audit Committee to discuss cybersecurity risks, review quarterly cyber metrics and oversee progress against our annual action plans. These briefings may encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and executive management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, and the CISO regularly updates executive management on cybersecurity risks and incidents.

companyName: Civeo Corp

ticker: CVEO


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, as well as to perform a variety of other functions throughout our business. We have enlisted the services of a third-party managed detection and response firm to conduct continuous monitoring of our information systems, including intrusion detection and alerting. We also regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: The Company's CISO leads management's assessment, prevention and management of cybersecurity risks. The CISO reports to the CIO who has responsibility for the usability, implementation and management of our information and computing systems. Both bring to their roles extensive experience in information technology and cybersecurity: • The Company's CISO joined the Company in 2022. The CISO has over 20 years of experience in information technology, cybersecurity and physical security management, including as Cybersecurity Operations Director at United States Steel Corporation (2020-2022); Director, Global Information Security and Compliance at Kennametal, Inc. (2018-2020); and Global Chief Information Security Officer/HIPAA Security Officer at Westlake Chemical (2013-2017). The CISO holds a Bachelor of Sciences degree in Information Systems Management from Carlow University and a Master of Sciences degree in Information Systems from Robert Morris University, and is a Certified Systems Security Professional. • The Company's CIO joined the Company in 2021. The CIO has over 20 years of experience in information technology, including, most recently, as Vice President Global IT and Chief Information Officer at Varroc Lighting Systems (2018-2021) and Chief Information Officer at AM General LLC (2016-2018). The CIO holds a Bachelor of Engineering degree in Industrial Engineering from Universidad de Lima.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: Further, we intend to put processes in place that would evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that would have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement and system monitoring.

companyName: bowmo, Inc.


text: Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within our Company and through our engagement of third-party service providers.

companyName: Century Communities, Inc.

ticker: CCS


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the CFO. Our CFO and Senior Director of IT work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the board of directors committee responsible for certain cybersecurity incidents.

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: Our Board of Directors is responsible for providing oversight and governance with respect to IT and cybersecurity matters, which includes providing oversight over disclosure controls and procedures related to any cybersecurity breach occurrences and IT matters. Annually, the CIO briefs the Board of Directors on the company's cybersecurity posture, the effectiveness of its risk management strategies, and the emerging threat landscape, which creates alignment of cybersecurity efforts with Ball's risk management framework.

companyName: BALL Corp

ticker: BALL


text: Our CISO is a Certified Information System Security Professional (CISSP) with decades of experience with technology in security, architecture, infrastructure and support in the financial, education, healthcare and verticals. He is a results driven leader who has managed multimillion dollar projects and solutions to successful completion. Our CTO has over 25 years of experience in enterprise technology solutions, with expertise in managed services, private cloud, service operations, and security. He is committed to driving reliability of services while prioritizing robust security measures.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Board Governance Our full Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Our management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: The Company's security team provides oversight and policy guidance on physical, cyber and information security, as well as business continuity, throughout the Company's operations. It is responsible for designing, implementing, monitoring and supporting effective physical and technical security controls for the Company's physical assets, business systems and operational technologies. The Company's security team also conducts annual and ongoing cybersecurity awareness training and education for the Company's employees. In 2023, 100% of the Company's active workforce completed mandatory cybersecurity training. By equipping employees with knowledge and skills, the Company strives to cultivate and maintain a cybersecurity-conscious culture within its workforce.

companyName: American Water Works Company, Inc.

ticker: AWK


text: The cybersecurity management team, including our Chief Information Officer, Executive VP IT Operations and IT Security Director, is responsible for assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The cybersecurity team leads dedicated cybersecurity meetings with the Chief Corporate Governance & Compliance Officer and key members of the legal and compliance and internal audit departments. This group meets monthly and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. The leadership of our cybersecurity team averages approximately 26 years of experience with information technology, with a background deeply rooted in data management and protection and data analytics and brings extensive experience in information security strategy and risk management at Houlihan Lokey and in previous roles.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: CIO. With over 20 years of experience in the information technology space, the CIO brings expertise and strategic insight to cybersecurity, compliance, enterprise architecture, systems resilience, and digital transformation to UFP Industries.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Our enterprise risk management framework was developed in conjunction with a third-party that objectively assessed key stakeholder responses to questionnaires on our operations and business functions, including information technology and cybersecurity. Our internal controls over financial reporting include key controls covering certain information technology and cybersecurity processes that are documented and tested annually.

