text: Identifying, assessing, and managing cybersecurity risk is generally integrated into our overall risk management processes. The Company's internal audit function, with primary oversight by the Audit Committee, assesses key risks facing the organization, which are reviewed and discussed by the Company's management-level risk committee (a multi-disciplinary committee including representation from senior management in the finance, internal audit, and legal functions, among others). The risk committee is tasked with ensuring risks, including those related to cybersecurity, are managed and aligning strategic objectives with an appropriate level of risk tolerance.

companyName: Booking Holdings Inc.

ticker: BKNG


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to BlackRock's Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.

companyName: ISHARES GOLD TRUST

ticker: IAU

secItem: Item 1C


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the risk factors under Item 1A. "Risk Factors" in this Annual Report, including "The Company (and the third parties with whom it works) faces physical security risks, as well as risks related to its information technology systems, data, potential cyber or phishing-attacks, and security incidents."

companyName: TerrAscend Corp.

ticker: TSNDF


text: As part of our overall risk management system, IT management monitors and tests our safeguards and trains our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies and risks through communication and training.

companyName: RxSight, Inc.

ticker: RXST


text: Our cybersecurity governance framework is structured to promote accountability and ongoing enhancement of cybersecurity measures. Management of the cybersecurity program involves cross-functional resources, our Cyber and Technology Risk Committee, an internal multi-departmental committee formed to address cyber and data privacy matters. The cybersecurity program is led by our Chief Information Security Officer ("CISO") who reports to the Chief Legal Officer. The Internal Audit Department monitors and reviews our cybersecurity initiatives.

companyName: EZCORP INC

ticker: EZPW


text: The Company is committed to maintaining a strong cybersecurity posture devoting significant resources to cybersecurity and risk management processes to adapt to the rapidly evolving landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company has designed and implemented cybersecurity policies and procedures for identifying and managing material risk from cybersecurity threats, both internally and related to the use of third-party service providers. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular basis. At the tactical level, our information technology (IT) security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The Company monitors and evaluates our cybersecurity position and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. Additionally, the Company maintains a formal information security training program for all employees that includes training on matters such as phishing, email security best practices and data privacy. To evaluate and enhance our cybersecurity program, it is regularly evaluated by external experts with the results of those reviews reported to senior management and the Audit Committee of our Board of Directors (Audit Committee). We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Mayville Engineering Company, Inc.

ticker: MEC


text: Our Chief Information Officer ("CIO"), who has over 25 years of experience in information technology and security and held pivotal leadership roles in Security at several Fortune 100 companies, has primary responsibility for overseeing our management of cybersecurity risks. Reporting to the Chief Technology Officer ("CTO"), our CIO meets regularly with the CTO, and works cross-functionally with other department leaders, including legal, business, policy, and technical functions, as appropriate, to exchange information related to cybersecurity. Our CIO provides quarterly updates to our Audit Committee on our cybersecurity status, risks, and strategies. These quarterly updates address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, technological trends, and information security considerations arising with respect to our peers and third parties.

companyName: Symbotic Inc.

ticker: SYM


text: Our management and senior IT team, including our Interim Chief Executive Officer, Chief Financial Officer and Operating Officer, Chief Legal Officer, Sr. Director, IT Infrastructure and Operations, and SVP, People & Culture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. This team's experience includes over 40 years in system engineering, risk management, data privacy and compliance monitoring. We also engage an external Data Protection Officer to monitor data collection and security in the European Union.

companyName: Funko, Inc.

ticker: FNKO


text: In the event of a potential or actual cybersecurity incident, we maintain an incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Incident Response Plan ("IRP") and business continuity and disaster recovery plans in the event of a significant cybersecurity incident or disruption. The IRP is tested using tabletop exercises.

companyName: Keenova Therapeutics plc


text: Management meets regularly to discuss cybersecurity risk and to review our cybersecurity program. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports and reporting to our board of directors, testing incident response plans and engaging vendors that provide cybersecurity services. Management participates in cybersecurity incident response efforts by being members of the incident response team and helping direct our response to cybersecurity incidents.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Response and Assessment Policies and Procedures align with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we are in the process of implementing a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan will outline communication responsibilities during incidents of all severity levels.

companyName: NEXGEL, INC.

ticker: NXGL


text: We recognize the critical importance of developing, implementing, and maintaining a robust cybersecurity risk management, strategy, and governance program in order to safeguard the confidentiality, integrity, and availability of our systems and information.

companyName: INSPERITY, INC.

ticker: NSP


text: We continue to invest in cybersecurity and resiliency of our networks and adapt our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A Risk Factors.

companyName: SKECHERS USA INC


text: Our Information Security Management System ("ISMS") is a key element of our information security program, designed to identify, assess, help mitigate, and monitor IT risks across our organization, including information security risks. The ISMS is informed by the structured principles of International Standard- ISO/IEC 27001:2022 (Information security, cybersecurity, and privacy protection), which outlines guidance for the establishment, implementation, maintenance, and improvement of information security management systems. Our ISMS is comprised of processes designed to identify cybersecurity risks, safeguard information assets and preserve the confidentiality, integrity, and availability of information owned, managed and maintained by us. Our ISMS includes formal written policies and procedures, technical security controls, such as automated tools designed to detect and prevent cybersecurity incidents, and programs designed to promote internal and third-party IT risk management, audit management, incident response and security awareness, including employee awareness trainings and other initiatives. Our ISMS includes periodic security audits, vulnerability assessments and penetration testing to proactively identify potential system vulnerabilities. Our ISMS is periodically assessed by third-party assessors and the results of such assessments, including any cybersecurity risks and related mitigations identified, are reported to the audit and risk committee of our board of directors, as described below, and are used by us to improve our ISMS and our broader information security program.

companyName: Alkermes plc.

ticker: ALKS


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: During fiscal year 2025 and through the date of this filing, based on the information available, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Please see Cybersecurity Risks under Item 1A - Risk Factors under Part I of this Form 10-K for more information about risks to us from cybersecurity threats.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Our Director of Information Technology has more than 20 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information technology department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from the University of California, Santa Barbara with a focus on business administration coursework and a Certified Information Systems Security Professional designation from ISC2 Organization.

