text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on June 30, 2023 and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Golub Capital Private Credit Fund


text: Management's Role in Assessing and Managing Cybersecurity Threats Our IT and Security team, which is headed by our CIO, is responsible for our efforts to comply with cybersecurity standards, establish industry-recognized protocols and protect the integrity, confidentiality and availability of our IT infrastructure. Our CIO and various members of the IT and Security team, meet regularly with members of management to address key security and privacy issues. Our CIO has more than 25 years of infrastructure and cybersecurity experience. We also have formed a cyber event incident team, composed of our CIO, Chief Financial Officer, Corporate Controller, Chief Legal Officer and vice president of Internal Audit, who, upon the occurrence of a cybersecurity incident, convene to assess the materiality of the event as well as the appropriate remediation and escalation procedures, including escalation to our Chief Executive Officer, the Finance/Risk Management Committee, the Audit Committee and the Board of Directors. Our internal audit department additionally conducts regular audits to assess management's processes and controls employed to identify and manage material cybersecurity risks.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI

secItem: Item 1C


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: Identifying reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems. Assessing the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information. Assessing the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by the use of consultants as the Company does not have a full-time dedicated cybersecurity position in the Company. Our consultants have over 20 years of experience in information technology matters and are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The Board of Directors (the " Board ")

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Financial Officer, and the Vice President of Operational Engineering. Those members of management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Vice President of Information Technology on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.

companyName: Knowles Corp

ticker: KN


text: We obtain security incident reports from our third-party software and service providers regarding unauthorized attempts to access our systems, when and if they occur, and we work closely with our third-party providers to explore the details of any unauthorized attempts to infiltrate those systems and to assess whether any critical information within those systems was compromised or not. We also evaluate to the extent possible our system of controls in comparison to information obtained from our third-party providers, as well as our independent accountants and other technology consultants, of practices followed by other companies in safeguarding their systems in order to ensure our cybersecurity strategies and processes remain at the forefront of industry best practices.

companyName: FTC Solar, Inc.

ticker: FTCI


text: The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Material Risks & Integrated Overall Risk Management are developing processes to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information we create, use, transmit, receive, and maintain. We also seek to integrate these processes and policies into our overall enterprise risk management system and processes. The processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: At the management level, our Enterprise Risk Management (ERM) Committee, chaired by the Chief Executive Officer and comprising other senior level executives, including the Chief Information Officer, reports to the Board's Risk Committee and is responsible for managing risk, including cybersecurity risk. The ERM Committee serves as a senior level forum for review and discussion of material operational risk issues, including cybersecurity risk, and receives regular updates from the CISO regarding cybersecurity risk. The ERM Committee directly oversees the Operational Risk Committee, which provides governance, direction, oversight, and high-level management of operational risk, including cybersecurity risk, and includes senior management representation from the LOB and support areas. The CISO is a voting member of the Operational Risk Committee.

companyName: KEYCORP /NEW/

ticker: KEY


text: Our CISO is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity governance (policies and procedures), risk assessment, defense operations, incident response, vulnerability monitoring, threat intelligence, identity access governance, information security/cyber related third-party risk management, and business continuity. Moreover, the Security function is responsible for assessing, managing and remediating material risks from cybersecurity threats. The Security management team has the technical, management and project leadership experience in mid-sized or larger banks, maintains appropriate technical certifications, and stay abreast of industry, technical and regulatory best practices and requirements.

companyName: HEARTLAND FINANCIAL USA INC


text: We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: Veradigm's information security policies and procedures have been developed to align with recognized security practices and utilize multi-layered defenses. As part of the IS Program, the Company employs a range of tools and services to inform assessment, identification and management of material risks from cybersecurity threats, which include, from time to time, monitoring emerging data protection laws and implementing responsive changes to our processes; undertaking periodic reviews of our policies and statements related to cybersecurity; conducting annual privacy and security awareness training for all Veradigm workforce members, including contractors and subcontractors, and tracking compliance; and deploying phishing test campaigns. We have an incident response program, which is reviewed and updated annually, and our incident response team members participate in regularly scheduled management reviews and tabletop exercises to simulate responses to cybersecurity incidents.

companyName: Veradigm Inc.


text: Our cybersecurity risk management processes are implemented, assessed, and managed by certain members of Olo management, including our CISO and GC. Our CISO has 25 years of experience in information technology and risk management at various companies, such as Yum Brands, Inc. and Domino's Pizza, Inc. He is also an ISC2 Certified Information Systems Security Professional. Our GC received a cybersecurity oversight certification from the National Cybersecurity Center. Both act as chairs of our GRC Committee. The GRC Committee provides direction, oversight, and management of our cybersecurity and privacy programs with a focus on business objectives, the protection of customer and employee data, safeguarding our systems, and complying with applicable laws, regulations, and contractual obligations. Cross-functional leaders within Olo, including members from our information technology, data science, finance, legal, and people & culture teams, are part of the committee. Our GRC Committee meets periodically to align cybersecurity and privacy strategy with business needs and risk appetite, monitor the execution of key cybersecurity initiatives, and serve as an escalation point for any related issues.

companyName: Olo Inc.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program.

companyName: T Series Middle Market Loan Fund LLC


text: The Audit Committee assists the Board in fulfilling its fiduciary duties regarding cybersecurity risk oversight. The Audit Committee is composed of directors with diverse professional experience, including three members with backgrounds in cybersecurity. We believe this expertise enables our Audit Committee to effectively oversee our cybersecurity risks and incident response plans. For more information on our directors' expertise, see our definitive proxy statement for our 2025 Annual Meeting of Stockholders to be filed with the SEC.

companyName: QXO BUILDING PRODUCTS, INC.


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we encourage our providers to meet appropriate security procedures, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: VirnetX Holding Corp

ticker: VHC


text: The Company's board of directors is responsible for overseeing and approving our cybersecurity strategy and policies. Our board of directors receives updates from management on the Company's cybersecurity status and initiatives and provides guidance and feedback on the cybersecurity goals and objectives.

companyName: TELIX QSAM INC.


text: Executive Officers of Restaurant Brands International, Inc., General Partner of Registrant Set forth below is certain information about our executive officers as of February 20, 2024. President, Tim Hortons Canada & U.S.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Tyler staffs an internal incident response team designed to launch when a potential or suspected security incident is reported to or identified by Tyler. That team is composed of a multi-disciplinary group of Tyler team members, including representatives from the security, privacy, communications, and relevant business unit teams, as well as outside threat intelligence, forensic and legal advisors that are called on as needed. The incident response team's goal is to confirm, contain, mitigate, and remediate the incident, as applicable, and to conduct a "lessons learned" process when the incident response is completed.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: In carrying out this responsibility, the Audit and Finance Committee regularly receives written reports from the company's Chief Information Security Officer (CISO) and periodic briefings from the CISO. These presentations may address a wide range of topics, such as the results of recent vulnerability assessments and third-party independent reviews, changes to the threat environment, technological trends and other recent developments, and peer and other third-party benchmarking.

companyName: Phillips 66

ticker: PSX


text: Cyber Expertise and Experience The Company relies on third party cybersecurity professionals to provide risk assessments to help assess cybersecurity risks. The Company provides cybersecurity training for its employees through a third party.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: The Company also has several tools and processes in place to actively prevent, detect and manage cybersecurity incidents. This includes: • Vulnerability Management – continuous scanning of the technology environment to identify and remediate potential vulnerabilities. • Attack Surface Management – actively monitor and prevent external attack attempts. • Security Monitoring and Operations – collection and aggregation of security alerts that are reviewed, analyzed and managed by the security operations team. • Threat Intelligence – gathering and analyzing information about current and emerging cyber threats. • Incident Response – incorporating detection and recovery processes, defining roles and responsibilities across the Company, establishing communication protocols and escalation procedures, including performing tabletop exercises. • Disaster Recovery and Business Continuity Plans – covering both technology and business areas globally with annual exercises to validate processes. • Cybersecurity Awareness – educating employees and third-party service providers on best practices for protecting the Company from cyber threats, which includes providing annual security and privacy industry-specific training to employees as well as conducting period phishing simulations to test their awareness. We are continuously enhancing our cybersecurity framework in response to the ongoing incidents and threats that we face.

companyName: TAPESTRY, INC.

ticker: TPR


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Investment Adviser's Chief Compliance Officer ("CCO") regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Steele Creek Capital Corp


text: the Company's information governance policies and programs; and major legislative and regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: The Company maintains an enterprise-wide and Board-approved Information and Cyber Security Program (the "Program"), which includes strategy, written policies, procedures, guidelines and standards to address the assessment, identification and management of cybersecurity risks. The Company designed the Program to be consistent with industry standards and in compliance with applicable federal and New York state laws, regulations and guidelines.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: Our cybersecurity program helps us secure our systems, keeps our business running around the clock and protects our clients, consultants, employees and shareholders from vulnerabilities and threats. We acknowledge the importance of assessing, identifying, and managing material risks associated with cybersecurity threats including: operational disruptions; violation of data privacy laws and regulations; breach of confidentiality; and financial and reputational harm.

companyName: KFORCE INC

ticker: KFRC


text: The Company provides regular, mandatory training for all personnel on cybersecurity threats and has processes and procedures in place to communicate out-of-cycle notices and updates regarding the Company's information security policies, standards, processes, and practices by the CTO as needed.

companyName: IBEX Ltd

ticker: IBEX


text: To help protect the Company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include but are not limited to establishing information security policies and standards, regular security audits, access controls, controlled use of administrative privileges, advanced threat detection, network security, vulnerability testing, compliance audits, incident response plan, employee training, and engaging third party risk management experts. We leverage CIS (Center for Internet Security) controls as a guideline to enhance our cybersecurity risk management strategy. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation.

companyName: Newsmax Inc.

ticker: NMAX


text: In addition, the Company engages third parties to assist in assessing, enhancing, implementing and monitoring the Company's cybersecurity risk-management programs. The Company maintains processes to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.

companyName: HYSTER-YALE, INC.

ticker: HY


text: Standards Based Program We use our best efforts to align our cybersecurity risk management with industry best practices, including processes to prevent, identify, assess, treat, monitor, and report on organizational risks. We design and assess our program utilizing tools such as the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these tools as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This covers Company owned and managed systems and technologies, along with those supplied to the organization by third parties.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. As part of such process, we conduct tests of our cybersecurity program on a regular basis that are designed to identify cybersecurity risks associated with our technology environment. We use third-party security service providers and cybersecurity consultants to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats and review our cybersecurity program. Our internal audit team also conducts audits to evaluate the effectiveness of our cybersecurity program and improve our security measures and planning. The results of such reviews are reflected in the cybersecurity risk register and certain members of our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), which evaluates our overall enterprise risk, as well as to the full Board.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: Management of Material Risks and Integrated Overall Risk Management Our comprehensive risk management framework is intended to strategically incorporate cybersecurity risk management across the company, with the objective of ensuring that cybersecurity considerations underpin the decision-making processes at all organizational levels. Our risk management team collaborates closely across various Enterprise-wide business units to continually assess and address identified cybersecurity risks in alignment with business objectives. The CTIO regularly updates the Chief Financial Officer and Chief Executive Officer on material cybersecurity risks and events.

companyName: NORDSTROM INC


text: The Company recognizes the risks posed by cybersecurity threats, including the risk of harm to our customers, our financial condition and results of operations, and our reputation. Following a layered defense-in-depth strategy, the Company utilizes a variety of controls and both internal and third-party resources to assess and manage identified risks. The following components of our information security program address cybersecurity risk management, and have been integrated into the Company's overall risk management systems and processes: • Cybersecurity risks are identified and prioritized for resource allocation using two annual risk assessments: an internal risk assessment utilizing the Federal Financial Institutions Examination Council's ("FFIEC") Cybersecurity Assessment Tool, and a formal risk assessment prepared in conjunction with an external consultant. • A comprehensive set of security technologies constantly monitor our information systems and data, including endpoint detection and response services, intrusion detection and prevention, various filtering technologies, and event correlation technologies that alert management to potential cybersecurity threats. • Skilled internal personnel manage and update cyber defense functions including engineering, configuration, data protection, identity and access management, security operations, and threat intelligence. • Training programs continuously educate employees about cybersecurity risks and protection practices. • Periodic social engineering testing assists management in identifying training needs. • An incident response plan outlines the Company's response to a cybersecurity incident. Periodic testing of the plan ensures readiness and identifies refinements. • Reputable third-party assessors are engage d to conduct various assessments on a regular basis.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Our CISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery. The department, as a whole, consists of information security professionals with varying degrees of professional education, certifications and experience.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: Risks, Threats and Material Incidents As of December 31, 2024, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, we and our third-party providers have been the target of cybersecurity threats and expect them to continue. Notwithstanding the extensive approach we take to address cybersecurity, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A "Risk Factors" - Risks Related to Our Business and Operations - The occurrence of cyber incidents, or a deficiency in our cybersecurity, or the cybersecurity of our service providers, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, regulatory enforcement and other legal proceedings, and/or damage to our business relationships, all of which could negatively impact our financial results.

companyName: JBG SMITH Properties

ticker: JBGS


text: Risk Management and Security The Company's Cybersecurity Policy outlines our guidelines and provisions for preserving the security of our data and technology infrastructure. The more the Company relies on technology to collect, store and manage information, the more vulnerable to severe security breaches the Company becomes. Human errors, hacker attacks and system malfunctions could cause significant financial damage and may jeopardize the Company's reputation. For this reason, the Company has implemented extensive security measures, has prepared instructions in order to mitigate security risks, and has outlined both provisions in this policy.

companyName: XERIANT, INC.

ticker: XERI


text: The Board, as a whole and through its committees, has responsibility for the oversight of risk management, including cybersecurity. The Board has delegated primary oversight of risk to the Compliance & Risk Management Committee, which partners with our Audit Committee to oversee risks related to the prevention, timely detection, and mitigation of the effects of cybersecurity threats or incidents on us. The Audit Committee monitors our Program, including as it relates to financial and reporting systems and controls. The Information Security Team, described below, communicates quarterly with the Audit and/or Compliance & Risk Management Committees to keep them informed about the state of our Program, current and evolving threats, compliance with regulations, and other strategic initiatives. Both committees regularly brief the entire Board on cybersecurity matters discussed during committee meetings.

companyName: R1 RCM Inc. /DE


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the Company's information systems environment. Identified vulnerabilities are classified and scored based on severity, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Avalon faces various cyber risks, including, but not limited to, risks related to the storage of members' information, and security breaches could expose us to a risk of loss or misuse of this information, litigation and potential liability. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security. Additionally, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. The risk assessment is discussed with the audit committee and board of directors on at least an annual basis. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics.

companyName: AVALON HOLDINGS CORP

ticker: AWX


text: Other than temporary disruption to operations that may be caused by a cybersecurity breach, we consider cash transactions to be the primary risk for potential loss. We and our financial institution take steps to minimize the risk by requiring multiple levels of authorization and other controls.

companyName: Gamida Cell Ltd.


text: The Bank's board of directors are responsible for overseeing Peapack-Gladstone Bank's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Peapack-Gladstone Bank's Information Security Officer, Chief Information Officer, and Chief Technology Officer provide reports to the Bank's board of directors regarding the information security program, technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves Peapack-Gladstone Bank's information security program, technology budgets, and strategies annually.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Lastly, we have established a Cybersecurity Incident Response Policy ("CIRP"), which details the steps to be followed to properly respond to, contain, and remediate a cybersecurity incident. The CIRP provides a process for escalating certain cybersecurity incidents to the Board and members of management to facilitate management-level consideration as to whether a cybersecurity incident may be material to the Company and whether public disclosure of the incident is required.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: We have implemented a third-party risk management policy that categorizes the cybersecurity risk posed by third party vendors along with the type of cybersecurity controls we may require of those vendors. These may include employee training, cybersecurity tools like multi-factor authentication, and contractual requirements that vendors maintain appropriate technical, administrative and physical cybersecurity controls. This is in addition to the policies and practices we maintain to monitor access of our information systems and data using our internal staff and third-party vendors. As part of communicating the importance of cybersecurity at an enterprise-wide level, we require that all company employees participate in annual cybersecurity training.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: Our Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: The company's Internal Audit organization audits the Enterprise Risk Management division's oversight of cybersecurity risk management and also independently tests the effectiveness of the company's cybersecurity risk management and governance. Members of the Internal Audit organization participate as non-voting members of both the Technology Risk Committee and the Enterprise Risk Committee.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: (2) A medium severity incident level is defined as incidents that have a moderate impact on business operations or data integrity and might affect internal systems and could potentially lead to limited unauthorized access to sensitive information. A high severity incident level is defined as incidents that pose a significant threat to business operations, data integrity, or confidential information. This level of incident may have legal, regulatory and public relations implications.

companyName: Rayonier, L.P.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Pioneer Green Farms, Inc.


text: The Audit Committee receives updates at least annually from the Chief Information Security Officer (CISO) on the design and progress of key information security initiatives in addition to regular briefings on cybersecurity and management of cybersecurity-related risks from relevant members of management, including the Head of ERM and our CISO. Recent updates from the CISO have focused on the Company's information security strategy, ongoing security assessments and ongoing projects. The Audit Committee is responsible for updating the full Board on identified risks related to cybersecurity.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Our management monitors our websites and online accounts frequently to manage risks associated with cyber-security risks. Our management has more than 20 years of experience working in the technology industry, which enables it to identify cybersecurity risks associated with the Company. Our management communicates with our board on matters of cybersecurity but, has not had to inform them of any breaches thus far.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: We believe our Director of Information Technology and Chief Operating Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Director of Information Technology has more than 25 years of information technology experience across the healthcare industry before joining Nutex Health. The Chief Operating Officer has more than 20 years of in-depth knowledge of our business operations that helps integrate the cybersecurity program into the overall business operations.

companyName: Nutex Health Inc.

ticker: NUTX


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all cybersecurity threats and incidents. For more information on the risks that we face from cybersecurity threats, see "Risk Factors – Risk Factors of General Applicability—Legislatures and regulators continue to scrutinize cybersecurity management and incident reporting." in Part 1, Item 1A of this report.

companyName: Gold.com, Inc.

ticker: GOLD


text: Cybersecurity is integrated into the risk management process for the company through various corporate mechanisms, including quarterly business reviews, annual budget planning, and targeted risk-based engagements.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: As of the date of this filing, the Company has not experienced a cybersecurity incident that has materially affected, or is reasonably likely to materially affect, its business, financial condition, or results of operations.

companyName: Perfect Moment Ltd.

ticker: PMNT


text: In addition, BHE's compliance requirements include the North American Electric Reliability Corporation Critical Infrastructure Protection Standards, the Transportation Security Administration Pipeline Security Directives and the United Kingdom Center for the Protection of National Infrastructure Standards as applicable to each of the companies. These requirements are audited and assessed as mandated by applicable government agencies.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: We have established and maintain an incident response plan that addresses our response to a cybersecurity incident. This plan is evaluated regularly.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats and vulnerabilities. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our audit committee is responsible for evaluating our cyber security program, cyber risk environment, and related risks and, with management, reporting findings and actions under our cyber security program and cyber risk environment to the full board of directors.

companyName: Axonics, Inc.


text: We maintain a cybersecurity program, designed to proactively identify, assess, manage, mitigate, and respond to cybersecurity threats. Our Cybersecurity Organization develops, implements, and maintains this program, which is governed by our global cybersecurity policy. The underlying controls of the cybersecurity program are based on recognized best practices and standards for cybersecurity and information technology and is aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. Cybersecurity is an important and integrated part of our enterprise risk management program that identifies, monitors and mitigates business, operational and legal risks. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: (a) management's internal knowledge of and perceived risks to the IT environment, (b) significant changes to the internal and the third-party vendor IT environments, (c) input received annually from its consultants and external auditors based on its auditor's review of the IT operating environment, (d) management's review of Service Organization Controls (SOC) reports received from vendors housing critical applications, (e) regulatory requirements or operating standards that may directly impact the IT environment, and (f) identification of threats and the evaluation of the probability and likelihood of threats. For any significant risks identified, IT Provider's management is responsible for implementing appropriate measures to monitor and manage these risks, including implementing or revising control procedures, conducting specific consulting projects, and updating systems and processes to ensure compliance.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: of Third-Party Service Providers have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.

companyName: Senmiao Technology Ltd

ticker: AIHS


text: Our Audit and Risk Committee is responsible for the oversight of data security, privacy and cybersecurity related risks. Our Chief Information Officer ("CIO") has a PGDip in Computer Science, an MBA, a Master of Mathematics and over 20 years of experience in senior leadership information technology and cybersecurity oversight roles, including within the retail industry. Our CIO reports to our Chief Operations Officer who also has decades of information technology experience, including with retailers such as Walmart, Inc., Family Dollar Stores, Inc. and Gap, Inc. Under the direction of our information technology department, we have implemented policies and controls in line with the requirements of the International Organization for Standardization and have assessed our cybersecurity maturity levels against the National Institute of Standards and Technology framework to set appropriate standards and guidelines. We monitor and remediate threats through our managed detection and response, and our vulnerability management programs. We provide regular employee communications and mandatory training, periodically review our incident response and breach notification plan, and leverage third-party expertise for testing, assessments and improvements. We have an onboarding and periodic security review process of all third-party vendors who have or will have access to our confidential information. We also have established business continuity disaster recovery plans that are designed to limit downtime and data loss in the event of a security breach.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, data and information protection plans, network security and access controls for certain systems, encryption of data, systems monitoring, cyber insurance and employee training.

companyName: Equillium, Inc.

ticker: EQ


text: The Audit Committee of the Company's Board of Directors maintains oversight over cybersecurity risk, in coordination with the full Board of Directors. The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: TMCC's cybersecurity program utilizes a variety of controls that are designed to identify, prevent, detect, respond to, and recover from cybersecurity threats and events. Those processes and controls include: • dedicated cybersecurity professionals who are responsible for analyzing cybersecurity threats, defining cybersecurity risk policies and standards, implementing controls, monitoring the environment, and responding to cybersecurity incidents; • periodic cybersecurity awareness training for employees and contractors on our policies and emerging cybersecurity threats, including phishing awareness; • internal and independent cybersecurity testing, including penetration testing and tabletop exercises, to assess vulnerabilities of our information systems and evaluate our cyber defense capabilities, technical safeguards and resiliency; • identifying and managing cybersecurity risk of our critical third-party suppliers; • periodic cybersecurity risk assessments for our information systems and applications; • cybersecurity monitoring and response processes employing cross functional teams to identify, assess, escalate, investigate, contain, and remediate incidents; and • incident response and recovery plans.

companyName: TOYOTA MOTOR CREDIT CORP


text: Markel Group is a holding company comprised of a diverse group of companies and investments. Our specialty insurance business, Markel, sits at the core of our company. Markel Group utilizes information technology systems and services, including cybersecurity, provided and/or administered by Markel. Through Markel Group's wholly owned subsidiary, Markel Ventures, Inc. (Markel Ventures), Markel Group owns controlling interests in businesses that operate in a variety of industries. The Markel Ventures businesses are independently managed with respect to their information security and data protection programs.

companyName: MARKEL GROUP INC.

ticker: MKL


text: not aware of any cybersecurity incidents that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: VPR Brands, LP.

ticker: VPRB


text: Our Information Security program has six broad components: Controls & Compliance; Security Operations; Cloud Security; Identity and Access Management; Application Security; and Data Governance. Within each program component, and depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining a vulnerability management policy and disaster recovery/business continuity plans, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, a vendor risk management program, a dedicated cybersecurity staff/officer, active monitoring, detection, prevention, mitigation, and remediation strategies to ensure we are adequately safeguarding and protecting our critical information, routinely conducting audits, vulnerability scans, penetration tests, social engineering simulations, security awareness training, and threat intelligence assessments to ensure that our systems, policies, and procedures are operating as intended. We also engage with a range of external experts to help us evaluate and attest to our risk management systems, including maintaining a certification pursuant to ISO 27001 and conducting periodic third-party audits to maintain our certification.

companyName: Tempus AI, Inc.

ticker: TEM


text: The cybersecurity risk management program includes a comprehensive risk assessment that is applicable to the Fund's operations. This assessment is based on recognized standards for cybersecurity and information technology as set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). It is reviewed and updated at least annually. Internal controls designed to mitigate risks presented in the assessment are tested annually by an independent third party. Additionally, the Manager, on behalf of the Fund, contracts with a qualified third party to perform annual assessments of the Company's cybersecurity risk management program and to perform cybersecurity risk evaluations of selected key vendors. Another third party is engaged to provide day to day IT services which include implementing, monitoring, and maintaining the preventative and detective measures specified as part of the Fund's cybersecurity risk management program.

companyName: Venture Lending & Leasing IX, Inc.


text: One of the functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives updates as needed from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition As of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: ATHENA GOLD CORP

ticker: AHNRF


text: Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") each have over 24 years of information system experience and are primarily responsible for implementing the Cybersecurity Program and managing our information security personnel and consultants. The CIO has served in a variety of information technology leadership positions in the finance industry and holds a B.S. in Electrical Engineering. The CISO served in a variety of cybersecurity operations, cybersecurity architecture, and critical infrastructure cybersecurity enhancement programs in the finance industry, the utility industry and in government and holds a B.S.in Management Information Systems and Decision Sciences.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: The Company has implemented information security programs to, among other actions, assess, identify and manage material risks from cybersecurity threats. These programs include periodic risk assessments, company-wide testing initiatives, periodic phishing tests and annual audits. As the Company assesses its risks and determines how to implement risk management programs, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. The Company also utilizes an independent cybersecurity advisor to provide periodic objective assessments of the Company's capabilities and to conduct advanced attack simulations.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: Management Oversight Our CISO, who reports to our CIO, has overall responsibility for our enterprise-wide cybersecurity activities. The CISO is responsible for establishing the strategy, architecture, policies, procedures and standards related to cybersecurity across our organization. Each business then has a Security Lead, who reports to that business's IT leadership, responsible for the strategy, implementation and operation of that business's cybersecurity program (collectively, our CISO, CIO and the Security Leads are referred to as our "Security Team"). Our CISO holds a master's degree in information systems and has over twenty years of IT experience, including significant experience dedicated to cybersecurity and IT risk management. Having been with Post in various IT capacities since 2012, including approximately five years as the head of cybersecurity, his extensive knowledge of our IT systems and controls is instrumental in safeguarding our digital infrastructure. Our CIO's background encompasses over twenty-five years of IT experience, including many years of cybersecurity and risk management oversight, and numerous years of experience in supply chain and business transformation leadership. This experience includes approximately thirty years in various roles of increasing responsibility at Bob Evans, which Post acquired in 2018, ultimately serving as the CIO of Bob Evans for approximately four years before becoming our CIO in 2022. His broad knowledge and significant experience enable him to have a holistic risk management view across our organization. In addition, members of our Security Team participate in industry specific organizations that allow us to share information about threats and risks facing our industry, share best practices across our industry and work together to find opportunities to strengthen our industry. Members of our Security Team also have established and maintain relationships with governmental entities, which have helped inform our cybersecurity incident response planning and the protection of our IT environment.

companyName: Post Holdings, Inc.

ticker: POST


text: In the ordinary course of our business, we collect, use, store, and transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology ("IT") systems is important to our operations and business strategy. To this end, we have documented cybersecurity policies and standards and we assess risks from cybersecurity threats and monitor information systems for potential cybersecurity issues. These processes are managed and monitored by a dedicated cybersecurity team, including third-party service providers and led by our Head of IT, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we use processes and tools to conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct regular employee training on matters such as phishing and email security best practices, among other topics. In addition, we consult with outside advisors and experts when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: Supporting the D.R. Horton CIO and CSRO is a dedicated cybersecurity team that designs and monitors our cybersecurity control framework as well as implements cybersecurity control systems and solutions. The D.R. Horton cybersecurity team collectively holds the following degrees and certifications: Master's in Cybersecurity, Certified Information Systems Security Professional, Security+, Network+, AQS Certified Cloud Practitioner and Certified Information Systems Auditor.

companyName: Forestar Group Inc.

ticker: FOR


text: The Company also maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through internal management and external service providers. Our cybersecurity risk management and strategy processes are led by our Chief Administrative Officer. This individual has over 30 years of prior work experience in various roles involving managing information systems and security, developing information security strategy, implementing effective information and cybersecurity programs, as well as a degree focusing on computer science. The Chief Administrative Officer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management and participation in the Company's cyber security risk management and strategy processes including the operation of our incident response plan. This management team member routinely discusses trends in cyber risks and our strategy with management and reports to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: The Information Security Team carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Our IT Provider has more than 20 years of experience in the latest technologies and experiences in a variety of network configurations.

companyName: ProtoKinetix, Inc.

ticker: PKTX


text: Our management team has certifications from various organizations, such as ISC2 (Certified Information Security Systems Professional or "CISSP"), Global Information Assurance ("GIAC"), and the EC-Council.

companyName: Stereotaxis, Inc.

ticker: STXS


text: The Bank retains external consultants to assist in the development and monitoring processes for assessing, identifying, and managing cybersecurity incident and threat risk. The Bank engages third-party services to conduct evaluations of security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Bank also requires subcontractors to report on cybersecurity incidents so the Bank can assess their impact. As part of the Bank's vendor management process, the Bank undertakes due diligence of third-party systems with whom the Bank will interact with, including risk profiling and classification, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of all service providers in accordance with a risk profile classification. The Bank reviews vendor performance, relevant technologies utilized by vendors and promotes escalation of any unsatisfactory reviews, as part of Bank's continuous assessment of its vendors.

companyName: Federal Home Loan Bank of Atlanta


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program.

companyName: Lightstone Value Plus REIT II, Inc.


text: e. Application and execution of our risk management framework in the event of a potential issue; and f. Development and execution of an action plan for each potential issue to address risks via remediating, mitigating, accepting or closing the issue.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Our Board of Directors oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. Our Board of Directors receives presentations on cybersecurity issues and developments as needed. Our Board of Directors also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting materiality thresholds, as well as ongoing updates regarding such incident until it has been addressed. The Company evaluates the materiality of a cybersecurity incident based on the overall impact of the event, which depends on a number of factors including, but not limited to, the financial impact of the incident and the type of information involved. At least once each year, our Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President and Chief Executive Officer and General Counsel.

companyName: Farmland Partners Inc.

ticker: FPI


text: We also engage third-party providers to perform periodic risk-based assessments of our cybersecurity programs, and also leverage our internal audit department, supported by third-party technical experts, to conduct periodic risk-based audits of our cybersecurity programs.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a risk-based approach to identifying and overseeing third party cybersecurity risks, including evaluating the cybersecurity processes of service providers and other vendors, and reviewing available security certifications and independent audit reports.

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Legal, the CFO, the CEO, and the IT department, and help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: CHIMERIX INC


text: Cybersecurity risk management is an integral part of Payoneer's control infrastructure and is included as an overall risk in our enterprise risk management program. Payoneer's cybersecurity risk management program is designed to align with industry best practices like National Institute of Standards and Technology (NIST) and Control Objectives for Information Technology (COBIT) which help provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed and services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Risk Committee of the Board of Directors ("Risk Committee") of material cybersecurity threats and incidents. Our cybersecurity team is responsible for assessing our cybersecurity risk management program considering industry best practice and aligning to regulatory requirements and engages with third-party security experts for advisement on cybersecurity risk assessments and system enhancements. In addition, our cybersecurity team provides training to employees on a periodic basis.

companyName: Payoneer Global Inc.

ticker: PAYO


text: The CIO, Security Officer is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity team implements and oversees processes for the regular monitoring of our information systems. In the event of a cybersecurity incident, the cybersecurity team follows a written security incident response runbook, which includes procedures to, among other things, respond to the incident, mitigate its impact, and evaluate and satisfy applicable obligations.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – General Risk Factors – Cyber risk and the failure to maintain the integrity of our operational or security systems or infrastructure, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition or results of operations." in this annual report on Form 10-K.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: Xcel Energy's cybersecurity policies, standards, practices, annual cybersecurity training content and readiness are regularly assessed by third-party consultants. These partners are engaged to perform independent penetration testing and other security related services to assist in the prevention, detection, monitoring, mitigation and remediation of cybersecurity incidents and risks. The results of these assessments are communicated to management and the Board of Directors by the Chief Security Officer.

companyName: XCEL ENERGY INC

ticker: XEL


text: We consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment. In addition, we continue to expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises. Our processes also considers cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers during contracting and vendor selection processes. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), the Company has a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.

companyName: Arhaus, Inc.

ticker: ARHS


text: Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: There have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. The nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business, financial conditions or results of operations. For more information about the cybersecurity risks we face, refer to the Risk Factors in section "Cybersecurity Risks" in Part I, Item 1A, "Risk Factors".

companyName: DATA I/O CORP

ticker: DAIO


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, management oversees cybersecurity assessments to identify potential threats, vulnerabilities, and the potential impact on the business. Management is responsible for establishing cybersecurity policies and procedures that align with industry best practices and regulatory requirements. Management oversees the implementation of systems that continuously monitor the Company's cybersecurity posture and drives a culture of continuous improvement in cybersecurity.

companyName: Cano Health, Inc.


text: Secure Remote Access and secure tunneling: We utilize secure VPNs and tunneling technologies with strong encryption to protect remote access to our systems. These connections are continuously monitored to ensure security and integrity.

companyName: Health In Tech, Inc.

ticker: HIT


text: The CTO has served in various roles in information technology and information security for over 25 years. The CTO holds undergraduate and graduate degrees in Management Information Systems and Masters in Business Administration. Our Chief Executive Officer, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields. Collectively, they have several decades of experience managing risk at our company and in similar organizations or settings and assessing cybersecurity threats.

companyName: CareDx, Inc.

ticker: CDNA


text: Risk Assessment Processes: We conduct regular risk assessments to proactively identify potential cybersecurity threats and vulnerabilities. These assessments involve thorough evaluations of our IT infrastructure, data systems, and processes to pinpoint areas of weakness;

companyName: Jet.AI Inc.

ticker: JTAI


text: Processes for assessing, identifying, and managing material risks from cybersecurity Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.

companyName: SL Investment Fund II LLC


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. Our Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents, if any. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations of April 30, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: U.S. GOLD CORP.

ticker: USAU


text: Risk Governance and Oversight Cybersecurity represents an important component of the Company's overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management (ERM) approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment. While the Board is ultimately responsible for risk oversight, the Audit Committee oversees the overall review of our policies and procedures with respect to risk assessment and risk management, and has oversight of information technology and security matters, which includes cybersecurity strategies and risks, as well as data privacy and data protection (Information Security). The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes, and practices that the Company's management implements to address risks from cybersecurity threats.

companyName: Burlington Stores, Inc.

ticker: BURL


text: In 2023, we conducted an enterprise risk assessment that included an assessment of cybersecurity risk in context with other enterprise-level risks. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors", of this Annual Report on Form 10-K.

companyName: Volato Group, Inc.

ticker: SOAR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director, Information Technology, who has fourteen years of information security experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our Senior Information Security Manager holds CISSP certification, an MSc. in Information Security, and has over 20 years government and industry cybersecurity experience.

companyName: MACROGENICS INC

ticker: MGNX


text: Our cybersecurity risk management program is integrated into our overall risk management program which includes insurance coverage for cybersecurity incidents and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: 10x Genomics, Inc.

ticker: TXG


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Part I, Item 1A, "Risk Factors" - "We rely significantly on information technology to support our operations and if we are unable to protect against service interruptions or security breaches, it could have a material adverse effect on our business, financial condition, cash flows and results of operations," which is incorporated by reference into this Item 1C.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factors captioned "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—The security or operation of our platform, networks, computer systems or data, or those of third parties with whom we work, have in the past, and may in the future, be breached or otherwise disrupted, and any such breach or other disruption could have a material adverse effect on our business and reputation" and "Risk Factors—Risks Related to the Development and Operation of Our aiWARE Platform and other Products—Interruptions or performance problems associated with our technology and infrastructure, or that of our third party service providers, including AWS and Azure, may adversely affect our business and operating results."

companyName: Veritone, Inc.

ticker: VERI


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Evoke Pharma Inc

ticker: EVOK


text: Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: The Company's cybersecurity program includes exercises and trainings designed to sustain a high level of cybersecurity awareness and readiness across our employee base. The Company also has a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents.

companyName: ULTRALIFE CORP

ticker: ULBI


text: We maintain a comprehensive cybersecurity program which is integrated within Caterpillar's enterprise risk management system and encompasses the corporate information technology and operational technology environments as well as customer-facing products. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity risks. We utilize cybersecurity policies and frameworks based on industry and government standards. Our cyber risk management program controls are based on recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO 27001) Information Security Management System Requirements. We partner with third parties to support and evaluate our cybersecurity program. These third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing, consulting on best practices, bug bounty programs and others. We also consume threat intelligence from several paid and non-paid sources.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: Our cybersecurity risks include, among other things: operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws. Although, as of the date of this Form 10-K, Huron has not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under Item 1A. "Risk Factors."

companyName: Huron Consulting Group Inc.

ticker: HURN


text: The Company has not identified any risks from known cybersecurity threats and did not have any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.

companyName: High Roller Technologies, Inc.

ticker: ROLR


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks and incidents to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems we control from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including the public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize cybersecurity incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company maintains several plans designed to prepare the Salesforce Security Response Center (SSRC) with the proper training, processes and capabilities needed to effectively respond to incidents.

companyName: Salesforce, Inc.

ticker: CRM


text: Oversight of cybersecurity is a joint responsibility of our Board of Directors and Audit Committee, with each receiving at least quarterly updates from management on our cybersecurity program, including measures taken to address cybersecurity risks and significant cybersecurity incidents. We also maintain a cybersecurity insurance policy to mitigate risks associated with cybersecurity incidents.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Franklin Templeton and the Advisor recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cyber security procedures. For example, new hires receive mandatory privacy and information security training. In addition, current employees of the Advisor must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related awareness activities and trainings that we conduct throughout the year.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Continuous monitoring of our systems for suspicious activities and providing expert consultation to address and mitigate potential threats.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: Our Board is actively engaged in the oversight of our cybersecurity program. Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks. Our Chief Information Security Officer ("CISO") provides quarterly reports to the Risk Committee regarding information security programs, key enterprise cyber initiatives, and significant cybersecurity and privacy incidents.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: Utilizing e-mail services and cloud based storage systems offered by well-known reputable software and service providers which incorporate cybersecurity protections in their products.

companyName: Transit Pro Tech Inc.


text: The Board's Oversight of Cybersecurity Risk Our Board of Directors oversees management's enterprise risk management process, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Officer (CIO), regularly briefs the Board of Directors on our cybersecurity and information security, and we have processes by which certain cybersecurity incidents are escalated to the Board of Directors.

companyName: NPK International Inc.

ticker: NPKI


text: Cybersecurity Risk Management Program Overview We recognize the critical role that properly managing cybersecurity risk plays in maintaining the trust and confidence of our stockholders, the patients in our clinical trials, our employees, our business partners and our other stakeholders. Accordingly, our cybersecurity program is designed to identify, assess, manage and mitigate material risks from cybersecurity threats through a variety measures, including risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. In collaboration with our third-party information technology service providers, a cross-functional team comprised of representatives from our administrative, finance and legal functions actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We also engage external experts, including information technology experts, other consultants, and auditors to evaluate our cybersecurity measures and risk management processes.

companyName: CervoMed Inc.

ticker: CRVO


text: At the management level, we have established an Enterprise Cybersecurity Council, which includes our CIO, CISO, Director of Information Security, Director of Infrastructure, Senior Security Architects and Engineers, that meets monthly to identify opportunities to further strengthen our cybersecurity risk management program, including with respect to the prevention, detection, mitigation and remediation of cybersecurity incidents. This group is responsible for developing and coordinating risk identification and remediation, performance metrics and policy enforcement and providing guidance to management and oversight bodies. Members of the group have significant cybersecurity experience and hold a number of certifications, including CISM, Certified Information Systems Security Professionals (CISSP), Certified Ethical Hacker (CEH), and Cisco Certified Network Associate (CCNA).

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Cybersecurity risk management is an integral part of the Corporation's enterprise risk management program. The cybersecurity risk management program is designed to align with industry best practices, is generally based on the framework established by the National Institute of Standards and Technology (NIST), provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications and services provided by third parties, and facilitates coordination across different departments of the Corporation. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a threat, including whether the threat is associated with a third-party service provider, implementing countermeasures and mitigation strategies, and informing management and the Board of Directors of material cybersecurity threats, incidents, and impact.

companyName: HNI CORP

ticker: HNI


text: To support the ongoing identification and management of cybersecurity issues, all employees are required to complete cybersecurity awareness training, including social engineering, password best practices, data classification and phishing awareness, with additional training for handling of customer personal information. We also publish a monthly security awareness newsletter along with performing ongoing internal phishing assessments.

companyName: KB HOME

ticker: KBH


text: Education and Awareness Our policies require each of our employees to contribute to our cybersecurity efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through privacy and security trainings to enhance employee awareness of how to detect and report cybersecurity threats and cybersecurity incidents.

companyName: VirnetX Holding Corp

ticker: VHC


text: Furthermore, the Company's vendor management program addresses cybersecurity risks associated with its use of third-party service providers including suppliers, software, and cloud-based service providers. The Company proactively evaluates the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence during contracting, and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted to mitigate risk.

companyName: MP Materials Corp. / DE

ticker: MP


text: As of December 31, 2024, we have not had any known instances of material cybersecurity incidents. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "We and our tenants face risks relating to cybersecurity attacks that could cause the loss of confidential information or other business disruptions" in Item 1A. "Risk Factors" for further information relating to cybersecurity risks.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: The CORC and the ISC both report risks to our Executive Risk Management Committee (ERMC), which is comprised of senior management from our corporate functions and business segments and is responsible for overseeing our enterprise-wide risk management program. The ERMC is chaired by the CRO, who maintains a direct line of communication with the Risk and Finance Committee (RFC) of our board of directors.

companyName: Unum Group

ticker: UNM


text: Our Enterprise Risk Manager is responsible for oversight of the Company's information technology governance and risk program. In this role, the Enterprise Risk Manager provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high level risks receive appropriate attention. The Enterprise Risk Manager is a member of the Company's Risk Management Group and reports to the Chief Risk Officer, who in turn reports to the Board Risk Committee.

companyName: FIRST BANCSHARES INC /MS/


text: At the management level, our Data Protection & Cybersecurity Steering Committee ("DPCSC") meets on a quarterly basis. The DPCSC includes representatives from communications, ethics and compliance, human resources, information technology, corporate audit, legal, risk, privacy, and sourcing. This committee is responsible for overseeing LII's data protection and cybersecurity policies and procedures. These cybersecurity policies and procedures include an IT security and privacy incident response plan to notify the appropriate parties in a timely manner, including our Chief Technology Officer, our Disclosure Committee, and our Board of Directors.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Our CISO oversees our cybersecurity risk management in partnership with our Vice President of Information Technology, Chief Financial Officer, General Counsel, Chief Compliance and Privacy Officer and other members of management. These members of management monitor and are informed of the prevention, mitigation, detection and remediation of cybersecurity incident through their management of, and participation in, the cybersecurity risk management and strategy processes described above.

companyName: NEVRO CORP


text: This includes protecting against known and evolving threats to the security of the Company's systems and information, and against unauthorized access, compromise, or loss of data. The Cybersecurity System is managed centrally, so the same security controls, policies and procedures are implemented across the organization. The Company maintains cybersecurity policies including an Acceptable Use Policy that all system users sign to acknowledge that they understand their security responsibilities. All system users receive security awareness key element of the Company's Cybersecurity System is to mature the system to align with the CIS18 Critical Security Controls security framework. The CIS controls are designed based on real-world data about cyber-attacks, to ensure that the measures are effective against current threats. The framework provides a prioritized set of actions, which enables the Company to focus its efforts on the most effective defensive measures first. This prioritization helps in optimizing the use of resources for maximum impact on security. This strategy provides a structured and effective approach to cybersecurity, helping the Company to protect its assets, comply with regulations, manage risks, and improve its overall security posture.

companyName: OneMeta Inc.

ticker: ONEI