companyName: LXP Industrial Trust

ticker: LXP


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, before contracting with certain technology service providers, when possible, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and to require them to adhere to security standards and protocols. Finally, we maintain cybersecurity insurance coverage.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: Our overall cybersecurity risk management covers IT, information security and data protection risk and its objective is to avoid or minimize the impacts of threat events that could lead to penetration, disruption or misuse of our information systems and to ensure compliance with applicable legal and contractual obligations. Our cybersecurity risk management improvement initiatives are informed by regulatory guidance, industry standards (such as ISO, NIST, CIS, FAIR and others), threat intelligence feeds, internal and external audits, external consultants, and insights from cybersecurity community. Some of our subsidiaries are certified under ISO 27001, an international information security management systems standard, or undergo regular Payment Card Industry Data Security Standard (PCI) audits. Experts from our Technology Leadership Centre, under the supervision of the Chief Technology Officer, periodically review our cybersecurity risk management processes to address changing threats and conditions.

companyName: Freedom Holding Corp.

ticker: FRHC


text: FirstEnergy conducts cyber security exercises and training. For example, all personnel with any form of computer system access must complete cyber security training on a recurring basis, which educates the personnel on FirstEnergy's policies and procedures for using FirstEnergy systems, keeping FirstEnergy information secure, and for safe, reliable operation of electric utility systems. FirstEnergy also conducts various tests of its cyber incident response plans, disaster recovery plans and business continuity plans with key stakeholders and responders for various areas of FirstEnergy's utility and business functions. FirstEnergy's management also holds executive cyber security incident tabletop exercises to train on cyber security incident response.

companyName: FIRSTENERGY CORP

ticker: FE


text: Our Chief Financial Officer has overall responsibility for our cybersecurity and has over 30 years of experience managing information technology, or IT, departments at biotechnology and pharmaceutical companies. Our Senior Director of Information Technology is responsible for the development and implementation of IT department controls, policies, infrastructure, and day-to-day operations, in addition to managing security risk, evaluating safeguards and recommending security improvements, and has over eight years of experience managing IT departments for a biotechnology company. We utilize third-party vendors to help strengthen our information security risk management by conducting evaluations of our security controls on at least a quarterly basis.

companyName: Altimmune, Inc.

ticker: ALT


text: We regularly assess and test our cybersecurity policies, standards, processes and practices. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage recognized third-party experts to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: PROS Holdings, Inc.


text: Our Board oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Board regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: On a day-to-day basis, our CISO leads our cybersecurity program with support from senior leadership. Our Information Security program is a bespoke program created for the Company and is guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Information Security team is composed of three core functional areas, which work collaboratively to keep our assets secure: • Governance, Risk, & Administration. Responsible for setting policy, maintaining and conducting risk assessments, ensuring regulatory compliance in partnership with our legal and compliance team, coordinating audits, evaluating new technology platforms, and overseeing the Company's data governance, vendor risk management, and training programs. • Security Operations. Responsible for monitoring our security posture on an ongoing basis, including alert response and escalation. This team is supported by a third-party security firm that serves as the Company's Security Operations Center and performs continuous monitoring of security across the enterprise. • Security Architecture. Responsible for managing and maintaining security systems and identity management programs, as well as performing security reviews for key technology platforms.

companyName: Evercore Inc.

ticker: EVR


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks, which includes engagement with both senior management and the Board. Our Board is responsible for overseeing our enterprise risk management activities in general, including those related to cybersecurity, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on our risk management process and the risk trends related to cybersecurity at least annually. Further, the Audit Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity from the CIO at least four times a year.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: The Committee receives annual reports from management on our cybersecurity posture. In addition, management updates the Committee where it deems appropriate regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: ARDELYX, INC.

ticker: ARDX


text: Our Chief Compliance Officer has over 40 years of experience leading global legal and compliance departments. He holds an undergraduate degree in economics from the Wharton School of Business and a Juris Doctor from Columbia University School of Law.

companyName: NCR Atleos Corp

ticker: NATL


text: The Company employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems the Company uses.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Cybersecurity is an important component of our overall approach to risk management. We have implemented cybersecurity processes, technologies and controls to facilitate our efforts to identify, assess and manage material risks from cybersecurity threats. We leverage industry associations, third-party benchmarking, results from internal and third-party testing, and other similar resources to inform our cybersecurity programs and processes. We also adhere to applicable Payment Card Industry Data Security Standards. We have prioritized improving our cyber security posture to safeguard our systems and mitigate risks. During fiscal 2023, we made significant investments in people and technology to detect, respond, and recover from security incidents. We have developed and are executing our cybersecurity roadmap which provides the framework to continually strengthen our capabilities.