companyName: BayCom Corp

ticker: BCML


text: Board of Directors has oversight of our enterprise risk assessment and risk management processes, as well as the steps taken to mitigate these risks, including for cybersecurity matters. The Audit Committee of our Board of Directors has oversight of cybersecurity risk assessment and risk management policies as part of its risk management oversight responsibilities, and is responsible for ensuring that the Company has processes in place to identify, evaluate and manage cybersecurity risks, as well as appropriate processes and programs to mitigate cybersecurity incidents if they occur. Significant cybersecurity matters, including those related to incidents, are escalated to the Board of Directors.

companyName: SRx Health Solutions, Inc.

ticker: SRXH


text: We leverage information technology to enable our teams to share best practices, stay informed, adapt to challenges and opportunities promptly, improve the quality of care, mitigate risks, and enhance both clinical outcomes and financial performance. Additionally, we have invested in specialized healthcare technology systems to support our nursing and support staff. Our software and technology in each operation allows our clinical staff to monitor and deliver patient care and record patient information more efficiently, but the use of information systems also introduces cybersecurity risks, including system disruption, security breaches, ransomware, theft, espionage, and inadvertent release of information.

companyName: Pennant Group, Inc.

ticker: PNTG


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing procedures, systems, and safeguards in place to manage such risks.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: Our Chief Operating Officer and General Counsel manage the cybersecurity risk management program. The Vertex Executive Leadership Team has oversight over their management and the program. Our Chief Operating Officer is responsible for managing and mitigating our material risks from cybersecurity threats. His team of information security professionals manage our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Operating Officer has over twenty-five years of leadership experience in global business operations, including information security and compliance. Our General Counsel has overall management responsibility of cybersecurity risks. His team of attorneys and certified risk professional assess cybersecurity risks, assist the information security team with mitigating identified risks, and aligns the management of cybersecurity risks with the management of enterprise risks. Our General Counsel's experience includes over twenty years in positions of leadership in global organizations supervising compliance and risk professionals.

companyName: Vertex, Inc.

ticker: VERX


text: The Program is situated within the Company's information security department, which is composed of multiple teams, including security operations, security architecture and engineering, technology governance, mergers and acquisitions information security, and advisor security. The information security department is led by the chief information security officer, who has primary responsibility for managing the Program. The current chief information security officer has over 20 years of experience in information security.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: If a cybersecurity incident were to occur, we would implement our incident response plan in an effort to contain and mitigate the threat. As part of our incident response plan, our Cybersecurity Incident Response Team (a cross-functional taskforce comprised of senior representatives), would convene to assess the potential impact to our business, including financial reporting requirements and legal implications.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes and internal IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan to respond to cybersecurity incidents; and • a third-party risk management process for service providers.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: The Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The CISO briefs the Board of Directors on the effectiveness of our cyber risk management program periodically and as needed.

companyName: IPALCO ENTERPRISES, INC.


text: Company recognizes the importance of cybersecurity governance and intends to formalize oversight structures, including establishing Board-level committees, in the near future as our operations expand.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation or affect our vendor's ability to perform under our contracts.

companyName: PARKS AMERICA, INC

ticker: PRKA


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. As part of its enterprise risk management efforts, the Board meets with senior management, including the executive leadership team, to assess and respond to critical business risks. Critical enterprise risks are assessed by senior management annually and discussed with the Board. Once identified, each of the risks we view as most significant is assigned an executive risk owner who is responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). Cybersecurity threats have been and continue to be identified as one of the Company's top risks, with our Chief Technology Officer and Chief Information Security Officer assigned as the executive risk owners. The Board has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. Our Chief Information Security Officer briefs the Board annually.

companyName: Fisker Inc./DE


text: Under agreements with NEE Management and NEER, NEE's affiliates provide or arrange for the provision to NEP of substantially all of NEP's information technology functions, including those relating to cybersecurity. NEP's board oversees the provision of these services.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: Our board of directors has primary responsibility for oversight of our cybersecurity and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: Our ISP, together with our risk and compliance resources, proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) periodically assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) essential business functions remaining available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. We also maintain an operational security function that has a real time response capability that triages potential incidents and triggers, as appropriate, impact mitigation protocols. Additionally, we utilize third parties to conduct periodic cybersecurity assessments to identify, assess, manage, and as appropriate, mitigate and respond to cybersecurity risks, and our internal audit function includes certain cyber risk audits as part of its overall risk audit. Our cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: To improve our cybersecurity posture, we regularly engage third-party consultants for penetration testing, risk assessments, and control audits. We also monitor third-party service providers, particularly those with access to sensitive data, through contractual and oversight mechanisms designed to mitigate and monitor risks continuously.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities.

companyName: FUEL TECH, INC.

ticker: FTEK


text: To proactively manage cybersecurity risk in our organization, our management team has instituted an Edwards Information Technology Security Policy that is available to all employees through the employee handbook and on our intranet. We also conduct regular cybersecurity awareness and training campaigns for existing employees. Internal and external stakeholders can access the Edwards Integrity Helpline 24/7 online or by phone, to report any security incidents for escalation. We also disclose information about our product security and provide relevant contact information for our stakeholders to report any product vulnerabilities.

companyName: Edwards Lifesciences Corp

ticker: EW


text: Senior management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Senior management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity policies and processes, and reviewing security assessments and other security-related reports.

companyName: Sweetgreen, Inc.

ticker: SG


text: Technical Safeguards We periodically assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are periodically evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: We have experienced cybersecurity threats to our information technology infrastructure and have experienced non-material cybersecurity attacks, attempts to breach our systems, fraudulent activity and other similar incidents. As of the filing of this Annual Report, we are not aware of any such incidents that have occurred that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future security and/or privacy breaches, acts of vandalism or terror, computer viruses, misplaced or lost data, programming, and/or human error or other similar events with respect to our information technology systems or processes or the information technology systems or processes of third-parties that have been entrusted with our information expose us to a risk of loss or misuse of this information, litigation and potential liability, which could have a material adverse effect on our business, financial condition, results of operations or cash flows. Risks related to cybersecurity events are detailed in the section of this Annual Report titled "Risk Factors—Risks related to our business and industry—We may be subject to information technology systems failures, cybersecurity attacks, network disruptions and breaches of data security, which could compromise our information and expose us to liability."

