text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. Our full board of directors also receives briefings from management on our cyber risk management program.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our information technology policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. The Company's Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Chief Information Officer has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience and certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and engage external resources and advisors as needed. All employees are required to complete cybersecurity trainings each month through online trainings and simulations.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA

secItem: Item 1C


text: The Company's information technology team is led by the Vice President, Information Technology and Operating Initiatives. He has overall responsibility for developing, implementing, and maintaining the Company's technology strategy, systems, and operations. The current Vice President of Information Technology and Operating Initiatives has been employed in the Company's information technology department for more than 10 years, previously as a Director of IT Development and a Business Analyst. He has a Master of Science in Information Systems Degree from DePaul University of Chicago. The leadership team also includes our Director of IT Infrastructure and Security, who is responsible for managing the Company's cybersecurity strategy, including management of firewalls, identity and access management, endpoint protection, and backups. The current Director of IT Infrastructure and Security has been employed in the Company's information technology department for 13 years, previously as a Technician and Network Administrator. He has a Master of Science in Information Management Degree from the University of Illinois.

companyName: SIGMATRON INTERNATIONAL INC


text: Our information security program is managed through a dynamic enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes. The Bank relies upon a formalized internal Information and Cybersecurity Program (the "Program") to safeguard confidential information, maintain the confidentiality of our customers' data and to ensure the integrity of financial transactions. The Program is approved by the Bank's Board of Directors or a committee thereof annually, and is designed to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage these threats could cause, and assess the appropriateness of policies, standards and procedures used to identify and mitigate risks associated with a material cybersecurity incident. The Program has been designed to align with industry best practices, as well as regulatory guidelines and laws and leverages the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") as its baseline. We are dedicated to cybersecurity and maintaining the trust and confidence of our customers and stockholders.

companyName: Bogota Financial Corp.

ticker: BSBK


text: The Audit Committee periodically receives reports on our cybersecurity risks from our Chief Information Security Officer ("CISO") or his designee at least twice annually. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents or incidents with lesser impact potential.

companyName: Lemonade, Inc.

ticker: LMND


text: As of July 31, 2024, we have implemented the following set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: We have invested in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party vendors and service providers. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: HASBRO, INC.

ticker: HAS


text: The Vice President of IT and Digital, along with the CISO, have developed a strategy and multi-year plan for cybersecurity and regularly update it based on evolving technology trends. The Audit Committee reviews the Company's information security program, including cybersecurity controls, annually (and/or if and when a significant event occurs as defined by its Incident Management policy). The Audit Committee updates the Board annually and upon request of the Board as detailed under the Corporate Governance and Oversight Section.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: We have developed a cybersecurity program based on internationally recognized frameworks, such as SOC-2 compliance for systems and organization controls related to our software development, and maps to standards published by Center for Internet Security (CIS) for our day-to-day operational stance. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include assessing the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the cybersecurity function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: In addition, our board of directors, as a whole and through its Enterprise Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from Busey's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team regarding cybersecurity risks, and Busey's efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. The audit committee of our board of directors bears primary responsibility for the board's oversight of our cybersecurity risk. Periodically management updates our audit committee about various risks facing the Company, of which cybersecurity may be included.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: EIS employs a variety of measures to prepare for and protect against, and detect, contain and eradicate cybersecurity incidents and threats. The preparatory and protective measures EIS has in place include, but are not limited to, password protection, multi-factor authentication, internal and external penetration testing, cybersecurity assessments, industry benchmarking, annual cybersecurity awareness trainings to employees, and social engineering awareness efforts. To detect and prevent Incidents, the cybersecurity program uses automated event-detection technology monitored by the cyber defense team, notifications from employees, vendors or service providers, and other tools. The Company has relationships with a number of third-party service providers to assist with Incident response and containment and remediation efforts, including a forensic investigation firm, insurance providers, auditors, consultants, assessors and various law firms. While the Company maintains a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, the Company operates with, and plans for, the notion that it is impossible to prevent or detect all Incidents, that Incidents will occur, and that the Company will not always be able to detect threats in a timely manner or anticipate and implement adequate security measures. For additional information, see Item 1A. "Risks Related to the Company's Information Technology, Cybersecurity and Data Protection."

companyName: ROBERT HALF INC.

ticker: RHI


text: Executive Reporting Our CISO provides periodic security and risk management updates to executive leadership, the board of directors, and audit committee, ensuring comprehensive awareness and oversight of our security posture. Updates are delivered during quarterly meetings with executive leadership and bi-annual meetings with the audit committee. Topics related to cybersecurity risk, control maturity, incident management, compliance posture, and security improvement initiatives are addressed during these meetings.

companyName: CONNS INC


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Our board of directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our CISO, via our audit committee, which is assigned oversight of cybersecurity risks. In addition, the chair of our audit committee meets with our CISO on a quarterly basis to discuss cybersecurity threats and incidents, as well as the business's approach to responding to them. Our incident response plans also provide that our board of directors and audit committee are also notified in the event of a material cybersecurity incident.

companyName: Snap Inc

ticker: SNAP


text: Our CIIO, with over 40 years of experience in IT and operational technology security, has the primary responsibility of overseeing our cybersecurity risk management program and assessing and managing any material risks related to cybersecurity threats. Our CIIO supervises efforts to help prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information systems personnel and reports produced by security tools deployed in the technical environment.

companyName: Lifevantage Corp

ticker: LFVN


text: The Board of Directors emphasizes and supports the management of risks associated with cybersecurity threats. The Board maintains a collaborative relationship with IT leadership to promote effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: Our comprehensive vendor management program and processes assess all new vendors and segments them into criticality tiers. Our most critical vendors (tiers 1 and 2) are evaluated annually based on requested vendor documents, such as Statements on Standards Attestation Engagements No. 18 (SSAE 18), financial statements, insurance, and due diligence questionnaires. The vendor management team also monitors all news alerts related to all critical vendors.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Our cyber security program includes a cyber incident response policy overseen by our CISO. This incident policy sets forth the procedures to be followed in the event of a cybersecurity event, including escalation, mitigation, and remediation steps. Our cyber security procedures provide criteria for the escalation of cybersecurity events to management of the other operational functions of the Company to participate in determining and executing on the response. Depending on the nature and severity of the incident, we have procedures for escalating notification to our executive officers and Board of Directors.

companyName: Moelis & Co

ticker: MC


text: To more effectively share information and gain consensus regarding cybersecurity initiatives and prevention policies, the Company has in place a Cyber Council consisting of various members of LP senior leadership and the Chief Information Officer. The Cyber Council is chaired by our ISO. The ISO, along with her team, is responsible for leading an enterprise-wide information security strategy, including policy, standards, architecture, processes, and security technology. The Cyber Council (i) meets semi-annually to review and discuss the Company's cybersecurity risks and threats, incident responses, technology, the status of projects to strengthen the Company's information security systems, assessments of the Company's cybersecurity program and the emerging threat landscape and (ii) reports risks related to any material cybersecurity incidents, as needed, to the Board of Directors and the Finance and Audit Committee (FAC) of the Board of Directors.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board and senior management are devoting resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape to respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program will leverage the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our IT security reviews such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices go through an internal review process and are approved by appropriate members of management. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The internal business owners of hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework. We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to our data and systems, including malware and computer virus attacks.

companyName: US NUCLEAR CORP.

ticker: UCLE


text: Our full Board of Directors provides oversight of our cybersecurity risk management program and receives updates on the program from the Senior Vice President and Chief Digital and Information Officer on a quarterly basis, or more frequently as appropriate. Those updates include information regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including any learnings from external cybersecurity incidents.

companyName: Polaris Inc.

ticker: PII


text: Our cybersecurity risk management program also includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Expion360 Inc.

ticker: XPON


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees at Morgan Stanley. These committees include representatives from management of Morgan Stanley as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to the Firm's policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's Non-Financial Risk Committee. The CIO and the Head of NFR CTIS report on the status of Morgan Stanley's Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to Morgan Stanley's Risk Committee, the BOTC and the MS Board. To the extent any cybersecurity incidents relate to the Company, the status of such incidents and remedial actions will be reported to our board of trustees.

companyName: North Haven Net REIT


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Pursuant to our CIRP, when a cybersecurity event has been identified through our detection processes, it is assessed in order to determine whether the event is a cybersecurity incident. Our CIRP designates the primary manager of a cybersecurity incident, describes the parties who should be informed about the incident and outlines the processes for containment, eradication, recovery and resolution of the incident. Depending on the severity and impact of a cybersecurity threat, members of our senior management team and Board of Directors are notified of an incident and kept informed of the mitigation and remediation of the incident.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: Our Cyber Risk Management Policy establishes the framework for our cybersecurity risk management and governance. Our security teams operationalize the Policy across the Company and conduct cyber risk identification, assessment, management, monitoring, tracking, and reporting. Our privacy program is built upon the privacy principles of transparency, purpose, control, security, embedded privacy, and accountability. Our privacy teams are responsible for identifying, managing, and reporting on data protection risks. We leverage the National Institute of Standards and Technology (NIST) frameworks for cybersecurity and privacy. The NIST frameworks help us to align our security and privacy functions and provide a risk management approach across the Company. We annually measure our security and privacy program maturity against these frameworks, and engage a third party every other year to assess the current state against these frameworks. The results of these assessments are discussed with the Board and the Cybersecurity Subcommittee of the Audit Committee. In addition, our Global Privacy Advisory Council, consisting of our privacy leaders, leads the development and implementation of strategies to monitor, manage, and remediate privacy risks.

companyName: Booking Holdings Inc.

ticker: BKNG


text: >administering a series of processes and automated tools to monitor and alert for potentially malicious activities and vulnerabilities on our network, systems, applications and devices, with the ability to terminate processes and isolate potential vulnerabilities;

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently are not aware of risks from cybersecurity threats that are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Chief Financial Officer is responsible to oversight of the Company's risk management program, including technology and cybersecurity risks facing the Company. The Chief Financial Officer receives briefings from management and the third-party service provider about cybersecurity risk management and the overall technology and cybersecurity environment.

companyName: CXJ GROUP CO., Ltd

ticker: ECXJ


text: Key components of our cybersecurity risk management strategy include: • We have a dedicated Information Security team principally responsible for implementing and managing our cybersecurity strategy and controls. • We use industry standard technologies and tools appropriate to our operations which are designed to prevent and detect unauthorized access to, or compromise of, our network, servers, endpoints and external applications, such as multi-factor authentication, malware protection, firewalls and monitoring controls. • We regularly train our personnel on cybersecurity awareness and conduct periodic additional awareness and training activities such as simulated phishing campaigns. • We have in place an Incident Response Plan that governs how we respond to and manage cybersecurity incidents. We conduct regular tabletop exercises to test our response to potential incidents. • We use third-party service providers where appropriate to design, implement and support aspects of our security processes as well as to monitor and test our safeguards.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: Our Board of Directors has tasked the Audit Committee with oversight of enterprise risk management, including cybersecurity risk management. Our CISO or EVP, Chief Product and Technology Officer briefs the Audit Committee on cybersecurity risks at each of the quarterly meetings of the Audit Committee. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. The Audit Committee and/or the EVP, Chief Product and Technology Officer also regularly briefs the entire Board on cybersecurity matters.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: Our cybersecurity risk assessment and management efforts are led by our Director of Infrastructure and Cybersecurity, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our IT Department, including our Director of Infrastructure and Cybersecurity, reports directly to our CEO. Our Director of Infrastructure and Cybersecurity has significant experience in the field of information technology and is an ISACA Certified Information Security Manager (CISM).

companyName: Vitesse Energy, Inc.

ticker: VTS


text: Risk Management and Strategy CACI is committed to maintaining a robust cybersecurity management and oversight program to mitigate cybersecurity risks to our systems and to protect both our and our customers' confidential and sensitive information. We employ technologies and have implemented programs and processes to continually assess, identify, and manage cybersecurity risks as we aim to incorporate industry best practices throughout our cybersecurity program.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: At the management level, our Information Technology Supervisor, who has extensive cybersecurity and information technology knowledge and skills gained from over 30 years of work experience at the Company and elsewhere, heads the Information Technology team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Executive Vice President, Chief Financial Officer and General Counsel. The Company's Information Technology Supervisor receives reports on cybersecurity threats on an ongoing basis and, in conjunction with management and the Cybersecurity Risk Management Committee, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks, lead stakeholder training and engage external cybersecurity resources. Our Information Technology Supervisor works closely with Legal to oversee compliance with legal, regulatory and contractual security requirements. Reporting to our Information Technology Supervisor are a number of experienced information technology personnel. In addition to our internal cybersecurity capabilities, we also regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks along with training. The Information Technology Supervisor also annually attends the Board's Audit Committee meeting, and more frequent meetings if appropriate, to report on any material developments.

companyName: SILVERBOW RESOURCES, INC.