companyName: Citi Trends Inc

ticker: CTRN


text: We regularly engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement and compliance, including review of past cybersecurity incidents in order to address known vulnerabilities. Our processes also address cybersecurity risks associated with third-party service providers, including those with access to our non-public or restricted data, including client data. Third-party risks are also included within our ERM program and are actively reported to the Audit and Governance Committees. Our Third Party Risk Management Program comprises a defined process to identify, assess, and mitigate risks by our third-party suppliers and service providers, specifically including cybersecurity and privacy risks.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), cybersecurity consultants, and cybersecurity software providers.

companyName: Turnstone Biologics Corp.


text: The audit committee of our Board, pursuant to its charter, oversees our enterprise risk management process, which includes risks from cybersecurity threats. The audit committee regularly receives reports from management with respect to risks from cybersecurity threats and quarterly reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives with the CTO. These risks and mitigation strategies are also periodically reviewed by the entire Board.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: While no organization can eliminate cybersecurity risk entirely, we believe our cybersecurity program is reasonably designed to mitigate our cybersecurity and information technology risks. Our cybersecurity program is supported by our information security team, which is primarily responsible for identifying, monitoring and preventing cybersecurity threats and our data privacy team, which is primarily responsible for developing, creating, maintaining and enforcing privacy policies, standards and procedures. Our information security team reviews potential identified incidents through various internal and external resources; identifies potential or actual cybersecurity threats; evaluates and prioritizes threats based on severity; investigates and mitigates the cause and impact of such incidents; administers our documented response procedures with respect to any data breach; and implements safeguards to help prevent recurrence.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: Chemours recognizes the critical importance of maintaining a cybersecurity program to provide a secure and reliable computing environment protecting the Company's information, systems and assets and to enable our digital transformation goals. Our cyber and information security program (the "Program") is based upon standards published by the National Institute of Standards and Technology ("NIST") in their Cybersecurity Framework. The goals of our Program are: • identifying, preventing, and mitigating cybersecurity threats to the Company; • preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; • protecting the Company's intellectual property; • maintaining the confidence of our customers, business partners and other stakeholders; and • providing appropriate public disclosure of cybersecurity risks and incidents, when required.

companyName: Chemours Co

ticker: CC


text: The Board of Directors, as a whole, has overarching responsibility for overseeing our strategic and operational risks. The Audit Committee specifically monitors risk management, including cybersecurity threats. Management, led by the Vice President, Information Systems and Technology, regularly reports to the Board of Directors, primarily through the Audit Committee, providing regular reports on specific risks, mitigation efforts, and a review of Nordson's cybersecurity maturity.

companyName: NORDSON CORP

ticker: NDSN


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents impacting the Company. The Response Plan includes (1) detection, (2) analysis, which may include timely notice to our management and audit committee chair, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. We also maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents. It is important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect us against any future claims or that such insurance proceeds will be paid to us in a timely manner.

companyName: Arq, Inc.

ticker: ARQ


text: An internal cyber risk assessment is performed annually to ensure that our cybersecurity program and its processes and controls adequately mitigate material cybersecurity threats and risks. As part of the program, we proactively identify IT assets, systems, and information and assess their risk and protection levels to detect and remediate any potential weaknesses by using vulnerability scanning, penetration testing and simulations of real cyberattacks. The Company also engages an external third party to independently validate the organization's maturity with regard to managing cybersecurity risks and that it meets regulatory and industry standards with respect to managing those risks.

companyName: Santander Holdings USA, Inc.


text: The Company's Director of Security and Information Technology (DSIT), in coordination with the Company's Vice President of Technology, is responsible for leading the assessment and management of cybersecurity risks. The current DSIT has over 18 years of experience in information security. The DSIT reports to the Board and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on a quarterly basis or as needed.

companyName: Dave Inc./DE

ticker: DAVE


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our executive management team informs the board on cybersecurity risks on a regular basis, with a minimum frequency of once per year.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: Seaboard maintains a risk-based approach to information security that is based on the CIS-18 controls framework to identify key areas of cybersecurity risk. Seaboard's information security program maintains a team responsible for managing the cybersecurity risk assessment process across all segments (the "Information Security Team"). The Information Security Team routinely performs various reviews and generates reports throughout the year to determine risks, threats and compliance with information security policies, standards and the framework of controls. This Information Security Team partners with each of the segments to identify key areas of cybersecurity risk based on the framework and develop action plans tailored to address those risks. Risks are evaluated at least on a quarterly basis according to Seaboard's cybersecurity reporting process.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2024 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further information about these risks, please see Part I - Item 1A. Risk Factors - IV. Operational Risks - A disruption in or failure of our IT systems, including those related to cybersecurity, could adversely affect our business operations, reputation and financial performance and could expose us to third-party liability.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A “Risk Factors – Risks Related to Units – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”

companyName: MARINE PETROLEUM TRUST

ticker: MARPS


text: Every quarter, the Privacy and Security Council meets to discuss certain cybersecurity risks and upcoming changes to our legal obligations that may affect our cybersecurity program, and to review our cybersecurity program. Our cybersecurity team is responsible for preparing for any cybersecurity incidents, responding to any cybersecurity incidents, approving cybersecurity policies and procedures, and reviewing cybersecurity-related audit reports.

companyName: Grindr Inc.

ticker: GRND


text: The Company has processes in place designed to protect its information systems and to assess, identify and manage material risks from cybersecurity threats. Accordingly, the Company has designed and implemented an Information Security Program, designed to protect the confidentiality, integrity, and availability of its information systems and data (including nonpublic information in its possession, custody, or control), as well as to comply with privacy and Information Security Program requirements for insurers as set forth in applicable state laws and regulations. As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing monthly training and regular phishing simulation and exercises. In addition, the Company has engaged third parties in connection with these processes.

companyName: Root, Inc.

ticker: ROOT


text: As part of our risk management program, we reference security industry frameworks and other guidance to help us assess, identify, and manage cybersecurity risks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Atai Beckley N.V.

ticker: ATAI


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not be discovered, occur, or result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, please refer to Item 1A. "Risk Factors."

companyName: EPLUS INC

ticker: PLUS


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's board of directors, primarily through its audit committee.

companyName: Lithium Corp

ticker: LTUM


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: We conduct annual assessments to identify cybersecurity risks based on known threats and vulnerabilities, as well as assessments after any material change in our business practices that may affect information systems exposed to such cybersecurity risks. These risk assessments include identification of reasonably foreseeable internal and external threats and vulnerabilities, the likelihood that such threats will occur, and the impact on our business that could result from such occurrences. We then evaluate the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Axonics, Inc.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, threat intelligence service providers, penetration testing providers, dark web monitoring services, forensic investigators, and professional services firms, including legal counsel.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: Management plays a role in assessing and managing our material risks from cybersecurity threats through membership on our cybersecurity team, as well as by making final materiality determinations and disclosures and other compliance decisions, as reflected in the HighPeak Energy IRP. Our cybersecurity team is made up of experienced professionals, both employees and third parties with extensive backgrounds in information security, risk management, and incident response. This team is lead by an officer of the Company, bringing over a decade of experience in IT leadership, policy development, and technology strategy. With a strong background in overseeing IT departments and driving digital transformation, the team plays a critical role in ensuring the security, efficiency, and innovation of our technology infrastructure. Cybersecurity remains a top priority, with a focus on risk management, regulatory compliance, and safeguarding company data. Our cybersecurity team regularly interacts with the Board of Directors and the Audit Committee, providing insights on IT governance, cybersecurity initiatives, and emerging technology trends.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere, through our service agreements with them, as further discussed in Note 11—Related Party Transactions of our Notes to Financial Statements, and the board of directors of CQP's general partner (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.

companyName: Sabine Pass Liquefaction, LLC


text: The Hartford has implemented an information protection program with established governance routines for assessing and managing risks. The Hartford employs a 'defense-in-depth' strategy that uses multiple security measures to protect the integrity of the Company's information assets. This 'defense-in-depth' strategy aligns to the National Institute of Standards and Technology Cybersecurity Framework, where controls are implemented throughout our environments to achieve five categorical objectives, including identification, protection, detection, response and recovery.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: We work with third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers and penetration testing firms.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Our board of directors (the "Board") is acutely aware of the critical nature of managing risks associated with cybersecurity threats given the significance of these threats to our operational integrity and stakeholder confidence.

companyName: GOLDENWELL BIOTECH, INC.

ticker: GWLL


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response strategies, systems monitoring, personnel training, cybersecurity insurance, data encryption strategies, network security controls, access controls, physical security controls, and asset management (such as tracking and disposal of Company information systems).

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: In addition, we maintain specific policies and practices governing our third-party security risks, including our third-party assessment (" TPA ") process. Under our TPA process, we gather information from certain third parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.

companyName: AvePoint, Inc.

ticker: AVPT


text: Frontier's management is primarily responsible for governing and overseeing cybersecurity risks. Operational responsibility for ensuring the adequacy and effectiveness of the Company's cybersecurity risk management, control and governance processes is assigned to the SVP, Cyber Security (CISO). Our CISO has over 20 years of experience in IT, cyber security and data privacy and data management and reports directly to the EVP, Chief Digital and Information Officer (CDIO). Our CDIO has over 25 years of experience, having previously held senior leadership positions in technology, IT and operations at large public companies prior to joining Frontier.

companyName: Frontier Communications Parent, Inc.


text: Our CISO is informed of cybersecurity incidents by the cybersecurity team's security operations center, which is generally responsible for monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. We have an established process governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident, including for our evaluation of materiality. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and Board of Directors.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: Upon detection of a material cybersecurity threat, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include cybersecurity materials discussing current material cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Chief Executive Officer. Our board of directors receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.

companyName: NexImmune, Inc.

ticker: NEXI


text: We have introduced corporate policies and training on these policies for all of our staff. Our Information Management team, and in particular our information security team together with the corporate compliance team are responsible for ensuring compliance with these corporate policies. Our Chief Operating Officer oversees our policies and is primarily responsible to assess and manage material risks from cybersecurity threats, with assistance from third party experts as appropriate.

companyName: Adaptimmune Therapeutics PLC


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: The Company has a written incident response plan and periodically conducts tabletop exercises to enhance incident response preparedness. The Company also maintains business continuity and disaster recovery plans to prepare for a potential disruption in technology. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and at least semi-annually thereafter.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: We have implemented ongoing processes that are designed to continually identify, assess, manage, monitor, and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists us in maintaining our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Officer ("CCO"), which are then considered by other officers and employees of our Adviser and Administrator working on our behalf before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes, and procedures.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Our cybersecurity policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting our systems and the data entrusted to us.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our Board oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Security Committee directly oversees our cybersecurity program. The Board receives periodic updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: VisionWave Holdings, Inc.

ticker: VWAV


text: Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors, who views our focus in these areas as essential for the success of our company and the broader technology industry in which we operate. As described in the Audit Committee Charter of the Board of Directors, the Audit Committee is tasked with oversight of certain risk issues, including cybersecurity. The Audit Committee is comprised entirely of independent directors, two of whom have significant work experience related to information security issues or oversight. Management reports high severity security incidents to the Audit Committee after they are discovered. Additionally, management provides a summary four times per year of all security incidents to the Audit Committee. The full Board of Directors is also provided an annual assessment of our security program, our internal response preparedness, and assessments led by outside assessors and auditors.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: (a) As discussed in Item 1A, Risk Factors, we face risks associated with security breaches and other significant disruptions of our IT networks and related systems that are essential to our business operations. Due to our Defense/IT strategy and the nature of the customers and activities it serves, we may have a heightened likelihood of being targeted for cyber-attacks or -intrusions, including by governments, organizations or persons hostile to the USG.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: We take cyber risk seriously as a part of modern enterprise risk management, protecting our stakeholders and assets, and building resilient processes. The modern threat landscape requires us to consider cyber risks, and make determinations regarding how to treat the risks. We evaluate cybersecurity risks alongside other business risks.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including executive management. When appropriate given the nature of any potential cybersecurity incident, our executive management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified, and to make any legally required notifications to individuals or regulatory agencies, including making any required disclosures under the Exchange Act.

companyName: GERON CORP

ticker: GERN


text: The operations of AEP's electric utility subsidiaries are subject to extensive and rigorous mandatory cyber and physical security requirements that are developed and enforced by NERC to protect grid security and reliability. Cook Plant is also subject to NRC regulation for cybersecurity. AEP's enterprise-wide security program includes cyber and physical security and incorporates many of the guidelines set forth in the National Institute of Standards and Technology Cybersecurity Framework. AEP''s Chief Security Officer (CSO) has accountability for cyber aspects of third-party risk and data loss prevention and is also its NERC Critical Infrastructure Protection Senior Manager, who is responsible for ensuring alignment of compliance with the enterprise-wide security program. AEP's CSO possesses extensive experience across cybersecurity, risk and data controls and infrastructure engineering. AEP's CSO was the Chief Security Officer at Bread Financial Holdings, Inc., a publicly registered financial services company, and an executive director of cyber security at JPMorgan Chase & Co. prior to joining AEP.

companyName: AEP Transmission Company, LLC


text: Information technology supports all aspects of our business, including operations, marketing, sales, order processing, production and distribution networks, retail and professional hairstylist customer experience, consumer experience, finance, business intelligence, and product development. We continue to maintain and enhance our information technology systems, cybersecurity infrastructure and customer and consumer experiences in alignment with our long-term strategy. An increasing portion of our global information technology infrastructure is cloud-based and in partnership with industry-leading service providers. We believe this approach enables a high-performance platform to support current and future requirements and enhances our scale and flexibility to respond to the demands of the business by leveraging advanced and leading-edge technologies. We recognize that technology presents opportunities to build a competitive advantage, and we continue to invest in new capabilities across various aspects of our business. Such efforts, however, subject us to increased cyber risk, as these investments are subject to cyberattacks, business disruptions and other risks described in "Risk Factors – Risks Related to Information Technology and Cybersecurity."

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: Our information security function, led by our Senior Director, IT & Facilities and our Senior Manager, IT Infrastructure and Operations, helps identify, assess and manage our cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and resources including, for example automated tools, internal and external audits, external intelligence feeds and third-party threat assessments; conducting scans of the threat environment, threat assessments for internal and external risk and vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile and threats reported to us; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threat and threat actors and coordinating with law enforcement concerning threats; and internal tabletop incident response exercises.

companyName: CERUS CORP

ticker: CERS


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Our information technology personnel and our senior management lead the operational oversight of the company -wide cybersecurity strategy and processes. The board of directors provides oversight of our cybersecurity risk. Additionally, the board of directors reviews our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.

companyName: BURZYNSKI RESEARCH INSTITUTE INC

ticker: BZYR


text: We have invested significantly over the past several years to enhance our cybersecurity governance. We have expanded our control access to data and systems, invested in firewalls and security systems, elevated internal awareness through trainings and exercises, and upgraded our systems, programs and intrusion monitoring.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: As of the date of this report, we are not aware of any material breaches to our networks or computer systems that have materially affected or are reasonably likely to materially affect our execution of our business strategy, results of operations, or financial condition. We describe potential risks from cybersecurity threats under the heading "Our information technology systems can be negatively affected by cybersecurity threats," in Part I — Item 1. "Risk Factors" of this 2024 Form 10 K, which disclosures are incorporated herein by reference.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is designed to share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We have a cross-functional team composed of senior IT, cybersecurity and compliance leadership from both TKO and Endeavor that typically meets on a monthly basis to discuss efforts to identify new or prospective risks, mitigate previously identified risks, and discuss recent cybersecurity events. This cross-functional team reports into an executive steering committee comprised of senior enterprise leadership which meets, at a minimum, quarterly.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Our security technology team, led by the Head of Core Technology & Security (Head of CT&S), is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of CT&S reports to our Chief Digital and Technology Officer. The Head of CT&S has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He is an ISACA certified security manager and has over 20 years of experience in information technology, with over 10 years specifically focused on cybersecurity risk management.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: Our management team, including our Chief Financial Officer, Chief Technology Officer and General Counsel (the cybersecurity disclosure committee), is responsible for assessing material risks from cybersecurity threats and our General Counsel oversees any required reporting obligations and notifications. Our Chief Technology Officer has primary responsibility for overseeing our security incident response plan, including identification and initial assessment of threat levels and escalations.

companyName: LANDS' END, INC.

ticker: LE


text: Adobe has certain security processes, infrastructure, systems, policies and practices for assessing, identifying and managing risks from cybersecurity threats. We maintain an information security risk management framework for managing cybersecurity risks, priorities and projects for our products, services, infrastructure and corporate resources. As part of our framework, a cybersecurity risk steering committee meets regularly to review newly identified risks and progress on remediating existing risks.

companyName: ADOBE INC.

ticker: ADBE


text: We understand that cybersecurity threats—ranging from phishing to more sophisticated forms of intrusion—are dynamic and evolving. While we have not, to date, experienced any cybersecurity incidents that have materially affected our operations, results of operations, or financial condition, we continue to monitor our risk exposure and expect to expand our cybersecurity infrastructure and governance as our business matures. For additional information about risks related Governance

companyName: Brag House Holdings, Inc.

ticker: TBH


text: Cybersecurity is among the risks identified for Board-level oversight, with the Audit Committee of our Board of Directors responsible for overseeing our policies, practices, and assessments with respect to cybersecurity. Our Audit Committee and Board of Directors receive regular updates throughout the year on cybersecurity from our Finance, Risk and Sustainability (the "FRS") Committee, which is tasked with risk management, data protection, and monitoring compliance with our cybersecurity policy. The FRS Committee is comprised of our Chief Financial Officer, Chief Legal Officer, Chief Operating Officer, Senior Vice President of IT, and VP of Corporate Development. Each of our Board of Directors and Audit Committee member separately receives an annual report on cybersecurity matters and related risk exposures, and when the report is covered during an Audit Committee meeting, the chair of the Audit Committee reports on its related matters to our Board of Directors. Our Audit Committee also receives regular updates on our cybersecurity posture throughout the year, as appropriate.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: To ensure the confidentiality and integrity of data and systems, we leverage encryption of data during transfer and at rest whenever possible and as necessary, least privileged access when granting access, strong passwords and two-factor authentication, and version-controlled file systems.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Reporting to Board of Directors Our Chief Information Security Officer, in his capacity, regularly informs our executive management team of material cybersecurity risks and incidents. This is how executive management is kept abreast of our cybersecurity posture and potentially material cybersecurity risks facing Cytokinetics. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated by any of our executive officers to the Audit Committee, so that the Audit Committee can oversee and provide guidance on critical cybersecurity issues.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Our cybersecurity team evaluates the risk profile of new third party service providers and maintains communication channels with key third party service providers to evaluate and respond to possible effects of incidents within a service provider's organization. We rely on, and in certain cases require, our third parties to communicate such incidents timely.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Director of Information Security (DIS), under the direction of our Director of Information Technology (DIT) continuously evaluates and addresses cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as National Institute of Standards and Technology frameworks.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection safeguards; • Maintaining defined disaster recovery procedure and employing disaster recovery software, where appropriate; • Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: We use various controls, technologies, and other processes designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology (NIST). These include, but are not limited to, internal reporting, monitoring and detection tools, threat intelligence, and general and role-based training. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate and improve the effectiveness of our cybersecurity program internally and by engaging with consultants and other third party advisors to conduct reviews and assessments of our program. These periodic assessments and reviews may include penetration and vulnerability testing, simulations, table-tops, and other exercises.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee oversight of cybersecurity risks including oversight of management's implementation of our cybersecurity risk management program. Pursuant to its charter, the audit committee's oversight of the integrity of our information technology systems and cybersecurity risks includes the review and assessment with management of the adequacy of controls and security for our information technology systems, processes and data, as well as our contingency plans in the event of a breakdown or security breach affecting our information technology systems.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: We have experienced and expect to continue to experience cybersecurity attacks and have expended human and financial resources to respond to such attacks.

companyName: BRINKS CO

ticker: BCO


text: Depending on the nature of the services provided, and the sensitivity and quantity of information processed, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments have not experienced any material cybersecurity incidents in the past, and we believe no cybersecurity events have occurred that have materially affected the Company or its business strategy, results of operations or financial condition. We continue to invest in the cybersecurity of our infrastructure and the enhancement of our internal controls and processes, which are designed to help protect our systems and data, and the information they contain. We carry insurance in amounts that we believe are reasonable for our business that provides protection against potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may arise from a cybersecurity incident.

companyName: Streamex Corp.

ticker: STEX


text: As part of our governance structure, the Board of Directors, Chief Executive Officer and VP of IT play an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. The Bank and its vendors provide periodic reports to our Board of Directors, or committee thereof, as well as to our senior management team as appropriate. These reports include updates on the Bank's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Bogota Financial Corp.

ticker: BSBK


text: We review cybersecurity risk as part of our overall enterprise risk management program. This ensures that cybersecurity risk management remains a top priority in our business strategy and operations.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage independent third parties to penetration test our systems, consult on security enhancements, and perform industrial control system audits. In addition, our IT-related internal controls over financial reporting are audited by our independent external auditors. These practices allow us to leverage specialized knowledge and insights, identify risks, and continuously improve our information technology internal controls and processes to respond to the evolving cybersecurity threats.

companyName: BOISE CASCADE Co

ticker: BCC


text: We conduct annual risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We also utilize threat modeling to evaluate changes to our applications or environments for new threats or risks, and our cybersecurity team monitors the threat landscape regularly using security industry sources and certain threat intelligence information. Blend conducts daily vulnerability assessments, prioritizes remediation, and engages in routine system and application patching as well as other proactive measures, where deemed appropriate, to mitigate reasonably foreseeable risks.

companyName: Blend Labs, Inc.

ticker: BLND


text: Our supply chain risk management practices include risk assessments of suppliers, particularly regarding cybersecurity. We monitor our suppliers using commercially available services that provide real-time security scoring of supplier technology services, threat intelligence, financial intelligence, geopolitical risk intelligence, and other cybersecurity-related considerations. Regular reviews are performed to monitor changes in our suppliers' cybersecurity risk posture. Continuous threat intelligence monitoring is also conducted to identify potential cybersecurity incidents involving third parties. We strive to negotiate appropriate cybersecurity provisions in our contracts with suppliers.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: We are committed to protecting our intellectual property, customer and employee data, and the information technology systems critical to keeping our customers, employees, contractors and others aligned and allowing our operations to function properly. Our Board of Directors and its committees are involved on an ongoing basis in the oversight of our material enterprise-related risks, including cybersecurity risks. Our processes for oversight of cybersecurity-related risks are fully integrated into our overall enterprise risk management program, which is led by our General Counsel. We assign a member of our executive management team to report material information to our Board of Directors regarding each of our most significant enterprise risks. We have identified a separate risk for enterprise cybersecurity. The Audit Committee, in connection with the Chief Information Officer, provides primary oversight for cybersecurity risk for the company.

companyName: MARCUS CORP

ticker: MCS


text: Coupang has a cyber risk management framework designed to assess, identify, and manage cyber related risks. Cyber related risks are identified through audits, assessments, and incidents. Our vulnerability scanning process uses both automated tools and penetration testing to identify vulnerabilities within our environment.

companyName: Coupang, Inc.

ticker: CPNG


text: In order to monitor our information technology systems and data and to identify potential threats to such, we maintain cybersecurity risk assessment and management programs. Such programs include, but are not limited to, annual security penetration tests performed both externally and internally, bi-annual security assessments against cybersecurity frameworks, continuous vulnerability scanning, incident response processes, monthly and annual security awareness and simulated phishing trainings for our employees, and various system alert monitoring and screenings.

companyName: Permian Resources Corp

ticker: PR


text: Cybersecurity risks are integrated into TEC's overall risk management process through the collaboration of the cybersecurity professionals and TEC's and Emera's risk management functions to assess threat levels on an affiliate and corporate basis and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through receiving regular reports from the CIO, which include updates on TEC's performance with preparing, preventing, detecting, responding to, mitigating, and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to TEC, TEC's processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or inciden t. The CIO also provides regular updates on the key elements of its cybersecurity program to the Emera Board's Risk and Sustainability Committee, which has oversight over Emera's enterprise risk management framework, including oversight over cybersecurity risk.

companyName: TAMPA ELECTRIC CO


text: Sponsor recognizes the importance of managing cybersecurity risks to protect its business operations, clients, and stakeholders. The Sponsor has implemented a comprehensive Cybersecurity Policies and Procedures Plan for the Fund, which outlines our approach to identifying, assessing, and mitigating cybersecurity threats and vulnerabilities in alignment with industry standards and best practices. Risk Assessment and Management: The Fund has established a risk-based cybersecurity framework to manage cybersecurity risks effectively.

companyName: Dynamic Shares Trust


text: The CISO and CIO are informed about and monitor these cybersecurity programs and incidents through their oversight of, and participation in, the cybersecurity risk management and strategy processes described above, including management of and notices from our Security Operations Centers and the supervision of our incident response plan and processes.

companyName: TIDEWATER INC

ticker: TDW


text: We rely upon information technology (IT) networks and systems to process, transmit and store electronic information, and to manage or support a variety of critical manufacturing and business processes or activities. Additionally, we and certain of our third-party vendors collect and store personal or confidential information, including personally identifiable information, in connection with human resources operations and other aspects of our business. The secure operation of these information technology networks and systems and the proper processing and maintenance of this information are critical to our manufacturing and business operations.

companyName: Dauch Corp

ticker: DCH


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards and best practices as well as by engaging experts to manage our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, the activities we undertake include the following: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws, as applicable;

companyName: CervoMed Inc.

ticker: CRVO


text: The Sponsor of the Fund has a fundamental role in overseeing the Fund's cybersecurity risk management. The Sponsor receives regular updates on cybersecurity matters from management and third-party service providers, ensuring that cybersecurity risks are managed proactively at the highest level of the organization.


text: Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.

companyName: Canton Strategic Holdings, Inc.

ticker: CNTN