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: To mitigate cybersecurity risks, we continuously assess and enhance our security processes and procedures. We collaborate with industry-leading managed security service providers to strengthen our ability to identify, assess, prevent, and respond to cybersecurity threats. Our information technology operations and security processes are being aligned with the National Institute of Standards and Technology (NIST) framework to further standardize and improve our security posture.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: Audit Committee reviews a cybersecurity dashboard at its regularly held meetings, which includes certain information about overall security, employee training, and other statistics. Members of our management team often attend these discussions, and the Audit Committee has requested that Mr. Dennis provide updates at two of its meetings annually. The management team and/or Audit Committee, in turn, regularly provide data protection and cybersecurity reports to the full Board of Directors.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients, sensitive third-party information and employee information. To protect this information, we have implemented a framework that is designed to identify, assess, and mitigate cybersecurity threats.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: As part of the Board's oversight of risk management, the Board reviews our cyber-risks with management and the actions we are taking to mitigate such risks. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for employees. Board oversight of risk is also performed as needed between meetings through the Audit Committee and communications between management and the Board. The Board receives periodic education around cybersecurity risks and best practices.

companyName: W. P. Carey Inc.

ticker: WPC


text: Crexendo has instituted a security team that is responsible for security/compliance strategy and corporate governance policies. The team makes sure that implemented SOC2 controls are supported by complementing processes and procedures.

companyName: Crexendo, Inc.

ticker: CXDO


text: The Chief Security Officer ("CSO") and his delegates meet with the Cybersecurity and Technology Committee at least quarterly to, among other items, review any cybersecurity incidents, review key risks and metrics on the Company's cybersecurity program and related risk management programs, and discuss the Company's cybersecurity programs and goals. The Cybersecurity and Technology Committee also participates in cybersecurity tabletop exercises with management and receives training on cybersecurity trends and developments. The Cybersecurity and Technology Committee updates the full board of directors at each quarterly board meeting, or more frequently if needed.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: In order to recover systems or assets affected by a cybersecurity incident, we maintain and regularly test full backups of our business systems data. These backups are stored in multiple locations, both online and offline.

companyName: FIRST INDUSTRIAL LP


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from government, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Although we believe risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future, and we continue to closely monitor risks from cybersecurity threats. For additional information on the impact of cybersecurity matters on us, see "Risks Related to Our Business—Risks Related to Our IT Systems and Cybersecurity" in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: Our cybersecurity risk management program is a key component of our broader enterprise risk management ("ERM") infrastructure. Cybersecurity and information security, administered by our Head of IT and BrightSpire IT Partner (each, as defined below), is a key component of our broader ERM program, which includes diverse internal management, financial reporting, legal, compliance and risk management controls, policies and procedures primarily under the supervision of senior management. The results of our ERM layers of management control, risk control and compliance oversight and independent assurances in any given quarter are reviewed with senior management, our Audit Committee (independent directors, primarily responsible for oversight of our overall risk profile and risk management policies) and Board of Directors. We have focused on the following cybersecurity initiatives.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: Management plays a pivotal role in identifying, assessing, and managing material risks from cybersecurity threats. This involves continuous monitoring, analyzing emerging threats, and developing and implementing risk mitigation strategies. The Company, led by our Senior Vice President and Chief Technology Officer—who holds the Certified Information Systems Security Professional (CISSP) designation and has over 20 years of cyber and risk management experience—actively implements and enforces cybersecurity policies, procedures, and strategies, including employee training programs, security assessments, and updates to ensure alignment with our evolving threat landscape.

companyName: AGNC Investment Corp.

ticker: AGNC


text: Once a cybersecurity incident has been identified, the SOC team performs an initial investigation to determine if the incident is deemed high or low severity, based upon the business and operational impacts. Any incident deemed high severity would result in notification by the CISO to the Cyber Lead team to determine the appropriate actions to be taken. This determination would be made by the Cyber Lead team based on both qualitative and quantitative factors regarding the extent and magnitude of the incident. If the incident is then escalated to the Disclosure Committee and determined to be material, a disclosure via a Current Report on Form 8-K would be made within four business days of the incident being identified as such. Our Board of Directors would also be notified of any high severity incidents that are determined to be material, concurrently with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: Our overall cybersecurity risk management is overseen by the Risk Committee of our board of directors who assists our senior management and the board of directors with their overall risk management responsibilities. Audit or assurance procedures of Controlling Department, internal audit departments and other functions include testing of IT, information security and data protection controls. Our financial reporting department ensures financial performance reliability under U.S. regulatory requirements and provides an independent objective assurance to evaluate the effectiveness of our governance. The department is directly subordinate to the Audit Committee of our board of directors.

companyName: Freedom Holding Corp.

ticker: FRHC


text: Governance of Cybersecurity Risk Management Our Board of Directors (the "Board") holds collective oversight responsibility for our strategic and operational risks. Assisting the Board in this capacity, our Audit Committee thoroughly reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management. The Audit Committee provides periodic reports on these reviews to the full Board of Directors.

companyName: Rocket Lab Corp

ticker: RKLB


text: The audit committee of our board of directors provides direct oversight over cybersecurity risk and provides regular updates to the board of directors regarding such oversight. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Schrodinger, Inc.

ticker: SDGR


text: The SISO also reports to Hanover's Board Enterprise Risk Management Committee on a quarterly basis, or more frequently if needed. Similar to the SISO's management-level reporting, the SISO reports on the overall cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments. The SISO also provides an annual Information Security report to the full Board of Directors and executive leadership team on the overall cybersecurity program, including material risks, key risk indicators, and emerging trends.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: of Processes for Assessing, Identifying, and Managing Cybersecurity Risks the normal course of business, we may collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information and employee information. We seek to assess, identify and manage cybersecurity risks through the processes described below: Assessment:

companyName: Prairie Operating Co.

ticker: PROP


text: c.if deemed appropriate, reporting by our CISO to the Company's Management and its Disclosure Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and d.informing the Audit Committee of our Board of Directors (the "Board") of significant or material cybersecurity incidents, as appropriate.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: oversees our cybersecurity risk management as part of its general oversight responsibilities and specifically monitors our cybersecurity risk management processes and mitigation strategies.

companyName: Avid Bioservices, Inc.


text: The board of directors receives quarterly reports from management regarding the status of the cybersecurity risk management program, current activities, planned projects, and security assessments. In addition, management will update the board of directors, as necessary, regarding any significant cybersecurity incidents that we may experience.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: In the last three fiscal years, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition, and the expenses we have incurred from cybersecurity incidents were immaterial. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the following:

companyName: PlayAGS, Inc.


text: Our cybersecurity program's effectiveness is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including periodic evaluation against established quantifiable goals and other external benchmarks, including the Center for Internet Security, the National Institute of Standards and Technology and several other security frameworks. The evaluation is conducted through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct evaluations and assessments and to advise us on the effectiveness of our cybersecurity program.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: Cybersecurity risk updates are provided quarterly to our senior management team by the CIO and CISO as part of our enterprise risk management process. We have established an incident response policy that outlines the process for assessing and responding to cybersecurity incidents. The incident response policy is reviewed at least annually by executive management. The Board also receives quarterly updates on cybersecurity risks. These reports are typically presented by our CISO to the Risk Committee of the Board and include updates to recently completed cybersecurity initiatives, upcoming plans, an overview of current threats, as well as discussion of our overall cybersecurity maturity and readiness. The Board participates in simulated cybersecurity trainings and is kept apprised of changes in cybersecurity regulatory requirements, ensuring that our organization remains in compliance with relevant standards.

companyName: DMC Global Inc.

ticker: BOOM


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Vicor Corporation maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: VICOR CORP

ticker: VICR


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion of related risks, please see our Information Technology risk factor "We rely significantly on information technology. Our business and reputation could be adversely impacted if our computer systems, or systems of our business partners and service providers, are disrupted or cease to operate effectively or if we or they are subject to a data security or privacy breach" in Item 1A. Risk Factors of this report.

companyName: PVH CORP. /DE/

ticker: PVH


text: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including IT risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer ("CIO") and Chief Operations Officer ("COO"), with input from our Chief Information Security Officer ("CISO").

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: The Vice President, IT Security has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across the Adviser. He has a has more than 26 years of experience in diversified information technology and security. He holds a Bachelor's degree in Electronics and Communication Engineering. He possesses industry-recognized certifications such as CISSP, CRISC, and CISM The Adviser conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The Vice President, IT Security reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. The Vice President, IT Security also reviews the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of the Adviser's information and systems.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: Continuous Monitoring and Response Our security operations include 24/7 monitoring conducted by a third-party provider in collaboration with internal teams. Conn's has implemented vendor management controls that ensure our service providers practice due diligence and due care when providing professional services to Conn's or managing our data. Additionally, Conn's has implemented risk management processes to monitor for cybersecurity threats associated with vendors who have access to our systems, applications, or data. This proactive approach ensures timely detection and response to cybersecurity threats, minimizing the potential impact on our business operations and financial condition.

companyName: CONNS INC


text: Mr. Perlman leads software development, security, technical integration, and IT. His scope includes software design and development for customer service agent, field technician, and customer self-service applications. Mr. Perlman joined Charter as a Senior Vice President in 2016, initially overseeing Video and Shared Software Services. He added Video Engineering, Voice Engineering, Lab Infrastructure and Deployment Support to his team in 2019. Before joining Charter, Mr. Perlman served as Chief information Officer for Bright House Networks, where he oversaw all of IT including Billing System Management, Software Development, Online Development, Internal IT, Information Security, and other functions. Prior to that, he held various IT roles at CenturyLink. Mr. Perlman holds a bachelor of arts from Brown University and a master of business administration from the University of Colorado – Boulder Leeds School of Business.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: We have since completed a forensic investigation, automated off-boarding and access-revocation processes, established 24/7 SIEM/SOC monitoring for identity and domain anomalies, and conducted targeted cybersecurity training. Our domain, DNS, and email operations are now fully stabilized and secured, with quarterly access reviews and ongoing monitoring to ensure continued resilience. The incident did not have a material impact on our operations or financial condition.

companyName: TREASURE GLOBAL INC

ticker: TGL


text: We partner with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes, including through the use of cybersecurity consultants, to conduct evaluations of our security controls and provide certifications for industry-standard security frameworks, such as ISO 27001.

companyName: Aspen Technology, Inc.


text: The Board of Directors exercises risk management oversight, including cybersecurity risk, through the Audit Committee. The Audit Committee receives quarterly reports on our risk management program. These include regular reports from the CISO on the state of our cybersecurity risk management program and updates on cybersecurity matters, key cybersecurity initiatives, risk mitigation efforts, and assessments of emerging threats.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: We have strategically invested resources and tools to combat the ever-changing cyber threat landscape. These investments include growing our internal technology team headcount and bolstering our partnerships with entities with external expertise, resulting in increased protection, monitoring, and response capabilities. We have also made investments to carry cybersecurity insurance that provides additional protection and resources to reduce a cybersecurity event's impact and potential losses.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: We engage third party security experts to supplement our internal Information Security team for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

companyName: Kearny Financial Corp.

ticker: KRNY


text: Our CTO executes the Cybersecurity Program and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents, with the support of the IT team and our third-party cybersecurity vendor. Our cybersecurity incident response framework is governed by our cybersecurity incident response plan, which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. We have an incident response team whose primary responsibilities include: • Evaluating and validating the impact of an incident; • Approving and implementing certain incident response countermeasures and remediation actions; and • Escalating incidents and response countermeasures for approval;

companyName: Shapeways Holdings, Inc.


text: We place a high priority on cybersecurity within our organization. This includes regular cybersecurity training for employees, focusing on relevant risks to their job duties (e.g. social engineering, ransomware, denial of service, and other risks). As part of our cybersecurity risk management program, we conduct internal tests to identify potential vulnerabilities. Additionally, we organize annual tabletop exercises led by third-party consultants to enhance our readiness for different scenarios, assess our core information systems and cybersecurity practices, improve decision-making and prioritization, and promote monitoring and reporting across business functions.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Cybersecurity is a critical part of our enterprise risk management. The Board, through its Audit Committee, oversees enterprise risk management, including cybersecurity. To more effectively address cybersecurity threats, we have numerous security layers within our least privilege network approach which is managed by our Information Technology ("IT") department. Our cybersecurity programs align with numerous standards and continues to grow and develop as new technologies emerge. Further, we have regular user awareness testing and trainings in place which helps keep all end users and executive leadership up-to-date on the most current threats. The global head of our IT department has responsibility over cybersecurity management globally and reports directly to the Chief Financial Officer. He has degrees in both management information systems and cybersecurity - and has held a number of progressing roles, including management of global infrastructure, information security and technology operations at Balchem, in addition to managing a global team of information technology and cybersecurity experts. The IT department provides regular updates to senior management. Additionally, he provides at least an annual update, or more frequently if necessary, to both the Audit Committee and the full Board regarding the current threat landscape at Balchem, cybersecurity technologies, mitigation strategies, industry trends and best practices that we follow, major cybersecurity incidents (if any), and other areas of importance. Additional activities to maintain and enhance information security are discussed below.

companyName: BALCHEM CORP

ticker: BCPC


text: CEO is responsible for ensuring that cybersecurity measures relevant to Estrella are in place and effective. Estrella's management works closely with Eureka's IT Governance Committee to ensure that Estrella benefits from Eureka's comprehensive cybersecurity practices. Although Estrella does not have a dedicated cybersecurity officer, Eureka's IT Governance Committee, oversees the IT support provided by the third-party IT provider to Estrella. Any critical cybersecurity incidents or risks identified are communicated to Estrella's board for review and action. In the event of a cybersecurity incident, the board is promptly informed, and measures are taken in coordination with Eureka's IT Governance Committee and third-party IT provider to address and mitigate any risks. Estrella's board is committed to ensuring that cybersecurity remains a priority and that all necessary steps are taken to protect the company's data and operations.

companyName: Estrella Immunopharma, Inc.

ticker: ESLA


text: The Audit Committee of our Board of Directors provides oversight of our cybersecurity risk and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: The Chief Compliance Officer ("CCO") of the Company is responsible for overseeing the Company's risk management function and generally relies on the CIO, CISO, and Head of NFR CTIS to assist with assessing and managing material risks from cybersecurity threats that are applicable to the Company. The CIO has over 30 years of experience in various engineering, information technology ("IT"), operations, and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management, and information security. The Head of NFR CTIS has over 20 years of experience in technology, security, and compliance roles, including experience in government security agencies. The Company's CCO has worked in the financial services industry for 19 years and has covered business developments from a compliance perspective for over 10 years, during which time the Company's CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Related to Cybersecurity Risks Our Vice President, Information Technology, or Vice President, who reports to the Chief Operating Officer, is responsible for the strategic leadership and direction of our cybersecurity program. With over 20 years of experience in information technology, the Vice President works alongside individuals across other functions, such as legal and engineering, to establish and implement our cybersecurity strategy.

companyName: Korro Bio, Inc.

ticker: KRRO


text: The Company's board of trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to an audit committee of the board of trustees (the "Audit Committee"). The Company's CFO periodically reports to the Audit Committee as well as the full board of trustees as appropriate, on cybersecurity matters. Such reporting includes updates on Fortress's cybersecurity program, the external threat environment and Fortress's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Fortress's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: We maintain a comprehensive risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: The Board is responsible for oversight of risks from cybersecurity threats. Oversight of cybersecurity risk management is performed primarily by the Board and the IT Committee. The IT Committee's primary purpose is to assist the Board in its oversight of technology and innovation strategies, plans and operations related to cybersecurity, data privacy, and third-party technology risk management. Of the IT Committee members who are not Board members, only our CIO and CISO are responsible for assessing and managing cybersecurity risks, and the other committee members are responsible for oversight. The CISO provides monthly information security reports to the Board and IT Committee on cybersecurity programs, policies and controls, key risk indicators and trends including responses to any cybersecurity events, and efforts to improve security. Annually, the CISO provides security training to the Board. The CISO also provides the Board with an annual Information Security Program Summary Report in compliance with federal banking guidelines.

companyName: Investar Holding Corp

ticker: ISTR


text: The Company's Chief Security Officer ("CSO") and the S&C Team, work collaboratively across the Company to implement a program designed to protect our customer's data and the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Security Officer monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to Senior Leadership and the Audit Chair when appropriate.

companyName: Upland Software, Inc.

ticker: UPLD


text: We maintain a Cybersecurity Incident Response Plan that is an important component of our Cybersecurity Risk Management Program, which then integrates into our Enterprise Risk Management ("ERM") Program. Our Cybersecurity Incident Response Plan is designed to facilitate a timely, consistent, and compliant response to actual or attempted cybersecurity incidents impacting the Company. The Cybersecurity Incident Response Plan is built on a framework that is aligned with publication 800-61 of the National Institute of Standards and Technology and is tailored to our people, processes, and technology. Cybersecurity Incident Response Plan phases include (1) preparation, (2) detection and analysis, which includes processes to assess the materiality of cybersecurity incidents and make timely reports, (3) containment, eradication, and recovery, and (4) post-incident activity. The Cybersecurity Incident Response Plan also defines the objectives, roles and responsibilities, and scope of our incident response program.

companyName: Crocs, Inc.

ticker: CROX


text: Risks from cybersecurity threats may cause material disruptions to our operations and reputational harm, which could materially adversely affect our results of operations and financial condition. See Item 1.A Risk Factors, "We may be unable to adequately maintain our systems and safeguard the security of our data, which could adversely impact our ability to operate our business and cause reputational harm and, consequently, could materially adversely affect our results of operations and financial condition." on page 38 for more information about these risks.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: The program is cross-functional involving the participation and input of internal stakeholders, third-party consultants and board oversight. The program is reviewed and updated on a monthly basis, or whenever there is a significant change in our environment, operations, or objectives.

companyName: AGREE REALTY CORP

ticker: ADC


text: As part of the Company's overall enterprise risk management program, the Company has developed business continuity and disaster recovery plans, which include measures designed to respond to potential disruptions to its information technology systems (or information technology systems of third parties on which it relies). The Company also maintains a written information security incident response plan and conducts tabletop exercises to enhance incident response preparedness. The Company is also a member of an industry cybersecurity intelligence and risk sharing organization.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Key elements of our cybersecurity risk management program include but are not limited to the following: risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, and information;

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: As a foundation of this approach, we have implemented a layered governance structure to help assess, identify, manage and report cybersecurity risks. Our cybersecurity program leverages the NIST Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. To protect our network and information systems from cybersecurity threats, we use various security tools and policies that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: Gogo Inc.

ticker: GOGO


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the incident response team is initially focused on containing the cybersecurity incident as quickly and efficiently as possible consistent with the procedures in the IRP. Containment procedures may include off-lining systems, including by disconnecting, disabling, or segmenting network access for computers known to be infected or impacted, installing security patches to resolve malware issues or network vulnerabilities, resetting passwords for users with accounts that were breached, or blocking accounts of insiders who may have caused the incident, and coordinating with service providers.

companyName: Playa Hotels & Resorts N.V.


text: Additionally, we have established protective measures for the forensic analysis of cyber incidents. While we are proactive in our efforts to mitigate these threats through robust security processes and disaster recovery plans, the evolving nature of cybersecurity threats means that our systems may not always be able to identify or protect against a threat promptly or at all. As a result, there is a continuous risk of potential financial, legal, business, and reputational damage to our company stemming from cybersecurity threats.

companyName: NEWMARKET CORP

ticker: NEU


text: The Company has sought to leverage the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a guideline for its cybersecurity framework and to help identify, assess and manage cybersecurity risks related to its business. The Company regularly engages third party experts, including cybersecurity assessors, consultants and auditors to evaluate and test our cybersecurity risk management systems and processes. The Company's partnership with these third parties include regular audits and threat assessments. The Company requires all of its third-party information technology vendors to undergo evaluations by the Company's internal data privacy and data security team as a part of efforts to assess, document and mitigate potential cybersecurity threats associated with the use of such vendors and the software, applications and services they provide.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: of Risks from Cybersecurity Threats of the date of this Annual Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains.

companyName: Prairie Operating Co.

ticker: PROP


text: Our CISO, who reports directly to the Chief Technology Officer, is a Certified Information Systems Security Professional with over 20 years of experience managing information technology and cybersecurity matters, including more than four years in gaming and two years at GAN Limited. Members of the information security team who support the security program hold relevant educational and professional credentials with experience in similar roles from other technology companies.

companyName: GAN Ltd


text: The Company uses a training system to educate new and existing employees on cybersecurity risks. In addition to this training program, simulated phishing attempts and remote social engineering attacks are performed on a regular basis to evaluate employees' understanding of these risks.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams that we are able to prevent or sufficiently mitigate harm from. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. In addition, although the Company maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack. See "Risk Factors–Risks Related to our Business–If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our business operations and reputation could be damaged, which could adversely affect our financial condition and operating results."

companyName: American Homes 4 Rent

ticker: AMH


text: AppTech recognizes the importance of developing, implementing, and maintaining strong cybersecurity measures to safeguard our information systems and protect our data's privacy and integrity.

companyName: AppTech Payments Corp.

ticker: APCX


text: Management Strategy are a clinical stage biotechnology company focused on developing and commercializing new treatments for patients suffering from ACI and substance addiction. We and our third-party service providers, such as CROs, collect, process, transmit, and store sensitive data on our systems, including intellectual property, proprietary or confidential business information, and a variety of personal data.

companyName: Anebulo Pharmaceuticals, Inc.

ticker: ANEB


text: The Bank's Information Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with the Gramm-Leach-Bliley Act, the interagency guidelines issued thereunder, and other applicable laws and regulations. The Technology Committee of the Board of Directors ("Board") also annually reviews and approves the Bank's Information Security Policy.

companyName: Federal Home Loan Bank of New York


text: The Company has not experienced any material security incidents or data breaches as a result of a compromise of its information systems and is not aware of any cybersecurity incidents that have had a material impact, or are reasonably likely to materially effect, on its business strategy, operating results, or financial condition.

companyName: Sleep Number Corp

ticker: SNBR


text: Innospec's IT leadership team is responsible for assessing, identifying and managing the inherent and residual risks associated with cyber security threats across our IT and Operational Technology landscape. IT leadership periodically reviews the Company's external threats, portfolio, and external services, and will update its risk register accordingly.

companyName: INNOSPEC INC.

ticker: IOSP


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things have undertaken the following measures: • Advanced Endpoint Protection • Disparate Firewall Security technology between the edge and internal networks • Live monitoring for user permission changes; • Live monitoring for suspicious file access or activities; • Advanced intrusion detection and automated threat response; which monitors internal activities in addition to external traffic; • Enrolled in Oil and Gas ("O&G") threat intelligence service; • Enrolled in US Cybersecurity & Infrastructure Security Agency ("US CISA") data hygiene service; and • Enrolled in FBI InfraGard threat intelligence. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: Vertex Energy Inc.


text: As part of our overall risk management system, we monitor and test our controls and train our employees on these controls, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Axonics, Inc.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including the section titled "Risk Factors—Risks Relating to our Business—Security breaches, unauthorized access to or disclosure of our data or user data, other hacking and phishing attacks affecting our information technology systems or those of third parties with whom we work, or other data security incidents could compromise sensitive information related to our business or users processed by us or on our behalf and expose us to liability, which could harm our reputation, disrupt the availability of our systems and services, generate negative publicity, and materially and adversely affect our business."

companyName: Grindr Inc.

ticker: GRND


text: Risk Management and Strategy Farmer Mac recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include the potential for: • unauthorized access to or acquisition, destruction, alteration, release, theft, or loss of confidential, proprietary, or personal data; • fraud or extortion; • financial and economic loss or costs; • errors in Farmer Mac's financial statements; • impairment of Farmer Mac's liquidity; • harm to employees, customers, or vendors; • liability or service interruptions to customers; • loss of customers or vendors; • violation of data protection laws and other litigation and legal risk; • increased regulatory or legislative scrutiny; and • reputational damage.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.

companyName: KLA CORP

ticker: KLAC


text: While we have not experienced any material cybersecurity threats or incidents as of the date of this Annual Report on Form 10-K, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Valaris Ltd

ticker: VAL


text: The Chief Financial Officer has over 20 years of operations and leadership experience, including experience in information technology strategy and execution. The Chief Information Consultant has over 20 years of experience managing and securing technology infrastructure.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: We are acutely aware of risks associated with third-party service providers and we incorporate cybersecurity into our third-party vendor management policy. We conduct thorough security assessment to determine the category of risk third parties pose to Rocky Brands, with a priority focus on vendors with products or services that will have access to private and sensitive information. Vendor assessments incorporate inputs, including for example, BitSight and Service Organization Control Type 2 ("SOC2") information available for our third-party vendors. Our assessments and monitoring are designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: We have aligned our cybersecurity risk management program with recognized security frameworks such as the National Institute of Standards and Technology Cybersecurity Framework and ISO standards. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use these frameworks as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: Our information technology systems used in connection with programs for the U.S. government align with the NIST standard and meet the requirements of 32 CFR Part 117 (National Industrial Security Program Operating Manual) and other applicable U.S. government guidance. The program includes authorizations and assessments of new and existing IT systems by our customers. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: The Audit Committee oversees our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee. Material cybersecurity matters will be reviewed with the full Board of Directors.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: EOG's cybersecurity team leadership, Senior Vice President and Chief Information and Technology Officer and other members of senior management regularly report to EOG's Audit Committee and Board of Directors (Board) regarding cybersecurity matters, including the assessments performed regarding EOG's cybersecurity technologies, controls and procedures.

companyName: EOG RESOURCES INC

ticker: EOG


text: We have access to external advisors in connection with our cybersecurity risk management program should additional expertise be required to manage cybersecurity incidents or risk.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: HeartSciences Inc.

ticker: HSCS


text: The Board is responsible for general risk oversight. The Board reviews and evaluates management's evaluation and mitigation of cyber risks as part of its oversight of the Company's Risk Management program. Management periodically reviews cyber risks, incidents, and risk mitigation plans and activities with the Board.

companyName: iCoreConnect Inc.


text: Our Board of Directors has delegated certain responsibilities to the Audit Committee of the Board. The Audit Committee reviews and discusses with management the identification and mitigation of cybersecurity risks, including (among other things) the effectiveness of risk-management policies and practices designed to help safeguard our operations, financial systems, and data. Our Vice President of Information Security and Chief Information Security Officer (CISO) presents cybersecurity-related topics, including program maturity progress, regularly to the Audit Committee. The Internal Audit team, in its periodic compliance and risk assessment updates to the Audit Committee, also reports on its reviews of certain of our cybersecurity risk exposures, controls, and management actions. The full Board also receives cybersecurity evaluations from time to time.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: The IRP is designed to protect and preserve the confidentiality, integrity and continued availability of all confidential information in the care of the Company and the information systems owned or used by the Company, as well as the Company's ability to operate. Our cybersecurity IRP includes controls and procedures for timely and accurate reporting of any cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: During 2023, FMC did not directly experience a cybersecurity breach in any FMC system. During 2023, we did receive notification of cybersecurity breaches affecting third-party vendors, but none were material in nature for FMC.

companyName: FMC CORP

ticker: FMC


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's cybersecurity risk management is led by our CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Management of the Company, including the CCO, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: On a quarterly basis, the ISO presents risks and metrics related to cyber and information security efforts to the IT Steering Committee and then to the Board's Audit Committee.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: 26North has also developed an incident response plan that provides guidelines for preparing for, responding to and recovering from cybersecurity incidents, and facilitates coordination across multiple operational functions. The incident response plan includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan includes notification to the applicable members of 26North's technology leadership team, including 26North's General Counsel ("GC") and Chief Technology Officer ("CTO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the Risk Committee (as defined below) or the board of directors of 26North, as well as to our Chief Compliance Officer, the Audit Committee of our Board of Directors and to our full Board of Directors, if appropriate.

companyName: 26North BDC, Inc.


text: Our Board has established a risk management process to identify and manage material risks at the enterprise level, including the potential impact of key cybersecurity threats. The full Board meets with the Senior Vice President & Chief Digital Officer (CDO) and our Chief Information Security Officer (CISO) on at least an annual basis to discuss our cybersecurity posture. The Board also periodically receives targeted briefings related to cybersecurity and reviews our incident response capabilities.

companyName: DOVER Corp

ticker: DOV


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our security approach is aligned with applicable security and/or technical requirements and best practices established by National Institute of Standards and Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that our information security team uses the NIST CSF as the framework for helping us to identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Endeavor Group Holdings, Inc.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, the Bank is subject to SEC rules requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For additional information, see the section entitled "Part I, Item 1. Business—Supervision and Regulation—Supervision and Regulation of the Bank—Cybersecurity."

companyName: FIVE STAR BANCORP

ticker: FSBC


text: a. External Collaboration: We engage with external service providers, where appropriate, for assessing and testing our security processes and controls. a. Cybersecurity Awareness Training: Security awareness and training programs for our employees.

companyName: KALTURA INC

ticker: KLTR


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal information technology staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: LENSAR, Inc.

ticker: LNSR


text: Our Board of Directors provides oversight over our enterprise-wide risk management, which includes cybersecurity risk-management, and the Audit Committee assists the Board with oversight of cybersecurity matters. The VP IT reports on cybersecurity matters to senior management regularly and to the Audit Committee at least annually, and more often if needed. The Audit Committee, in turn, makes periodic reports to the Board on relevant cybersecurity matters.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Cybersecurity is a critical part of our risk management approach, and we maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats, including cybersecurity threats associated with our use of third-party service providers. To address cybersecurity threats more effectively, we leverage a multi-layered approach. Our CEO and other members of senior management have responsibility for assessing and managing our cybersecurity risk exposure, and we have a dedicated Chief Information Officer (or CIO), who is responsible for oversight of our overall cybersecurity program, which includes protecting the industrial control systems, data, corporate infrastructure (e.g. databases, servers and network equipment), end user devices (e.g. desktops, laptops, and mobile devices) and internal websites. Our CIO reports directly to our CFO.

companyName: DIAMOND OFFSHORE DRILLING, INC.


text: CyberTeam provides our board and executive leadership team with periodic updates about our cybersecurity program and material risks. This includes updates on cybersecurity practices, programs, and the status of projects designed to strengthen internal cybersecurity and data protection.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: The Audit Committee has identified two of its members, Ramesh Chikkala and Karen Etzkorn, both with expertise in cybersecurity risk management, as cybersecurity professionals. Furthermore, the Audit Committee has designated Ms. Etzkorn to meet regularly with management to review our cybersecurity strategy, key initiatives and progress toward our objectives. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee would be notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate.

companyName: HIBBETT INC


text: Key aspects of our risk management processes include: • Threat Monitoring. We receive information on emerging cybersecurity threats and vulnerabilities from different sources, including vendors, cybersecurity organizations and U.S. government agencies, to help support our ability to detect and defend against threats to the security of our information technology and operational technology systems. We maintain several cybersecurity monitoring tools and services to help us detect unauthorized activities involving our systems and potential cybersecurity threats and vulnerabilities to our systems. • Incident Response. We maintain a Cybersecurity Operations Center that is dedicated to monitoring for cybersecurity threats to our systems and responding to potential cybersecurity incidents. We also maintain cybersecurity incident response plans that establish a cross-functional incident response team and processes to guide our response to cybersecurity incidents, including processes for reporting and escalating cybersecurity incidents to senior management and the Audit Committee or the Board, as appropriate. We conduct tabletop exercises annually to test our incident response processes. • Assessments, Testing and Audits. We conduct different types of security assessments, testing and audits to help us proactively identify and mitigate potential cybersecurity threats and vulnerabilities to our information technology and operational technology systems. For example, we conduct security-related risk assessments on proposed software, hardware, and third-party technology solutions used by CenterPoint Energy prior to deployment in our network. We also undergo periodic vulnerability assessments, penetration tests and cybersecurity reviews of our systems and security controls. We engage third parties to support certain of these assessments and tests and to provide guidance and support to our cybersecurity management team. Our internal audit team also conducts audits of certain CenterPoint Energy systems and data security controls. • Third-Party Risk Management. We maintain a vendor risk management program, a component of which assesses the cybersecurity and data privacy practices of certain third-party service providers to help us assess and manage cybersecurity risks associated with third-party access to our systems and data. To help identify and mitigate third-party cybersecurity risks, we conduct vendor security reviews and privacy impact assessments when deemed appropriate based on the nature of the systems and data that will be accessed by the third-party. We also impose contractual obligations on certain of our service providers related to data privacy, confidentiality and security based on, among other factors, their extent of access to our data and systems and the nature and sensitivity of the data and systems to which they have access.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: The Company relies on a comprehensive Enterprise Risk Management ("ERM") program, which includes cybersecurity as an important component. Our cybersecurity program is focused on the following key areas:

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: We have not previously experienced any material cybersecurity incidents. In addition, cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to affect, the Company, including our business strategy, results of operations, or financial condition.

companyName: CEVA INC

ticker: CEVA


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our Head of IT provides quarterly updates to the Audit Committee regarding our cybersecurity risk management program, including information about cybersecurity risk management governance, and provides the Audit Committee with status updates on various projects intended to enhance the overall cybersecurity posture of the Company, as applicable.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: annual cybersecurity awareness training to instruct employees how to better identify cybersecurity concerns and to avoid actions that might inadvertently allow outsiders to access our systems;

companyName: AMPHENOL CORP /DE/

ticker: APH


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " If our security applications are breached by cyberattacks or are not adequate to address changing market conditions and customer concerns, we may incur significant losses and be unable to sell our services " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Usio, Inc.

ticker: USIO


text: Our cybersecurity management team includes our corporate global applications director, who leads the operational teams responsible for enterprise security, data governance and enterprise incident response, and global operations, and our senior vice president of cloud edge and engineering operations, who leads the operational teams responsible for product and cloud security, data governance and product security incident response. Our operational cybersecurity teams are comprised of members with decades of collective experience in IT security systems, tooling, operations, and governance, and hold various IT security industry certifications and have received specialized cybersecurity training.

companyName: DZS INC.


text: The Company's executive management is responsible for overseeing cybersecurity risks and ensuring compliance with our security practices. At this time, the Company does not have a dedicated cybersecurity team but relies on its IT service providers and Microsoft's security framework for system protection and incident response.

companyName: Coeptis Therapeutics Holdings, Inc.

ticker: COEP


text: Due to the size of the Company and minimal activity level, record keeping requirements are also minimal. All records are tightly maintained in one secure location with no utilization of servers or cloud-based services. We do not engage any assessors, consultants, auditors or other third parties in connection with our cybersecurity risk management at this time.

companyName: Cell Source, Inc.

ticker: CLCS


text: Given the company's small size, limited staff, and minimal resources, we have not yet developed or implemented specific cybersecurity risk management programs to safeguard the confidentiality, integrity, and availability of our essential systems and data.

companyName: Ultimate Holdings Group, Inc.

ticker: UHGI


text: In an effort to deter and detect cyber threats, we have a required cybersecurity training program that is provided to all new employees during on-boarding and semi-annually to employees with access to our IT resources, which aims to raise awareness and foster a culture of cybersecurity awareness among our workforce. We also have an ongoing process of sending simulated phishing emails to employees. The results of these simulated attempts are monitored and reported to each employee's manager. Training includes such cybersecurity topics as social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training also emphasizes the importance of reporting all incidents immediately.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventive measures against all cyber threats, especially because the techniques used are increasingly sophisticated, change frequently, are complex, and are often not recognized until launched. See the risk factor "A failure of our information systems or any security breach or unauthorized disclosure of confidential information could have a material adverse effect on our business" in Part I, Item 1A of this Form 10-K.

companyName: AUTONATION, INC.

ticker: AN


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency MBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives periodic reports from management, the information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate. Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last three years on information security breaches. However, the Company faces certain ongoing risks from cybersecurity that, if realized, could materially affect the Company. See "Item 1A. Risk Factors - The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations." There can be no assurance that the Company's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM