text: Our Board has delegated the primary responsibility for oversight and review of the Company's cybersecurity program to the Audit Committee. The Audit Committee actively participates in discussions regarding cybersecurity risk exposures and steps taken by management of Cohen & Steers to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Cohen & Steers and align Cohen & Steers' risk exposure with our strategic and business objectives. At least annually, the Audit Committee reviews with the Advisor and Cohen & Steers' CTO the Cohen & Steers' cybersecurity program, including the robustness and efficacy of Cohen & Steers' overall cybersecurity program, steps taken to enhance defenses and security measures in place and its established plans to identify, detect and respond to threats Cohen & Steers may encounter. The Audit Committee also annually reviews and discusses with the Advisor cyber insurance coverage. In addition, as necessary, our Board (or the Audit Committee) receives reports and communications from the Advisor regarding material risks and specific developments that may cover topics such as: the Advisor's computerized information system controls; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices including with respect to peers and third parties.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the Board. The cyber incident response plan also stipulates management assessment of the materiality of each identified threat or incident for the purposes of such reporting.

companyName: Federal Home Loan Bank of New York

secItem: Item 1C


text: Our processes also allow for our Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule.

companyName: Expion360 Inc.

ticker: XPON


text: We have already identified and, in some cases, engaged, third-party experts to allow for quicker engagement if a cybersecurity incident occurs in the future.

companyName: HERBALIFE LTD.

ticker: HLF


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management ("ERM"). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our executive management and board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX


text: Our Board of Directors has delegated primary responsibility for oversight of cybersecurity risk management to the Audit, Finance & Risk Committee of the Board. The Committee receives quarterly reports from the Chief Information Security Officer (CISO) and Chief Risk Officer (CRO), respectively, and reviews them with such officers. These reports are made available to all board members concurrently. The CRO's report includes evaluation of the level of cybersecurity risks and strength of mitigating controls. All board members are invited to attend the portion of the Committee's meetings for review of reports received on risk management from management (e.g., the CRO, CISO, Chief Compliance Officer).

companyName: 1ST SOURCE CORP

ticker: SRCE


text: The CTO provides periodic reports to our board of directors through its audit committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management, including the CTO, and the board of directors through its audit committee.

companyName: Cue Health Inc.


text: The Company engages in processes designed to identify such threats by, among other things, monitoring the threat environment, conducting scans of the threat environment, evaluating the Company's industry's risk profile, evaluating threats reported to the Company, coordinating with law enforcement concerning threats, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities.

companyName: CUTERA INC


text: Security Event Monitoring. A centralized security monitoring team is responsible for the response to alerts generated from a consolidated log collection system. Log collection occurs from various assets and hosted environments. The monitoring tool is third-party provided SIEM, and enables threat identification, detects suspicious activity in the environment using the MITRE Att&ck framework, performs user behavior analytics, and endpoint detection and response. Alerts are investigated to ascertain whether a cyber incident is occurring or not.

companyName: FNB CORP/PA/

ticker: FNB


text: While our Board and Audit Committee oversee cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including by overseeing and executing the risk management strategies discussed above. Our Risk Oversight Committee, which is chaired by our Chief Compliance Officer and comprised of members of senior management, including our Chief Financial Officer, Chief Operating Officer, Chief Strategy and Growth Officer and General Counsel, oversees the management of key enterprise risks, including cybersecurity risks. Senior management reports annually to the Board with respect to our overall enterprise risk management processes. Our CISO presents to the Risk Oversight Committee quarterly to review the status of management's key cybersecurity risk management strategies. The Risk Oversight Committee also receives the quarterly IT Risk Dashboard.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: ENCORE WIRE CORP


text: Our approach to risk management is designed to identify, assess, prioritize and manage major risk exposures, including material risks from cybersecurity threats, which could affect our ability to execute our corporate strategy and fulfill our business objectives. We have implemented and incorporated into our operations, cybersecurity risk management processes and technologies to protect the integrity, availability and confidentiality of our critical systems and information.

companyName: Stagwell Inc

ticker: STGW


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF and AI Risk Management Framework) and seek to follow industry best practices to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Clarus Corp

ticker: CLAR


text: Quarterly cybersecurity awareness training for teammates, monthly phishing simulation testing and other cybersecurity awareness campaigns (e.g., articles, flyers, cybersecurity awareness month); A dedicated security operations team to monitor, analyze, and respond to security threats 24/7; Security governance to manage and maintain security processes; Intrusion, detection, and prevention systems; A vulnerability management program to identify and remediate security liabilities; A configuration management program to harden systems based on industry standards; Industry-leading email security, endpoint detection, and response platforms; Threat intelligence from multiple resources to identify and anticipate emerging threats;

companyName: MONRO, INC.

ticker: MNRO


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: KALTURA INC

ticker: KLTR


text: As a company that deals with large volumes of sensitive customer information and financial transactions, Regions treats cybersecurity risk as a key operational risk within its enterprise-wide risk management framework. As part of this framework, Regions utilizes the "Three Lines of Defense" concept to clearly designate risk management activities within the Company, and this concept is applicable to cybersecurity risk (see the "Risk Management" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K). To manage cybersecurity risk, the Company has designed and implemented an IS Program that is led by our Chief Information Security Officer, who has close to two decades of experience in the cybersecurity field, including leadership roles at multiple financial services organizations. The IS Program includes information security policies, procedures, and controls designed to prevent, detect, limit and respond to cyber-attack or other similar incidents which might impact Regions' technologies, systems, and networks. Regions' IS Program is designed and implemented to substantially align with standards promulgated by the NIST. The Information Security Policy establishes technical, administrative, and physical control directives that are implemented to protect informational assets from reasonably foreseeable risks and threats. The IS Program is supplemented by cybersecurity operations that protect the integrity and availability of information systems. As discussed above, Regions' TPRM function also conducts due diligence and ongoing oversight of the Company's third-party vendors. The Company maintains a Cyber Incident Response Plan, which is part of broader business continuity planning and the Crisis Management Program, to help the Company respond to a possible data breach.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Our Company recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic assessments to identify cybersecurity threats.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: We are committed to protecting our information assets and systems from cybersecurity threats and ensuring compliance with applicable laws and regulations. Despite our commitment to protecting our systems, data and assets, we know that networks and systems are subject to the risk of an extended interruption, outage, or security incident due to many factors including, without limitation: (i) changes to our systems and networks for such things as scheduled maintenance and technology upgrades, or conversions to other technologies, service providers, or physical location of hardware; (ii) failures or lack of continuity of services from public cloud or third-party data center and other service providers; (iii) defects and/or critical security vulnerabilities in software programs; (iv) human and machine error; (v) acts of war and/or nature; (vi) intentional, unauthorized attacks from computer "hackers" or other cybersecurity attacks; and (vii) using the systems to perpetrate identity theft through unauthorized authentication to our customers' customers' accounts. In the following sections we describe how we identify, assess, and manage material risks related to cybersecurity, and how our Board of Directors (the "Board") oversees our cybersecurity program.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: Board of Directors' Oversight of Risks from Cybersecurity Threats Envestnet's Board of Directors maintains regular oversight of risks from cybersecurity threats. In particular, its Compliance and Information Security Committee reviews, assesses, and makes recommendations to our Board about our regulatory compliance programs and information technology security framework, including cybersecurity threats. This includes receiving regular reports from the Information Security team on audits, security issues, changes in risk postures and regulatory matters. The Compliance and Information Security Committee also oversees selection of Envestnet's independent security assessors and reviews their reports. The Committee is authorized to request that any Envestnet director, officer, employee, outside counsel or independent auditor attend a meeting of the committee or meet with any of its members or advisors.

companyName: ENVESTNET, INC.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A.—Risk Factors—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above Governance

companyName: New Mountain Guardian IV Income Fund, L.L.C.


text: Our Vice President of IT, who has more than 25 years of experience in the IT industry, periodically briefs the Board and our audit committee on cybersecurity matters and is responsible for integrating cybersecurity risk considerations into our overall risk management strategy. Our Vice President of IT is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Avid Bioservices, Inc.


text: Our CIO has served in various roles in information technology and information security for over 25 years, including serving as the Head of Cybersecurity for public and private companies. Our CIO holds an undergraduate degree in computer science and has attained a professional certification in Cybersecurity Governance. The Cybersecurity team (including the CIO) has extensive cybersecurity experience and hold multiple certifications across the cybersecurity landscape. Our CEO, CFO, COO, SVP HR and Senior Vice President and General Counsel each hold undergraduate degrees, graduate degrees or professional certifications in their respective fields, and each have significant experience managing risk.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: Our Board of Directors has primary oversight over our risk management activities and has specifically delegated cybersecurity risk management oversight to its Audit Committee, which is comprised entirely of independent directors. At least on a quarterly basis, our information security management provides updates on our cybersecurity activities and to the extent any cybersecurity incidents may have occurred. On at least an annual basis, our information security management team engages in a thorough discussion and review of our cybersecurity practices and procedures that are designed to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our information security management team is led jointly by our Vice President, IT Infrastructure and Cybersecurity and our Director of Privacy.

companyName: NovoCure Ltd

ticker: NVCR


text: Implementation and maintenance of our IT systems has been outsourced to a third-party contractor: Tyler Melton Technologies, LLC ("TMT"), which has over ten years of experience in support of cybersecurity for business enterprises. Supervision of the services provided by TMT for the Company is the responsibility of our Corporate Controller, who is charged with the role of assessing and managing our material risks from cybersecurity threats. Our Corporate Controller reviews the efficacy of our cybersecurity program from time to time as circumstances make it appropriate and annually in connection with the annual audit of the Company's financial statements. Our Corporate Controller renders to the auditor a written report regarding IT general controls, including cybersecurity systems, risk assessment and monitoring practices. The auditor reviews the report in connection with its assessment of the Company's internal controls over financial reporting, and advises Company management if the report reveals flaws in the Company's internal controls. Copies of the Corporate Controller's report are also given to the CEO/CFO and made available to members of the Board of Directors. Copies of the auditor's report are delivered to the members of the Board of Directors, which reviews and is responsible to cause a remediation of any material inadequacies in the controls environment.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner. See Item 1A: Risk Factors above for additional information on risk related to cyber attacks.

companyName: Comstock Inc.

ticker: LODE


text: The Company's information technology resources are managed by the Information Technology Department, which is responsible for the first line of defense – identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (CIO), who reports to the Company's President and CEO. The present CIO has been employed by the Company in the information technology area for three years and was previously the CISO at the Company for two years. The present CIO has over 36 years of IT experience, 13 of that in banking. The CIO holds a current Certified Information Systems Security Professional (CISSP) designation.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Members of the Cybersecurity Committee are appointed by, and serve at the discretion of, the Board. The Cybersecurity Committee consists of at least three members of the Board, all of whom are independent. Each member has a working familiarity and/or experience with cybersecurity, IT strategy, IT development and deployment, or IT risk assessment and management, including information security management.

companyName: MAXLINEAR, INC

ticker: MXL


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors as a whole has responsibility for the oversight of risk management, including as to material risks from cybersecurity threats. In its risk oversight role, the Company's Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology (including cybersecurity) risks. In general, the Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that it collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: INTENSITY THERAPEUTICS, INC.

ticker: INTS


text: Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and periodically reports to our CEO. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company.


text: Training and Awareness Our Company's employees are a critical part of our defense against potential cybersecurity incident exposure. All of our associates and contractors have a responsibility and a role to play by complying with our cybersecurity operational practices and reporting any potential cybersecurity incidents or exposures to our cybersecurity team.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Our management team is responsible for identifying, assessing and managing the material risks facing Columbia, supported by an enterprise risk management program. This program includes an annual enterprise risk assessment, during which interviews are conducted with independent directors and members of senior management seeking participants' judgement and assessment of the material risks facing Columbia. The enterprise risk management program then monitors the risks identified and mitigation efforts underway through periodic meetings with senior management.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: The Company reports on its information security program, including the results of periodic testing, to the Audit Committee of the Board of Directors. Our Board's Audit Committee is responsible for overseeing the Company's cybersecurity and information security procedures. The Audit Committee reviews management presentations concerning cybersecurity-related issues, including information security, technology risks, policies, and risk mitigation programs. The Audit Committee reports matters to the Board of Directors as needed. Our Chief Operating Officer, with the support of our Senior Director of Information Technology and third-party consultants, assesses and manages cybersecurity risk, including preventing, mitigating, detecting, and addressing cybersecurity incidents, if any. Our Chief Operating Officer also works closely with other management positions and external legal counsel to ensure that the Company understands its cybersecurity risk management responsibilities.

companyName: Akero Therapeutics, Inc.


text: The CISO serves as the Chair of the ISC which serves as the steering committee for aligning our overall security strategy with business objectives and is responsible for overseeing the cataloguing of cybersecurity risks and assessments described above. These risks are carried through to our management-level Enterprise Risk Committee which maintains a broader inventory of risk, providing another layer of governance oversight. The third-party security operations center and endpoint managed detection and response service is overseen by the CISO. Management also maintains a Vendor Oversight Committee which provides additional governance over the risks associated with use of third-party vendors, including cybersecurity risk. The Chair of the Enterprise Risk Committee and the Vendor Oversight Committee also reports on its activities to the Audit Committee at least annually.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Our management team, including our Chief Information Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Security Officer experience includes approximately 18 years in different information security roles, including recent roles as Chief Information Security Officer of Unum and Deputy Chief Information Security Officer of MasterCard.

companyName: EVERTEC, Inc.

ticker: EVTC


text: Lastly, our ERM organization, under the supervision of the Chief Risk Officer, leads our efforts to consider and assess threats to us and the risks that result therefrom, including cybersecurity threats and related risks. With support from the Information Security, Legal and the Privacy Office teams, our ERM organization conducts periodic evaluations of our information security posture, manages regular meetings with the executive leadership team to discuss risk levels across the Company, and maintains and monitors risk tolerances and escalation criteria that drive executive and the board of director communications, as further described in our disclosures related to the board of directors oversight of material risks associated with cybersecurity threats.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: The Company's cybersecurity management team is responsible for assessing and managing the Company's material risks from cybersecurity threats, including implementing the Cybersecurity Plan. The team includes the Company's Chief Technology Officer and Vice President of Information Technology (the "CTO"), the Director of Information Security, and two Cybersecurity Analysts, all of whom have an educational background relevant to, professional experience in, or other expertise in cybersecurity. This team is supported by the Company's Information Technology department. The CTO holds a Master of Business Administration and a Bachelor of Science in Electrical Engineering with over 30 years of professional experience in the utility industry with extensive management experience in engineering, operations and information technology. The CTO also assumes responsibilities as the Company's Chief Information Security Officer and its Chief Cyber Security Officer. The CTO has overall management responsibility for the Company's cybersecurity. The CTO reports to the Company's Chief Executive Officer. The Director of Information Security holds a Bachelor of Science in Computer Science and a Masters Certificate in Cyber Security with a concentration in Power Systems and has over 30 years of experience in the information technology field. The Director of Information Security has primary responsibility for the cyber security program including threat and vulnerability management, vendor security posture assessment, Industrial Control System (ICS) and SCADA infrastructure protection at electric substations and natural gas plants, as well as leading the Cyber Incident Response Team. One of the Cybersecurity Analysts has a Bachelor of Science in Information Technology and the other has a Bachelor of Science in Criminal Justice / Computer Crime and Digital Forensics, and the Cybersecurity Analysts have a combined 25 years of experience in various information technology and cyber roles.

companyName: UNITIL CORP

ticker: UTL


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under "Part I, Item 1A. — Risk Factors" in this Annual Report on Form 10-K, including the risk factor titled "If our information technology systems, or those of third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, significant fines or other liability, interruptions of our development programs, harm to our reputation, and other adverse consequences."

companyName: Kodiak Sciences Inc.

ticker: KOD


text: We also monitor and test our safeguards and train our employees on cybersecurity safeguards related to our information technology systems. Our employees are required to take periodic training on cybersecurity and data privacy, and we conduct regular phishing email simulations to enhance awareness and responsiveness to such possible threats. We carry information security risk insurance that provides protection against certain defined potential losses arising from a cybersecurity incident.

companyName: Varex Imaging Corp

ticker: VREX


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes aimed at providing for the availability of critical data and systems, maintaining regulatory compliance, identifying and managing our risks from cybersecurity threats, and protecting against, detecting, and responding to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: maintain a risk register and risk assessment process based on The National Institute of Standards and Technology ("NIST") Cybersecurity Framework (however, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business); use various third-party software testing products and services designed to test and assess the security of our software; closely monitor emerging data protection laws and implement changes to our processes designed to comply with such laws; undertake an annual review of our policies and statements related to cybersecurity;

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our Board addresses cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") is responsible for overseeing our cybersecurity risk management processes, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives regular reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from our information technology and cybersecurity experts. In addition, on at least an annual basis, the Board receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes.

companyName: GENTEX CORP

ticker: GNTX


text: In the event of a cybersecurity incident, including aggregation of a series of related incidents, management is equipped with a well-defined cyber crisis response plan. This plan includes assigning of the roles and duties of the crisis management team, immediate actions to mitigate the impact of the incident, and long-term strategies for remediation and prevention of future incidents.

companyName: MediaAlpha, Inc.

ticker: MAX


text: The Company maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and has integrated these processes into the overall risk management processes. The Company has programs in place intended to address and mitigate the cybersecurity risks that could adversely impact customers and/or reputation and lead to financial losses from remediation actions, loss of business, production downtimes and operational delays. These programs include regular monitoring of outside threats, continuous updating of software to mitigate risk, implementation of a formal policy related to employees that access corporate systems from personal devices, a simplification of infrastructure to minimize servers and migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers. Enhancements have also been made to endpoint protection and remote access protocols, including enhanced encryption, two-factor authentication (2FA) and real-time threat monitoring.

companyName: KOSS CORP

ticker: KOSS


text: Although we have not experienced any material cybersecurity incidents since becoming a stand-alone public company in July 2021, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, including the Cyber Incident, have affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled "Cyberattacks, including the Cyber Incident, and other security incidents have resulted, and in the future may result, in compromises or breaches of our, our IT services provider customers', or their SMB and mid-market customers' systems, the insertion of malicious code, malware, ransomware or other vulnerabilities into our, our IT services provider customers', or their SMB and mid-market customers' systems, the exploitation of vulnerabilities in our, our IT services provider customers', or their SMB and mid-market customers' environments, the theft or misappropriation of our, our IT services provider customers', or their SMB and mid-market customers' proprietary and confidential information, and interference with our, our IT services provider customers', or their SMB and mid-market customers' operations, exposure to legal and other liabilities, higher customer and employee attrition and the loss of key personnel, negative impacts to our sales, renewals and upgrades and reputational harm and other serious negative consequences, any or all of which could materially harm our business" and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer and employee relations, results of operations, financial condition or cash flows" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: N-able, Inc.

ticker: NABL


text: Our Company faces a number of cybersecurity risks in connection with the operation of our business which could have a material adverse effect on our business financial condition, results of operations, cash flows, or reputation. Although, to date, such risks have not materially affected us, we have, from time to time, experienced threats and breaches to our data and systems. For more information about the cybersecurity risks we face, see the risk factors entitled "We face continuing and growing security risks to our information base, including the information we maintain relating to our customers." and "We rely on other companies to provide key components of our business infrastructure." in Item 1A- Risk Factors.

companyName: BROOKLINE BANCORP INC


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, quality audits and communication and reporting structures, among other processes.

companyName: SKINVISIBLE, INC.

ticker: SKVI


text: The Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board is briefed on a periodic basis as to the nature of actions taken to mitigate risks from cyberattacks.

companyName: Castellum, Inc.

ticker: CTM


text: Our management team, including our Director of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes security program development and review, implementation of security tools and software, security risk identification and remediation, incident identification and remediation, as well as managing enterprise risk. In addition, we rely on third party cyber security consultants and legal counsel to supplement our expertise.

companyName: scPharmaceuticals Inc.


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has over two decades of IT experience, including in applications, infrastructure, development, security and governance, and has presented as a featured speaker at numerous IT and security conferences. Our management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The Response Team, including our CIO and other members of our management team, has primary responsibility for assessing and managing our response to cybersecurity incidents.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: Cybersecurity risk management is integrated into the Company's broader enterprise risk management ("ERM") program. The ERM program, led by the Company's Internal Audit and Legal teams, consolidates the collective input of executive management to prioritize enterprise-level risks, develop risk mitigation initiatives and establish monitoring functions. The Internal Audit and Legal teams perform an enterprise risk assessment annually and present the results to the Audit Committee of the Board of Directors. Further, our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") actively participate in the ERM program, including through diligence conducted as part of the broader ERM program.

companyName: GoHealth, Inc.

ticker: GOCO


text: The Company is committed to ensuring the safe operation of its business by means of a dedicated cybersecurity program designed to protect the confidentiality, integrity, and availability of its assets from cybersecurity threats. The Company's customers, suppliers, and joint venture partners also face cybersecurity threats, and a cybersecurity incident impacting the Company or any of these entities could materially impact our operations, performance, and results of operations. New and evolving cybersecurity threats and related risks make it imperative that the Company allocates the appropriate resources to mitigate these risks, adapts to the changing cybersecurity landscape, and responds to emerging threats in a timely and effective manner.

companyName: Andersons, Inc.

ticker: ANDE


text: any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Mercalot Inc.


text: We did not experience any material cybersecurity incidents in 2023. Although we incur numerous costs in the ordinary course of business to address the risks and implement the policies described above, risks from cybersecurity threats did not materially affect our strategy, results of operations, or financial condition in 2023. Although we are deeply committed to cybersecurity, we cannot fully mitigate all technology risks. Cybersecurity threats, including data breaches, ransomware, and similar threats, could materially impact our future results in the future. For further discussion of how any risks from cybersecurity threats may materially affect the Company, including our business strategy, results of operations or financial condition, see Part 1, Item 1A. Risk Factors, which is incorporated by reference into this Part 1, Item 1C. Cybersecurity..

companyName: Pennant Group, Inc.

ticker: PNTG


text: While we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems. Board.

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: Management of Material Risks & Integration into Overall Risk Management Our management team engages with experienced third-party service providers to assist us to develop, implement, and maintain information technology risk management measures. In addition, we have executive management with experience in areas relating to cybersecurity. We also foster a culture of cybersecurity awareness and have incorporated cybersecurity considerations into our decision-making processes. Our management team works closely with our third-party service providers to identify, evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our collaboration with third-party service providers includes threat assessments and consultation on security enhancements. In addition, the Company provides cybersecurity and phishing awareness training to our employees periodically.

companyName: Global Self Storage, Inc.

ticker: SELF


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer and Chief Technology Officer. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and adhering to relevant compliance requirements as well as several relevant degrees and certifications, including undergraduate degrees in information systems and computer engineering, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, and Internal Security Assessor.

companyName: GREEN DOT CORP

ticker: GDOT


text: Joshua Kobza. Mr. Kobza was appointed Chief Executive Officer of RBI effective March 1, 2023. Prior to that, Mr. Kobza served as Chief Operating Officer of RBI from January 2019 to March 2023, as Chief Technology and Development Officer of RBI from January 2018 to January 2019, and as Chief Financial Officer of RBI from December 2014 to January 2018. From April 2013 to December 2014, Mr. Kobza served as Executive Vice President and Chief Financial Officer of Burger King Worldwide. Mr. Kobza joined Burger King Worldwide in June 2012 as Director, Investor Relations, and was promoted to Senior Vice President, Global Finance in December 2012.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: In an effort to continually share threat intelligence and increase awareness of cybersecurity threats, routine communication to employees is conducted to highlight internal control requirements, common cybersecurity threats and schemes. Our incident response team members also participate in the annual Financial Services Information Sharing and Analysis Center tabletop cybersecurity tabletop exercises.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: The IQVIA cybersecurity program employs policies, procedures, guidelines, training, communications, tools, assessments and other methods and resources to identify and manage cybersecurity risks. Our Integrated Information Security Framework ("IISF") defines minimum controls and safeguards used to safeguard proprietary and confidential information. Our IISF is based on relevant industry frameworks and laws, including, but not limited to National Institute of Standards and Technology ("NIST"), Good Practices Quality Guidelines (GxP), Health Information Trust Alliance (HITRUST), the ISMS Family of Standards (ISO 27000 family), Control Objectives for Information Technologies (COBIT), the EU General Data Protection Regulation (GDPR), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The framework is integrated with IQVIA policies, standards, procedures, work instructions, documentation and development and oversight activities. Information is classified into four categories to help individuals apply the right level of controls and safeguards to information, applications and systems. In 2023, we conducted a mapping of the IISF with the NIST framework to make it easier for customers and other stakeholders to understand how IQVIA's cybersecurity program aligns with published frameworks. Our global data centers and IT controls are included in an annual SOC2 Type II attestation program carried out by an independent audit firm who performs control testing and issues reports. Our set of SOC2 controls is aligned with ISO 27001 specification and therefore provides an equivalent level of assurance on a global level. Additionally, our cybersecurity controls are regularly assessed as part of our global Internal Audit plan, and the maturity of our Information Security program is also regularly assessed on at least an annual basis with the help of independent consultants.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the Compensation and Services Agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Chief Financial Officer and Senior Vice President-Financial. These officers do not have formal IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is, required to be made).

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: The Company's cybersecurity risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: Reporting to our CIO, our cybersecurity function is led by our Chief Information Security Officer ("CISO"). The CISO manages a team of cybersecurity professionals and third-party support functions with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.

companyName: HUNTSMAN INTERNATIONAL LLC


text: retaining data security and data privacy legal counsel whose practice focuses on data breach response, information security compliance, and compliance with the data privacy laws in the various jurisdictions in which the Company operates; and utilizing specialized consultants and third-party managed service providers to assist us with projects that will improve the Company's IT infrastructure, strengthen our security posture and cybersecurity incident investigations, and improve our cyber readiness.

companyName: MONRO, INC.

ticker: MNRO


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents have been immaterial. This includes penalties and settlements, of which there were none. For a description of whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business operations and financial condition, see "Risk Factors" in Item 1A.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the section titled "Risk Factors—General risk factors—If our information technology systems or data, or those of any of our third-party partners (such as contract research organizations and clinical trial sites), or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; additional costs; loss of revenue or profits; and other adverse consequences."

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: The audit committee periodically reviews and discusses with the appropriate members of our management material risks relating to data privacy, technology and information security, including cybersecurity, threats and back-up of information systems and our processes for assessing, identifying, and managing such risks, as well as our internal controls and disclosure controls and procedures relating to cybersecurity incidents. The board and audit committee are also provided with reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: Our CISO, who reports to the Chief Financial Officer, leads the company's technology and digital capabilities, including the overall cybersecurity strategy. Our CISO has over 25 years experience working in the commercial sector within the IT and security environments, across a variety of business verticals. Prior to this was in the Armed Forces working in an IT, telecommunications and security capacity. A member of (ISC)2 and CISSP certified, the CISO understands the security and protection requirements needed for areas such as data protection, PCI/DSS, HIPAA, FedRAMP.

companyName: EGAIN Corp

ticker: EGAN


text: We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. However, prior cybersecurity incidents have not been material and are not reasonably likely to have had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal policies, processes, and operations; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors and additional stakeholders, which could subject us to additional liability and reputational harm.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: We take a risk-based approach in implementing and maintaining various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials, products in development and proprietary technologies (IT Systems and Data).

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: In the Closure phase, the priority is to confirm that all necessary containment, investigation, and response tasks have been completed.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Our Chief Information Security Officer, Chief Product and Technology Officer and Chief Information Officer each have extensive experience in the information technology area. In particular, our Chief Information Security Officer has over twenty years of professional experience in the information security area, including as a result of his service as the director of security, a security architect and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC; our Chief Product and Technology Officer has twenty eight years of professional experience in the information security area; and our Chief Information Officer has twenty three years of professional experience in the information security area.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees our risk management program, which focuses on the most significant risks we face. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity. Our Chief Financial Officer or Chief Operating Officer reports on our enterprise risk profile on an annual basis or more frequently as needed. Our Audit Committee also engages with external counsel on legal matters related to cybersecurity incident management and reporting.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are managed by our Director of Information Technology, in consultation with the legal and human resources teams. The Director of Information Technology has primary responsibility for day-to-day management of our cyber risk management program, including monitoring for cybersecurity risks. Currently, the Director of Information Technology role is held by an individual who has over 18 years of cybersecurity, information technology, and systems engineering experience. The Director of Information Technology reports to the Chief People Officer.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: Managing Material Risks & Integrated Overall Risk Management Arcosa has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Arcosa's Chief Information Security Officer ("CIO") and Director of Information Security work closely with the IT department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the CIS Critical Security Controls and National Institute of Standards and Technology ("NIST") frameworks.

companyName: Arcosa, Inc.

ticker: ACA


text: Peapack-Gladstone Bank's board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology and cyber related business impact. This committee provides oversight and governance of the technology program and the information security program. The committee is chaired by managers within the enterprise information technology department and include the Chief Information Officer, Chief Technology Officer, and Information Security Officer. The committee meets quarterly to provide oversight of the risk management strategy,standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Bank's board of directors.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: We employ information technology and cybersecurity technologies that are designed to protect Sabre's technology environment, detect threats, respond to threats and help support operational resilience. These technologies facilitate the identification of threats and vulnerabilities that may exist in the Sabre technology environment. Protective measures are employed to counter threats and mitigate risk, supporting operational resilience of our technology products. These tools include cloud security posture management, workload protection, endpoint detection and response, network firewalls and intrusion detection systems, identity and access management tools, data protection technologies and logging, monitoring, and alerting tools. Accompanying these tools are various processes such as security education and awareness training, security maturity assessments, vulnerability assessments, threat intelligence and hunting, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment. We practice data protection techniques and processes that are designed to treat our customer data with care. We also utilize third-parties, consultants, and auditors to regularly assess our security program. These assessments include periodic security maturity assessments in which third-parties assess security program maturity against established standards and industry benchmarks. We also annually engage a Qualified Security Assessor to conduct payment card industry certification on all applicable products and solutions.

companyName: Sabre Corp

ticker: SABR


text: On behalf of the Board, the Audit Committee provides oversight of our management of cybersecurity risk. The Audit Committee regularly reviews our cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities and compliance with cybersecurity and privacy laws and regulations. Our Vice President, Information Security and Privacy jointly with our Senior Vice President, Chief Strategy and Digital Officer brief the Audit Committee quarterly, and more often, if necessary, on active and emerging cybersecurity threats and efforts to strengthen our defenses against these threats.

companyName: GENESCO INC

ticker: GCO


text: We have established a cybersecurity supply chain risk management program, which is a cross-functional program that forms part of our Enterprise Risk Management program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact select suppliers and third-party service providers with whom we share personal identifying and confidential information. We continue to evolve our oversight processes to mature how we identify and manage cybersecurity risks associated with the products or services we procure from such suppliers. We generally require our suppliers to adopt security-control principles based on industry-recognized standards.

companyName: BOEING CO

ticker: BA


text: In 2023, we were a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. We identified an acquisition transaction candidate in the Fall of 2022, entered into a Business Combination Agreement in December 2022, and consummated the Business Combination on March 4, 2024. Prior to the consummation of the Business Combination, we did not consider that we faced significant cybersecurity risk and did not adopt any formal processes for assessing cybersecurity risk, however, we did maintain certain cybersecurity risk procedures, including utilization of two-factor authentication for accessing the Company's servers which were maintained by a third party IT service provider, and controls for disbursement of funds in the Company's bank account that held the Company's working capital, which included the Company's Chief Financial Officer receiving authorization from either the Company's Chief Executive Officer or Executive Chairman of the Board followed by callback confirmation from the Company's bank in order for funds to be disbursed. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our Offering through the time of the consummation of the Business Combination.

companyName: QT IMAGING HOLDINGS, INC.

ticker: QTI


text: Our Board of Directors (the "Board") addresses cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") has oversight of enterprise risks, including risks related to cybersecurity. In this regard, the Audit Committee reviews and discusses with management the adequacy and effectiveness of our information security, technology and privacy policies and the internal controls regarding these areas. Our Audit Committee receives regular cybersecurity updates about general cybersecurity risks from our CSO and updates about the prevention, detection, mitigation and remediation of cybersecurity incidents from our CSO and CCPO. Cybersecurity updates presented to the Audit Committee are reported to the Board by the Audit Committee Chair. We also have a Cyber Disclosure Committee, comprised of cross-functional leaders including finance, risk, operations and investor relations and led by the CSO and CCPO, that meets to assess certain incidents and makes determinations regarding materiality. Additionally, our CSO and CCPO identify certain cybersecurity risks that are reviewed as part of the enterprise risk management framework and presented to the Board and the Audit Committee on an annual basis.

companyName: ADOBE INC.

ticker: ADBE


text: Our Board of Directors maintains ultimate oversight of the Company's enterprise risk management program, which includes material cyber security risks. Under the oversight of the audit committee and capital allocation and risk management committee of the Company's Board of Directors, and as directed by the Company's Chief Executive Officer, our CIO is responsible for the assessment and management of material cybersecurity risks. Our CIO oversees the Company's cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. The CIO also coordinates with the Company's legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes.

companyName: ASBURY AUTOMOTIVE GROUP INC

ticker: ABG


text: Our Chief Operating Officer ("COO") and our information technology ("IT") department help identify, assess, and manage our cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, evaluating threats reported to us, conducting threat and vulnerability assessments, and performing audits.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Our cybersecurity program is led by a team of cybersecurity professionals. The program incorporates aspects of industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Senior members of our management, including our Chief Information Security Officer and Chief Information Officer, each of whom has over 10 years of experience in various roles involving information technology, including security, auditing, compliance, systems and programming, are responsible for assessing cybersecurity risk. Cybersecurity risk management is performed by the senior leadership of the cybersecurity team as well as members of our legal and privacy teams where relevant. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation and testing of our incident response plan. Additionally, our threat intelligence program issues a semi-annual report briefing to inform the security team about relevant cybersecurity events, significant vulnerabilities and vendor-related incidents.

companyName: Guardant Health, Inc.

ticker: GH


text: Our Head of IT directly reports to, and meets periodically with, our General Counsel to discuss and review our cybersecurity risk management processes, with input from the Company's MSP and vCISO, as appropriate.

companyName: Disc Medicine, Inc.

ticker: IRON


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see " Risk Factors - Risks Related to Our Business and Our Industry" included elsewhere in this Annual Report Governance

companyName: Citius Pharmaceuticals, Inc.

ticker: CTXR


text: security and IT infrastructure management team, responsible for managing our cybersecurity processes, implementing security applications and protocols, monitoring and executing security or network controls, and responding to incidents or threats; cybersecurity training programs and cybersecurity awareness event for employees; incident response plan, including assessing and monitoring potential cyber threats; similar processes or applications to mitigate or manage cybersecurity risk from third-party service providers;

companyName: CarParts.com, Inc.

ticker: PRTS


text: Our CISO leads our information security team and has more than 20 years of cybersecurity experience across four public companies. He is supported by our Vice President of Privacy Compliance, who leads our data privacy team. Our cybersecurity program is supported by other members of our senior management team as well, including our Chief Legal Officer and members of Peloton's disclosure committee. Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process. The CISO also provides updates to Peloton's senior management regarding cybersecurity risks, and meets regularly with Peloton's finance, enterprise technology, disclosure and internal audit teams.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: Risk Identification & Mitigation Cyber risk is incorporated into the Company's larger enterprise risk management practices, which include efforts to identify, assess, rank, treat, monitor and review risks. Cyber risks are assessed no less than annually by the CIO and CISO. Significant findings from these internal assessments are presented to management for incorporation into the enterprise risk management framework, and appropriate measures to mitigate and monitor the identified risks are developed and implemented. Strategic and emergent cyber-related efforts are shared with the wider information technology team and other stakeholders within the business for both informational and execution purposes.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as certain incidents with lesser impact potential.

companyName: AMERICAN AIRLINES, INC.


text: We maintain cybersecurity policies that articulate Atkore's expectations and requirements with respect to topics such as acceptable use of technology and data, data privacy, risk management, education and awareness and event and incident management. We regularly conduct exercises, with the support of outside domain experts, to improve the effectiveness of our processes and we periodically assess our processes against recognized cybersecurity frameworks. Consistent with our position that cybersecurity is the responsibility of every Atkore employee, we regularly educate and share best practices with our employees to raise awareness of cybersecurity threats. Atkore employees participate in monthly training and testing. In addition to training, Atkore conducts table-top exercises as often as twice a year to simulate cybersecurity risk and response scenarios.

companyName: Atkore Inc.

ticker: ATKR


text: As part of the above processes, we regularly engage external auditors and subject matter experts to assess our internal cybersecurity programs and compliance with applicable practices and standards. Since 2021, our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: We have implemented an Information Security Management System (ISMS) Program to secure sensitive data protected by us. This program includes: • Establishing policies governing data security. • Monitoring data access throughout the organization's independent subsidiaries. • Providing continuous security training and awareness. • Establishing controls over devices on the network which are actively tracked, monitored and evaluated for new, missing, or updated software needed to strengthen security on the device, patch known vulnerabilities, or stabilize software or operating system issues. • Protecting sensitive data through encryption techniques. • Designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any incidents from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: In the last three fiscal years, cybersecurity threats have not materially affected us, including our business strategy, results of operations or financial condition. See also, Item 1A, "Risk Factors—Risks Related to an Investment in Us—We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems."

companyName: Pacific Oak Strategic Opportunity REIT, Inc.

ticker: PCOK


text: We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including forensic investigation firms, insurance providers and various law firms.

companyName: OptiNose, Inc.


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Annual Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Annual Report.

companyName: Pyrophyte Acquisition Corp.


text: Effects and Impacts of Cybersecurity Risks As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion on the Company's cybersecurity related risks, see the risk factors titled " We depend on information technology systems and infrastructure to operate our business, and increased cybersecurity threats, system inadequacies, and failures could disrupt our operations, compromise customer, employee, vendor and other data which could negatively affect our business " and other risk factors contained in Part 1, Item 1A of this Annual Report on Form 10-K.

companyName: Treasure Holdco, Inc.


text: We designed a multi-faceted risk-management approach based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and informed by other industry standards and industry-recognized practices to identify and address cybersecurity risks. Our key cybersecurity processes include the following:

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: The Company's information security program is managed by the Company's Incident Response Team, which is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Members of the Incident Response Team have extensive global experience in developing and executing information technology strategies. The Incident Response Team, which includes the Chief Financial Officer ("CFO"), in collaboration with the Audit Committee, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: With oversight from the Board of Directors, NNN's management is responsible for managing all cyber risks and overseeing NNN's security programs. Primary cybersecurity risk oversight has been delegated to the Audit Committee. The Senior Vice President of Information Technology ("SVP of IT") oversees NNN's security programs and its Incident Response Policy and Plan. The SVP of IT reports to the Chief Accounting and Technology Officer, and together, they have a combined industry knowledge for technology and information systems of over 40 years.

companyName: NNN REIT, INC.

ticker: NNN


text: Our IT security team reviews enterprise risk management-level cybersecurity risks annually. The following key risk elements are evaluated: • Insiders – Whether intentional or unintentional, individuals within our Company may cause damage to our systems. We have processes in place to seek to mitigate these threats, including through controls over access to our systems and access to network resources. • External threats – We recognize the risk that hackers, vandals, and saboteurs may seek to gain access to information contained in our systems. We employ multi-layered defense and monitoring to seek to mitigate the risk associated with these threats. The Company also conducts regular periodic training of its employees as to the protection of sensitive information which includes security awareness training intended to prevent the success of "phishing" attacks. • Third-party risks – We also consider and evaluate cybersecurity risks associated with use of third-party service providers. User access to third-party systems is reviewed annually, and we obtain and review a System and Organization Controls ("SOC") 1 or SOC 2 report from key third-party service providers. Key cybersecurity risks and mitigating responses are addressed within our Company-wide policies.

companyName: ASTRONICS CORP

ticker: ATRO


text: The Company has very limited operations, consisting primarily of compliance activities as a public company and minimal real estate rental revenue. The Company has no employees, does not maintain its own bank accounts, and its activities are managed by the Chief Executive Officer with the assistance of outside legal and accounting professionals. The Company does not maintain significant information technology systems, customer data, or proprietary digital assets.

companyName: CANNABIS SUISSE CORP.

ticker: CSUI


text: In conjunction with third-party vendors and consultants, Goldman Sachs performs risk assessments to gauge the performance of the Cybersecurity Program, to estimate its risk profile and to assess compliance with relevant regulatory requirements. Goldman Sachs performs periodic assessments of control efficacy through its internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and "red team" engagements where third parties test its defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. Goldman Sachs uses third parties, such as outside forensics firms, to augment its cyber incident response capabilities. Goldman Sachs and its third-party service providers have a vendor management program that documents a risk-based framework for managing third-party vendor relationships (including those of the Company). Information security risk management is built into our vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: cybersecurity risk management program shall include: assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader enterprise IT environment;

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: Following these assessments, we re-design, implement, and maintain reasonable safeguards, when appropriate, to minimize identified risks; reasonably address any identified gaps in existing safeguards; and continually monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Trust Officer, who reports to our Chief Technology Officer, to manage the risk assessment and mitigation processes.

companyName: Autodesk, Inc.

ticker: ADSK


text: Board recognizes the critical importance of maintaining the trust and confidence of our business partners, employees and clinical trial participants. The Audit Committee is responsible for reviewing our policies with respect to cybersecurity risks and relevant contingent liabilities and risks that may be material to the Company, including risks from third parties and business partners.

companyName: ORAMED PHARMACEUTICALS INC.

ticker: ORMP


text: Management's oversight Cleco maintains a cybersecurity program overseen by its Chief Administrative and Sustainability Officer, EMT, and Audit Committee that uses a risk-based methodology to support the security, confidentiality, integrity, and availability of information. This program is integrated within Cleco's enterprise risk management program, which utilizes the Enterprise Risk Management Committee to collaboratively manage and advance enterprise-wide risk management processes. Cleco's Disclosure Committee, which is comprised of EMT and the Chief Accounting Officer, is the means in which cybersecurity matters are assessed for disclosure requirements. Cleco's EMT sets enterprise risk strategies and makes risk-informed decisions that include the assessment and response to cybersecurity risk. Management engages in quarterly discussions with the Audit Committee regarding incidents of any magnitude experienced during the quarter, strategies and significant risk exposures, as well as the measures implemented to monitor and control these risks. These discussions may include the results of internal and third-party risk assessments and audit results, and management's plans to improve its cybersecurity posture using a risk-based approach.

companyName: Cleco Corporate Holdings LLC


text: Cybersecurity risk management is integrated into our broader risk management framework. We have a security points of contact program, which embeds security experts into product development, services, and IT teams. In addition, a security council, chaired by our CISO, meets monthly to discuss the security program, security incidents, and ongoing program objectives. The council is comprised of senior leaders in product development, operations, security, quality, and services, and helps ensure that security remains a top priority across the enterprise.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: Cybersecurity at our Company is led by our Chief Information Security Officer (" CISO ") and our Compliance and Privacy Officer and overseen by our Board. One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our CISO and our Compliance and Privacy Officer provide periodic reports to the Board regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing and activities of third parties. The current CISO has over twenty years of experience in information technology and security, and his background includes technical experience, strategy and architecture focused roles, cyber and threat experience, and various leadership roles.

companyName: Greenbrook TMS Inc.


text: To help identify and manage cybersecurity risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts the Company and our technology systems. In this regard, we conduct due diligence of significant third-party service providers who will have access to our information technology systems and incorporate cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations. Further, our external auditor reviews our processes designed to control access to our information technology systems as part of its assessment of our internal controls.

companyName: TopBuild Corp

ticker: BLD


text: The Company has adopted standard operating procedures and processes designed to monitor, detect, evaluate and respond to cybersecurity incidents that impact and jeopardize sensitive data stored on the Company's internal systems or on third party systems utilized by the Company. Because the importance and sensitivity of information utilized by the Company varies, the Company applies different levels of protection according to a defined data classification matrix. The Company has implemented a data classification policy to ensure that all data utilized, or housed by or on behalf of the Company, is identified, classified, labeled, properly handled and protected in accordance with its risk profile and as may be required by applicable law. A Data Classification Steering Committee comprised of the Chief Executive Officer (CEO), the President and General Counsel oversees and approves this classification policy. The Company's Information Security team, a group with expertise in cybersecurity that is within the Information Technology function, operating under direction of the Company's Chief Information Officer (CIO), is responsible for monitoring data classification ratings and implementing control solutions to protect data in accordance with the classification assigned. The Company's Information Security team has appropriate experience in information technology roles. The Information Security team also evaluates third party service providers that store sensitive Company data to ensure reputability and the Company reviews service auditor reports annually as may be available. The Company engages third-party services to conduct evaluations of security controls, whether through penetration testing, automated vulnerability scanning, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Company regularly tests defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing operational policies and procedures with third-party experts. The Company also shares and receives threat intelligence with its defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations. Third parties are expected to communicate cybersecurity incidents to the Company within a timely manner.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: Safeguarding the Company's information technology ("IT") systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share is a critical concern. As such, the Company has processes in place to assess, identify, and manage material cybersecurity threats and incidents. The Company's cybersecurity strategy includes policies, procedures, and technology that proactively safeguard its operations against cybersecurity threats. The Company utilizes IT that enables its team to access both operational and financial performance data in real time, while, at the same time, identifying and preventing cybersecurity threats and risks. The Company aims to incorporate industry best practices throughout its cybersecurity processes and its cybersecurity framework leverages internationally recognized standards. These processes incorporate preventative, detective and corrective controls to identify relevant cyber risks and include network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within its network as well as evaluation and monitoring of detected security events. The Company continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats. Continuous monitoring of the Company's networks and systems for threats and vulnerabilities is a key component of the Company's strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats.

companyName: INNOVATIVE SOLUTIONS & SUPPORT INC

ticker: ISSC


text: Further, our risk from cybersecurity threats includes failure in or breach of our operational or security systems or infrastructure managed by third-party vendors and extends to other third parties, which could disrupt our businesses, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs, and/or cause losses.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has the primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has significant global experience in managing and leading IT and cybersecurity teams. Members of the cybersecurity team hold various credentials and certificates with respect to information systems and they participate in continuing education.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Risk Management Strategy. Our cybersecurity program is focused on the following key areas: • Governance. As discussed in more detail below under "Board Oversight of Cybersecurity Risks," the Board's oversight of cybersecurity risk management is supported by the Audit Committee and Compliance and Quality Committee, each of which regularly interacts with the Company's enterprise risk management function, our Chief Technology Officer ("CTO"), Chief Information Security Officer ("CISO"), Chief Legal Officer ("CLO"), and Chief Ethics, Compliance and Risk Officer together with other members of management with responsibility for risk management and cybersecurity. • Collaborative Approach. We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: agilon health, inc.

ticker: AGL


text: We also monitor and test our safeguards and train all our employees on cybersecurity safeguards related to our information technology systems. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic cybersecurity trainings and tests. Further, we are focused on building and maintaining a positive cybersecurity culture through a combination of trainings, educational tools, videos, and other cybersecurity awareness initiatives. Our security training incorporates awareness of cyber threats (including malware, ransomware, and social engineering attacks), password hygiene, the importance of multifactor authentication and our incident reporting process. In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee, identify and monitor material risks from cybersecurity threats relating to potential compromises of sensitive information at our third-party business partners where relevant and we reevaluate these risks periodically. These processes include vetting of certain service providers for security, reliability, and availability; execution of a Business Associate Agreement with relevant providers for compliant management, storage, or processing of PHI if necessary; and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable. In the event a service provider does not have a current and available SOC-2 or equivalent report, we review of the service provider's cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.

companyName: ACCURAY INC

ticker: ARAY


text: We, and our third-party service providers, use information technology to support our global business processes and activities, which exposes us to cybersecurity risks. KDP's overall risk management system includes ongoing cybersecurity risk assessment and reporting, incident management, and a diligence and risk management process for third-party service providers. Employees with network access participate in ongoing phishing, social engineering, and cybersecurity awareness training efforts, and we also conduct periodic tabletop exercises led by external consultants.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: We have implemented processes and procedures for the assessment, identification, and management of material risks from cybersecurity threats. These processes implement both qualitative and quantitative measurements that have been agreed upon with our third-party consultants, our auditors, and integrated into our overall risk management process.

companyName: Allegiant Travel CO

ticker: ALGT


text: The Cybersecurity Risk Management Program is administered through two primary channels: (i) Fortrea led cybersecurity services and capabilities, and (ii) trusted third-party partners delivering cybersecurity services overseen by our Cybersecurity leadership team. Both channels combined deliver the entire Cybersecurity Program, which includes key items such as:

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Managing Material Risks & Integrated Overall Risk Management Castellum strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our IT department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Castellum, Inc.

ticker: CTM


text: Our internal processes mandate the escalation of significant cybersecurity risks to executive leadership, as well as to management and committees responsible for preventing, detecting, mitigating, and remedying cybersecurity incidents. These processes ensure consistent and effective incident handling and response, establishing standards for internal notifications and escalations. Moreover, they outline considerations for external notifications, including disclosure or notification requirements to state and/or federal agencies or affected customers in the event of a cybersecurity incident. This structured approach reinforces our commitment to robust cybersecurity governance and risk management practices.

companyName: Intelligent Hotel Group Ltd.

ticker: ZHJD