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Specifically, our Security Steering Committee ("SSC"), a cross-functional team of employees chaired by our CIO, is responsible for providing strategic guidance and oversight to Amwell's privacy, risk and security programs and policies. Management has instituted an Information Security Management System ("ISMS"). The ISMS establishes risk-based safeguards that are designed to adequately protect the Company and information acquired through business operations. Amwell maintains its ISMS in accordance with ISO 27001 standards. Amwell is audited annually by a third-party assessment firm that determines the effectiveness of the procedures and processes of its ISMS. Amwell also self-assesses the performance and effectiveness of the ISMS through monitoring, measurement, analysis, and evaluation of controls and control objectives. The SSC ensures the workforce complies with the ISMS policies, procedures and controls through many channels, including annual review of audit and risk assessment results, multifactor authentication, annual employee training and company-wide communications.

companyName: American Well Corp

ticker: AMWL


text: The Committee oversees the Company's cybersecurity risk management and strategy, while management is responsible for implementing the Company's cybersecurity program. This approach ensures that cybersecurity risks are appropriately prioritized and managed throughout the organization.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Finally, the ISMS incorporates an Incident Response Plan, which outlines the procedures that we use to investigate and respond to cybersecurity events and alerts, an Incident Response Policy, which sets out high-level principles and requirements that apply to cybersecurity incident response, and a Business Continuity Plan, which sets out high-level steps in protecting the services, assets and employees of the Company during an event that disrupts business continuity. The Incident Response Plan includes clearly defined roles and responsibilities, including guidance for reporting up the chain to senior management and, where appropriate, to the Audit Committee and the Board. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. The Incident Response Plan comprises four high-level phases: identification and investigation of a cybersecurity incident (including suspected personal data breaches); containment to lessen any ongoing harm; eradication of the root cause; and, post-recovery, supplementation of the cybersecurity incident record with lessons learned in order to improve our incident response capabilities. The Business Continuity Plan defines the procedures to be followed if there is a critical failure that results in operations at one of our corporate offices being suspended, as well as the procedures to be followed if there is a critical failure of our services or underlying hosting infrastructure that results in significant degradation of a service provided, with an aim to operate at existing service levels throughout the duration of the incident.

companyName: Bumble Inc.

ticker: BMBL


text: Our Board of Directors, in coordination with the Audit Committee of the Board of Directors, oversees the Company's overall enterprise risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee is responsible for reviewing and discussing with management our risk exposure to cybersecurity risks and the steps management has taken to monitor and control the Company's exposure to risk. Additionally, the Board of Directors and the Audit Committee of the Board of Directors each receive regular presentations and reports on cybersecurity risks as well as prompt and timely information regarding any cybersecurity incident identified as significant by our CISO or Chief Privacy Officer, as required by the CIRP, and ongoing updates regarding any such incident until it has been addressed.

companyName: ACUITY INC. (DE)

ticker: AYI


text: The DISO also supervises the Incident Response Team ("IRT"), which consists of senior executives, including the Chief Audit Officer, Chief Risk Officer, General Counsel, and representatives from Operations, Accounting, and Communications. Upon detecting an incident, the IRT promptly convenes to assess its severity, categorizing it as low, medium, or high. The response protocol follows the Cybersecurity and Infrastructure Security Agency ("CISA") Cybersecurity Incident and Vulnerability Response Playbook (November 2021) and incorporates best practices outlined in the NIST Special Publication (SP) 800-61 Rev. 2: Computer Security Incident Handling Guide. The IRT has procedures and escalation protocols to escalate significant cybersecurity matters to the Executive Committee, the RMC and/or full Board, as deemed necessary.

companyName: NBT BANCORP INC

ticker: NBTB


text: Risk Management and Strategy NTIC's processes for assessing, identifying, and managing cybersecurity threats have been integrated into its overall risk management processes. The information provided by these processes facilitates management's ongoing assessment of NTIC's cybersecurity risk environment and provides current and accurate information regarding cybersecurity risks to management, the Audit Committee and Board of Directors to allow appropriate management of such risks through remediation or other risk mitigation activities.

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: Management and Strategy have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process.

companyName: NEPHROS INC

ticker: NEPH


text: Our CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of our ISP. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another later of defense will attempt to compensate. Our ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls. We periodically execute table top exercises as a part of our ISP program.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: The Company's team responsible for developing and executing our cybersecurity policies together with our CL&AO, including our Director of Cybersecurity and Director of IT Infrastructure and Operations, are individuals with formal education and degrees in information technology or cybersecurity, experience working in information technology and cybersecurity, including relevant industry experience in security related industries, or a combination of both education and experience. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity-related topics. The CL&AO is responsible for providing quarterly updates to the Board's Audit Committee regarding the effectiveness of the Company's cybersecurity program and any material cybersecurity incidents that may arise.

companyName: Kimball Electronics, Inc.

ticker: KE


text: To implement our policy, we maintain a comprehensive IR process containing detailed information on points of contact, response procedures, and training. We perform an annual security incident response exercise to test the effectiveness of the incident response process we have established. The annual test consists of scenario-based tabletop exercises that involve members of the IRT and cover specific types of incidents. These exercises also provide a mechanism to train personnel with security incident response duties to understand the roles, responsibilities, and procedures they have within the plan. In addition, we conduct regular security awareness trainings for all of our employees, and carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.

companyName: INSTRUCTURE HOLDINGS, INC.


text: Our cybersecurity awareness program provides training for all global employees at onboarding and subsequently three times every year. In 2024, across our organization, employees completed over 8,943 training classes related to cybersecurity. Additionally, in 2024, to elevate cybersecurity awareness, we also conducted live training as part of our Employee Development program, sent monthly phishing tips to all employees and provided weekly communications during October, which is cybersecurity awareness month.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: Our cybersecurity risk management and strategy processes are led by our CIO. Our cybersecurity team has experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments.

companyName: Arhaus, Inc.

ticker: ARHS


text: The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, employee and customer data. Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. Our team maintains processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management approach. Our team regularly reviews significant risks to our Company, including significant cybersecurity risks and the potential for future cybersecurity incidences. Through these reviews, we discuss the identified risks, describe the likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team, continuously monitoring and identifying potential threats with the ability to take immediate mitigation actions when required. In addition to these services, we conduct periodic network penetration tests conducted by an independent third-party.

companyName: CARRIAGE SERVICES INC

ticker: CSV


text: Industry standard frameworks including International Organization of Standardization (ISO)/27001 and National Institute of Standards and Technology (NIST) are the foundation of the Program, which includes but is not limited to the fundamental security principles of least privilege access, event monitoring, vulnerability management, education, third-party risk management and incident response. The Program leverages external subject-matter experts that assist with identifying and remediating security risks present in our environment through threat hunting and vulnerability/control testing with a focus on the latest attack vectors. These external experts bring to bear risk mitigation tactics based on current threats observed across multiple organizations with similar risk profiles.

companyName: TELEFLEX INC

ticker: TFX


text: For additional information on our cybersecurity risks, see " The degradation, failure or misuse of the Company's information systems could cause a disruption of services or improper loss, use and disclosure of personal data or other confidential information, resulting in increased costs, liabilities or loss of revenue. " in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Liberty Media Corp

ticker: FWONA


text: Our board of directors recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: The Company's information security organization seeks to employ cybersecurity best practices, including implementing new technologies to proactively identify and monitor new vulnerabilities and reduce risk, conducting due diligence of third-party vendors' information security programs, maintaining security policies and standards and regularly updating and testing our response planning and protocols. The information security organization also works in partnership with our Internal Audit function to identify cybersecurity risks and review cybersecurity-related internal controls with third parties as part of the overall internal controls process. The information security organization also gains valuable information to improve our threat and risk awareness capabilities as a member of an industry information sharing and analysis organization, which provides strategic and tactical information sharing channels. Additionally, employees are provided mandatory cybersecurity awareness training on an annual basis, which includes information about how to identify and report cybersecurity concerns and incidents. The information security organization also conducts phishing simulations and testing scenarios through tabletop exercises and assessment activities, to help ensure compliance with our cyber policies and procedures. We maintain a cybersecurity insurance policy and have retained relevant incident response services. Additionally, we maintain an offensive security team that works both independently and with third party cybersecurity professionals to conduct security assessments of our enterprise-wide cybersecurity practices, including penetration testing, and identify areas for continuous improvement within the information security program. The Company is a member of the Retail and Hospitality Information Sharing and Analysis Center, which provides additional intelligence associated with threats pertaining to our industry.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: These processes are integrated into the Company's overall risk management program and systems, as overseen by the Board, primarily through the Audit Committee.

companyName: CorMedix Inc.

ticker: CRMD


text: Currently, we rely on an established major incident management and communication process to address any potential cybersecurity incidents. This established process includes the use of third party partnerships to make available the distinct skill sets needed to assist in properly responding to any cybersecurity threat. We have established defined response procedures to effectively address any cyber threat that may occur regardless of the safeguards in place that minimize the chance of a successful cyberattack. The response procedures are designed to identify, analyze, contain and remediate such cyber incidents expeditiously. These procedures and approach to safeguard our information and assets will be continuously monitored by management and updated to evolve with the current cyber landscape in alignment with the ISO 27001 standard mentioned above.

companyName: JOINT Corp

ticker: JYNT


text: Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that cybersecurity risk exposures are monitored, establishing appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our Board of Directors, including through the Audit Committee. Our Senior Vice President and Chief Information Officer ("CIO"), who has over 30 years of industry experience, leads our cybersecurity program and is supported by our Information Security Officer and team members holding relevant certifications. The CIO reports to the Audit Committee on cybersecurity risks at each of its quarterly meetings. These reports include assessments of cybersecurity risks, the current and emerging threat landscape, updates on any incidents, and reports on our investments in cybersecurity risk mitigation and governance.

companyName: HIBBETT INC


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third-party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third-party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We may also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: FITLIFE BRANDS, INC.

ticker: FTLF


text: At December 31, 2024, risks from cybersecurity threats, including those arising from any previous cybersecurity incidents, have not materially impacted our business strategy, results of operations, or financial condition. Management has evaluated known cybersecurity incidents for potential materiality and disclosure using formal, documented processes and has determined that there have been no material cybersecurity incidents, either individually or in aggregate. We acknowledge that future cybersecurity incidents could potentially have a material adverse effect on our organization, despite our efforts to prevent or mitigate such events. For additional discussion regarding cybersecurity risks, see "Cybersecurity Risk" in Risk Factors on page 19.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our Senior Director of IT, and our Chief Financial Officer, and Treasurer, or the CFO.

companyName: Y-mAbs Therapeutics, Inc.


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee of the Board, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. Management provides regular updates to the Audit Committee of the Board regarding risk assessments, developing threats, and the current and planned cybersecurity strategy, and promptly provides notification of significant attacks or breaches as part of the Incident Response Plan. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: XOMA Royalty Corp

ticker: XOMA


text: The Corporation works closely with its internal auditors to assess, identify, and manage cybersecurity risks. In addition, the Corporation engages with third party cybersecurity specialists to provide an independent assessment of the Corporation's cybersecurity programs and to prepare a 3-year plan to maintain compliance and operational excellence. Management periodically reviews the 3-year plan and modifies it in response to changes in the threat landscape or otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" above for more information.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: Our CTIO is part of the risk management function, reporting directly to our Chief Executive Officer ("CEO"). Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly and summaries of key issues discussed and actions taken are provided to the Risk Committee.

companyName: Kearny Financial Corp.

ticker: KRNY


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations. See "Risk Factors—Risks Related to Our Business and Properties—Cybersecurity incidents or other technology disruptions could negatively impact our business, our relationships, and our reputation."

companyName: Broad Street Realty, Inc.

ticker: BRST


text: Theriva has not, to date, been subject to any cybersecurity incidents resulting in a material adverse effect on the Company; however, future cyber incidents may occur and the Company has implemented processes to manage, mitigate, and respond to cybersecurity threats. We maintain policies and controls over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with third-party information technology ("IT") providers leveraging third-party technology and expertise. These partners, including consultants and other third-party service providers, are a key part of Theriva's cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response,, and cyber risk advisory, assessment and remediation.

companyName: Theriva Biologics, Inc.

ticker: TOVX


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act 12 CFR 364, Appendix B, integrating people, technology, and processes. The program includes company-wide employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management and incident response. Juniata's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse its systems or information. The information security program is periodically reviewed by the Company's SVP/IT Manager and ISO with the goal of addressing changing threats and conditions.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves.

companyName: EASTMAN KODAK CO

ticker: KODK


text: The Company's cybersecurity policy outlines every level of protection put in place to safeguard sensitive data as well as company technology assets, including threats and vulnerabilities posed from our interactions with suppliers and third-party service providers. These layers of protection include physical, local, and network layers as prescribed by standard information technology guidelines. The cybersecurity policy also contains procedures for responding to incidents that may threaten the security of Company systems and/or network, which include multiple layers of protections using current security measures and applications. The effectiveness of our security policy and procedures are tested frequently with periodic effectiveness reports shared with senior management and the Audit Committee to facilitate their risk oversight responsibilities.

companyName: Abacus Global Management, Inc.

ticker: ABX


text: For control efficacy, the cybersecurity program leverages a variety of metrics and measurements to demonstrate whether the control objectives are being consistently achieved within the target range. Monthly security operation ("SecOps") reviews are utilized to monitor metric trends and root causes to determine potential capability improvements. The monthly SecOps reviews and related actions are aggregated into a subset of key metrics reviewed quarterly by the Board of Directors.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: The cybersecurity incident did not result in a misstatement to the interim consolidated financial statements previously filed or included in this Annual Report on Form 10-K. In addition, while we cannot presently quantify the full extent of remediation and legal expenses associated with this cyber-attack, we do not believe the incident has materially affected or is reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: Our Senior Director of Information Security reports to our Chief Information Officer and is responsible for leading our enterprise-wide information security team. The team focuses on developing and implementing strategies, processes and response plans to protect the confidentiality, integrity, and availability of our assets. Our Senior Director of Information Security has prior experience as a chief information security officer and over 25 years of experience in Technology and Security. Our security team also includes members who maintain industry security certificates. Our team is additionally supported by third parties to assist in the operations of our program, compliance audits and security penetration testing.

companyName: Envista Holdings Corp

ticker: NVST


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: We separately operate an enterprise risk management ("ERM") program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: The Company has also established a management-level Technology Risk Management Committee, which includes leaders from finance, legal, operations, quality & compliance, and information systems & informatics, who are responsible for overseeing the execution of high-risk incident response and mitigation plans. This committee actively reviews technology strategies, physical and cybersecurity threat assessment, and emerging issues and related initiatives. It is also responsible for evaluating the materiality of information for SEC filings and, as required or as otherwise appropriate, coordinates with the Company's Materiality Committee to support timely disclosure of relevant information.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: We use a combination of technology controls and human oversight to actively monitor and protect our network and systems. In the event of a cybersecurity incident, we have an incident response plan which sets forth a framework for reporting and documenting such incidents by our cybersecurity incident response team. This same framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents promptly. Cybersecurity incidents are reported to our Vice President of Information Technology, and critical events are reported to our CEO and our Chief Legal Counsel. In the event a cybersecurity incident is determined to be potentially material, the incident is reported in a timely manner to our Board of Directors as part of their cybersecurity oversight.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: Our internal audit team assesses the effectiveness of our internal controls relating to cybersecurity. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics. For example, we conduct tests that help discover potential vulnerabilities, including external penetration testing and tabletop and other exercises, to evaluate our core information systems and cybersecurity practices that enable improved decision-making and prioritization, as well as to promote monitoring and reporting across compliance functions. As part of our overall risk mitigation strategy, the Company also maintains cybersecurity insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related incidents.

companyName: COCA COLA CO

ticker: KO


text: Our cybersecurity program is managed by our SVP, Security Engineering, who reports to our Chief Business Affairs and Legal Officer. Our SVP, Security Engineering, has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Our information security program encompasses partnerships among teams that are responsible for cyber governance, prevention, detection and remediation activities within our cybersecurity environment. Team members have relevant certifications, educational and industry experience, including experience holding similar positions at other large technology companies. The information security teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings. Our information security leadership reports directly to the Audit Committee or the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. We also maintain an escalation process to inform senior management and the Board of Directors of material issues and make determinations with respect to any required disclosures.

companyName: Match Group, Inc.

ticker: MTCH


text: Our Chief Technology Officer ("CTO") is responsible for cybersecurity within our company, including information technology risks, controls, strategies and procedures. The Cybersecurity Subcommittee of the Board of Directors oversees cybersecurity for our company and meets with the CTO at least quarterly to discuss the status of cybersecurity efforts as well as any security incidents. Cybersecurity Subcommittee materials are provided to the Audit Committee as well as the full Board of Directors. The Board of Directors believes that a strong cyber strategy based on industry accepted best practices is vital to protect our business, customers and assets.

companyName: JOINT Corp

ticker: JYNT


text: Our Chief Security Officer ("CSO") reports to our Chief Operational Officer and President of the Bank and leads the Company's overall cybersecurity function. Our CSO provides periodic updates on our cybersecurity risk management program to the management-level Operational and Compliance Risk Committee ("OCRC") and Executive Committee ("EC"). The Operational and Compliance Risk Committee of our Board of Directors also receives periodic reports from our CSO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.

companyName: SLM Corp

ticker: SLM


text: As part of our overall risk management approach, Lumen prioritizes the identification and management of cybersecurity risk at several levels, including oversight by Lumen's Board of Directors, executive commitment and employee training. Lumen's Risk and Security Committee, comprised of independent directors from its Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, the Risk and Security Committee, which meets quarterly, (i) receives periodic reports from Lumen's Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews cybersecurity risk assessments from information security, privacy, and internal audit management teams, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, the Risk and Security Committee provides reports to the full Board regarding matters recently discussed by the Committee, which enables the full Board of Directors to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.

companyName: Level 3 Parent, LLC


text: Korn Ferry has been certified by the British Standards Institute (BSI) to ISO/IEC 27001 and ISO/IEC 27018 for our key technology platforms and processes across global operations.

companyName: KORN FERRY

ticker: KFY


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, and controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Marpai, Inc.

ticker: MRAI


text: Ashland also maintains a similar risk-based approach to its third-party vendor management program including identifying and overseeing cybersecurity risks that such third parties may present. As part of this program, the Company, imposes additional scrutiny for vendors that may handle personally identifiable information (PII) data or trade secrets.

companyName: ASHLAND INC.

ticker: ASH


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the risk factor above entitled "Cybersecurity breaches and improper access to or disclosure of our data or user data, or other infiltration, hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business."

companyName: Pactiv Evergreen Inc.


text: Cybersecurity risk is a significant operational risk facing our business. Cybersecurity risks result from intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our clients' or third parties' operations, systems or data. Cybersecurity risk management is an integral element of the Company's overall risk management strategy.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Our IT cybersecurity team maintains an incident response plan designed to respond to potential cybersecurity threats, such as security breaches and cyber-attacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate significant cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We conduct tabletop exercises for tactical response readiness, perform regular security scans of our environment both from an external and internal perspective, as well as work with a qualified third-party vendor to perform penetration tests of our environment. These penetration tests are focused on specific objectives to assist us in managing our cybersecurity threat risks. Any identified risks are included in our overall risk management program, which we validate on a regular basis.

companyName: A10 Networks, Inc.

ticker: ATEN


text: For additional information regarding how cybersecurity threats have affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see Part I, Item 1A, "Risk Factors—General Risk Factors—Interruption, interference with, or failure of our information technology and communications systems could hurt our ability to effectively provide our products and services, which could harm our reputation, financial condition, operating results and cash flows".

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target, such as GrabAGun, may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: COLOMBIER ACQUISITION CORP. II


text: Aurora's Information Security team reports to and is led by our Vice President, Head of Security Engineering, who is responsible for structuring and driving all cybersecurity initiatives at Aurora. This individual regularly reports cybersecurity progress to our Board of Directors, as well as senior leadership across the Company.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: Senior leadership, including our CEO, who also has relevant experience in cybersecurity matters, regularly brief the Board of Directors on our cybersecurity and information security initiatives, and the Board of Directors is apprised of cybersecurity incidents deemed to have a material business impact.

companyName: TUCOWS INC /PA/

ticker: TCX


text: Our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected the Director of IT, Head of Resource Management, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD


text: The Company's cybersecurity program has direct involvement from senior management and all employees. Our business operations and relationships with our customers are reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business.

companyName: ENDI Corp.

ticker: ENDI


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Company's Cybersecurity Program and material risks from cybersecurity threats at the Audit Committee's quarterly meetings. Such reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident.

companyName: Main Street Capital CORP

ticker: MAIN


text: Our cybersecurity program includes the assessment, identification and management of material risks from cybersecurity threats (as defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, our annual enterprise risk management assessment considers risks from cybersecurity threats alongside other risks as part of our overall risk assessment process. In addition, we engage with consultants, internal and external auditors and other third parties to gather certain insights designed to identify and assess material risks from cybersecurity threats, their severity and potential mitigations. We also employ a range of tools and services, depending on the environment, including network and endpoint monitoring, malware detection, vulnerability assessments, cloud penetration testing, threat hunting and incident responsiveness, as well as tabletop exercises, to inform our cybersecurity risk identification and assessment. As part of our cybersecurity program, we maintain an incident response plan that includes processes to assess the severity of, escalate, contain, investigate and remediate cybersecurity incidents. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Aircastle LTD

ticker: AYR


text: 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Relation to our Business, Strategy, and Industry" in Report.

companyName: Massimo Group

ticker: MAMO


text: The Bank's Cybersecurity Incident Response and Business Continuity Programs are inclusive of cyber resiliency, business continuity and disaster recovery strategies to help mitigate the impact of a cybersecurity incident across all business lines. Management Role and Board Oversight.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: In an effort to continually share threat intelligence and increase awareness of cybersecurity threats, routine communication to employees is conducted to highlight internal control requirements, common cybersecurity threats and schemes. Our incident response team members also participate in the annual Financial Services Information Sharing and Analysis Center tabletop cybersecurity tabletop exercises.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Third-Party Risk we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes regular assessments by our Chief Operating Officer. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Biostax Corp.


text: Third Party Risk Management Program The Information Security third party risk management program is a piece of the overarching enterprise third party risk management program. The Information Security team's reviews of third parties include initial and periodic security assessments, documentation and audit report reviews, and consultation on any security enhancements recommended based on the results of the completed reviews.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: We depend on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of our Advisor when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: We take a risk-based approach to assess, identify, and manage cybersecurity risks, including evaluating the likelihood of a cybersecurity incident as well as the impact it would have on our business, reputation, assets, health and safety of individuals and the environment. Our controls are based on the NIST Cybersecurity Framework (CSF). The effectiveness of our controls are evaluated periodically to determine residual risk levels and guide ongoing program improvement and cybersecurity project work. Our cybersecurity framework is evaluated by internal and external experts on an ongoing basis or within the scope of certain projects or engagements. Where we use third-party service providers, we endeavor to ensure that cybersecurity threats are minimized including establishing contractual protections including minimum security and breach notification requirements.

companyName: California Resources Corp

ticker: CRC


text: Role of Management The Company has a Cyber Risk Governance Council consisting of the Senior Vice President Chief Digital and Information Officer ("CDIO"), the CISO, the IT leadership team, and the legal and cybersecurity teams that focuses on cybersecurity and compliance risks. The Cyber Risk Governance Council meets monthly to review cybersecurity risks and related risk management methodologies. Cybersecurity risks are included in the Company's ERM as appropriate based on potential impact and vulnerability assessed according to certain set criteria and defined ERM materiality thresholds. Regular discussions over cybersecurity developments and risk mitigation approaches are held by the Cyber Risk Governance Council with the Chief Executive Officer and the senior leadership team. The CISO has over 27 years of experience in IT in various capacities with over 21 years in cybersecurity, reporting into the CDIO, who has over 20 years of IT related experience.

companyName: Garrett Motion Inc.

ticker: GTX


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: SolarWinds Corp


text: During the year ended, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: WEED, INC.

ticker: BUDZ


text: Board Governance and Management Our board of directors has oversight responsibility for risk management, which it administers directly and with assistance from its committees, primarily the audit committee. Throughout the year, the board and its committees engage with management to discuss a wide range of enterprise risks, including cybersecurity.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: Although we have not experienced any material cybersecurity incidents, because of past immaterial cybersecurity threats and incidents, and what we have learned in responding to those threats, we have increased our cybersecurity program enhancement efforts, including stronger protective controls. As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, for a discussion of risks from cybersecurity threats that could materially affect our business strategy, results of operations, or financial condition, see Item 1A. Risk Factors - "Information technology failures, cybersecurity incidents, or new technology disruptions could have a material adverse effect on our operations" on page 23, which is incorporated by reference into this Item 1C.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: Company's processes to assess, identify, and manage material cybersecurity risks We have developed an ISO/IEC 27001-certified Information Security Management System ("ISMS") designed to enhance our corporate security measures, identify and mitigate information security risks, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by the Company and that of its customers and suppliers in our control. Our ISO certification can be verified on the BSI Group website using certificate number IS 64920.

companyName: TELOS CORP

ticker: TLS


text: Third-party risk management at First Solar includes screening processes to evaluate the information security programs and capabilities of our vendors, including periodic reviews of vendor control assessments, such as System and Organization Controls ("SOC") 2 Type 2 reports, which are supplemented by end-user controls performed by First Solar associates. These processes enable us to oversee and identify potentially material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: • Third Party Assessments of Security Program Maturity. Equifax has a formal process in place to annually assess our security program maturity, which is a measure of our ability to adapt to cyber threats and manage risk over time. Under the oversight of the Technology Committee of the Board of Directors, Equifax engages a third party research and advisory firm to conduct an annual analysis of the maturity of our security program and identify potential initiatives to enhance maturity. On an annual basis, the Technology Committee reviews the results of this analysis with management, including a review of Company performance against relevant benchmarks. • Controls Testing. Equifax has a formal process in place to periodically assess the effectiveness of controls in our security controls framework. These controls assessments are performed by the Security team. Results are regularly reported to management and the Technology Committee and annually to the Board of Directors. • Internal Audit Review. Our internal audit department is responsible for providing the Audit and Technology Committees and management with an independent assessment and assurance regarding the design and effectiveness of the risk management framework related to cybersecurity. As part of the assessment of our cybersecurity program, the internal audit department has a "red team" that regularly performs testing to simulate real threat scenarios that would be carried out by a perpetrator. On a quarterly basis, our head of Internal Audit provides an update to management and the Audit and Technology Committees of the Board on audit activities pursuant to the IT and security portions of the internal audit plan. Our head of Internal Audit reviews the IT and security audit reports issued, including a summary of IT and security audit findings by inherent risk and residual risk rating.

companyName: EQUIFAX INC

ticker: EFX


text: The CSIRP applies to all Company employees and workforce members and provides processes and procedures to properly identify and handle incidents that may affect the safety and/or security of Company resources. The CSIRP covers all potential or realized privacy or security incidents, and is applicable to all Company campuses, divisions, business units, systems, devices, and materials.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: The Audit Committee of our Board of Directors has oversight responsibility for our cybersecurity program. Our Chief Financial Officer and Information Technology leadership provide periodic updates regarding our cybersecurity risk management strategy and related activities to the Audit Committee, and provide other information as needed or requested to facilitate the committee's oversight of our cybersecurity risk. The chair of our Audit Committee, who previously founded and for 19 years led an information technology consulting company that specialized in providing software and systems integration, business process and technical consulting to multinational companies, holds a certification in Systemic Cyber Risk Governance for Corporate Directors. Other members of our full Board of Directors, which also receives periodic briefings on cybersecurity matters, also have received professional education and training related to cybersecurity.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed regularly by internal and external cybersecurity experts. The multifaceted nature of our cybersecurity measures includes aspects of prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. We have established processes to oversee and identify cybersecurity risks associated with the use of third-party service providers, which includes (i) the completion of due diligence before engaging with any third party, (ii) controls for response to mitigate any significant risks, and (iii) assessments and reviews during the course of the relationship. Additionally, we have ongoing partnerships with government and commercial cybersecurity experts to understand emerging cybersecurity threats.

companyName: SYSCO CORP

ticker: SYY


text: Our Vice President of Information Technology earned a Bachelor of Science in Computer Science and Business and a Bachelor of Science in Business and Economics. The Vice President of Information Technology is also a Certified Public Accountant, a Certified Information Systems Auditor, and a Chartered Global Management Accountant. Our Director of Cybersecurity earned an Associates Degree in Computer Network Engineering and is a Certified Information Systems Security Professional.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices. multifactor authentication on internal and external systems;

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: Corporate Governance The Board of Directors is responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk. The Audit Committee has the primary responsibility for overseeing risk management, including oversight of cybersecurity risk management practices and performance. The Audit Committee generally receives reports at each regular quarterly meeting provided by the Chief Information Officer, the CSO, the CISO, and the General Auditor on the cybersecurity management program. The reports focus on the programs and protocols in place to mitigate cybersecurity risks, led by the CSO. Among other things, the reports may include: recent cyber risk and cybersecurity developments; industry engagement activities; legislative and regulatory developments; cyber-risk governance and oversight; selected cyber risk metrics and activities; cyber risk incident response plans and strategies; cybersecurity drills and exercises; assessments by third party experts and Internal Audit; and major projects and initiatives.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Cincinnati Financial Corporation - 2024 10-K - Page 41 Associates involved in this area stay informed of industry trends and evolving threats using various resources including government authorities, peers, continuous education, industry publications, news outlets and other external parties that provide pertinent information. We take administrative, technical and internal accounting control measures to protect against cybersecurity incidents, including actions to monitor for, prevent, detect, mitigate and remediate any incidents that occur. These measures and actions include endpoint controls, multi-factor authentication and general cybersecurity education directed at our workforce and independent agents.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: Our board of directors is responsible for overseeing matters relating to our information technology and cybersecurity risk exposures and the steps our Company takes to monitor and mitigate these risks. The board is briefed semi-annually or as needed by senior management and the Chief Information Security Officer, or CISO, on cybersecurity matters, or more frequently as the circumstances require. To assist the board, we also have established a security and privacy steering committee comprised of members of senior management, including our CISO and our Chief Technology Officer, to oversee data privacy, information technology, and cybersecurity matters. Our CISO has extensive information technology and program management experience, has served in this role for the Company since 2019 and has supported the Company's information security function since 2015.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: Our CISO is responsible for the oversight, implementation and compliance of our cybersecurity program and mitigation of cyber-related risks. Our current CISO has more than 20 years of industry experience and over 5 years of experience with development, training and controls of effective enterprise cybersecurity programs. Our CISO's responsibilities include, but are not limited to, (a) reviewing our enterprise risk register and functional risk register, (b) maintaining adequate processes to manage the identified risks under our cybersecurity program, (c) analyzing logs of cybersecurity threats and vulnerabilities, (d) overseeing prevention, detection, mitigation and remediation efforts and (e) developing, maintaining and ensuring team familiarity with the above mentioned incident response plan. Additionally, we maintain an experienced software and business technology team at the employee level that supports the implementation of our cybersecurity program and internal reporting, security and mitigation functions.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: As a component of the Company's enterprise risk management program, the Company's cybersecurity risk management program outlines the Company's cybersecurity risk management practices and capabilities, including the division of responsibilities for reviewing the Company's cybersecurity risk exposure and risk tolerance, tracking emerging information risks, and ensuring proper escalation of certain key risks for periodic review by the Board and its committees.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. Although the size and scope of our operations is limited compared to larger global operations, we are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial condition and results of operations. In that regard, we have increased our investment in information systems by hiring a Director of Technology in 2024 to replace limited outsourced services previously utilized. We are currently working towards CMMC certification and expect to be ready for a third-party assessment sometime during the 2025 fiscal year.

companyName: VirTra, Inc

ticker: VTSI


text: Our board of directors has the ultimate oversight responsibility for the risk management process and regularly reviews issues that present particular risk to us, including those involving cybersecurity. Our board is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks and mitigate and remediate cybersecurity threats and incidents.

companyName: Powerfleet, Inc.

ticker: AIOT


text: The Risk Steering Committee reports to the Risk Oversight Committee of our Board of Directors at the regular quarterly meetings, or more frequently as needed. The Risk Oversight Committee's duties include, among other things, oversight of risks related to information technology security. The Risk Oversight Committee communicates as appropriate with the full Board of Directors, which is ultimately responsible for cybersecurity risk oversight. Blackbaud, Inc.

companyName: BLACKBAUD INC

ticker: BLKB


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit and Finance Committee, which is comprised entirely of independent directors with information security experience, oversees and monitors the company's information security programs. Additionally, one of our independent directors has a CERT Certification in Cybersecurity Oversight from Carnegie Mellon University Software Engineering Institute. The Chief Information Officer ("CIO") meets with the Audit and Finance Committee regularly to report on risks, mitigation, initiatives, compliance, and outcomes and the Audit and Finance Committee reports relevant information to the full Board.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: While the Corporation believes its cybersecurity program to be appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures we are taking prove to be insufficient or if our proprietary data is otherwise not protected, see " Item 1A. Risk Factors: Operational and Other Factors -- Cybersecurity" in this report.

companyName: EXXON MOBIL CORP

ticker: XOM


text: In addition, our cybersecurity risk management and data strategy processes are further overseen by certain management team members. Together with CISO and our General Counsel and Chief Privacy Officer, these management team members are regularly informed about and routinely monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their ongoing management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Such individuals have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: As part of our cybersecurity incident response plan, we have also established a cybersecurity incident escalation process whereby potential cybersecurity incidents are identified, monitored, assessed, and escalated to our Cybersecurity Disclosure Committee ("CSDC"), as appropriate. The CSDC is comprised of members of our ELT and representatives from our Business Information Systems, including our VP of BIS, Accounting, Legal and Internal Audit departments. The CSDC assists in evaluating qualitative and quantitative factors related to the cybersecurity incident in order to assess the impact of such cybersecurity incidents and to disclose the incident should we determine that the cybersecurity incident is material. The Audit Committee or its designee will be made aware of material cybersecurity incidents in the event they occur.

companyName: SOUTHWESTERN ENERGY CO


text: We may face risks from cybersecurity threats that, if realized, are likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A: Risk Factors— Risks Relating to our Business: We are susceptible to cybersecurity breaches and cyber-related fraud.

companyName: INVO Fertility, Inc.

ticker: IVF


text: Vice President of Human Resources & Administration ("VP HR&A") leads our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: Third Party Risk Management The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, a managed service security provider that monitors certain of the Company's computer networks and third-party hosted services.

companyName: TEJON RANCH CO

ticker: TRC


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE